@letterblack/lbe-sdk 0.4.3 → 0.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +13 -13
- package/dist/mcp-server.js +2 -2
- package/package.json +1 -1
package/dist/cli.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
import
|
|
2
|
+
import Gt from"fs";import xe from"path";import{fileURLToPath as gs}from"url";function Ge(e){if(e.length===0)return{command:"help",opts:{}};let t=e[0],r={};for(let s=1;s<e.length;s++)if(e[s].startsWith("--")){let o=e[s].substring(2);if(o.includes("=")){let[n,i]=o.split("=");r[n]=i}else{let n=e[s+1];!n||n.startsWith("-")?r[o]=!0:(r[o]=n,s++)}}else if(e[s].startsWith("-")){let o=e[s].substring(1),n=e[s+1];!n||n.startsWith("-")?r[o]=!0:(r[o]=n,s++)}return{command:t,opts:r}}function le(e="unknown"){console.log(`
|
|
3
3
|
\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
|
|
4
4
|
\u2551 LetterBlack Sentinel \u2014 CLI Governance \u2551
|
|
5
|
-
\u2551 Local-first execution governance SDK v${
|
|
5
|
+
\u2551 Local-first execution governance SDK v${e.padEnd(12)}\u2551
|
|
6
6
|
\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
|
|
7
7
|
|
|
8
8
|
USAGE:
|
|
@@ -59,21 +59,21 @@ EXAMPLES:
|
|
|
59
59
|
lbe verify --in proposal.json --pub-key-file ./keys/public.key
|
|
60
60
|
|
|
61
61
|
For more info, visit: https://github.com/Letterblack0306/LetterBlack-LBE-Core
|
|
62
|
-
`)}import x from"fs";import $ from"path";import
|
|
63
|
-
`).map(r=>r.trim()).filter(r=>r&&!r.startsWith("#")&&!r.startsWith("!")).map(r=>r.endsWith("/")?r+"**":r):[]}function B(e){return e.filter((t,r,s)=>t&&s.indexOf(t)===r)}function
|
|
64
|
-
`)}function
|
|
62
|
+
`)}import x from"fs";import $ from"path";import kr from"readline";import be from"tweetnacl";import{canonicalize as We}from"json-canonicalize";function we(e){return Buffer.from(e,"base64")}function Ae(e){return Buffer.from(e).toString("base64")}function de({payloadObj:e,sigB64:t,pubKeyB64:r}){try{let s=Buffer.from(We(e),"utf8"),o=we(t),n=we(r),i=be.sign.detached.verify(new Uint8Array(s),new Uint8Array(o),new Uint8Array(n));return{valid:i,message:i?"Signature verified":"Signature verification failed"}}catch(s){return{valid:!1,message:`Signature verification error: ${s.message}`}}}function He(){let e=be.sign.keyPair();return{publicKey:Ae(e.publicKey),secretKey:Ae(e.secretKey)}}function ze({payloadObj:e,secretKeyB64:t}){try{let r=Buffer.from(We(e),"utf8"),s=we(t),o=be.sign.detached(new Uint8Array(r),new Uint8Array(s));return{signature:Ae(o),error:null}}catch(r){return{signature:null,error:`Signing failed: ${r.message}`}}}import Ze from"fs";import Zt from"path";import Xe from"fs";import zt from"path";var Xt=/^[A-Za-z0-9:_-]{3,128}$/;function Qt(e){return typeof e=="string"&&Xt.test(e)&&e!=="default"}function Q(e){let t=zt.resolve(e);if(!Xe.existsSync(t))return{ok:!1,reason:"KEY_STORE_MISSING",message:`Key store not found: ${t}`,store:null};try{let r=Xe.readFileSync(t,"utf-8"),s=JSON.parse(r);return!s||typeof s!="object"||typeof s.trustedKeys!="object"?{ok:!1,reason:"KEY_STORE_INVALID",message:`Invalid key store format: ${t}`,store:null}:{ok:!0,reason:null,message:"Key store loaded",store:s}}catch(r){return{ok:!1,reason:"KEY_STORE_INVALID_JSON",message:`Unable to parse key store: ${r.message}`,store:null}}}function Qe({keyStore:e,keyId:t,requesterId:r,now:s=new Date}){if(!e||typeof e!="object")return{ok:!1,reason:"KEY_STORE_UNAVAILABLE",message:"Trusted key store is not available",publicKey:null};if(!Qt(t))return{ok:!1,reason:"KEY_ID_INVALID",message:`Invalid keyId '${t}'. Use versioned key IDs like 'agent:gpt-v1-2026Q1'`,publicKey:null};let o=e.trustedKeys?.[t];if(!o)return{ok:!1,reason:"KEY_NOT_TRUSTED",message:`Key '${t}' is not in trusted key store`,publicKey:null};if(o.deprecated)return{ok:!1,reason:"KEY_DEPRECATED",message:`Key '${t}' is deprecated`,publicKey:null};if(o.requesterId&&o.requesterId!==r)return{ok:!1,reason:"KEY_REQUESTER_MISMATCH",message:`Key '${t}' is not authorized for requester '${r}'`,publicKey:null};let n=o.notBefore||o.validFrom,i=o.expiresAt||o.validUntil;if(typeof n!="string"||typeof i!="string")return{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' must define lifecycle fields 'notBefore' and 'expiresAt'`,publicKey:null};let a=new Date(n),c=new Date(i);return Number.isNaN(a.getTime())||Number.isNaN(c.getTime())?{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' has invalid lifecycle timestamp(s)`,publicKey:null}:a>=c?{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' has notBefore >= expiresAt`,publicKey:null}:s<a?{ok:!1,reason:"KEY_NOT_YET_VALID",message:`Key '${t}' not valid until ${n}`,publicKey:null}:s>c?{ok:!1,reason:"KEY_EXPIRED",message:`Key '${t}' expired on ${i}`,publicKey:null}:!o.publicKey||typeof o.publicKey!="string"?{ok:!1,reason:"KEY_CONFIG_INVALID",message:`Trusted key '${t}' is missing publicKey`,publicKey:null}:{ok:!0,reason:null,message:"Trusted key resolved",publicKey:o.publicKey}}function ue({policyObj:e,secretKeyB64:t,keyId:r}){let s=ze({payloadObj:e,secretKeyB64:t});return s.error?{ok:!1,reason:"POLICY_SIGNATURE_CREATE_FAILED",message:s.error,envelope:null}:{ok:!0,reason:null,message:"Policy signature created",envelope:{alg:"ed25519",keyId:r,sig:s.signature,createdAt:Math.floor(Date.now()/1e3)}}}function Z({policyObj:e,keyStore:t,policySigPath:r="./config/policy.sig.json",allowUnsigned:s=!1}){let o=Zt.resolve(r);if(!Ze.existsSync(o))return s?{ok:!0,skipped:!0,reason:"POLICY_SIGNATURE_SKIPPED",message:`Policy signature not found: ${o} (allowed by flag)`}:{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_MISSING",message:`Policy signature file not found: ${o}`};let n;try{n=JSON.parse(Ze.readFileSync(o,"utf-8"))}catch(c){return{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:`Unable to parse policy signature file: ${c.message}`}}if(!n||n.alg!=="ed25519"||typeof n.keyId!="string"||typeof n.sig!="string")return{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:"Policy signature envelope must include {alg, keyId, sig}"};if(!t)return{ok:!1,skipped:!1,reason:"POLICY_SIGNER_KEY_STORE_UNAVAILABLE",message:"Trusted key store is required for policy signature verification"};let i=Qe({keyStore:t,keyId:n.keyId,requesterId:void 0});if(!i.ok)return{ok:!1,skipped:!1,reason:"POLICY_SIGNER_NOT_TRUSTED",message:i.message};let a=de({payloadObj:e,sigB64:n.sig,pubKeyB64:i.publicKey});return a.valid?{ok:!0,skipped:!1,reason:null,message:"Policy signature verified",keyId:n.keyId}:{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:a.message}}import _e from"fs";import L from"path";var er=[{file:"package.json",type:"node"},{file:"pyproject.toml",type:"python"},{file:"requirements.txt",type:"python"},{file:"go.mod",type:"go"},{file:"Cargo.toml",type:"rust"},{file:"pom.xml",type:"java"},{file:"build.gradle",type:"java"},{file:"build.gradle.kts",type:"java"},{file:"Dockerfile",type:"docker"},{file:"docker-compose.yml",type:"docker"},{dir:".github/workflows",type:"ci"},{file:".gitlab-ci.yml",type:"ci"},{dir:".circleci",type:"ci"},{file:"Jenkinsfile",type:"ci"},{file:".travis.yml",type:"ci"}],Ne=["node","python","go","rust","java"],tr={source:["src","lib","app","pages","components","core","api","server","client","pkg","cmd"],generated:["dist","build",".next","out","coverage","target",".cache","__pycache__",".turbo"],tests:["test","tests","__tests__","spec","e2e"],docs:["docs","doc","documentation"]},rt=[".env",".env.*","keys/**","secrets/**","*.key","*.pem","*.p12","*.pfx","*.crt"],rr=["node_modules/**",".git/**"],sr={node:["package-lock.json","yarn.lock","pnpm-lock.yaml"],python:["Pipfile.lock","poetry.lock"],go:["go.sum"],rust:["Cargo.lock"],java:["gradle/wrapper/**"],docker:[],ci:[],generic:[]},et={node:["package.json","tsconfig*.json","jest.config.*","vite.config.*","next.config.*","webpack.config.*",".eslintrc*",".eslint.config.*",".prettierrc*","babel.config.*"],python:["pyproject.toml","setup.py","setup.cfg","tox.ini","pytest.ini","mypy.ini",".flake8",".pylintrc","Pipfile"],go:["go.mod",".golangci.yml",".golangci.yaml"],rust:["Cargo.toml","rust-toolchain.toml","clippy.toml",".rustfmt.toml"],java:["pom.xml","build.gradle","build.gradle.kts","gradle.properties","settings.gradle","settings.gradle.kts"],docker:["Dockerfile","docker-compose.yml",".dockerignore"],ci:[".gitlab-ci.yml","Jenkinsfile",".travis.yml"],generic:["Makefile","CMakeLists.txt","meson.build"]},or=[".editorconfig",".nvmrc",".node-version",".python-version"],nr=["config",".github",".gitlab",".circleci",".vscode"],ir={node:"dependency and build config",python:"package and environment config",go:"module definition",rust:"crate manifest",java:"build definition",docker:"container config",ci:"pipeline definition",generic:"project config"},ar={node:"package manager",python:"dependency resolver",go:"module checksums",rust:"dependency resolver",java:"Gradle wrapper"},cr=["composer.json","Gemfile","mix.exs","pubspec.yaml","Package.swift","project.clj","build.sbt","stack.yaml","deno.json","deno.jsonc","Podfile"],lr=["composer.lock","Gemfile.lock","mix.lock","pubspec.lock","Package.resolved"],dr=[".csproj",".fsproj",".sln",".cabal"];function T(e){return _e.existsSync(e)}function tt(e,t){return t.filter(r=>T(L.join(e,r))).map(r=>`${r}/**`)}function ur(e){let t=L.join(e,".gitignore");return T(t)?_e.readFileSync(t,"utf8").split(`
|
|
63
|
+
`).map(r=>r.trim()).filter(r=>r&&!r.startsWith("#")&&!r.startsWith("!")).map(r=>r.endsWith("/")?r+"**":r):[]}function B(e){return e.filter((t,r,s)=>t&&s.indexOf(t)===r)}function fr(e){let t=new Set,r=[];for(let s of er){if(t.has(s.type))continue;let o=L.join(e,s.file||s.dir);T(o)&&(t.add(s.type),r.push(s.type))}return r.length>0?r:["generic"]}function pr(e){return Ne.find(t=>e.includes(t))??"generic"}function mr(e){let t=cr.filter(s=>T(L.join(e,s))),r=lr.filter(s=>T(L.join(e,s)));try{let s=_e.readdirSync(e);for(let o of s)dr.some(n=>o.endsWith(n))&&t.push(o)}catch{}return{manifests:t,lockfiles:r}}function yr(e,t){let r={};for(let[o,n]of Object.entries(tr))r[o]=tt(e,n);r.secrets=rt.filter(o=>{let n=o.split("/")[0].replace(/\*.*/,"");return n.includes("*")||T(L.join(e,n))});let s=B(t.flatMap(o=>et[o]||et.generic).concat(or));if(r.config=B([...s.filter(o=>!o.includes("*")&&!o.endsWith("/**")&&T(L.join(e,o))),...s.filter(o=>o.endsWith("/**")&&T(L.join(e,o.replace("/**","")))),...tt(e,nr)]),r.lockfiles=B(t.flatMap(o=>sr[o]||[]).filter(o=>{let n=o.replace(/\*.*/,"").split("/")[0];return n.includes("*")||T(L.join(e,n))})),!t.some(o=>Ne.includes(o))){let o=mr(e);r.config=B([...r.config,...o.manifests]),r.lockfiles=B([...r.lockfiles,...o.lockfiles])}return r}function gr(e,t,r){let s={};if(s.structure="Preserve the existing folder structure. Add new files within established directories. Do not create top-level directories, reorganize, or rename existing folders.",r.source.length>0&&(s.source=`Source code lives in ${r.source.join(", ")}. Make feature changes and bug fixes here only.`),s.secrets=`Never propose changes to credential or key files (${rt.slice(0,4).join(", ")} \u2026). These are never task targets regardless of the instruction.`,r.generated.length>0&&(s.generated=`${r.generated.join(", ")} contain generated output. Modify the source files that produce them; never write to generated directories directly.`),r.config.length>0){let o=e.filter(c=>Ne.includes(c)),n=o.length===1?ir[o[0]]:"project configuration",i=r.config.slice(0,5).join(", "),a=r.config.length>5?" and related files":"";s.config=`Treat ${i}${a} as ${n} files. Do not modify them unless the task explicitly requires a configuration or dependency change.`}if(r.tests.length>0&&(s.tests=`Test files in ${r.tests.join(", ")} validate behavior. Update them only when the behavior they cover changes.`),r.lockfiles?.length>0){let o=ar[t]||"tooling",n=r.lockfiles.slice(0,3).join(", ");s.lockfiles=`${n} are generated by the ${o}. Never edit them directly.`}if(t==="generic"){let o=r.config.filter(n=>!n.endsWith("/**"));o.length>0?s.unknown=`This project uses an unrecognized toolchain. Treat ${o.slice(0,3).join(", ")} as dependency/manifest files. Do not modify them unless the task explicitly requires a dependency change.`:s.unknown="This project uses an unrecognized toolchain. Do not assume standard source layouts, dependency files, or build conventions apply. Confirm any structural assumption before acting."}return e.includes("docker")&&(s.docker="Dockerfile and docker-compose.yml define the container environment. Treat them as infrastructure config \u2014 only modify when the task explicitly involves container or environment changes."),e.includes("ci")&&(s.ci="CI config files (.github/**, .gitlab-ci.yml, etc.) define the build and deployment pipeline. Do not modify them unless the task explicitly involves CI/CD changes."),s}function hr(e,t){let r=B([...e.source,...e.docs,...e.tests]),s=[...e.config],o=B([...e.secrets,...e.generated,...e.lockfiles||[],...rr,...t.filter(n=>n.endsWith("/**")).slice(0,8)]);return{allow:r.length>0?r:["src/**"],approval:s.length>0?s:[],deny:o}}function st(e){let t=L.resolve(e||process.cwd()),r=fr(t),s=pr(r),o=yr(t,r),n=ur(t),i=gr(r,s,o),a=hr(o,n);return{projectTypes:r,primaryType:s,surfaces:o,semantics:i,enforcement:a}}function ot(e,t,r){let s=[],o=Array.isArray(e)?e.join(" + "):e;s.push(`Detected: ${o}`),s.push(""),s.push("Agent semantics:");for(let[,n]of Object.entries(t))s.push(` - ${n}`);return s.push(""),s.push("Enforcement:"),r.allow.length&&s.push(` allow: ${r.allow.join(", ")}`),r.approval.length&&s.push(` approval: ${r.approval.join(", ")}`),r.deny.length&&s.push(` deny: ${r.deny.slice(0,6).join(", ")}${r.deny.length>6?" \u2026":""}`),s.join(`
|
|
64
|
+
`)}function Sr(e){return process.stdin.isTTY?new Promise(t=>{let r=kr.createInterface({input:process.stdin,output:process.stdout});r.question(e,s=>{r.close(),t(s.trim().toLowerCase())})}):Promise.resolve("y")}function Ir(e){return{...e,deny:[...new Set([...e.deny,...e.approval,"*.json","config/**"])],approval:[]}}function Er(e){return{...e,approval:[]}}function vr(e){let t=new Date().toISOString(),r=new Date(Date.now()+4320*60*60*1e3).toISOString(),s="agent:gpt-v1-2026Q1",o="policy-signer-v1-2026Q1";for(let y of["config","keys","data"])x.mkdirSync($.join(e,y),{recursive:!0});let n={"data/nonce.db.json":JSON.stringify({entries:[]},null,2),"data/rate-limit.db.json":JSON.stringify({entries:[]},null,2),"data/policy.state.json":JSON.stringify({schemaVersion:"1",lastAccepted:null,updatedAt:null},null,2),"data/audit.log.jsonl":""};for(let[y,S]of Object.entries(n)){let k=$.join(e,y);x.existsSync(k)||x.writeFileSync(k,S)}let i=$.join(e,"keys"),a=$.join(i,"public.key"),c=$.join(i,"secret.key"),l,u;if(x.existsSync(a)&&x.existsSync(c))l=x.readFileSync(a,"utf8").trim(),u=x.readFileSync(c,"utf8").trim();else{let y=He();l=y.publicKey,u=y.secretKey,x.writeFileSync(a,l),x.writeFileSync(c,u,{mode:384})}let f=$.join(e,"config/keys.json"),d=x.existsSync(f)?JSON.parse(x.readFileSync(f,"utf8")):{schemaVersion:"1",defaultKeyId:s,trustedKeys:{}};for(let y of[s,o])d.trustedKeys[y]||(d.trustedKeys[y]={publicKey:l,notBefore:t,expiresAt:r,validFrom:t,validUntil:r,deprecated:!1});d.defaultKeyId=s,x.writeFileSync(f,JSON.stringify(d,null,2));let p=$.join(e,"config/policy.default.json"),g;x.existsSync(p)?g=JSON.parse(x.readFileSync(p,"utf8")):(g={default:"DENY",version:"1.0.0",createdAt:t,security:{maxClockSkewSec:600,maxPolicyCreatedAtSkewSec:31536e3,defaultRateLimit:{windowSec:60,maxRequests:30}},requesters:{"agent:gpt":{allowAdapters:["noop","shell"],allowCommands:["RUN_SHELL"],rateLimit:{windowSec:60,maxRequests:30},filesystem:{roots:[e],denyPatterns:["**/.git/**","**/secrets/**","**/*.key"]},exec:{allowCmds:["ls","node","python","echo"],denyCmds:["rm","chmod","chown","curl","wget","su","sudo"]}}}},x.writeFileSync(p,JSON.stringify(g,null,2)));let m=ue({policyObj:g,secretKeyB64:u,keyId:o});return m.ok&&x.writeFileSync($.join(e,"config/policy.sig.json"),JSON.stringify(m.envelope,null,2)),{defaultKeyId:s,secretKeyB64:u,publicKeyB64:l}}async function nt(e={}){let t=process.cwd(),r=e.yes||e.y||!process.stdin.isTTY,s=$.join(t,"lbe.workspace.json");console.log(`
|
|
65
65
|
Scanning workspace...
|
|
66
|
-
`);let{projectTypes:o,primaryType:n,semantics:i,enforcement:a}=st(t);console.log(ot(o,i,a)),console.log("");let c=a;if(!r){let u=await
|
|
66
|
+
`);let{projectTypes:o,primaryType:n,semantics:i,enforcement:a}=st(t);console.log(ot(o,i,a)),console.log("");let c=a;if(!r){let u=await Sr("Accept? [Y = accept / s = strict / r = relaxed / n = cancel] ");if(u==="n")return console.log("Cancelled."),{success:!1};u==="s"&&(c=Ir(a)),u==="r"&&(c=Er(a))}let l={lbe:!0,version:"0.4.0",state:"local",projectTypes:o,primaryType:n,semantics:i,enforcement:c};return x.writeFileSync(s,JSON.stringify(l,null,2)),console.log("\u2713 Wrote lbe.workspace.json"),vr(t),console.log(`\u2713 Keys and policy ready
|
|
67
67
|
`),console.log("Done. Agents that detect lbe.workspace.json will operate within these boundaries."),console.log(`Run npx lbe doctor at any time to review or update the contract.
|
|
68
|
-
`),{success:!0,contract:l}}import
|
|
68
|
+
`),{success:!0,contract:l}}import Pe from"fs";import te from"path";import dt from"fs";import _r from"path";import w from"fs";import Oe from"path";import xr from"crypto";var wr={timeoutMs:5e3,pollMs:15,staleMs:3e4};function Ar(e){return e+".lock"}function it(e){try{let t=w.openSync(e,"wx");return w.writeSync(t,`pid:${process.pid}:${Date.now()}`),w.closeSync(t),!0}catch(t){if(t.code==="EEXIST"||t.code==="EPERM"||t.code==="EBUSY"||t.code==="EACCES")return!1;throw t}}function at(e,t){try{let r=w.statSync(e);if(Date.now()-r.mtimeMs>t)try{w.unlinkSync(e)}catch{}}catch{}}function br(e){let t=Date.now()+e;for(;Date.now()<t;)try{Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,Math.max(1,t-Date.now()))}catch{}}function ct(e,t,r){let s=typeof t=="function"?t:r,o=typeof t=="function"?{}:t||{},{timeoutMs:n,pollMs:i,staleMs:a}={...wr,...o},c=Oe.dirname(e);w.existsSync(c)||w.mkdirSync(c,{recursive:!0});let l=Ar(e),u=Date.now()+n,f=!1;for(;!f&&(f=it(l),!f);){if(Date.now()>=u){if(at(l,a),f=it(l),f)break;let p=new Error(`withFileLock: timeout acquiring ${l} after ${n}ms`);throw p.code="ELOCKTIMEOUT",p}at(l,a);let d=Math.floor(Math.random()*i);br(i+d)}try{return s()}finally{try{w.unlinkSync(l)}catch{}}}function A(e,t,r={}){let s=Oe.dirname(e);w.existsSync(s)||w.mkdirSync(s,{recursive:!0});let o=Oe.join(s,`.tmp-${Date.now()}-${xr.randomBytes(4).toString("hex")}`);try{w.writeFileSync(o,t,r),w.renameSync(o,e)}catch(n){try{w.existsSync(o)&&w.unlinkSync(o)}catch{}throw n}}function lt(e){try{if(!w.existsSync(e))return null;let t=w.readFileSync(e,"utf8");return JSON.parse(t)}catch(t){return console.error(`[atomicWrite] Failed to read JSON from ${e}:`,t.message),null}}function ut(e){if(typeof e=="number"&&Number.isFinite(e))return{ok:!0,kind:"int",parts:[Math.floor(e)],raw:String(e)};if(typeof e!="string"||!e.trim())return{ok:!1,reason:"POLICY_VERSION_INVALID",message:"Policy version is required"};let t=e.trim();if(/^\d+$/.test(t))return{ok:!0,kind:"int",parts:[Number(t)],raw:t};let r=t.replace(/^v/i,"");if(/^\d+(\.\d+){0,2}$/.test(r)){let s=r.split(".").map(o=>Number(o));for(;s.length<3;)s.push(0);return{ok:!0,kind:"semver",parts:s,raw:t}}return{ok:!1,reason:"POLICY_VERSION_INVALID",message:`Unsupported policy version format '${e}' (use integer or semver)`}}function Nr(e,t){let r=Math.max(e.parts.length,t.parts.length);for(let s=0;s<r;s++){let o=e.parts[s]??0,n=t.parts[s]??0;if(o>n)return 1;if(o<n)return-1}return 0}function ft(e){if(typeof e=="number"&&Number.isFinite(e))return{ok:!0,epochSec:e>1e12?Math.floor(e/1e3):Math.floor(e)};if(typeof e!="string"||!e.trim())return{ok:!1,reason:"POLICY_CREATED_AT_INVALID",message:"Policy createdAt is required"};let t=Date.parse(e);return Number.isNaN(t)?{ok:!1,reason:"POLICY_CREATED_AT_INVALID",message:`Invalid policy createdAt '${e}'`}:{ok:!0,epochSec:Math.floor(t/1e3)}}function Or(e){if(!dt.existsSync(e))return{schemaVersion:"1",lastAccepted:null,updatedAt:null};try{let t=JSON.parse(dt.readFileSync(e,"utf8"));if(!t||typeof t!="object")throw new Error("Policy state file has invalid structure");return{schemaVersion:String(t.schemaVersion||"1"),lastAccepted:t.lastAccepted&&typeof t.lastAccepted=="object"?t.lastAccepted:null,updatedAt:t.updatedAt||null}}catch(t){throw new Error(`Policy state at ${e} is corrupt or unreadable: ${t.message}`)}}function Cr(e,t){let r=JSON.stringify(t,null,2);A(e,r,{encoding:"utf8"})}function q({policyObj:e,statePath:t=_r.resolve("data/policy.state.json"),maxCreatedAtSkewSec:r=31536e3,nowSec:s=Math.floor(Date.now()/1e3),persist:o=!0}){let n=ut(e?.version);if(!n.ok)return{ok:!1,reason:n.reason,message:n.message,updated:!1};let i=ft(e?.createdAt);if(!i.ok)return{ok:!1,reason:i.reason,message:i.message,updated:!1};let a=Math.abs(s-i.epochSec),c=Number.isFinite(r)&&r>0?Math.floor(r):31536e3;if(a>c)return{ok:!1,reason:"POLICY_CREATED_AT_SKEW_EXCEEDED",message:`Policy createdAt skew ${a}s exceeds allowed ${c}s`,updated:!1};let l;try{l=Or(t)}catch(m){return{ok:!1,reason:"POLICY_STATE_CORRUPT",message:m.message,updated:!1}}let u=l.lastAccepted,f=null,d=null,p=0;if(u&&(f=ut(u.version),d=ft(u.createdAt),f.ok&&d.ok)){if(p=Nr(n,f),p<0)return{ok:!1,reason:"POLICY_VERSION_REGRESSION",message:`Policy version regression: current '${n.raw}' < last '${f.raw}'`,updated:!1};if(p===0&&i.epochSec<d.epochSec)return{ok:!1,reason:"POLICY_CREATED_AT_REGRESSION",message:`Policy createdAt regression: current '${e.createdAt}' < last '${u.createdAt}'`,updated:!1};if(p>0&&i.epochSec<d.epochSec)return{ok:!1,reason:"POLICY_CREATED_AT_REGRESSION",message:"Policy createdAt must be monotonic when version increases",updated:!1}}let g=!u||!f?.ok||!d?.ok||p>0||p===0&&i.epochSec>d.epochSec;if(o&&g){let m={schemaVersion:"1",lastAccepted:{version:e.version,createdAt:e.createdAt,environment:e.environment||null},updatedAt:new Date().toISOString()};Cr(t,m)}return{ok:!0,reason:null,message:"Policy version guard passed",updated:g}}import pt from"fs";import yt from"path";import{fileURLToPath as Rr}from"url";var Lr=yt.dirname(Rr(import.meta.url)),Ce=yt.join(Lr,"lbe_engine.wasm"),mt={0:{allowed:!0,reason:null,message:"Policy check passed"},1:{allowed:!1,reason:"POLICY_NOT_CONFIGURED",message:"No policy configured"},2:{allowed:!1,reason:"REQUESTER_NOT_ALLOWED",message:"Requester not in policy"},3:{allowed:!1,reason:"COMMAND_NOT_ALLOWED",message:"Command not allowed for requester"},4:{allowed:!1,reason:"ADAPTER_NOT_ALLOWED",message:"Adapter not allowed"},5:{allowed:!1,reason:"NO_FILESYSTEM_ROOTS_DEFINED",message:"No filesystem roots defined for requester"},6:{allowed:!1,reason:"CWD_OUTSIDE_ALLOWED_ROOT",message:"Path not under allowed roots"},7:{allowed:!1,reason:"PATH_DENIED_BY_PATTERN",message:"Path matches deny pattern"},8:{allowed:!1,reason:"SHELL_CMD_DENIED",message:"Shell command not allowed"}},Pr={0:{valid:!0,error:null},1:{valid:!1,error:"Missing required field: id"},2:{valid:!1,error:"Missing required field: commandId"},3:{valid:!1,error:"Missing required field: requesterId"},4:{valid:!1,error:"Missing required field: sessionId"},5:{valid:!1,error:"Missing required field: timestamp"},6:{valid:!1,error:"Missing required field: nonce"},7:{valid:!1,error:"Missing required field: requires"},8:{valid:!1,error:"Missing required field: payload"},9:{valid:!1,error:"Missing required field: signature"},10:{valid:!1,error:"Field 'id' is invalid"},11:{valid:!1,error:"Field 'commandId' is invalid"},12:{valid:!1,error:"Field 'requesterId' is invalid"},13:{valid:!1,error:"Field 'sessionId' is invalid"},14:{valid:!1,error:"Field 'timestamp' is invalid"},15:{valid:!1,error:"Field 'nonce' is invalid"},16:{valid:!1,error:"Field 'requires' is invalid"},17:{valid:!1,error:"payload: missing required field: adapter"},18:{valid:!1,error:"payload: field 'adapter' is invalid"},19:{valid:!1,error:"signature: missing required field: alg"},20:{valid:!1,error:"signature: missing required field: keyId"},21:{valid:!1,error:"signature: missing required field: sig"},22:{valid:!1,error:"signature: field 'alg' must be ed25519"},23:{valid:!1,error:"signature: field 'sig' is invalid"},24:{valid:!1,error:"Field 'risk' is invalid"}},Dr={1:"KEY_ID_INVALID",2:"KEY_NOT_TRUSTED",3:"KEY_DEPRECATED",4:"KEY_REQUESTER_MISMATCH",5:"KEY_LIFECYCLE_INVALID",6:"KEY_NOT_YET_VALID",7:"KEY_EXPIRED"},Tr={0:"schema",1:"timestamp",2:"key",3:"signature",4:"rate_limit",5:"nonce",6:"policy",255:"ok"},$r=["LOW","MEDIUM","HIGH","CRITICAL"],Fr={ECHO:0,READ_FILE:1,WRITE_FILE:2,PATCH_FILE:3,DELETE_FILE:4,RUN_SHELL:5},fe=null;function M(){if(fe)return fe;if(!pt.existsSync(Ce))throw new Error(`LBE engine missing: ${Ce}`);let e=pt.readFileSync(Ce);return fe=new WebAssembly.Instance(new WebAssembly.Module(e),{}),fe}function pe(){return new Uint8Array(M().exports.memory.buffer)}function gt(){return M().exports.lbe_in_ptr()}function ht(){return M().exports.lbe_out_ptr()}function jr(){return M().exports.lbe_buf_size()}function kt(e){let t=new TextEncoder().encode(e),r=pe(),s=gt();r.set(t,s),r[s+t.length]=0}function St(){let e=pe(),t=ht(),r=t;for(;e[r]!==0&&r-t<jr();)r++;return new TextDecoder().decode(e.slice(t,r))}function Kr(e){let t=pe(),r=gt(),s=new DataView(t.buffer,r);e.forEach((o,n)=>s.setUint32(n*4,o>>>0,!0))}function qr(){let e=pe(),t=ht(),r=new DataView(e.buffer,t);return{stage:r.getUint32(0,!0),code:r.getUint32(4,!0)}}function It(e){Kr([e.hasId?1:0,e.idValid?1:0,e.hasCommandId?1:0,e.commandIdValid?1:0,e.hasRequesterId?1:0,e.requesterIdValid?1:0,e.hasSessionId?1:0,e.sessionIdValid?1:0,e.hasTimestamp?1:0,e.timestampValid?1:0,e.hasNonce?1:0,e.nonceValid?1:0,e.hasRequires?1:0,e.requiresValid?1:0,e.hasPayload?1:0,e.hasPayloadAdapter?1:0,e.payloadAdapterValid?1:0,e.hasSignature?1:0,e.hasSignatureAlg?1:0,e.signatureAlgValid?1:0,e.hasSignatureKeyId?1:0,e.hasSignatureSig?1:0,e.signatureSigValid?1:0,e.hasRisk?1:0,e.riskValid?1:0,e.cmdTimestamp>>>0,e.nowSec>>>0,e.maxClockSkewSec>>>0,e.keyIdFormatValid?1:0,e.keyFound?1:0,e.keyNotDeprecated?1:0,e.keyRequesterMatches?1:0,e.keyNotBeforeOk?1:0,e.keyNotExpired?1:0,e.keyLifecycleFieldsPresent?1:0,e.signatureValid?1:0,e.rateLimitOk?1:0,e.rateLimitRetryAfterSec>>>0,e.nonceOk?1:0,e.policyConfigured?1:0,e.requesterConfigured?1:0,e.commandAllowed?1:0,e.adapterAllowed?1:0,e.filesystemRequired?1:0,e.filesystemRootsDefined?1:0,e.filesystemOk?1:0,e.pathDenied?1:0,e.shellRequired?1:0,e.shellCommandOk?1:0]),M().exports.lbe_validate_pipeline();let{stage:t,code:r}=qr();return{ok:t===255,stage:t,stageLabel:Tr[t]||"unknown",code:r,schemaError:t===0?Pr[r]?.error||"Schema invalid":null,keyReason:t===2?Dr[r]||"KEY_ERROR":null,policyResult:t===6?{...mt[r]||mt[1],code:r}:null,retryAfterSec:t===4?r:0,skewSec:t===1?r:0}}function Re({ttlSec:e,nowSec:t,newKey:r,existingEntries:s}){let o=[`${e}:${t}`,r,...s].join(`
|
|
69
69
|
`)+`
|
|
70
70
|
`;if(kt(o),M().exports.lbe_nonce_check()!==0)return{ok:!1,updatedEntriesText:null};let i=St();return{ok:!0,updatedEntriesText:i.startsWith(`OK
|
|
71
71
|
`)?i.slice(3):i}}function Et({windowSec:e,maxRequests:t,nowSec:r,requesterId:s,existingEntries:o}){let n=[`${e}:${t}:${r}`,s,...o].join(`
|
|
72
72
|
`)+`
|
|
73
73
|
`;kt(n);let i=M().exports.lbe_rate_check()!==0,a=St();if(i){let c=parseInt(a.match(/^EXCEEDED:(\d+)/)?.[1]??"1",10),l=a.replace(/^EXCEEDED:\d+\n/,"");return{ok:!1,retryAfterSec:c,updatedEntriesText:l}}return{ok:!0,retryAfterSec:0,updatedEntriesText:a.startsWith(`OK
|
|
74
|
-
`)?a.slice(3):a}}function vt(e,t=!1){let r=
|
|
75
|
-
`).filter(Boolean).map(t=>{let r=t.lastIndexOf(":");return{key:t.slice(0,r),timestamp:parseInt(t.slice(r+1),10)||0}})}function
|
|
76
|
-
`).filter(Boolean).map(t=>{let r=t.lastIndexOf(":");return{requesterId:t.slice(0,r),timestamp:parseInt(t.slice(r+1),10)||0}})}function ee({commandObj:e,pubKeyB64:t,keyStore:r,nonceDb:s,policy:o,rateLimiter:n,policyStatePath:i}){let a={valid:!1,commandId:e?.commandId,checks:{},errors:[]},c=Math.floor(Date.now()/1e3),l=new Date,u=Number.isFinite(o?.security?.maxClockSkewSec)?o.security.maxClockSkewSec:600;if(i&&o?.version!==void 0)try{let h=q({policyObj:o,statePath:i});if(a.checks.policyVersion=h.ok,!h.ok)return a.errors.push({type:"POLICY_VERSION_INVALID",message:h.message}),a}catch{a.checks.policyVersion=!0}else a.checks.policyVersion=!0;let f=Gr(e),d=e?.signature?.keyId,p=Hr(r,d,e?.requesterId,l),g=!1,m=p.publicKey;if(!m&&t&&(m=t),m){let h={...e};delete h.signature,g=ce({payloadObj:h,sigB64:e?.signature?.sig,pubKeyB64:m}).valid}let y=!0,S=0;if(g&&n&&typeof n.db<"u"){let h=o?.requesters?.[e.requesterId]?.rateLimit||{},_=o?.security?.defaultRateLimit||{},O=h.windowSec??_.windowSec??60,z=h.maxRequests??_.maxRequests??30,X=Et({windowSec:O,maxRequests:z,nowSec:c,requesterId:e.requesterId,existingEntries:zr(n.db)});y=X.ok,S=X.retryAfterSec,X.ok&&(n.db.entries=Xr(X.updatedEntriesText))}else if(g&&n&&typeof n.checkAndRecord=="function"){let h=o?.requesters?.[e.requesterId]?.rateLimit||{},_=o?.security?.defaultRateLimit||{},O=n.checkAndRecord({requesterId:e.requesterId,nowSec:c,windowSec:h.windowSec??_.windowSec??60,maxRequests:h.maxRequests??_.maxRequests??30});y=O.ok,S=O.retryAfterSec??0}let k=!0,D=`${e?.requesterId}|${e?.sessionId}|${e?.nonce}`,K=3600;if(g&&y&&s)if(typeof s.checkAndRecord=="function")if(s.db){let h=Ce({ttlSec:K,nowSec:c,newKey:D,existingEntries:xt(s.db)});k=h.ok,h.ok&&(s.db.entries=wt(h.updatedEntriesText))}else k=s.checkAndRecord({requesterId:e.requesterId,sessionId:e.sessionId,nonce:e.nonce}).ok;else{let h=Ce({ttlSec:K,nowSec:c,newKey:D,existingEntries:xt(s)});k=h.ok,h.ok&&(s.entries=wt(h.updatedEntriesText))}let Be=Wr(o,e??{}),I=It({...f,cmdTimestamp:e?.timestamp??0,nowSec:c,maxClockSkewSec:u,...p,signatureValid:g,rateLimitOk:y,rateLimitRetryAfterSec:S,nonceOk:k,...Be}),b=I.stage;if(a.checks.schema=b!==0,b>=1&&(a.checks.timestamp=b!==1),b>=2&&(a.checks.keyId=b!==2),b>=2&&(a.checks.signature=b!==2&&b!==3),b>=4&&(a.checks.rateLimit=b!==4),b>=5&&(a.checks.nonce=b!==5),(b>=6||I.ok)&&(a.checks.policy=b!==6),!I.ok){let h=I.stageLabel;if(h==="schema")a.errors.push({type:"SCHEMA_ERROR",message:I.schemaError||"Schema invalid"});else if(h==="timestamp")a.errors.push({type:"TIMESTAMP_SKEW_EXCEEDED",message:`Command timestamp skew ${I.skewSec}s exceeds allowed ${u}s`});else if(h==="key"){let _=I.keyReason||"KEY_ERROR",O={KEY_ID_INVALID:`Invalid keyId '${d}'`,KEY_NOT_TRUSTED:`Key '${d}' is not in trusted key store`,KEY_DEPRECATED:`Key '${d}' is deprecated`,KEY_REQUESTER_MISMATCH:`Key '${d}' is not authorized for requester '${e?.requesterId}'`,KEY_LIFECYCLE_INVALID:`Key '${d}' must define notBefore and expiresAt`,KEY_NOT_YET_VALID:`Key '${d}' is not yet valid`,KEY_EXPIRED:`Key '${d}' has expired`};a.errors.push({type:_,message:O[_]||_})}else h==="signature"?a.errors.push({type:"SIGNATURE_INVALID",message:m?"Signature verification failed":"No public key available"}):h==="rate_limit"?a.errors.push({type:"RATE_LIMIT_EXCEEDED",message:`Rate limit exceeded. Retry after ${I.retryAfterSec}s`}):h==="nonce"?a.errors.push({type:"REPLAY_NONCE",message:"Nonce has already been used"}):h==="policy"&&I.policyResult?a.errors.push({type:I.policyResult.reason,message:I.policyResult.message}):a.errors.push({type:"VALIDATION_FAILED",message:`Failed at stage: ${h}`});return a}return a.valid=!0,a.risk=vt(e.id,e.payload?.cmd==="rm"),a.message="Command validation successful",a}import fe from"fs";import Qr from"path";var V=class{constructor(t,r=3600){this.dbPath=t,this.ttlSec=r,this.db={entries:[]}}async load(){if(!fe.existsSync(this.dbPath)){this.db={entries:[]};return}try{let t=fe.readFileSync(this.dbPath,"utf8");this.db=JSON.parse(t),this.prune()}catch(t){throw new Error(`Nonce DB at ${this.dbPath} is corrupt or unreadable: ${t.message}`)}}async save(){try{let t=Qr.dirname(this.dbPath);fe.existsSync(t)||fe.mkdirSync(t,{recursive:!0}),A(this.dbPath,JSON.stringify(this.db,null,2),{encoding:"utf8"})}catch(t){throw new Error(`Failed to save nonce DB: ${t.message}`)}}checkAndRecord({requesterId:t,sessionId:r,nonce:s}){let o=Math.floor(Date.now()/1e3);this.db.entries=this.db.entries.filter(i=>o-i.timestamp<=this.ttlSec);let n=`${t}|${r}|${s}`;return this.db.entries.some(i=>i.key===n)?{ok:!1,reason:"REPLAY_NONCE",message:"Nonce has already been used"}:(this.db.entries.push({key:n,timestamp:o}),{ok:!0,reason:null,message:"Nonce accepted"})}prune(){let t=Math.floor(Date.now()/1e3),r=this.db.entries.length;this.db.entries=this.db.entries.filter(o=>t-o.timestamp<=this.ttlSec);let s=this.db.entries.length;return{prunedCount:r-s,remainingCount:s}}};async function At(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||te.resolve("config/keys.json"),n=e["policy-sig"]||te.resolve("config/policy.sig.json"),i=e["policy-state"]||te.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let S=te.resolve(t),k=Le.readFileSync(S,"utf-8");c=JSON.parse(k)}catch(S){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:S.message})),process.exit(5)}let l;try{let S=r||te.resolve("config/policy.default.json");Le.existsSync(S)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${S}`})),process.exit(1));let k=Le.readFileSync(S,"utf-8");l=JSON.parse(k)}catch(S){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:S.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(te.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l}),y={status:m.valid?"valid":"invalid",commandId:c.commandId||"N/A",checks:m.checks,errors:m.errors||[],risk:m.risk||"UNKNOWN"};console.log(JSON.stringify(y,null,2)),m.valid||(m.checks.schema===!1&&process.exit(5),m.checks.signature===!1&&process.exit(3),m.checks.nonce===!1&&process.exit(4),m.checks.timestamp===!1&&process.exit(6),m.checks.rateLimit===!1&&process.exit(7),m.checks.policy===!1&&process.exit(2),process.exit(9)),process.exit(0)}import Te from"fs";import oe from"path";async function bt(e){return{adapter:"noop",commandId:e.commandId||"unknown",command:e.id||"unknown",status:"completed",output:`[NOOP] Would execute: ${e.id||"unknown"} on adapter: ${e.payload?.adapter||"unknown"}`,exitCode:0,timestamp:new Date().toISOString()}}import{spawnSync as Zr}from"child_process";import Pe from"path";function es(e){if(e===void 0)return{ok:!0,args:[]};if(!Array.isArray(e))return{ok:!1,error:"payload.args must be an array"};let t=[];for(let r of e){if(typeof r!="string"&&typeof r!="number"&&typeof r!="boolean")return{ok:!1,error:"payload.args may only contain string, number, or boolean values"};t.push(String(r))}return{ok:!0,args:t}}async function _t(e,t,r){let s=e.payload,o=3e4,n=1024*1024;if(s.adapter!=="shell")return{adapter:"shell",commandId:e.commandId,status:"error",error:"Adapter mismatch",exitCode:1};let i=r?.exec?.allowCmds||[];if((r?.exec?.denyCmds||[]).includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' is denied`,exitCode:2};if(i.length>0&&!i.includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' not in allowlist`,exitCode:2};if(!(r?.filesystem?.roots||[]).some(f=>{let d=Pe.resolve(f),p=Pe.resolve(s.cwd);return p===d||p.startsWith(d+Pe.sep)}))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`CWD '${s.cwd}' not authorized`,exitCode:2};let u=es(s.args);if(!u.ok)return{adapter:"shell",commandId:e.commandId,status:"blocked",error:u.error,exitCode:2};try{let f=Zr(s.cmd,u.args,{cwd:s.cwd,timeout:o,encoding:"utf8",maxBuffer:n,stdio:["pipe","pipe","pipe"],shell:!1});if(f.error)throw f.error;let d=`${f.stdout||""}${f.stderr||""}`,p=f.status??1;return p!==0?{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:d.substring(0,n)||`Command exited with code ${p}`,exitCode:p,timestamp:new Date().toISOString()}:{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"completed",output:d.substring(0,n),exitCode:0,timestamp:new Date().toISOString()}}catch(f){return{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:f.message,exitCode:f.status||1,timestamp:new Date().toISOString()}}}import ie from"fs";import se from"path";import Y from"fs";import pe from"path";import ts from"crypto";function me(e,t){let r=t||pe.resolve("data/backups");Y.existsSync(r)||Y.mkdirSync(r,{recursive:!0});let s=pe.resolve(e),o=Y.existsSync(s),n=null,i=null;o&&(n=Y.readFileSync(s),i=ts.createHash("sha256").update(n).digest("hex"));let a=pe.basename(s).replace(/[^a-zA-Z0-9._-]/g,"_"),c=`${Date.now()}-${i?i.slice(0,8):"new"}-${a}`,l=o?pe.join(r,c):null;return o&&n!==null&&A(l,n),{originalPath:s,backupPath:l,existed:o,hash:i,createdAt:new Date().toISOString()}}function U(e){if(!e)return{restored:!1,error:"No backup metadata"};let{originalPath:t,backupPath:r,existed:s}=e;if(!s)try{return Y.existsSync(t)&&Y.unlinkSync(t),{restored:!0,action:"deleted"}}catch(o){return{restored:!1,error:o.message}}if(!r||!Y.existsSync(r))return{restored:!1,error:"Backup file not found at: "+r};try{let o=Y.readFileSync(r);return A(t,o),{restored:!0,action:"restored"}}catch(o){return{restored:!1,error:o.message}}}var rs=10*1024*1024;function ss(e,t){return e?se.isAbsolute(e)?se.resolve(e):se.resolve(t||process.cwd(),e):null}function os(e,t){let r=se.resolve(e);return t.some(s=>{let o=se.resolve(s);return r===o||r.startsWith(o+se.sep)})}function ns(e,t){for(let r of t||[])if(new RegExp("^"+r.replace(/\./g,"\\.").replace(/\*\*/g,".*").replace(/\*/g,"[^/\\\\]*")+"$").test(e))return r;return null}function re(e,t,r,s=2){return{adapter:"file",commandId:e.commandId,status:"blocked",errorCode:t,error:r,exitCode:s}}function F(e,t,r,s=null,o=1){return{adapter:"file",commandId:e.commandId,status:"error",errorCode:t,error:r,backup:s?ye(s):null,exitCode:o}}function ye(e){return e?{path:e.backupPath,existed:e.existed,hash:e.hash,createdAt:e.createdAt}:null}async function Nt(e,t,r){let s=e.payload,o=s.action,n=s.cwd||process.cwd(),i=ss(s.target,n);if(!o)return re(e,"FILE_NO_ACTION","payload.action is required");if(!i&&o!=="noop")return re(e,"FILE_NO_TARGET","payload.target is required");let a=r?.filesystem?.roots||[];if(a.length===0)return re(e,"FILE_NO_ROOTS","No filesystem roots defined for requester");if(!os(i,a))return re(e,"FILE_OUTSIDE_ROOT",`'${i}' is outside allowed roots`);let c=ns(i,r?.filesystem?.denyPatterns);if(c)return re(e,"FILE_PATH_DENIED",`'${i}' matches deny pattern: ${c}`);switch(o){case"read":return is(e,i);case"write":return as(e,i,s);case"patch":return cs(e,i,s);case"delete":return ls(e,i);default:return re(e,"FILE_UNKNOWN_ACTION",`Unknown action: '${o}'`)}}function is(e,t){if(!ie.existsSync(t))return F(e,"FILE_NOT_FOUND",`Not found: ${t}`);try{let r=ie.statSync(t);if(r.size>rs)return F(e,"FILE_TOO_LARGE","File exceeds 10 MB read limit");let s=ie.readFileSync(t,"utf8");return{adapter:"file",action:"read",commandId:e.commandId,status:"completed",target:t,output:s,bytesRead:r.size,exitCode:0}}catch(r){return F(e,"FILE_READ_ERROR",r.message)}}function as(e,t,r){let s=r.content;if(s==null)return F(e,"FILE_MISSING_CONTENT","payload.content is required for write");let o=De(t);try{return A(t,s,{encoding:"utf8"}),{adapter:"file",action:"write",commandId:e.commandId,status:"completed",target:t,backup:ye(o),output:`Wrote ${Buffer.byteLength(s,"utf8")} bytes to ${t}`,exitCode:0}}catch(n){return U(o),F(e,"FILE_WRITE_ERROR",n.message,o)}}function cs(e,t,r){let s=r.content;if(s==null)return F(e,"FILE_MISSING_CONTENT","payload.content is required for patch");let o=De(t);try{return A(t,s,{encoding:"utf8"}),{adapter:"file",action:"patch",commandId:e.commandId,status:"completed",target:t,backup:ye(o),output:`Patched ${t} (${Buffer.byteLength(s,"utf8")} bytes)`,exitCode:0}}catch(n){return U(o),F(e,"FILE_PATCH_ERROR",n.message,o)}}function ls(e,t){if(!ie.existsSync(t))return F(e,"FILE_NOT_FOUND",`Not found: ${t}`);let r=De(t);try{return ie.unlinkSync(t),{adapter:"file",action:"delete",commandId:e.commandId,status:"completed",target:t,backup:ye(r),output:`Deleted ${t}`,exitCode:0}}catch(s){return U(r),F(e,"FILE_DELETE_ERROR",s.message,r)}}function De(e){try{return me(e)}catch{return null}}async function Ot(e,t,r){let s=Date.now();try{let o=e.id||"";if(!o.toUpperCase().startsWith("OBSERVE"))return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer adapter only handles OBSERVE_* commands, got '${o}'`,exitCode:1};let{source:n,context:i,issueType:a,description:c,severity:l,metadata:u}=e.payload||{};if(!a||!c)return{adapter:"observer",commandId:e.commandId,status:"error",error:"Observer payload must include issueType and description",exitCode:1};let f=["low","medium","high","critical"];return l&&!f.includes(l)?{adapter:"observer",commandId:e.commandId,status:"error",error:`Invalid severity '${l}'. Must be one of: ${f.join(", ")}`,exitCode:1}:{adapter:"observer",commandId:e.commandId,status:"recorded",timestamp:new Date().toISOString(),requesterId:e.requesterId,observation:{source:n||"unknown",context:i||"unknown",issueType:a,description:c,severity:l||"info",metadata:u||{}},duration_ms:Date.now()-s,exitCode:0}}catch(o){return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer execution failed: ${o.message}`,exitCode:9}}}var Ct={noop:bt,shell:_t,file:Nt,observer:Ot};function ds(e){return Ct[e]}async function ge(e,t,r,s){let o=ds(e);if(!o)return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter '${e}' not found`,exitCode:1};try{return await o(t,r,s)}catch(n){return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter execution failed: ${n.message}`,exitCode:9}}}var Go=Object.keys(Ct);async function Rt(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||oe.resolve("config/keys.json"),n=e["policy-sig"]||oe.resolve("config/policy.sig.json"),i=e["policy-state"]||oe.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let k=oe.resolve(t),D=Te.readFileSync(k,"utf-8");c=JSON.parse(D)}catch(k){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:k.message})),process.exit(5)}let l;try{let k=r||oe.resolve("config/policy.default.json");Te.existsSync(k)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${k}`})),process.exit(1));let D=Te.readFileSync(k,"utf-8");l=JSON.parse(D)}catch(k){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:k.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(oe.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l});if(!m.valid){let k={status:"invalid",commandId:c.commandId||"N/A",checks:m.checks,errors:m.errors||[],executionResult:null};console.log(JSON.stringify(k,null,2)),m.checks.schema===!1&&process.exit(5),m.checks.signature===!1&&process.exit(3),m.checks.nonce===!1&&process.exit(4),m.checks.timestamp===!1&&process.exit(6),m.checks.rateLimit===!1&&process.exit(7),m.checks.policy===!1&&process.exit(2),process.exit(9)}let y;try{let k=l.requesters?.[c.requesterId];y=await ge("noop",c,l,k)}catch(k){y={adapter:"noop",status:"error",error:k.message}}let S={status:"valid_simulated",commandId:c.commandId||"N/A",checks:m.checks,risk:m.risk||"UNKNOWN",executionResult:{adapter:y.adapter,status:y.status,output:y.output||y.error||"",exitCode:y.exitCode||0,note:"This is a simulation using noop adapter. No actual execution occurred."}};console.log(JSON.stringify(S,null,2)),process.exit(0)}import Se from"fs";import R from"path";import gs from"crypto";import J from"fs";import $e from"path";import us from"crypto";function Lt(e){return us.createHash("sha256").update(e).digest("hex")}function fs(e){try{if(!J.existsSync(e))return"GENESIS";let t=J.readFileSync(e,"utf8").trim();if(!t)return"GENESIS";let r=t.split(`
|
|
77
|
-
`),s=r[r.length-1];try{return JSON.parse(s).hash||"GENESIS"}catch{return"GENESIS"}}catch{return"GENESIS"}}function
|
|
78
|
-
`,{encoding:"utf8"})}catch(u){throw new Error(`Audit log write failed: ${u.message}`)}s={success:!0,hash:a,prevHash:o,message:"Audit entry appended"}}),s}function Pt(e,t={}){let r=t.failFast!==!1,s=Number.isFinite(t.maxEntries)&&t.maxEntries>0?Math.floor(t.maxEntries):null,o={ok:!0,file
|
|
79
|
-
`),a=s?i.slice(0,s):i;o.entries=a.length;let c="GENESIS";for(let l=0;l<a.length;l++){let u;try{u=JSON.parse(a[l])}catch{let g={index:l,reason:"INVALID_JSON_LINE",message:`Line ${l} is not valid JSON`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break;continue}if(u.prevHash!==c){let g={index:l,reason:"PREV_HASH_MISMATCH",message:`Expected prevHash '${c}', got '${u.prevHash}'`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break}let f={...u},d=f.hash;delete f.hash;let p=Lt(JSON.stringify(f));if(d!==p){let g={index:l,reason:"HASH_MISMATCH",message:`Expected hash '${p}', got '${d}'`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break}c=d}return o.message=o.valid?`Audit log verified: ${o.entries} entries`:`Audit log integrity failed at index ${o.firstInvalidIndex}`,o}catch(n){return{ok:!1,file:$e.resolve(e),entries:0,valid:!1,firstInvalidIndex:null,reason:"AUDIT_VERIFY_ERROR",errors:[{index:null,reason:"AUDIT_VERIFY_ERROR",message:n.message}],message:`Integrity check failed: ${n.message}`}}}import he from"fs";import ps from"path";var ke=class{constructor(t){this.dbPath=t,this.db={entries:[]}}async load(){try{if(!he.existsSync(this.dbPath)){this.db={entries:[]};return}let t=he.readFileSync(this.dbPath,"utf8");this.db=JSON.parse(t),Array.isArray(this.db.entries)||(this.db={entries:[]})}catch{this.db={entries:[]}}}async save(){let t=ps.dirname(this.dbPath);he.existsSync(t)||he.mkdirSync(t,{recursive:!0}),A(this.dbPath,JSON.stringify(this.db,null,2),{encoding:"utf8"})}checkAndRecord({requesterId:t,nowSec:r,windowSec:s,maxRequests:o}){let n=Number.isFinite(r)?r:Math.floor(Date.now()/1e3),i=Number.isFinite(s)&&s>0?s:60,a=Number.isFinite(o)&&o>0?o:30,c=n-i;this.db.entries=this.db.entries.filter(u=>u.timestamp>=c);let l=this.db.entries.filter(u=>u.requesterId===t);if(l.length>=a){let u=l.sort((d,p)=>d.timestamp-p.timestamp)[0],f=Math.max(1,i-(n-u.timestamp));return{ok:!1,reason:"RATE_LIMIT_EXCEEDED",message:`Rate limit exceeded for '${t}' (${a}/${i}s)`,retryAfterSec:f}}return this.db.entries.push({requesterId:t,timestamp:n}),{ok:!0,reason:null,message:"Rate limit check passed",retryAfterSec:0}}};import ys from"crypto";import ms from"path";var Ke=class{constructor(t){this.dbPath=t||ms.resolve("data/checkpoints.db.json"),this.store={checkpoints:{},tokens:{}},this._load()}_load(){let t=lt(this.dbPath);t&&(this.store=t,this.store.checkpoints=this.store.checkpoints||{},this.store.tokens=this.store.tokens||{})}_save(){let t=JSON.stringify(this.store,null,2);A(this.dbPath,t,{encoding:"utf8"})}saveCheckpoint(t,r){this.store.checkpoints[t]={jobId:t,...r,updatedAt:Date.now()},this._save()}getCheckpoint(t){return this.store.checkpoints[t]||null}getAllCheckpoints(){return Object.values(this.store.checkpoints)}removeCheckpoint(t){return this.store.checkpoints[t]?(delete this.store.checkpoints[t],this._save(),!0):!1}saveToken(t,r){this.store.tokens[t]={tokenId:t,...r,createdAt:Date.now()},this._save()}getToken(t){return this.store.tokens[t]||null}getAllTokens(){return Object.values(this.store.tokens)}removeToken(t){return this.store.tokens[t]?(delete this.store.tokens[t],this._save(),!0):!1}},je=null;function Dt(e){return je||(je=new Ke(e)),je}var Me=class{constructor(t){this.store=Dt(t),this._pendingResolvers=new Map}createToken(t,r={}){let s=ys.randomBytes(16).toString("hex"),o={jobId:t,context:r,status:"pending",expiresAt:Date.now()+1440*60*1e3};return this.store.saveToken(s,o),s}awaitApproval(t){let r=this.store.getToken(t);return r?r.status!=="pending"?Promise.reject(new Error(`Approval token ${t} is no longer pending (status: ${r.status})`)):Date.now()>r.expiresAt?(this.store.removeToken(t),Promise.reject(new Error(`Approval token ${t} expired`))):new Promise((s,o)=>{this._pendingResolvers.set(t,{resolve:s,reject:o})}):Promise.reject(new Error(`Approval token ${t} not found`))}approve(t,r={}){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"approved",approverData:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.resolve({approved:!0,approverData:r}),this._pendingResolvers.delete(t)),!0}deny(t,r="Manually denied"){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"denied",reason:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.reject(new Error(`Approval denied: ${r}`)),this._pendingResolvers.delete(t)),!0}},qe=null;function Tt(e){return qe||(qe=new Me(e)),qe}function Ve(e){return gs.createHash("sha256").update(JSON.stringify(e)).digest("hex")}async function $t(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||R.resolve("config/keys.json"),n=e["policy-sig"]||R.resolve("config/policy.sig.json"),i=e["policy-state"]||R.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let E=R.resolve(t),C=Se.readFileSync(E,"utf-8");c=JSON.parse(C)}catch(E){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:E.message})),process.exit(5)}let l;try{let E=r||R.resolve("config/policy.default.json");Se.existsSync(E)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${E}`})),process.exit(1));let C=Se.readFileSync(E,"utf-8");l=JSON.parse(C)}catch(E){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:E.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(R.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=new ke(R.resolve("data/rate-limit.db.json"));await m.load();let y=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l,rateLimiter:m});if(!y.valid){try{await g.save(),await m.save()}catch{}let E={status:"invalid",commandId:c.commandId||"N/A",checks:y.checks,errors:y.errors||[],executionResult:null};console.error(JSON.stringify(E,null,2));let C=R.resolve("data/audit.log.jsonl");try{Fe(C,{commandId:c.commandId||"N/A",status:"rejected",requesterId:c.requesterId||"unknown",payloadHash:Ve(c),reason:y.checks,timestamp:new Date().toISOString()})}catch(zt){console.error(JSON.stringify({status:"error",error:"AUDIT_WRITE_FAILED",message:zt.message})),process.exit(10)}y.checks.schema===!1&&process.exit(5),y.checks.signature===!1&&process.exit(3),y.checks.nonce===!1&&process.exit(4),y.checks.timestamp===!1&&process.exit(6),y.checks.rateLimit===!1&&process.exit(7),y.checks.policy===!1&&process.exit(2),process.exit(9)}let S=y.risk||"LOW",k=c.payload.adapter||"shell",D=l.requesters?.[c.requesterId],K=D?.requireApproval;if(K===!0||Array.isArray(K)&&(K.includes(S)||K.includes("*")||["HIGH","CRITICAL"].includes(S)&&K.includes("HIGH+"))){let C=Tt().createToken(c.commandId,{requesterId:c.requesterId,adapter:k,risk:S});await g.save().catch(()=>{}),await m.save().catch(()=>{}),console.log(JSON.stringify({status:"approval_required",commandId:c.commandId||"N/A",risk:S,approvalToken:C,message:`${S} risk operation requires operator approval. Approve with: lbe approve --token ${C}`},null,2)),process.exit(11)}let I=null;if((e.backup===!0||k==="file")&&c.payload.target)try{I=me(R.resolve(c.payload.target))}catch{}let h;try{h=await ge(k,c,l,D)}catch(E){h={adapter:k,status:"error",error:E.message,exitCode:1}}let _=h.status==="error"||h.exitCode!==0,O=null;if(_&&I&&e["rollback-on-failure"]!==!1)try{O=U(I)}catch(E){O={restored:!1,error:E.message}}let z=null;if(!_&&c.payload.target&&["write","patch"].includes(c.payload.action)){let C=Se.existsSync(R.resolve(c.payload.target));z={ok:C,check:"target_exists",target:c.payload.target},!C&&I&&(O=U(I),h.status="error")}let X=R.resolve("data/audit.log.jsonl");try{Fe(X,{commandId:c.commandId||"N/A",status:O?.restored?"rolled_back":h.status||"completed",requesterId:c.requesterId||"unknown",payloadHash:Ve(c),executionHash:Ve(h),adapter:h.adapter,riskLevel:S,exitCode:h.exitCode||0,rolledBack:O?.restored||!1,timestamp:new Date().toISOString()})}catch(E){console.error(JSON.stringify({status:"error",error:"AUDIT_WRITE_FAILED",message:E.message})),process.exit(10)}await g.save(),await m.save();let Ht={status:_||z&&!z.ok?"failed":"executed",commandId:c.commandId||"N/A",risk:S,checks:y.checks,executionResult:{adapter:h.adapter,status:h.status||"completed",output:h.output||h.error||"",exitCode:h.exitCode||0},backup:I?{path:I.backupPath,existed:I.existed,hash:I.hash}:null,rollback:O,postValidation:z};console.log(JSON.stringify(Ht,null,2)),process.exit(h.exitCode||0)}import Ft from"path";function jt(e,t){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}async function Kt(e){let t=e.audit?Ft.resolve(e.audit):Ft.resolve("data/audit.log.jsonl"),r=jt(e["fail-fast"],!0),s=jt(e.json,!0),o=Number.isFinite(Number(e.max))?Number(e.max):void 0,n=Pt(t,{failFast:r,maxEntries:o});s?console.log(JSON.stringify(n,null,2)):n.valid?(console.log(`OK: ${n.file}`),console.log(`Entries: ${n.entries}`)):(console.log(`FAIL: ${n.file}`),console.log(`First invalid index: ${n.firstInvalidIndex}`),console.log(`Reason: ${n.reason}`)),process.exit(n.valid?0:8)}import Je from"path";import G from"fs";import P from"path";import hs from"crypto";import{fileURLToPath as ks}from"url";var ae=P.dirname(ks(import.meta.url));function qt(e){try{let t=G.readFileSync(e);return hs.createHash("sha256").update(t).digest("hex")}catch{return null}}function Ss(e=P.join(ae,"../..")){let t={},r=["src/core/signature.js","src/core/validator.js","src/core/policyEngine.js","src/core/nonceStore.js","src/core/auditLog.js","src/core/schema.js","bin/lbe.js"];for(let s of r){let o=P.join(e,s),n=qt(o);n&&(t[s]=n)}return t}function Is(e,t=P.join(ae,"../..")){let r={valid:!0,mismatches:[],missing:[],checkedFiles:0};for(let[s,o]of Object.entries(e)){let n=P.join(t,s);if(!G.existsSync(n)){r.valid=!1,r.missing.push(s);continue}let i=qt(n);r.checkedFiles++,i!==o&&(r.valid=!1,r.mismatches.push({file:s,expected:o,actual:i}))}return r}async function ne(e={}){let t=typeof e=="string"||e===null?{manifestPath:e}:e,r=t.rootDir||P.join(ae,"../.."),s=t.strict===!0,o=t.manifestPath||P.join(r,"config/integrity.manifest.json");if(!G.existsSync(o))return s?{valid:!1,skipped:!1,reason:"INTEGRITY_MANIFEST_MISSING",message:`Integrity manifest not found: ${o}`,checkedFiles:0,mismatches:[],missing:[]}:{valid:!0,skipped:!0,reason:null,message:"Integrity manifest not found - check skipped",checkedFiles:0,mismatches:[],missing:[]};try{let n=G.readFileSync(o,"utf8"),i=JSON.parse(n),a=Is(i,r);return{...a,skipped:!1,reason:a.valid?null:"INTEGRITY_CHECK_FAILED",message:a.valid?`Integrity check passed (${a.checkedFiles} files verified)`:"Runtime integrity check failed - system may be tampered"}}catch(n){return{valid:!1,skipped:!1,reason:"INTEGRITY_CHECK_ERROR",message:`Integrity check error: ${n.message}`,checkedFiles:0,mismatches:[],missing:[]}}}function Mt({outputPath:e=P.join(ae,"../../config/integrity.manifest.json"),rootDir:t=P.join(ae,"../..")}={}){let r=Ss(t),s=JSON.stringify(r,null,2),o=P.dirname(e);return G.existsSync(o)||G.mkdirSync(o,{recursive:!0}),G.writeFileSync(e,s),{outputPath:e,fileCount:Object.keys(r).length,manifest:r}}function Ye(e,t=!1){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}async function Vt(e){let t=Ye(e.strict,!1)||Ye(e["integrity-strict"],!1),r=e.manifest?Je.resolve(e.manifest):Je.resolve(e["integrity-manifest"]||"config/integrity.manifest.json"),s=Ye(e.json,!0),o=await ne({manifestPath:r,strict:t});console.log(s?JSON.stringify({ok:o.valid,valid:o.valid,skipped:o.skipped===!0,strict:t,manifestPath:r,checkedFiles:o.checkedFiles,mismatches:o.mismatches||[],missing:o.missing||[],reason:o.reason||null,message:o.message},null,2):o.message),process.exit(o.valid?0:8)}async function Yt(e){let t=Je.resolve(e.out||e.output||e.manifest||"config/integrity.manifest.json"),r=Mt({outputPath:t});console.log(JSON.stringify({ok:!0,outputPath:r.outputPath,fileCount:r.fileCount},null,2)),process.exit(0)}import W from"fs";import Ie from"path";async function Jt(e){let t=Ie.resolve(e.config||e.policy||"config/policy.default.json"),r=Ie.resolve(e["policy-sig"]||"config/policy.sig.json"),s=Ie.resolve(e["secret-key-file"]||"keys/secret.key"),o=String(e["policy-key-id"]||"policy-signer-v1-2026Q1");W.existsSync(t)||(console.error(JSON.stringify({status:"error",error:"POLICY_FILE_MISSING",message:`Policy file not found: ${t}`},null,2)),process.exit(1)),W.existsSync(s)||(console.error(JSON.stringify({status:"error",error:"SECRET_KEY_MISSING",message:`Secret key file not found: ${s}`},null,2)),process.exit(1));let n=JSON.parse(W.readFileSync(t,"utf8"));(typeof n.version>"u"||typeof n.createdAt>"u")&&(console.error(JSON.stringify({status:"error",error:"POLICY_VERSION_METADATA_MISSING",message:"Policy must include version and createdAt before signing"},null,2)),process.exit(8));let i=W.readFileSync(s,"utf8").trim(),a=le({policyObj:n,secretKeyB64:i,keyId:o});a.ok||(console.error(JSON.stringify({status:"error",error:a.reason||"POLICY_SIGN_FAILED",message:a.message},null,2)),process.exit(8));let c=Ie.dirname(r);W.existsSync(c)||W.mkdirSync(c,{recursive:!0}),W.writeFileSync(r,JSON.stringify(a.envelope,null,2)),console.log(JSON.stringify({status:"ok",message:"Policy signature written",policy:t,policySig:r,keyId:o},null,2)),process.exit(0)}import v from"fs";import N from"path";function Bt(e,t){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}function j(e,t,r,s){e[t]={ok:r,message:s}}function H(e){try{return v.accessSync(e,v.constants.R_OK),!0}catch{return!1}}function Es(e){let t=N.join(e,`.healthcheck-${Date.now()}`);try{return v.mkdirSync(e,{recursive:!0}),v.writeFileSync(t,"ok","utf8"),v.unlinkSync(t),{ok:!0,message:"Data directory writable"}}catch(r){return{ok:!1,message:`Data directory not writable: ${r.message}`}}}async function Ut(e){let t=Bt(e.json,!0),r=N.resolve(e.config||e.policy||"config/policy.default.json"),s=N.resolve(e["policy-sig"]||"config/policy.sig.json"),o=N.resolve(e["keys-store"]||"config/keys.json"),n=N.resolve(e["data-dir"]||"data"),i=N.resolve(e.audit||N.join(n,"audit.log.jsonl")),a=N.resolve(e["nonce-db"]||N.join(n,"nonce.db.json")),c=N.resolve(e["rate-db"]||N.join(n,"rate-limit.db.json")),l=N.resolve(e["policy-state"]||N.join(n,"policy.state.json")),u=Bt(e["integrity-strict"],!1),f=N.resolve(e["integrity-manifest"]||"config/integrity.manifest.json"),d={};j(d,"policy",v.existsSync(r)&&H(r),v.existsSync(r)?`Policy file readable: ${r}`:`Policy file missing: ${r}`),j(d,"policySignature",v.existsSync(s)&&H(s),v.existsSync(s)?`Policy signature readable: ${s}`:`Policy signature missing: ${s}`),j(d,"trustedKeys",v.existsSync(o)&&H(o),v.existsSync(o)?`Trusted keys readable: ${o}`:`Trusted keys missing: ${o}`),j(d,"auditLog",v.existsSync(i)&&H(i),v.existsSync(i)?`Audit log readable: ${i}`:`Audit log missing: ${i}`),j(d,"nonceDb",v.existsSync(a)&&H(a),v.existsSync(a)?`Nonce DB readable: ${a}`:`Nonce DB missing: ${a}`),j(d,"rateLimitDb",v.existsSync(c)&&H(c),v.existsSync(c)?`Rate-limit DB readable: ${c}`:`Rate-limit DB missing: ${c}`),j(d,"policyState",v.existsSync(l)&&H(l),v.existsSync(l)?`Policy state readable: ${l}`:`Policy state missing: ${l}`);let p=Es(n);if(j(d,"dataWritable",p.ok,p.message),u){let y=await ne({strict:!0,manifestPath:f});j(d,"integrity",y.valid,y.valid?y.message:`${y.reason}: ${y.message}`)}let g=Object.values(d).every(y=>y.ok===!0),m={ok:g,status:g?"healthy":"unhealthy",timestamp:new Date().toISOString(),checks:d};console.log(t?JSON.stringify(m,null,2):`${m.status.toUpperCase()}: ${Object.keys(d).length} checks`),process.exit(g?0:8)}function xs(e,t=!1){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}var ws=Ee.dirname(vs(import.meta.url)),As=Ee.join(ws,"../package.json"),Gt=JSON.parse(Wt.readFileSync(As,"utf-8"));async function bs(){let e=process.argv.slice(2);e.includes("--version")&&(console.log(`LetterBlack Sentinel v${Gt.version}`),process.exit(0));let{command:t,opts:r}=Ge(e);r.version&&(console.log(`LetterBlack Sentinel v${Gt.version}`),process.exit(0)),(r.help||!t)&&(ve(),process.exit(0));try{if(r["pub-key-file"])try{r["pub-key"]=Wt.readFileSync(Ee.resolve(r["pub-key-file"]),"utf-8").trim()}catch(s){console.error(`Error reading public key file: ${s.message}`),process.exit(1)}if(["verify","dryrun","run"].includes(t)){let s=xs(r["integrity-strict"],!1),o=Ee.resolve(r["integrity-manifest"]||"config/integrity.manifest.json"),n=await ne({strict:s,manifestPath:o});n.valid||(console.error(JSON.stringify({status:"error",error:n.reason||"INTEGRITY_CHECK_FAILED",message:n.message},null,2)),process.exit(8))}switch(t){case"init":await nt(r);break;case"verify":await At(r);break;case"dryrun":await Rt(r);break;case"run":await $t(r);break;case"audit-verify":await Kt(r);break;case"integrity-check":await Vt(r);break;case"integrity-generate":await Yt(r);break;case"policy-sign":await Jt(r);break;case"health":await Ut(r);break;default:console.error(`Unknown command: ${t}`),ve(),process.exit(1)}}catch(s){console.error(JSON.stringify({status:"error",error:"INTERNAL_ERROR",message:s.message,stack:process.env.DEBUG?s.stack:void 0})),process.exit(9)}}bs().catch(e=>{console.error(JSON.stringify({status:"error",error:"FATAL_ERROR",message:e.message})),process.exit(9)});
|
|
74
|
+
`)?a.slice(3):a}}function vt(e,t=!1){let r=Fr[e]??0,s=M().exports.lbe_classify_risk(r,t?1:0);return $r[s]??"LOW"}import Le from"path";function Mr(e){let t=n=>e!=null&&Object.prototype.hasOwnProperty.call(e,n),r=n=>typeof n=="string",s=e?.payload,o=e?.signature;return{hasId:t("id"),idValid:r(e?.id)&&/^[A-Z_]+$/.test(e.id)&&e.id.length>=1&&e.id.length<=50,hasCommandId:t("commandId"),commandIdValid:r(e?.commandId)&&/^[a-f0-9-]+$/.test(e.commandId)&&e.commandId.length===36,hasRequesterId:t("requesterId"),requesterIdValid:r(e?.requesterId)&&e.requesterId.length>=3&&e.requesterId.length<=100,hasSessionId:t("sessionId"),sessionIdValid:r(e?.sessionId)&&e.sessionId.length>=3,hasTimestamp:t("timestamp"),timestampValid:typeof e?.timestamp=="number"&&e.timestamp>=1e9,hasNonce:t("nonce"),nonceValid:r(e?.nonce)&&e.nonce.length>=32&&e.nonce.length<=128,hasRequires:t("requires"),requiresValid:Array.isArray(e?.requires)&&e.requires.length>=1&&e.requires.every(r),hasPayload:t("payload")&&typeof s=="object"&&s!==null&&!Array.isArray(s),hasPayloadAdapter:s!=null&&Object.prototype.hasOwnProperty.call(s,"adapter"),payloadAdapterValid:r(s?.adapter),hasSignature:t("signature")&&typeof o=="object"&&o!==null&&!Array.isArray(o),hasSignatureAlg:o!=null&&Object.prototype.hasOwnProperty.call(o,"alg"),signatureAlgValid:o?.alg==="ed25519",hasSignatureKeyId:o!=null&&Object.prototype.hasOwnProperty.call(o,"keyId"),hasSignatureSig:o!=null&&Object.prototype.hasOwnProperty.call(o,"sig"),signatureSigValid:r(o?.sig)&&o.sig.length>=10,hasRisk:t("risk"),riskValid:["LOW","MEDIUM","HIGH","CRITICAL"].includes(e?.risk)}}function Vr(e,t){let r=!!(e&&e.default==="DENY"&&e.requesters&&typeof e.requesters=="object"),s=e?.requesters?.[t.requesterId],o=t.id?.toLowerCase()??"",n=!!s?.allowCommands?.some(p=>p.toLowerCase()===o),i=!!s?.allowAdapters?.includes(t.payload?.adapter),a=!!t.payload?.cwd,c=!1,l=!1,u=!1;if(a){let p=s?.filesystem?.roots??[];if(c=p.length>0,c){let g=Le.resolve(t.payload.cwd);l=p.some(y=>{let S=Le.resolve(y);return g===S||g.startsWith(S+Le.sep)}),u=(s?.filesystem?.denyPatterns??[]).some(y=>new RegExp("^"+y.replace(/\./g,"\\.").replace(/\*\*/g,".*").replace(/\*/g,"[^/]*")+"$").test(g))}}let f=!1,d=!0;if(t.id==="RUN_SHELL"){f=!0;let p=s?.exec?.allowCmds??[],g=s?.exec?.denyCmds??[],m=t.payload?.cmd;g.includes(m)?d=!1:d=p.length===0||p.includes(m)}return{policyConfigured:r,requesterConfigured:!!s,commandAllowed:n,adapterAllowed:i,filesystemRequired:a,filesystemRootsDefined:c,filesystemOk:l,pathDenied:u,shellRequired:f,shellCommandOk:d}}function Yr(e,t,r,s=new Date){if(!e||!t)return{keyIdFormatValid:!1,keyFound:!1,keyNotDeprecated:!1,keyRequesterMatches:!1,keyNotBeforeOk:!1,keyNotExpired:!1,keyLifecycleFieldsPresent:!1,publicKey:null};let n=/^[A-Za-z0-9:_-]{3,128}$/.test(t)&&t!=="default";if(!n)return{keyIdFormatValid:n,keyFound:!1,keyNotDeprecated:!1,keyRequesterMatches:!1,keyNotBeforeOk:!1,keyNotExpired:!1,keyLifecycleFieldsPresent:!1,publicKey:null};let i=e.trustedKeys?.[t],a=!!i;if(!a)return{keyIdFormatValid:n,keyFound:a,keyNotDeprecated:!1,keyRequesterMatches:!1,keyNotBeforeOk:!1,keyNotExpired:!1,keyLifecycleFieldsPresent:!1,publicKey:null};let c=!i.deprecated,l=!i.requesterId||i.requesterId===r,u=i.notBefore||i.validFrom,f=i.expiresAt||i.validUntil,d=typeof u=="string"&&typeof f=="string",p=!1,g=!1;if(d){let m=new Date(u),y=new Date(f);!isNaN(m.getTime())&&!isNaN(y.getTime())&&m<y&&(p=s>=m,g=s<y)}return{keyIdFormatValid:n,keyFound:a,keyNotDeprecated:c,keyRequesterMatches:l,keyNotBeforeOk:p,keyNotExpired:g,keyLifecycleFieldsPresent:d,publicKey:i.publicKey??null}}function xt(e){return(e?.entries??[]).map(t=>`${t.key}:${t.timestamp}`)}function wt(e){return e.split(`
|
|
75
|
+
`).filter(Boolean).map(t=>{let r=t.lastIndexOf(":");return{key:t.slice(0,r),timestamp:parseInt(t.slice(r+1),10)||0}})}function Jr(e){return(e?.entries??[]).map(t=>`${t.requesterId}:${t.timestamp}`)}function Br(e){return e.split(`
|
|
76
|
+
`).filter(Boolean).map(t=>{let r=t.lastIndexOf(":");return{requesterId:t.slice(0,r),timestamp:parseInt(t.slice(r+1),10)||0}})}function ee({commandObj:e,pubKeyB64:t,keyStore:r,nonceDb:s,policy:o,rateLimiter:n,policyStatePath:i}){let a={valid:!1,commandId:e?.commandId,checks:{},errors:[]},c=Math.floor(Date.now()/1e3),l=new Date,u=Number.isFinite(o?.security?.maxClockSkewSec)?o.security.maxClockSkewSec:600;if(i&&o?.version!==void 0)try{let h=q({policyObj:o,statePath:i});if(a.checks.policyVersion=h.ok,!h.ok)return a.errors.push({type:"POLICY_VERSION_INVALID",message:h.message}),a}catch{a.checks.policyVersion=!0}else a.checks.policyVersion=!0;let f=Mr(e),d=e?.signature?.keyId,p=Yr(r,d,e?.requesterId,l),g=!1,m=p.publicKey;if(!m&&t&&(m=t),m){let h={...e};delete h.signature,g=de({payloadObj:h,sigB64:e?.signature?.sig,pubKeyB64:m}).valid}let y=!0,S=0;if(g&&n&&typeof n.db<"u"){let h=o?.requesters?.[e.requesterId]?.rateLimit||{},_=o?.security?.defaultRateLimit||{},O=h.windowSec??_.windowSec??60,z=h.maxRequests??_.maxRequests??30,X=Et({windowSec:O,maxRequests:z,nowSec:c,requesterId:e.requesterId,existingEntries:Jr(n.db)});y=X.ok,S=X.retryAfterSec,X.ok&&(n.db.entries=Br(X.updatedEntriesText))}else if(g&&n&&typeof n.checkAndRecord=="function"){let h=o?.requesters?.[e.requesterId]?.rateLimit||{},_=o?.security?.defaultRateLimit||{},O=n.checkAndRecord({requesterId:e.requesterId,nowSec:c,windowSec:h.windowSec??_.windowSec??60,maxRequests:h.maxRequests??_.maxRequests??30});y=O.ok,S=O.retryAfterSec??0}let k=!0,D=`${e?.requesterId}|${e?.sessionId}|${e?.nonce}`,K=3600;if(g&&y&&s)if(typeof s.checkAndRecord=="function")if(s.db){let h=Re({ttlSec:K,nowSec:c,newKey:D,existingEntries:xt(s.db)});k=h.ok,h.ok&&(s.db.entries=wt(h.updatedEntriesText))}else k=s.checkAndRecord({requesterId:e.requesterId,sessionId:e.sessionId,nonce:e.nonce}).ok;else{let h=Re({ttlSec:K,nowSec:c,newKey:D,existingEntries:xt(s)});k=h.ok,h.ok&&(s.entries=wt(h.updatedEntriesText))}let Ue=Vr(o,e??{}),I=It({...f,cmdTimestamp:e?.timestamp??0,nowSec:c,maxClockSkewSec:u,...p,signatureValid:g,rateLimitOk:y,rateLimitRetryAfterSec:S,nonceOk:k,...Ue}),b=I.stage;if(a.checks.schema=b!==0,b>=1&&(a.checks.timestamp=b!==1),b>=2&&(a.checks.keyId=b!==2),b>=2&&(a.checks.signature=b!==2&&b!==3),b>=4&&(a.checks.rateLimit=b!==4),b>=5&&(a.checks.nonce=b!==5),(b>=6||I.ok)&&(a.checks.policy=b!==6),!I.ok){let h=I.stageLabel;if(h==="schema")a.errors.push({type:"SCHEMA_ERROR",message:I.schemaError||"Schema invalid"});else if(h==="timestamp")a.errors.push({type:"TIMESTAMP_SKEW_EXCEEDED",message:`Command timestamp skew ${I.skewSec}s exceeds allowed ${u}s`});else if(h==="key"){let _=I.keyReason||"KEY_ERROR",O={KEY_ID_INVALID:`Invalid keyId '${d}'`,KEY_NOT_TRUSTED:`Key '${d}' is not in trusted key store`,KEY_DEPRECATED:`Key '${d}' is deprecated`,KEY_REQUESTER_MISMATCH:`Key '${d}' is not authorized for requester '${e?.requesterId}'`,KEY_LIFECYCLE_INVALID:`Key '${d}' must define notBefore and expiresAt`,KEY_NOT_YET_VALID:`Key '${d}' is not yet valid`,KEY_EXPIRED:`Key '${d}' has expired`};a.errors.push({type:_,message:O[_]||_})}else h==="signature"?a.errors.push({type:"SIGNATURE_INVALID",message:m?"Signature verification failed":"No public key available"}):h==="rate_limit"?a.errors.push({type:"RATE_LIMIT_EXCEEDED",message:`Rate limit exceeded. Retry after ${I.retryAfterSec}s`}):h==="nonce"?a.errors.push({type:"REPLAY_NONCE",message:"Nonce has already been used"}):h==="policy"&&I.policyResult?a.errors.push({type:I.policyResult.reason,message:I.policyResult.message}):a.errors.push({type:"VALIDATION_FAILED",message:`Failed at stage: ${h}`});return a}return a.valid=!0,a.risk=vt(e.id,e.payload?.cmd==="rm"),a.message="Command validation successful",a}import me from"fs";import Ur from"path";var V=class{constructor(t,r=3600){this.dbPath=t,this.ttlSec=r,this.db={entries:[]}}async load(){if(!me.existsSync(this.dbPath)){this.db={entries:[]};return}try{let t=me.readFileSync(this.dbPath,"utf8");this.db=JSON.parse(t),this.prune()}catch(t){throw new Error(`Nonce DB at ${this.dbPath} is corrupt or unreadable: ${t.message}`)}}async save(){try{let t=Ur.dirname(this.dbPath);me.existsSync(t)||me.mkdirSync(t,{recursive:!0}),A(this.dbPath,JSON.stringify(this.db,null,2),{encoding:"utf8"})}catch(t){throw new Error(`Failed to save nonce DB: ${t.message}`)}}checkAndRecord({requesterId:t,sessionId:r,nonce:s}){let o=Math.floor(Date.now()/1e3);this.db.entries=this.db.entries.filter(i=>o-i.timestamp<=this.ttlSec);let n=`${t}|${r}|${s}`;return this.db.entries.some(i=>i.key===n)?{ok:!1,reason:"REPLAY_NONCE",message:"Nonce has already been used"}:(this.db.entries.push({key:n,timestamp:o}),{ok:!0,reason:null,message:"Nonce accepted"})}prune(){let t=Math.floor(Date.now()/1e3),r=this.db.entries.length;this.db.entries=this.db.entries.filter(o=>t-o.timestamp<=this.ttlSec);let s=this.db.entries.length;return{prunedCount:r-s,remainingCount:s}}};async function At(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||te.resolve("config/keys.json"),n=e["policy-sig"]||te.resolve("config/policy.sig.json"),i=e["policy-state"]||te.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let S=te.resolve(t),k=Pe.readFileSync(S,"utf-8");c=JSON.parse(k)}catch(S){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:S.message})),process.exit(5)}let l;try{let S=r||te.resolve("config/policy.default.json");Pe.existsSync(S)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${S}`})),process.exit(1));let k=Pe.readFileSync(S,"utf-8");l=JSON.parse(k)}catch(S){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:S.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(te.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l}),y={status:m.valid?"valid":"invalid",commandId:c.commandId||"N/A",checks:m.checks,errors:m.errors||[],risk:m.risk||"UNKNOWN"};console.log(JSON.stringify(y,null,2)),m.valid||(m.checks.schema===!1&&process.exit(5),m.checks.signature===!1&&process.exit(3),m.checks.nonce===!1&&process.exit(4),m.checks.timestamp===!1&&process.exit(6),m.checks.rateLimit===!1&&process.exit(7),m.checks.policy===!1&&process.exit(2),process.exit(9)),process.exit(0)}import $e from"fs";import oe from"path";async function bt(e){return{adapter:"noop",commandId:e.commandId||"unknown",command:e.id||"unknown",status:"completed",output:`[NOOP] Would execute: ${e.id||"unknown"} on adapter: ${e.payload?.adapter||"unknown"}`,exitCode:0,timestamp:new Date().toISOString()}}import{spawnSync as Gr}from"child_process";import De from"path";function Wr(e){if(e===void 0)return{ok:!0,args:[]};if(!Array.isArray(e))return{ok:!1,error:"payload.args must be an array"};let t=[];for(let r of e){if(typeof r!="string"&&typeof r!="number"&&typeof r!="boolean")return{ok:!1,error:"payload.args may only contain string, number, or boolean values"};t.push(String(r))}return{ok:!0,args:t}}async function _t(e,t,r){let s=e.payload,o=3e4,n=1024*1024;if(s.adapter!=="shell")return{adapter:"shell",commandId:e.commandId,status:"error",error:"Adapter mismatch",exitCode:1};let i=r?.exec?.allowCmds||[];if((r?.exec?.denyCmds||[]).includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' is denied`,exitCode:2};if(i.length>0&&!i.includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' not in allowlist`,exitCode:2};if(!(r?.filesystem?.roots||[]).some(f=>{let d=De.resolve(f),p=De.resolve(s.cwd);return p===d||p.startsWith(d+De.sep)}))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`CWD '${s.cwd}' not authorized`,exitCode:2};let u=Wr(s.args);if(!u.ok)return{adapter:"shell",commandId:e.commandId,status:"blocked",error:u.error,exitCode:2};try{let f=Gr(s.cmd,u.args,{cwd:s.cwd,timeout:o,encoding:"utf8",maxBuffer:n,stdio:["pipe","pipe","pipe"],shell:!1});if(f.error)throw f.error;let d=`${f.stdout||""}${f.stderr||""}`,p=f.status??1;return p!==0?{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:d.substring(0,n)||`Command exited with code ${p}`,exitCode:p,timestamp:new Date().toISOString()}:{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"completed",output:d.substring(0,n),exitCode:0,timestamp:new Date().toISOString()}}catch(f){return{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:f.message,exitCode:f.status||1,timestamp:new Date().toISOString()}}}import ie from"fs";import se from"path";import Y from"fs";import ye from"path";import Hr from"crypto";function ge(e,t){let r=t||ye.resolve("data/backups");Y.existsSync(r)||Y.mkdirSync(r,{recursive:!0});let s=ye.resolve(e),o=Y.existsSync(s),n=null,i=null;o&&(n=Y.readFileSync(s),i=Hr.createHash("sha256").update(n).digest("hex"));let a=ye.basename(s).replace(/[^a-zA-Z0-9._-]/g,"_"),c=`${Date.now()}-${i?i.slice(0,8):"new"}-${a}`,l=o?ye.join(r,c):null;return o&&n!==null&&A(l,n),{originalPath:s,backupPath:l,existed:o,hash:i,createdAt:new Date().toISOString()}}function U(e){if(!e)return{restored:!1,error:"No backup metadata"};let{originalPath:t,backupPath:r,existed:s}=e;if(!s)try{return Y.existsSync(t)&&Y.unlinkSync(t),{restored:!0,action:"deleted"}}catch(o){return{restored:!1,error:o.message}}if(!r||!Y.existsSync(r))return{restored:!1,error:"Backup file not found at: "+r};try{let o=Y.readFileSync(r);return A(t,o),{restored:!0,action:"restored"}}catch(o){return{restored:!1,error:o.message}}}var zr=10*1024*1024;function Xr(e,t){return e?se.isAbsolute(e)?se.resolve(e):se.resolve(t||process.cwd(),e):null}function Qr(e,t){let r=se.resolve(e);return t.some(s=>{let o=se.resolve(s);return r===o||r.startsWith(o+se.sep)})}function Zr(e,t){for(let r of t||[])if(new RegExp("^"+r.replace(/\./g,"\\.").replace(/\*\*/g,".*").replace(/\*/g,"[^/\\\\]*")+"$").test(e))return r;return null}function re(e,t,r,s=2){return{adapter:"file",commandId:e.commandId,status:"blocked",errorCode:t,error:r,exitCode:s}}function F(e,t,r,s=null,o=1){return{adapter:"file",commandId:e.commandId,status:"error",errorCode:t,error:r,backup:s?he(s):null,exitCode:o}}function he(e){return e?{path:e.backupPath,existed:e.existed,hash:e.hash,createdAt:e.createdAt}:null}async function Nt(e,t,r){let s=e.payload,o=s.action,n=s.cwd||process.cwd(),i=Xr(s.target,n);if(!o)return re(e,"FILE_NO_ACTION","payload.action is required");if(!i&&o!=="noop")return re(e,"FILE_NO_TARGET","payload.target is required");let a=r?.filesystem?.roots||[];if(a.length===0)return re(e,"FILE_NO_ROOTS","No filesystem roots defined for requester");if(!Qr(i,a))return re(e,"FILE_OUTSIDE_ROOT",`'${i}' is outside allowed roots`);let c=Zr(i,r?.filesystem?.denyPatterns);if(c)return re(e,"FILE_PATH_DENIED",`'${i}' matches deny pattern: ${c}`);switch(o){case"read":return es(e,i);case"write":return ts(e,i,s);case"patch":return rs(e,i,s);case"delete":return ss(e,i);default:return re(e,"FILE_UNKNOWN_ACTION",`Unknown action: '${o}'`)}}function es(e,t){if(!ie.existsSync(t))return F(e,"FILE_NOT_FOUND",`Not found: ${t}`);try{let r=ie.statSync(t);if(r.size>zr)return F(e,"FILE_TOO_LARGE","File exceeds 10 MB read limit");let s=ie.readFileSync(t,"utf8");return{adapter:"file",action:"read",commandId:e.commandId,status:"completed",target:t,output:s,bytesRead:r.size,exitCode:0}}catch(r){return F(e,"FILE_READ_ERROR",r.message)}}function ts(e,t,r){let s=r.content;if(s==null)return F(e,"FILE_MISSING_CONTENT","payload.content is required for write");let o=Te(t);try{return A(t,s,{encoding:"utf8"}),{adapter:"file",action:"write",commandId:e.commandId,status:"completed",target:t,backup:he(o),output:`Wrote ${Buffer.byteLength(s,"utf8")} bytes to ${t}`,exitCode:0}}catch(n){return U(o),F(e,"FILE_WRITE_ERROR",n.message,o)}}function rs(e,t,r){let s=r.content;if(s==null)return F(e,"FILE_MISSING_CONTENT","payload.content is required for patch");let o=Te(t);try{return A(t,s,{encoding:"utf8"}),{adapter:"file",action:"patch",commandId:e.commandId,status:"completed",target:t,backup:he(o),output:`Patched ${t} (${Buffer.byteLength(s,"utf8")} bytes)`,exitCode:0}}catch(n){return U(o),F(e,"FILE_PATCH_ERROR",n.message,o)}}function ss(e,t){if(!ie.existsSync(t))return F(e,"FILE_NOT_FOUND",`Not found: ${t}`);let r=Te(t);try{return ie.unlinkSync(t),{adapter:"file",action:"delete",commandId:e.commandId,status:"completed",target:t,backup:he(r),output:`Deleted ${t}`,exitCode:0}}catch(s){return U(r),F(e,"FILE_DELETE_ERROR",s.message,r)}}function Te(e){try{return ge(e)}catch{return null}}async function Ot(e,t,r){let s=Date.now();try{let o=e.id||"";if(!o.toUpperCase().startsWith("OBSERVE"))return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer adapter only handles OBSERVE_* commands, got '${o}'`,exitCode:1};let{source:n,context:i,issueType:a,description:c,severity:l,metadata:u}=e.payload||{};if(!a||!c)return{adapter:"observer",commandId:e.commandId,status:"error",error:"Observer payload must include issueType and description",exitCode:1};let f=["low","medium","high","critical"];return l&&!f.includes(l)?{adapter:"observer",commandId:e.commandId,status:"error",error:`Invalid severity '${l}'. Must be one of: ${f.join(", ")}`,exitCode:1}:{adapter:"observer",commandId:e.commandId,status:"recorded",timestamp:new Date().toISOString(),requesterId:e.requesterId,observation:{source:n||"unknown",context:i||"unknown",issueType:a,description:c,severity:l||"info",metadata:u||{}},duration_ms:Date.now()-s,exitCode:0}}catch(o){return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer execution failed: ${o.message}`,exitCode:9}}}var Ct={noop:bt,shell:_t,file:Nt,observer:Ot};function os(e){return Ct[e]}async function ke(e,t,r,s){let o=os(e);if(!o)return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter '${e}' not found`,exitCode:1};try{return await o(t,r,s)}catch(n){return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter execution failed: ${n.message}`,exitCode:9}}}var jo=Object.keys(Ct);async function Rt(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||oe.resolve("config/keys.json"),n=e["policy-sig"]||oe.resolve("config/policy.sig.json"),i=e["policy-state"]||oe.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let k=oe.resolve(t),D=$e.readFileSync(k,"utf-8");c=JSON.parse(D)}catch(k){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:k.message})),process.exit(5)}let l;try{let k=r||oe.resolve("config/policy.default.json");$e.existsSync(k)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${k}`})),process.exit(1));let D=$e.readFileSync(k,"utf-8");l=JSON.parse(D)}catch(k){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:k.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(oe.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l});if(!m.valid){let k={status:"invalid",commandId:c.commandId||"N/A",checks:m.checks,errors:m.errors||[],executionResult:null};console.log(JSON.stringify(k,null,2)),m.checks.schema===!1&&process.exit(5),m.checks.signature===!1&&process.exit(3),m.checks.nonce===!1&&process.exit(4),m.checks.timestamp===!1&&process.exit(6),m.checks.rateLimit===!1&&process.exit(7),m.checks.policy===!1&&process.exit(2),process.exit(9)}let y;try{let k=l.requesters?.[c.requesterId];y=await ke("noop",c,l,k)}catch(k){y={adapter:"noop",status:"error",error:k.message}}let S={status:"valid_simulated",commandId:c.commandId||"N/A",checks:m.checks,risk:m.risk||"UNKNOWN",executionResult:{adapter:y.adapter,status:y.status,output:y.output||y.error||"",exitCode:y.exitCode||0,note:"This is a simulation using noop adapter. No actual execution occurred."}};console.log(JSON.stringify(S,null,2)),process.exit(0)}import Ee from"fs";import R from"path";import ds from"crypto";import J from"fs";import Fe from"path";import ns from"crypto";function Lt(e){return ns.createHash("sha256").update(e).digest("hex")}function is(e){try{if(!J.existsSync(e))return"GENESIS";let t=J.readFileSync(e,"utf8").trim();if(!t)return"GENESIS";let r=t.split(`
|
|
77
|
+
`),s=r[r.length-1];try{return JSON.parse(s).hash||"GENESIS"}catch{return"GENESIS"}}catch{return"GENESIS"}}function je(e,t){let r=Fe.dirname(e);J.existsSync(r)||J.mkdirSync(r,{recursive:!0});let s;return ct(e,()=>{let o=is(e),n={...t,prevHash:o,timestamp:new Date().toISOString()};delete n.hash;let i=JSON.stringify(n),a=Lt(i),c=JSON.stringify({...n,hash:a}),l="";J.existsSync(e)&&(l=J.readFileSync(e,"utf8"));try{A(e,l+c+`
|
|
78
|
+
`,{encoding:"utf8"})}catch(u){throw new Error(`Audit log write failed: ${u.message}`)}s={success:!0,hash:a,prevHash:o,message:"Audit entry appended"}}),s}function Pt(e,t={}){let r=t.failFast!==!1,s=Number.isFinite(t.maxEntries)&&t.maxEntries>0?Math.floor(t.maxEntries):null,o={ok:!0,file:Fe.resolve(e),entries:0,valid:!0,firstInvalidIndex:null,reason:null,errors:[],message:"Audit log verified"};try{if(!J.existsSync(e))return o.message="Audit log file not found (treated as empty)",o;let n=J.readFileSync(e,"utf8").trim();if(!n)return o.message="Empty audit log",o;let i=n.split(`
|
|
79
|
+
`),a=s?i.slice(0,s):i;o.entries=a.length;let c="GENESIS";for(let l=0;l<a.length;l++){let u;try{u=JSON.parse(a[l])}catch{let g={index:l,reason:"INVALID_JSON_LINE",message:`Line ${l} is not valid JSON`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break;continue}if(u.prevHash!==c){let g={index:l,reason:"PREV_HASH_MISMATCH",message:`Expected prevHash '${c}', got '${u.prevHash}'`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break}let f={...u},d=f.hash;delete f.hash;let p=Lt(JSON.stringify(f));if(d!==p){let g={index:l,reason:"HASH_MISMATCH",message:`Expected hash '${p}', got '${d}'`};if(o.valid=!1,o.ok=!1,o.firstInvalidIndex??=l,o.reason??=g.reason,o.errors.push(g),r)break}c=d}return o.message=o.valid?`Audit log verified: ${o.entries} entries`:`Audit log integrity failed at index ${o.firstInvalidIndex}`,o}catch(n){return{ok:!1,file:Fe.resolve(e),entries:0,valid:!1,firstInvalidIndex:null,reason:"AUDIT_VERIFY_ERROR",errors:[{index:null,reason:"AUDIT_VERIFY_ERROR",message:n.message}],message:`Integrity check failed: ${n.message}`}}}import Se from"fs";import as from"path";var Ie=class{constructor(t){this.dbPath=t,this.db={entries:[]}}async load(){try{if(!Se.existsSync(this.dbPath)){this.db={entries:[]};return}let t=Se.readFileSync(this.dbPath,"utf8");this.db=JSON.parse(t),Array.isArray(this.db.entries)||(this.db={entries:[]})}catch{this.db={entries:[]}}}async save(){let t=as.dirname(this.dbPath);Se.existsSync(t)||Se.mkdirSync(t,{recursive:!0}),A(this.dbPath,JSON.stringify(this.db,null,2),{encoding:"utf8"})}checkAndRecord({requesterId:t,nowSec:r,windowSec:s,maxRequests:o}){let n=Number.isFinite(r)?r:Math.floor(Date.now()/1e3),i=Number.isFinite(s)&&s>0?s:60,a=Number.isFinite(o)&&o>0?o:30,c=n-i;this.db.entries=this.db.entries.filter(u=>u.timestamp>=c);let l=this.db.entries.filter(u=>u.requesterId===t);if(l.length>=a){let u=l.sort((d,p)=>d.timestamp-p.timestamp)[0],f=Math.max(1,i-(n-u.timestamp));return{ok:!1,reason:"RATE_LIMIT_EXCEEDED",message:`Rate limit exceeded for '${t}' (${a}/${i}s)`,retryAfterSec:f}}return this.db.entries.push({requesterId:t,timestamp:n}),{ok:!0,reason:null,message:"Rate limit check passed",retryAfterSec:0}}};import ls from"crypto";import cs from"path";var qe=class{constructor(t){this.dbPath=t||cs.resolve("data/checkpoints.db.json"),this.store={checkpoints:{},tokens:{}},this._load()}_load(){let t=lt(this.dbPath);t&&(this.store=t,this.store.checkpoints=this.store.checkpoints||{},this.store.tokens=this.store.tokens||{})}_save(){let t=JSON.stringify(this.store,null,2);A(this.dbPath,t,{encoding:"utf8"})}saveCheckpoint(t,r){this.store.checkpoints[t]={jobId:t,...r,updatedAt:Date.now()},this._save()}getCheckpoint(t){return this.store.checkpoints[t]||null}getAllCheckpoints(){return Object.values(this.store.checkpoints)}removeCheckpoint(t){return this.store.checkpoints[t]?(delete this.store.checkpoints[t],this._save(),!0):!1}saveToken(t,r){this.store.tokens[t]={tokenId:t,...r,createdAt:Date.now()},this._save()}getToken(t){return this.store.tokens[t]||null}getAllTokens(){return Object.values(this.store.tokens)}removeToken(t){return this.store.tokens[t]?(delete this.store.tokens[t],this._save(),!0):!1}},Ke=null;function Dt(e){return Ke||(Ke=new qe(e)),Ke}var Ve=class{constructor(t){this.store=Dt(t),this._pendingResolvers=new Map}createToken(t,r={}){let s=ls.randomBytes(16).toString("hex"),o={jobId:t,context:r,status:"pending",expiresAt:Date.now()+1440*60*1e3};return this.store.saveToken(s,o),s}awaitApproval(t){let r=this.store.getToken(t);return r?r.status!=="pending"?Promise.reject(new Error(`Approval token ${t} is no longer pending (status: ${r.status})`)):Date.now()>r.expiresAt?(this.store.removeToken(t),Promise.reject(new Error(`Approval token ${t} expired`))):new Promise((s,o)=>{this._pendingResolvers.set(t,{resolve:s,reject:o})}):Promise.reject(new Error(`Approval token ${t} not found`))}approve(t,r={}){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"approved",approverData:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.resolve({approved:!0,approverData:r}),this._pendingResolvers.delete(t)),!0}deny(t,r="Manually denied"){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"denied",reason:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.reject(new Error(`Approval denied: ${r}`)),this._pendingResolvers.delete(t)),!0}},Me=null;function Tt(e){return Me||(Me=new Ve(e)),Me}function Ye(e){return ds.createHash("sha256").update(JSON.stringify(e)).digest("hex")}async function $t(e){let{in:t}=e,r=e.config||e.policy,s=e["pub-key"],o=e["keys-store"]||R.resolve("config/keys.json"),n=e["policy-sig"]||R.resolve("config/policy.sig.json"),i=e["policy-state"]||R.resolve("data/policy.state.json"),a=e["policy-unsigned-ok"]===!0||String(e["policy-unsigned-ok"]).toLowerCase()==="true";t||(console.error("Error: --in <file> is required"),process.exit(1));let c;try{let E=R.resolve(t),C=Ee.readFileSync(E,"utf-8");c=JSON.parse(C)}catch(E){console.error(JSON.stringify({status:"error",error:"INVALID_PROPOSAL_FILE",message:E.message})),process.exit(5)}let l;try{let E=r||R.resolve("config/policy.default.json");Ee.existsSync(E)||(console.error(JSON.stringify({status:"error",error:"MISSING_POLICY",message:`Policy file not found: ${E}`})),process.exit(1));let C=Ee.readFileSync(E,"utf-8");l=JSON.parse(C)}catch(E){console.error(JSON.stringify({status:"error",error:"INVALID_POLICY",message:E.message})),process.exit(1)}let u=Q(o),f=u.ok?u.store:null,d=Z({policyObj:l,keyStore:f,policySigPath:n,allowUnsigned:a});d.ok||(console.error(JSON.stringify({status:"error",error:d.reason,message:d.message},null,2)),process.exit(8));let p=q({policyObj:l,statePath:i,maxCreatedAtSkewSec:l?.security?.maxPolicyCreatedAtSkewSec});p.ok||(console.error(JSON.stringify({status:"error",error:p.reason,message:p.message},null,2)),process.exit(8));let g=new V(R.resolve("data/nonce.db.json"));await g.load(),!f&&!s&&(console.error(JSON.stringify({status:"error",error:"MISSING_KEY_MATERIAL",message:`${u.message}. Provide --pub-key/--pub-key-file or create config/keys.json`})),process.exit(1));let m=new Ie(R.resolve("data/rate-limit.db.json"));await m.load();let y=ee({commandObj:c,pubKeyB64:s,keyStore:f,nonceDb:g,policy:l,rateLimiter:m});if(!y.valid){try{await g.save(),await m.save()}catch{}let E={status:"invalid",commandId:c.commandId||"N/A",checks:y.checks,errors:y.errors||[],executionResult:null};console.error(JSON.stringify(E,null,2));let C=R.resolve("data/audit.log.jsonl");try{je(C,{commandId:c.commandId||"N/A",status:"rejected",requesterId:c.requesterId||"unknown",payloadHash:Ye(c),reason:y.checks,timestamp:new Date().toISOString()})}catch(Ht){console.error(JSON.stringify({status:"error",error:"AUDIT_WRITE_FAILED",message:Ht.message})),process.exit(10)}y.checks.schema===!1&&process.exit(5),y.checks.signature===!1&&process.exit(3),y.checks.nonce===!1&&process.exit(4),y.checks.timestamp===!1&&process.exit(6),y.checks.rateLimit===!1&&process.exit(7),y.checks.policy===!1&&process.exit(2),process.exit(9)}let S=y.risk||"LOW",k=c.payload.adapter||"shell",D=l.requesters?.[c.requesterId],K=D?.requireApproval;if(K===!0||Array.isArray(K)&&(K.includes(S)||K.includes("*")||["HIGH","CRITICAL"].includes(S)&&K.includes("HIGH+"))){let C=Tt().createToken(c.commandId,{requesterId:c.requesterId,adapter:k,risk:S});await g.save().catch(()=>{}),await m.save().catch(()=>{}),console.log(JSON.stringify({status:"approval_required",commandId:c.commandId||"N/A",risk:S,approvalToken:C,message:`${S} risk operation requires operator approval. Approve with: lbe approve --token ${C}`},null,2)),process.exit(11)}let I=null;if((e.backup===!0||k==="file")&&c.payload.target)try{I=ge(R.resolve(c.payload.target))}catch{}let h;try{h=await ke(k,c,l,D)}catch(E){h={adapter:k,status:"error",error:E.message,exitCode:1}}let _=h.status==="error"||h.exitCode!==0,O=null;if(_&&I&&e["rollback-on-failure"]!==!1)try{O=U(I)}catch(E){O={restored:!1,error:E.message}}let z=null;if(!_&&c.payload.target&&["write","patch"].includes(c.payload.action)){let C=Ee.existsSync(R.resolve(c.payload.target));z={ok:C,check:"target_exists",target:c.payload.target},!C&&I&&(O=U(I),h.status="error")}let X=R.resolve("data/audit.log.jsonl");try{je(X,{commandId:c.commandId||"N/A",status:O?.restored?"rolled_back":h.status||"completed",requesterId:c.requesterId||"unknown",payloadHash:Ye(c),executionHash:Ye(h),adapter:h.adapter,riskLevel:S,exitCode:h.exitCode||0,rolledBack:O?.restored||!1,timestamp:new Date().toISOString()})}catch(E){console.error(JSON.stringify({status:"error",error:"AUDIT_WRITE_FAILED",message:E.message})),process.exit(10)}await g.save(),await m.save();let Wt={status:_||z&&!z.ok?"failed":"executed",commandId:c.commandId||"N/A",risk:S,checks:y.checks,executionResult:{adapter:h.adapter,status:h.status||"completed",output:h.output||h.error||"",exitCode:h.exitCode||0},backup:I?{path:I.backupPath,existed:I.existed,hash:I.hash}:null,rollback:O,postValidation:z};console.log(JSON.stringify(Wt,null,2)),process.exit(h.exitCode||0)}import Ft from"path";function jt(e,t){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}async function Kt(e){let t=e.audit?Ft.resolve(e.audit):Ft.resolve("data/audit.log.jsonl"),r=jt(e["fail-fast"],!0),s=jt(e.json,!0),o=Number.isFinite(Number(e.max))?Number(e.max):void 0,n=Pt(t,{failFast:r,maxEntries:o});s?console.log(JSON.stringify(n,null,2)):n.valid?(console.log(`OK: ${n.file}`),console.log(`Entries: ${n.entries}`)):(console.log(`FAIL: ${n.file}`),console.log(`First invalid index: ${n.firstInvalidIndex}`),console.log(`Reason: ${n.reason}`)),process.exit(n.valid?0:8)}import Be from"path";import G from"fs";import P from"path";import us from"crypto";import{fileURLToPath as fs}from"url";var ae=P.dirname(fs(import.meta.url));function qt(e){try{let t=G.readFileSync(e);return us.createHash("sha256").update(t).digest("hex")}catch{return null}}function ps(e=P.join(ae,"../..")){let t={},r=["src/core/signature.js","src/core/validator.js","src/core/policyEngine.js","src/core/nonceStore.js","src/core/auditLog.js","src/core/schema.js","bin/lbe.js"];for(let s of r){let o=P.join(e,s),n=qt(o);n&&(t[s]=n)}return t}function ms(e,t=P.join(ae,"../..")){let r={valid:!0,mismatches:[],missing:[],checkedFiles:0};for(let[s,o]of Object.entries(e)){let n=P.join(t,s);if(!G.existsSync(n)){r.valid=!1,r.missing.push(s);continue}let i=qt(n);r.checkedFiles++,i!==o&&(r.valid=!1,r.mismatches.push({file:s,expected:o,actual:i}))}return r}async function ne(e={}){let t=typeof e=="string"||e===null?{manifestPath:e}:e,r=t.rootDir||P.join(ae,"../.."),s=t.strict===!0,o=t.manifestPath||P.join(r,"config/integrity.manifest.json");if(!G.existsSync(o))return s?{valid:!1,skipped:!1,reason:"INTEGRITY_MANIFEST_MISSING",message:`Integrity manifest not found: ${o}`,checkedFiles:0,mismatches:[],missing:[]}:{valid:!0,skipped:!0,reason:null,message:"Integrity manifest not found - check skipped",checkedFiles:0,mismatches:[],missing:[]};try{let n=G.readFileSync(o,"utf8"),i=JSON.parse(n),a=ms(i,r);return{...a,skipped:!1,reason:a.valid?null:"INTEGRITY_CHECK_FAILED",message:a.valid?`Integrity check passed (${a.checkedFiles} files verified)`:"Runtime integrity check failed - system may be tampered"}}catch(n){return{valid:!1,skipped:!1,reason:"INTEGRITY_CHECK_ERROR",message:`Integrity check error: ${n.message}`,checkedFiles:0,mismatches:[],missing:[]}}}function Mt({outputPath:e=P.join(ae,"../../config/integrity.manifest.json"),rootDir:t=P.join(ae,"../..")}={}){let r=ps(t),s=JSON.stringify(r,null,2),o=P.dirname(e);return G.existsSync(o)||G.mkdirSync(o,{recursive:!0}),G.writeFileSync(e,s),{outputPath:e,fileCount:Object.keys(r).length,manifest:r}}function Je(e,t=!1){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}async function Vt(e){let t=Je(e.strict,!1)||Je(e["integrity-strict"],!1),r=e.manifest?Be.resolve(e.manifest):Be.resolve(e["integrity-manifest"]||"config/integrity.manifest.json"),s=Je(e.json,!0),o=await ne({manifestPath:r,strict:t});console.log(s?JSON.stringify({ok:o.valid,valid:o.valid,skipped:o.skipped===!0,strict:t,manifestPath:r,checkedFiles:o.checkedFiles,mismatches:o.mismatches||[],missing:o.missing||[],reason:o.reason||null,message:o.message},null,2):o.message),process.exit(o.valid?0:8)}async function Yt(e){let t=Be.resolve(e.out||e.output||e.manifest||"config/integrity.manifest.json"),r=Mt({outputPath:t});console.log(JSON.stringify({ok:!0,outputPath:r.outputPath,fileCount:r.fileCount},null,2)),process.exit(0)}import W from"fs";import ve from"path";async function Jt(e){let t=ve.resolve(e.config||e.policy||"config/policy.default.json"),r=ve.resolve(e["policy-sig"]||"config/policy.sig.json"),s=ve.resolve(e["secret-key-file"]||"keys/secret.key"),o=String(e["policy-key-id"]||"policy-signer-v1-2026Q1");W.existsSync(t)||(console.error(JSON.stringify({status:"error",error:"POLICY_FILE_MISSING",message:`Policy file not found: ${t}`},null,2)),process.exit(1)),W.existsSync(s)||(console.error(JSON.stringify({status:"error",error:"SECRET_KEY_MISSING",message:`Secret key file not found: ${s}`},null,2)),process.exit(1));let n=JSON.parse(W.readFileSync(t,"utf8"));(typeof n.version>"u"||typeof n.createdAt>"u")&&(console.error(JSON.stringify({status:"error",error:"POLICY_VERSION_METADATA_MISSING",message:"Policy must include version and createdAt before signing"},null,2)),process.exit(8));let i=W.readFileSync(s,"utf8").trim(),a=ue({policyObj:n,secretKeyB64:i,keyId:o});a.ok||(console.error(JSON.stringify({status:"error",error:a.reason||"POLICY_SIGN_FAILED",message:a.message},null,2)),process.exit(8));let c=ve.dirname(r);W.existsSync(c)||W.mkdirSync(c,{recursive:!0}),W.writeFileSync(r,JSON.stringify(a.envelope,null,2)),console.log(JSON.stringify({status:"ok",message:"Policy signature written",policy:t,policySig:r,keyId:o},null,2)),process.exit(0)}import v from"fs";import N from"path";function Bt(e,t){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}function j(e,t,r,s){e[t]={ok:r,message:s}}function H(e){try{return v.accessSync(e,v.constants.R_OK),!0}catch{return!1}}function ys(e){let t=N.join(e,`.healthcheck-${Date.now()}`);try{return v.mkdirSync(e,{recursive:!0}),v.writeFileSync(t,"ok","utf8"),v.unlinkSync(t),{ok:!0,message:"Data directory writable"}}catch(r){return{ok:!1,message:`Data directory not writable: ${r.message}`}}}async function Ut(e){let t=Bt(e.json,!0),r=N.resolve(e.config||e.policy||"config/policy.default.json"),s=N.resolve(e["policy-sig"]||"config/policy.sig.json"),o=N.resolve(e["keys-store"]||"config/keys.json"),n=N.resolve(e["data-dir"]||"data"),i=N.resolve(e.audit||N.join(n,"audit.log.jsonl")),a=N.resolve(e["nonce-db"]||N.join(n,"nonce.db.json")),c=N.resolve(e["rate-db"]||N.join(n,"rate-limit.db.json")),l=N.resolve(e["policy-state"]||N.join(n,"policy.state.json")),u=Bt(e["integrity-strict"],!1),f=N.resolve(e["integrity-manifest"]||"config/integrity.manifest.json"),d={};j(d,"policy",v.existsSync(r)&&H(r),v.existsSync(r)?`Policy file readable: ${r}`:`Policy file missing: ${r}`),j(d,"policySignature",v.existsSync(s)&&H(s),v.existsSync(s)?`Policy signature readable: ${s}`:`Policy signature missing: ${s}`),j(d,"trustedKeys",v.existsSync(o)&&H(o),v.existsSync(o)?`Trusted keys readable: ${o}`:`Trusted keys missing: ${o}`),j(d,"auditLog",v.existsSync(i)&&H(i),v.existsSync(i)?`Audit log readable: ${i}`:`Audit log missing: ${i}`),j(d,"nonceDb",v.existsSync(a)&&H(a),v.existsSync(a)?`Nonce DB readable: ${a}`:`Nonce DB missing: ${a}`),j(d,"rateLimitDb",v.existsSync(c)&&H(c),v.existsSync(c)?`Rate-limit DB readable: ${c}`:`Rate-limit DB missing: ${c}`),j(d,"policyState",v.existsSync(l)&&H(l),v.existsSync(l)?`Policy state readable: ${l}`:`Policy state missing: ${l}`);let p=ys(n);if(j(d,"dataWritable",p.ok,p.message),u){let y=await ne({strict:!0,manifestPath:f});j(d,"integrity",y.valid,y.valid?y.message:`${y.reason}: ${y.message}`)}let g=Object.values(d).every(y=>y.ok===!0),m={ok:g,status:g?"healthy":"unhealthy",timestamp:new Date().toISOString(),checks:d};console.log(t?JSON.stringify(m,null,2):`${m.status.toUpperCase()}: ${Object.keys(d).length} checks`),process.exit(g?0:8)}function hs(e,t=!1){if(e===void 0)return t;if(e===!0||e===!1)return e;let r=String(e).trim().toLowerCase();return r==="true"||r==="1"||r==="yes"?!0:r==="false"||r==="0"||r==="no"?!1:t}var ks=xe.dirname(gs(import.meta.url)),Ss=xe.join(ks,"../package.json"),ce=JSON.parse(Gt.readFileSync(Ss,"utf-8"));async function Is(){let e=process.argv.slice(2);e.includes("--version")&&(console.log(`LetterBlack Sentinel v${ce.version}`),process.exit(0)),(e.length===0||e.includes("--help")||e.includes("-h"))&&(le(ce.version),process.exit(0));let{command:t,opts:r}=Ge(e);r.version&&(console.log(`LetterBlack Sentinel v${ce.version}`),process.exit(0)),(r.help||!t||t==="help")&&(le(ce.version),process.exit(0));try{if(r["pub-key-file"])try{r["pub-key"]=Gt.readFileSync(xe.resolve(r["pub-key-file"]),"utf-8").trim()}catch(s){console.error(`Error reading public key file: ${s.message}`),process.exit(1)}if(["verify","dryrun","run"].includes(t)){let s=hs(r["integrity-strict"],!1),o=xe.resolve(r["integrity-manifest"]||"config/integrity.manifest.json"),n=await ne({strict:s,manifestPath:o});n.valid||(console.error(JSON.stringify({status:"error",error:n.reason||"INTEGRITY_CHECK_FAILED",message:n.message},null,2)),process.exit(8))}switch(t){case"init":await nt(r);break;case"verify":await At(r);break;case"dryrun":await Rt(r);break;case"run":await $t(r);break;case"audit-verify":await Kt(r);break;case"integrity-check":await Vt(r);break;case"integrity-generate":await Yt(r);break;case"policy-sign":await Jt(r);break;case"health":await Ut(r);break;default:console.error(`Unknown command: ${t}`),le(ce.version),process.exit(1)}}catch(s){console.error(JSON.stringify({status:"error",error:"INTERNAL_ERROR",message:s.message,stack:process.env.DEBUG?s.stack:void 0})),process.exit(9)}}Is().catch(e=>{console.error(JSON.stringify({status:"error",error:"FATAL_ERROR",message:e.message})),process.exit(9)});
|
package/dist/mcp-server.js
CHANGED
|
@@ -11,7 +11,7 @@ import Ae from"fs";import jt from"path";import xe from"crypto";import Vt from"fs
|
|
|
11
11
|
`),s=r[r.length-1];try{return JSON.parse(s).hash||"GENESIS"}catch{return"GENESIS"}}catch{return"GENESIS"}}function Se(e,t){let r=Ar.dirname(e);J.existsSync(r)||J.mkdirSync(r,{recursive:!0});let s;return ct(e,()=>{let o=Nr(e),n={...t,prevHash:o,timestamp:new Date().toISOString()};delete n.hash;let a=JSON.stringify(n),i=Lr(a),c=JSON.stringify({...n,hash:i}),l="";J.existsSync(e)&&(l=J.readFileSync(e,"utf8"));try{v(e,l+c+`
|
|
12
12
|
`,{encoding:"utf8"})}catch(d){throw new Error(`Audit log write failed: ${d.message}`)}s={success:!0,hash:i,prevHash:o,message:"Audit entry appended"}}),s}async function xt(e){return{adapter:"noop",commandId:e.commandId||"unknown",command:e.id||"unknown",status:"completed",output:`[NOOP] Would execute: ${e.id||"unknown"} on adapter: ${e.payload?.adapter||"unknown"}`,exitCode:0,timestamp:new Date().toISOString()}}import{spawnSync as Or}from"child_process";import Be from"path";function Cr(e){if(e===void 0)return{ok:!0,args:[]};if(!Array.isArray(e))return{ok:!1,error:"payload.args must be an array"};let t=[];for(let r of e){if(typeof r!="string"&&typeof r!="number"&&typeof r!="boolean")return{ok:!1,error:"payload.args may only contain string, number, or boolean values"};t.push(String(r))}return{ok:!0,args:t}}async function bt(e,t,r){let s=e.payload,o=3e4,n=1024*1024;if(s.adapter!=="shell")return{adapter:"shell",commandId:e.commandId,status:"error",error:"Adapter mismatch",exitCode:1};let a=r?.exec?.allowCmds||[];if((r?.exec?.denyCmds||[]).includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' is denied`,exitCode:2};if(a.length>0&&!a.includes(s.cmd))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`Command '${s.cmd}' not in allowlist`,exitCode:2};if(!(r?.filesystem?.roots||[]).some(u=>{let p=Be.resolve(u),m=Be.resolve(s.cwd);return m===p||m.startsWith(p+Be.sep)}))return{adapter:"shell",commandId:e.commandId,status:"blocked",error:`CWD '${s.cwd}' not authorized`,exitCode:2};let d=Cr(s.args);if(!d.ok)return{adapter:"shell",commandId:e.commandId,status:"blocked",error:d.error,exitCode:2};try{let u=Or(s.cmd,d.args,{cwd:s.cwd,timeout:o,encoding:"utf8",maxBuffer:n,stdio:["pipe","pipe","pipe"],shell:!1});if(u.error)throw u.error;let p=`${u.stdout||""}${u.stderr||""}`,m=u.status??1;return m!==0?{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:p.substring(0,n)||`Command exited with code ${m}`,exitCode:m,timestamp:new Date().toISOString()}:{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"completed",output:p.substring(0,n),exitCode:0,timestamp:new Date().toISOString()}}catch(u){return{adapter:"shell",commandId:e.commandId,command:s.cmd,status:"error",error:u.message,exitCode:u.status||1,timestamp:new Date().toISOString()}}}import re from"fs";import X from"path";import B from"fs";import Ie from"path";import Tr from"crypto";function te(e,t){let r=t||Ie.resolve("data/backups");B.existsSync(r)||B.mkdirSync(r,{recursive:!0});let s=Ie.resolve(e),o=B.existsSync(s),n=null,a=null;o&&(n=B.readFileSync(s),a=Tr.createHash("sha256").update(n).digest("hex"));let i=Ie.basename(s).replace(/[^a-zA-Z0-9._-]/g,"_"),c=`${Date.now()}-${a?a.slice(0,8):"new"}-${i}`,l=o?Ie.join(r,c):null;return o&&n!==null&&v(l,n),{originalPath:s,backupPath:l,existed:o,hash:a,createdAt:new Date().toISOString()}}function j(e){if(!e)return{restored:!1,error:"No backup metadata"};let{originalPath:t,backupPath:r,existed:s}=e;if(!s)try{return B.existsSync(t)&&B.unlinkSync(t),{restored:!0,action:"deleted"}}catch(o){return{restored:!1,error:o.message}}if(!r||!B.existsSync(r))return{restored:!1,error:"Backup file not found at: "+r};try{let o=B.readFileSync(r);return v(t,o),{restored:!0,action:"restored"}}catch(o){return{restored:!1,error:o.message}}}var Dr=10*1024*1024;function Pr(e,t){return e?X.isAbsolute(e)?X.resolve(e):X.resolve(t||process.cwd(),e):null}function $r(e,t){let r=X.resolve(e);return t.some(s=>{let o=X.resolve(s);return r===o||r.startsWith(o+X.sep)})}function Fr(e,t){for(let r of t||[])if(new RegExp("^"+r.replace(/\./g,"\\.").replace(/\*\*/g,".*").replace(/\*/g,"[^/\\\\]*")+"$").test(e))return r;return null}function z(e,t,r,s=2){return{adapter:"file",commandId:e.commandId,status:"blocked",errorCode:t,error:r,exitCode:s}}function $(e,t,r,s=null,o=1){return{adapter:"file",commandId:e.commandId,status:"error",errorCode:t,error:r,backup:s?we(s):null,exitCode:o}}function we(e){return e?{path:e.backupPath,existed:e.existed,hash:e.hash,createdAt:e.createdAt}:null}async function At(e,t,r){let s=e.payload,o=s.action,n=s.cwd||process.cwd(),a=Pr(s.target,n);if(!o)return z(e,"FILE_NO_ACTION","payload.action is required");if(!a&&o!=="noop")return z(e,"FILE_NO_TARGET","payload.target is required");let i=r?.filesystem?.roots||[];if(i.length===0)return z(e,"FILE_NO_ROOTS","No filesystem roots defined for requester");if(!$r(a,i))return z(e,"FILE_OUTSIDE_ROOT",`'${a}' is outside allowed roots`);let c=Fr(a,r?.filesystem?.denyPatterns);if(c)return z(e,"FILE_PATH_DENIED",`'${a}' matches deny pattern: ${c}`);switch(o){case"read":return Kr(e,a);case"write":return qr(e,a,s);case"patch":return Vr(e,a,s);case"delete":return Br(e,a);default:return z(e,"FILE_UNKNOWN_ACTION",`Unknown action: '${o}'`)}}function Kr(e,t){if(!re.existsSync(t))return $(e,"FILE_NOT_FOUND",`Not found: ${t}`);try{let r=re.statSync(t);if(r.size>Dr)return $(e,"FILE_TOO_LARGE","File exceeds 10 MB read limit");let s=re.readFileSync(t,"utf8");return{adapter:"file",action:"read",commandId:e.commandId,status:"completed",target:t,output:s,bytesRead:r.size,exitCode:0}}catch(r){return $(e,"FILE_READ_ERROR",r.message)}}function qr(e,t,r){let s=r.content;if(s==null)return $(e,"FILE_MISSING_CONTENT","payload.content is required for write");let o=Me(t);try{return v(t,s,{encoding:"utf8"}),{adapter:"file",action:"write",commandId:e.commandId,status:"completed",target:t,backup:we(o),output:`Wrote ${Buffer.byteLength(s,"utf8")} bytes to ${t}`,exitCode:0}}catch(n){return j(o),$(e,"FILE_WRITE_ERROR",n.message,o)}}function Vr(e,t,r){let s=r.content;if(s==null)return $(e,"FILE_MISSING_CONTENT","payload.content is required for patch");let o=Me(t);try{return v(t,s,{encoding:"utf8"}),{adapter:"file",action:"patch",commandId:e.commandId,status:"completed",target:t,backup:we(o),output:`Patched ${t} (${Buffer.byteLength(s,"utf8")} bytes)`,exitCode:0}}catch(n){return j(o),$(e,"FILE_PATCH_ERROR",n.message,o)}}function Br(e,t){if(!re.existsSync(t))return $(e,"FILE_NOT_FOUND",`Not found: ${t}`);let r=Me(t);try{return re.unlinkSync(t),{adapter:"file",action:"delete",commandId:e.commandId,status:"completed",target:t,backup:we(r),output:`Deleted ${t}`,exitCode:0}}catch(s){return j(r),$(e,"FILE_DELETE_ERROR",s.message,r)}}function Me(e){try{return te(e)}catch{return null}}async function Rt(e,t,r){let s=Date.now();try{let o=e.id||"";if(!o.toUpperCase().startsWith("OBSERVE"))return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer adapter only handles OBSERVE_* commands, got '${o}'`,exitCode:1};let{source:n,context:a,issueType:i,description:c,severity:l,metadata:d}=e.payload||{};if(!i||!c)return{adapter:"observer",commandId:e.commandId,status:"error",error:"Observer payload must include issueType and description",exitCode:1};let u=["low","medium","high","critical"];return l&&!u.includes(l)?{adapter:"observer",commandId:e.commandId,status:"error",error:`Invalid severity '${l}'. Must be one of: ${u.join(", ")}`,exitCode:1}:{adapter:"observer",commandId:e.commandId,status:"recorded",timestamp:new Date().toISOString(),requesterId:e.requesterId,observation:{source:n||"unknown",context:a||"unknown",issueType:i,description:c,severity:l||"info",metadata:d||{}},duration_ms:Date.now()-s,exitCode:0}}catch(o){return{adapter:"observer",commandId:e.commandId,status:"error",error:`Observer execution failed: ${o.message}`,exitCode:9}}}var Lt={noop:xt,shell:bt,file:At,observer:Rt};function Mr(e){return Lt[e]}async function Nt(e,t,r,s){let o=Mr(e);if(!o)return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter '${e}' not found`,exitCode:1};try{return await o(t,r,s)}catch(n){return{adapter:e,commandId:t.commandId,status:"error",error:`Adapter execution failed: ${n.message}`,exitCode:9}}}var Ot=Object.keys(Lt);import Pt from"fs";import Wr from"path";import Ct from"fs";import Yr from"path";var Ur=/^[A-Za-z0-9:_-]{3,128}$/;function jr(e){return typeof e=="string"&&Ur.test(e)&&e!=="default"}function Tt(e){let t=Yr.resolve(e);if(!Ct.existsSync(t))return{ok:!1,reason:"KEY_STORE_MISSING",message:`Key store not found: ${t}`,store:null};try{let r=Ct.readFileSync(t,"utf-8"),s=JSON.parse(r);return!s||typeof s!="object"||typeof s.trustedKeys!="object"?{ok:!1,reason:"KEY_STORE_INVALID",message:`Invalid key store format: ${t}`,store:null}:{ok:!0,reason:null,message:"Key store loaded",store:s}}catch(r){return{ok:!1,reason:"KEY_STORE_INVALID_JSON",message:`Unable to parse key store: ${r.message}`,store:null}}}function Dt({keyStore:e,keyId:t,requesterId:r,now:s=new Date}){if(!e||typeof e!="object")return{ok:!1,reason:"KEY_STORE_UNAVAILABLE",message:"Trusted key store is not available",publicKey:null};if(!jr(t))return{ok:!1,reason:"KEY_ID_INVALID",message:`Invalid keyId '${t}'. Use versioned key IDs like 'agent:gpt-v1-2026Q1'`,publicKey:null};let o=e.trustedKeys?.[t];if(!o)return{ok:!1,reason:"KEY_NOT_TRUSTED",message:`Key '${t}' is not in trusted key store`,publicKey:null};if(o.deprecated)return{ok:!1,reason:"KEY_DEPRECATED",message:`Key '${t}' is deprecated`,publicKey:null};if(o.requesterId&&o.requesterId!==r)return{ok:!1,reason:"KEY_REQUESTER_MISMATCH",message:`Key '${t}' is not authorized for requester '${r}'`,publicKey:null};let n=o.notBefore||o.validFrom,a=o.expiresAt||o.validUntil;if(typeof n!="string"||typeof a!="string")return{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' must define lifecycle fields 'notBefore' and 'expiresAt'`,publicKey:null};let i=new Date(n),c=new Date(a);return Number.isNaN(i.getTime())||Number.isNaN(c.getTime())?{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' has invalid lifecycle timestamp(s)`,publicKey:null}:i>=c?{ok:!1,reason:"KEY_LIFECYCLE_INVALID",message:`Key '${t}' has notBefore >= expiresAt`,publicKey:null}:s<i?{ok:!1,reason:"KEY_NOT_YET_VALID",message:`Key '${t}' not valid until ${n}`,publicKey:null}:s>c?{ok:!1,reason:"KEY_EXPIRED",message:`Key '${t}' expired on ${a}`,publicKey:null}:!o.publicKey||typeof o.publicKey!="string"?{ok:!1,reason:"KEY_CONFIG_INVALID",message:`Trusted key '${t}' is missing publicKey`,publicKey:null}:{ok:!0,reason:null,message:"Trusted key resolved",publicKey:o.publicKey}}function $t({policyObj:e,keyStore:t,policySigPath:r="./config/policy.sig.json",allowUnsigned:s=!1}){let o=Wr.resolve(r);if(!Pt.existsSync(o))return s?{ok:!0,skipped:!0,reason:"POLICY_SIGNATURE_SKIPPED",message:`Policy signature not found: ${o} (allowed by flag)`}:{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_MISSING",message:`Policy signature file not found: ${o}`};let n;try{n=JSON.parse(Pt.readFileSync(o,"utf-8"))}catch(c){return{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:`Unable to parse policy signature file: ${c.message}`}}if(!n||n.alg!=="ed25519"||typeof n.keyId!="string"||typeof n.sig!="string")return{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:"Policy signature envelope must include {alg, keyId, sig}"};if(!t)return{ok:!1,skipped:!1,reason:"POLICY_SIGNER_KEY_STORE_UNAVAILABLE",message:"Trusted key store is required for policy signature verification"};let a=Dt({keyStore:t,keyId:n.keyId,requesterId:void 0});if(!a.ok)return{ok:!1,skipped:!1,reason:"POLICY_SIGNER_NOT_TRUSTED",message:a.message};let i=ee({payloadObj:e,sigB64:n.sig,pubKeyB64:a.publicKey});return i.valid?{ok:!0,skipped:!1,reason:null,message:"Policy signature verified",keyId:n.keyId}:{ok:!1,skipped:!1,reason:"POLICY_SIGNATURE_INVALID",message:i.message}}import Gr from"crypto";import Hr from"path";var Ue=class{constructor(t){this.dbPath=t||Hr.resolve("data/checkpoints.db.json"),this.store={checkpoints:{},tokens:{}},this._load()}_load(){let t=lt(this.dbPath);t&&(this.store=t,this.store.checkpoints=this.store.checkpoints||{},this.store.tokens=this.store.tokens||{})}_save(){let t=JSON.stringify(this.store,null,2);v(this.dbPath,t,{encoding:"utf8"})}saveCheckpoint(t,r){this.store.checkpoints[t]={jobId:t,...r,updatedAt:Date.now()},this._save()}getCheckpoint(t){return this.store.checkpoints[t]||null}getAllCheckpoints(){return Object.values(this.store.checkpoints)}removeCheckpoint(t){return this.store.checkpoints[t]?(delete this.store.checkpoints[t],this._save(),!0):!1}saveToken(t,r){this.store.tokens[t]={tokenId:t,...r,createdAt:Date.now()},this._save()}getToken(t){return this.store.tokens[t]||null}getAllTokens(){return Object.values(this.store.tokens)}removeToken(t){return this.store.tokens[t]?(delete this.store.tokens[t],this._save(),!0):!1}},Ye=null;function Ft(e){return Ye||(Ye=new Ue(e)),Ye}var We=class{constructor(t){this.store=Ft(t),this._pendingResolvers=new Map}createToken(t,r={}){let s=Gr.randomBytes(16).toString("hex"),o={jobId:t,context:r,status:"pending",expiresAt:Date.now()+1440*60*1e3};return this.store.saveToken(s,o),s}awaitApproval(t){let r=this.store.getToken(t);return r?r.status!=="pending"?Promise.reject(new Error(`Approval token ${t} is no longer pending (status: ${r.status})`)):Date.now()>r.expiresAt?(this.store.removeToken(t),Promise.reject(new Error(`Approval token ${t} expired`))):new Promise((s,o)=>{this._pendingResolvers.set(t,{resolve:s,reject:o})}):Promise.reject(new Error(`Approval token ${t} not found`))}approve(t,r={}){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"approved",approverData:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.resolve({approved:!0,approverData:r}),this._pendingResolvers.delete(t)),!0}deny(t,r="Manually denied"){let s=this.store.getToken(t);if(!s)throw new Error("Token not found");if(s.status!=="pending")throw new Error("Token not pending");this.store.saveToken(t,{...s,status:"denied",reason:r,resolvedAt:Date.now()});let o=this._pendingResolvers.get(t);return o&&(o.reject(new Error(`Approval denied: ${r}`)),this._pendingResolvers.delete(t)),!0}},je=null;function Kt(e){return je||(je=new We(e)),je}var He={DEBUG:0,INFO:1,WARN:2,ERROR:3};function ve({level:e="INFO",maxHistory:t=500,silent:r=!1}={}){let s=He[e]??He.INFO,o=[];function n(i,c,l,d){let u={ts:new Date().toISOString(),level:i,scope:c,message:l,...d!==void 0?{meta:d}:{}};if(o.length>=t&&o.shift(),o.push(u),!r&&He[i]>=s){let p=d!==void 0?`[${i}] [${c}] ${l} ${JSON.stringify(d)}`:`[${i}] [${c}] ${l}`;process.stderr.write(p+`
|
|
13
13
|
`)}}function a(i){return{debug:(c,l)=>n("DEBUG",i,c,l),info:(c,l)=>n("INFO",i,c,l),warn:(c,l)=>n("WARN",i,c,l),error:(c,l)=>n("ERROR",i,c,l)}}return{scope:a,debug:(i,c)=>n("DEBUG","lbe",i,c),info:(i,c)=>n("INFO","lbe",i,c),warn:(i,c)=>n("WARN","lbe",i,c),error:(i,c)=>n("ERROR","lbe",i,c),exportLogs:()=>[...o],clearHistory:()=>{o.length=0},get historyLength(){return o.length}}}var Jr=process.env.LBE_LOG_LEVEL||"INFO",zr=process.env.LBE_LOG_SILENT==="1",Io=ve({level:Jr,silent:zr});function se(e){if(e===null||typeof e!="object"||Object.isFrozen(e))return e;Object.freeze(e);for(let t of Object.getOwnPropertyNames(e)){let r=e[t];typeof r=="object"&&r!==null&&!Object.isFrozen(r)&&se(r)}return e}import ze from"fs";import Ge from"path";var Q=class extends Error{constructor(t,r,s){super(t),this.name="InvariantGateError",this.checks=r,this.failures=s}};function qt(e,t,r){let s={},o=[],n=!!(t&&typeof t.version<"u"&&t.requesters&&typeof t.requesters=="object"&&t.default==="DENY");s.policy_structure=n,n||o.push("Policy missing required fields: version, requesters, default=DENY");let a=!!(r&&typeof r=="object"&&Object.keys(r).length>0);s.keys_available=a,a||o.push("No trusted keys loaded \u2014 provide config/keys.json");let i=Ge.dirname(e.auditLog);s.audit_log_writable=Je(i),s.audit_log_writable||o.push(`Audit log directory not writable: ${i}`);let c=Ge.dirname(e.nonceDb);s.nonce_db_writable=Je(c),s.nonce_db_writable||o.push(`Nonce DB directory not writable: ${c}`);let l=Ge.dirname(e.rateLimit);if(s.rate_limit_writable=Je(l),s.rate_limit_writable||o.push(`Rate-limit DB directory not writable: ${l}`),t&&t.requesters){let d=[];for(let[u,p]of Object.entries(t.requesters))for(let m of p.allowAdapters||[])Ot.includes(m)||d.push(`${u}\u2192${m}`);s.adapter_chain_valid=d.length===0,s.adapter_chain_warnings=d.length>0?d:[]}else s.adapter_chain_valid=!0,s.adapter_chain_warnings=[];return s.secret_key_present=!!e.secretKey,s.secret_key_present||o.push("secretKey not provided to createLBE()"),{ok:o.length===0,checks:s,failures:o}}function Xe(e,t,r){let s=qt(e,t,r);if(!s.ok){let o=s.failures.length;throw new Q(`Invariant gate: ${o} violation${o===1?"":"s"} \u2014 ${s.failures.join(" | ")}`,s.checks,s.failures)}return s}function Xr(e){try{return ze.accessSync(e,ze.constants.W_OK),!0}catch{return!1}}function Je(e){if(Xr(e))return!0;try{return ze.mkdirSync(e,{recursive:!0}),!0}catch{return!1}}function Zr(e,t){let r=x.resolve(e||process.cwd());if(!t||t==="local"){let s=xe.createHash("sha256").update(r).digest("hex").slice(0,16);return x.join(Qr.homedir(),".lbe","workspaces",s)}if(t==="workspace")return x.join(r,".lbe");if(t&&typeof t=="object"&&t.adapter)return null;throw new Error(`createLBE: unknown state option: ${JSON.stringify(t)}`)}var es={patch_file:"PATCH_FILE",write_file:"WRITE_FILE",read_file:"READ_FILE",delete_file:"DELETE_FILE",run_shell:"RUN_SHELL",echo:"ECHO"},ts={PATCH_FILE:"file",WRITE_FILE:"file",READ_FILE:"file",DELETE_FILE:"file",RUN_SHELL:"shell",ECHO:"noop"},rs=new Set(["HIGH","CRITICAL"]);function Qe(e){return xe.createHash("sha256").update(JSON.stringify(e)).digest("hex")}function ss(e,t){if(!t?.requireApproval)return!1;let r=t.requireApproval;return r===!0?!0:Array.isArray(r)?r.includes(e)||r.includes("*")||rs.has(e)&&r.includes("HIGH+"):!1}function Bt(e={}){if(e.rootDir&&!e.secretKey){let A=Pe(),E=e.keyId||"sdk-auto-key";e={defaultActor:"agent:sdk",logLevel:"WARN",...e,secretKey:A.secretKey,keyId:E,keyStore:e.keyStore||os({publicKey:A.publicKey,keyId:E}),policy:e.policy||{version:1,default:"DENY",requesters:{"agent:sdk":{allowCommands:["write_file","read_file","patch_file","delete_file"],allowAdapters:["file"],filesystem:{roots:[e.rootDir],denyPatterns:["*.key","*.env","*.secret"]}}}}}}let{secretKey:t,keyId:r="sdk-key-v1",sessionId:s,defaultActor:o="agent:sdk",policy:n,keyStore:a,policyPath:i,keysStorePath:c,policySigPath:l,policyStatePath:d,nonceDbPath:u,rateLimitDbPath:p,auditLogPath:m,backupDir:_,allowUnsignedPolicy:S=!1,state:b="local",rootDir:D,logLevel:M=process.env.LBE_LOG_LEVEL||"INFO",logSilent:oe=process.env.LBE_LOG_SILENT==="1"}=e,Y=n&&typeof n=="object"?n:null,ne=a&&typeof a=="object"?a:null,I=Zr(D,b),h={secretKey:t,policy:i||x.resolve("config/policy.default.json"),keys:c||x.resolve("config/keys.json"),policySig:l||x.resolve("config/policy.sig.json"),policyState:d||x.join(I,"policy.state.json"),nonceDb:u||x.join(I,"nonce.db.json"),rateLimit:p||x.join(I,"rate-limit.db.json"),auditLog:m||x.join(I,"audit.log.jsonl"),backupDir:_||x.join(I,"backups")},f=ve({level:M,silent:oe}),g=f.scope("Executor"),L=f.scope("Validator"),F=f.scope("Policy");async function K({actor:A,intent:E,target:k,content:ie,args:Xt=[],transaction:Qt={}}){let Z={validate:!0,backup:!0,rollbackOnFailure:!0,audit:!0,...Qt};g.info("execute() called",{actor:A,intent:E,target:k});let ae=es[E]||E.toUpperCase().replace(/-/g,"_"),W=ts[ae]||"noop",O;if(Y)O=Y,F.debug("Using inline policy",{version:O.version});else try{O=JSON.parse(Vt.readFileSync(h.policy,"utf8")),F.debug("Policy loaded from file",{version:O.version})}catch(y){return F.error("Policy load failed",{error:y.message}),{ok:!1,stage:"policy_load",error:"POLICY_LOAD_FAILED",message:y.message}}let U;if(ne)U=ne,L.debug("Using inline keyStore");else{let y=Tt(h.keys);U=y.ok?y.store:null,L.debug("Keys loaded from file",{ok:y.ok})}se(O),U&&se(U);try{let y=Xe(h,O,U);L.debug("Invariant gate passed",y.checks)}catch(y){if(y instanceof Q)return L.error("Invariant gate failed",{failures:y.failures}),{ok:!1,stage:"invariant_gate",error:"INVARIANT_GATE_FAILED",message:y.message,checks:y.checks,failures:y.failures};throw y}if(!Y){let y=$t({policyObj:O,keyStore:U,policySigPath:h.policySig,allowUnsigned:S});if(!y.ok)return F.error("Policy signature invalid",{reason:y.reason}),{ok:!1,stage:"policy_sig",error:y.reason,message:y.message};let N=me({policyObj:O,statePath:h.policyState});if(!N.ok)return F.error("Policy version guard failed",{reason:N.reason}),{ok:!1,stage:"policy_version",error:N.reason,message:N.message};F.debug("Policy signature and version valid")}if(!t)return{ok:!1,stage:"sign",error:"NO_SECRET_KEY",message:"createLBE requires secretKey"};let Zt=Math.floor(Date.now()/1e3),er=xe.randomBytes(32).toString("hex"),tr=s||`sdk-${Date.now()}`,C=xe.randomUUID();g.debug("Proposal built",{commandId:C,commandId_str:ae,adapter:W});let ce={id:ae,commandId:C,requesterId:A,sessionId:tr,timestamp:Zt,nonce:er,requires:["policy","signature"],payload:{adapter:W,action:E.includes("_")?E.split("_")[0]:E,target:k?x.resolve(k):null,content:ie||null,args:Xt,cwd:k?x.dirname(x.resolve(k)):process.cwd()}},le=fe({payloadObj:ce,secretKeyB64:t});if(le.error)return g.error("Signing failed",{error:le.error}),{ok:!1,stage:"sign",commandId:C,error:"SIGN_FAILED",message:le.error};let de={...ce,signature:{alg:"ed25519",keyId:r,sig:le.signature}},Le=new ke(h.nonceDb);await Le.load();let Ne=new _e(h.rateLimit);await Ne.load();let T=Ve({commandObj:de,keyStore:U,nonceDb:Le,policy:O,rateLimiter:Ne,policyStatePath:Y?null:h.policyState}),ue=async()=>{await Le.save().catch(()=>{}),await Ne.save().catch(()=>{})};if(!T.valid)return L.warn("Validation failed",{error:T.errors[0]?.type,checks:T.checks}),await ue(),Z.audit&&Se(h.auditLog,{commandId:C,status:"rejected",requesterId:A,payloadHash:Qe(de),reason:T.errors[0]?.type,intent:E}),{ok:!1,stage:"validate",commandId:C,error:T.errors[0]?.type,message:T.errors[0]?.message,checks:T.checks,operationLog:f.exportLogs()};L.info("Validation passed",{risk:T.risk,checks:T.checks});let q=T.risk||"LOW",st=O.requesters?.[A];if(ss(q,st)){g.warn("Approval required",{risk:q,commandId:C}),await ue();let N=Kt(h.policyState).createToken(C,{actor:A,intent:E,target:k,risk:q,commandId:ae});return{ok:!1,stage:"approval_pending",commandId:C,approvalToken:N,risk:q,message:`${q} risk operation requires approval. Token: ${N}`,operationLog:f.exportLogs()}}let P=null;if(Z.backup&&k){let y=["write","patch","delete"].includes(ce?.payload?.action??E.split("_")[0]);try{P=te(x.resolve(k),h.backupDir),g.debug("Backup created",{existed:P.existed,path:P.backupPath})}catch(N){if(y)return g.error("Backup failed \u2014 aborting write transaction",{error:N.message}),await ue(),{ok:!1,stage:"backup",error:"BACKUP_FAILED",message:N.message};g.warn("Backup failed (non-fatal for read)",{error:N.message})}}g.info("Executing adapter",{adapter:W,target:k});let R;try{R=await Nt(W,de,O,st)}catch(y){R={adapter:W,commandId:C,status:"error",error:y.message,exitCode:1}}g.debug("Adapter returned",{status:R.status,exitCode:R.exitCode});let Oe=R.status==="error"||R.exitCode!==0&&R.exitCode!==void 0,H=null;if(Z.validate&&k&&!Oe){let y=["write","patch"],N=ce.payload.action;if(y.includes(N)){let ot=Vt.existsSync(x.resolve(k));H={ok:ot,check:"target_exists",target:k},ot?g.debug("Post-execution validation passed"):(g.error("Post-execution validation failed \u2014 target missing after write",{target:k}),R.status="error")}}let G=null;if((Oe||H&&!H.ok)&&Z.rollbackOnFailure&&P)try{G=j(P),g.warn("Rollback executed",G)}catch(y){G={restored:!1,error:y.message},g.error("Rollback failed",{error:y.message})}Z.audit&&Se(h.auditLog,{commandId:C,status:G?.restored?"rolled_back":R.status||"completed",requesterId:A,payloadHash:Qe(de),executionHash:Qe(R),adapter:W,intent:E,riskLevel:q,exitCode:R.exitCode||0,rolledBack:G?.restored||!1}),await ue();let pe=!Oe&&(!H||H.ok);return g.info("execute() complete",{ok:pe,stage:pe?"executed":"failed",risk:q}),{ok:pe,commandId:C,intent:E,actor:A,target:k,risk:q,stage:pe?"executed":"failed",status:R.status,output:R.output||null,exitCode:R.exitCode??0,checks:T.checks,backup:P?{path:P.backupPath,existed:P.existed,hash:P.hash}:null,rollback:G,postValidation:H,operationLog:M==="DEBUG"?f.exportLogs():void 0}}return{execute:K,exportLogs:()=>f.exportLogs(),async writeFile(A,E){let k=await K({actor:o,intent:"write_file",target:A,content:E,transaction:{backup:!0,rollbackOnFailure:!0,audit:!0}});if(!k.ok){let ie=new Error(`LBE write failed [${k.error||k.stage}]${k.message?": "+k.message:""}`);throw ie.lbeResult=k,ie}return k},async readFile(A){let E=await K({actor:o,intent:"read_file",target:A,transaction:{audit:!0}});if(!E.ok){let k=new Error(`LBE read failed [${E.error||E.stage}]${E.message?": "+E.message:""}`);throw k.lbeResult=E,k}return E.output}}}function os({publicKey:e,keyId:t,validDays:r=365}){let s=new Date,o=new Date(s.getTime()+r*24*3600*1e3);return{defaultKeyId:t,trustedKeys:{[t]:{publicKey:e,notBefore:s.toISOString(),expiresAt:o.toISOString()}}}}import Mt from"fs";import ns from"path";var Yt=[{name:"lbe_workspace_context",description:["Read the workspace contract for this project.","Call this FIRST \u2014 before writing, modifying, or planning any file changes.","Returns the semantics contract: what this project is, where things live,","what must never be touched, and how changes are expected to happen here.","Agents that read this contract before acting produce fewer mistakes and","require fewer corrections. If no contract exists, run: npx lbe init"].join(" "),inputSchema:{type:"object",properties:{include_enforcement:{type:"boolean",description:"Also return allow/approval/deny enforcement rules. Default: false."}},required:[]}},{name:"lbe_write_file",description:["Write content to a file under the governance controller.","The write is validated (schema \u2192 signature \u2192 nonce \u2192 policy), backed up,","and appended to the immutable audit log before any bytes are written.","Requires the actor to be in the policy allowlist."].join(" "),inputSchema:{type:"object",properties:{path:{type:"string",description:"File path to write (must be within policy filesystem.roots)"},content:{type:"string",description:"Content to write"},actor:{type:"string",description:'Actor identifier, e.g. "agent:gpt". Defaults to MCP_DEFAULT_ACTOR env.'}},required:["path","content"]}},{name:"lbe_read_file",description:"Read a file via the governance controller. Audited; policy-checked.",inputSchema:{type:"object",properties:{path:{type:"string",description:"File path to read"},actor:{type:"string",description:"Actor identifier"}},required:["path"]}},{name:"lbe_shell_command",description:["Run a shell command via the governance controller.","Command must be in the actor's policy allowCommands list.","Audited. Does not allow shell expansion beyond the policy."].join(" "),inputSchema:{type:"object",properties:{command:{type:"string",description:"Command name (must be in policy allowlist)"},args:{type:"array",items:{type:"string"},description:"Command arguments"},actor:{type:"string",description:"Actor identifier"}},required:["command"]}},{name:"lbe_patch_file",description:"Append or patch content in an existing file. Backed up before write.",inputSchema:{type:"object",properties:{path:{type:"string",description:"File path to patch"},content:{type:"string",description:"Content to append/patch"},actor:{type:"string",description:"Actor identifier"}},required:["path","content"]}},{name:"lbe_health",description:"Check LBE controller health. Returns ok status and SDK log entry count.",inputSchema:{type:"object",properties:{},required:[]}}];async function Ut(e,t,r,s="mcp:client"){let o=typeof t.actor=="string"&&t.actor?t.actor:s;switch(e){case"lbe_workspace_context":{let n=ns.resolve(process.cwd(),"lbe.workspace.json");if(!Mt.existsSync(n))return{content:[{type:"text",text:JSON.stringify({ok:!1,error:"NO_WORKSPACE_CONTRACT",message:"No lbe.workspace.json found. Run: npx lbe init"},null,2)}]};let a;try{a=JSON.parse(Mt.readFileSync(n,"utf8"))}catch{return{content:[{type:"text",text:JSON.stringify({ok:!1,error:"CONTRACT_PARSE_ERROR",message:"lbe.workspace.json is malformed. Run: npx lbe init to regenerate."},null,2)}]}}let i={ok:!0,projectTypes:a.projectTypes??null,primaryType:a.primaryType??null,semantics:a.semantics??{}};return t.include_enforcement&&(i.enforcement=a.enforcement??{}),{content:[{type:"text",text:JSON.stringify(i,null,2)}]}}case"lbe_write_file":{let n=await r.execute({actor:o,intent:"write_file",target:t.path,content:t.content,transaction:{backup:!0,rollbackOnFailure:!0,audit:!0}});return be(n)}case"lbe_read_file":{let n=await r.execute({actor:o,intent:"read_file",target:t.path,transaction:{backup:!1,audit:!0}});return be(n)}case"lbe_shell_command":{let n=await r.execute({actor:o,intent:"shell_command",target:t.command,content:JSON.stringify({args:Array.isArray(t.args)?t.args:[]}),transaction:{backup:!1,audit:!0}});return be(n)}case"lbe_patch_file":{let n=await r.execute({actor:o,intent:"patch_file",target:t.path,content:t.content,transaction:{backup:!0,rollbackOnFailure:!0,audit:!0}});return be(n)}case"lbe_health":{let n=r.exportLogs();return{content:[{type:"text",text:JSON.stringify({ok:!0,sdkLogEntries:n.length},null,2)}]}}default:return{content:[{type:"text",text:`Unknown tool: ${e}`}],isError:!0}}}function be(e){let t={ok:e.ok,commandId:e.commandId,stage:e.stage,risk:e.risk??void 0,output:e.output??void 0,error:e.error??void 0,message:e.message??void 0};return Object.keys(t).forEach(r=>t[r]===void 0&&delete t[r]),{content:[{type:"text",text:JSON.stringify(t,null,2)}],isError:!e.ok}}(process.argv.includes("--help")||process.argv.includes("-h"))&&(console.log(`
|
|
14
|
-
lbe-mcp \u2014 LBE-Core MCP Server v0.4.
|
|
14
|
+
lbe-mcp \u2014 LBE-Core MCP Server v0.4.4
|
|
15
15
|
|
|
16
16
|
Wraps LBE-Core as a Model Context Protocol (MCP) server. Every tool call
|
|
17
17
|
passes through the full 7-gate LBE governance pipeline before execution.
|
|
@@ -49,4 +49,4 @@ Claude Desktop config:
|
|
|
49
49
|
}
|
|
50
50
|
}
|
|
51
51
|
}
|
|
52
|
-
`),process.exit(0));var Wt,Ht,Gt,Jt;try{let{Server:e}=await import("@modelcontextprotocol/sdk/server/index.js"),{StdioServerTransport:t}=await import("@modelcontextprotocol/sdk/server/stdio.js"),{CallToolRequestSchema:r,ListToolsRequestSchema:s}=await import("@modelcontextprotocol/sdk/types.js");Wt=e,Ht=t,Gt=r,Jt=s}catch{console.error("[lbe-mcp] @modelcontextprotocol/sdk is not installed."),console.error("[lbe-mcp] Reinstall LBE dependencies: npm install"),process.exit(1)}var zt=process.env.LBE_MCP_DEFAULT_ACTOR||"mcp:client",Ze=jt.resolve(process.env.LBE_SECRET_KEY_PATH||"keys/secret.key"),et=jt.resolve(process.env.LBE_KEYS_STORE_PATH||"config/keys.json"),Re=null,tt=null;if(!Ae.existsSync(Ze)||!Ae.existsSync(et))tt={error:"LBE_WORKSPACE_NOT_INITIALIZED",message:"LBE workspace keys are missing. Run: npx lbe init",secretKeyPath:Ze,keysStorePath:et},console.error("[lbe-mcp] Workspace not initialized. Run: npx lbe init");else{let e=Ae.readFileSync(Ze,"utf8").trim(),t=JSON.parse(Ae.readFileSync(et,"utf8"));Re=Bt({secretKey:e,keyId:t.defaultKeyId,logLevel:process.env.LBE_LOG_LEVEL||"WARN",logSilent:!1})}var rt=new Wt({name:"lbe-core",version:"0.4.
|
|
52
|
+
`),process.exit(0));var Wt,Ht,Gt,Jt;try{let{Server:e}=await import("@modelcontextprotocol/sdk/server/index.js"),{StdioServerTransport:t}=await import("@modelcontextprotocol/sdk/server/stdio.js"),{CallToolRequestSchema:r,ListToolsRequestSchema:s}=await import("@modelcontextprotocol/sdk/types.js");Wt=e,Ht=t,Gt=r,Jt=s}catch{console.error("[lbe-mcp] @modelcontextprotocol/sdk is not installed."),console.error("[lbe-mcp] Reinstall LBE dependencies: npm install"),process.exit(1)}var zt=process.env.LBE_MCP_DEFAULT_ACTOR||"mcp:client",Ze=jt.resolve(process.env.LBE_SECRET_KEY_PATH||"keys/secret.key"),et=jt.resolve(process.env.LBE_KEYS_STORE_PATH||"config/keys.json"),Re=null,tt=null;if(!Ae.existsSync(Ze)||!Ae.existsSync(et))tt={error:"LBE_WORKSPACE_NOT_INITIALIZED",message:"LBE workspace keys are missing. Run: npx lbe init",secretKeyPath:Ze,keysStorePath:et},console.error("[lbe-mcp] Workspace not initialized. Run: npx lbe init");else{let e=Ae.readFileSync(Ze,"utf8").trim(),t=JSON.parse(Ae.readFileSync(et,"utf8"));Re=Bt({secretKey:e,keyId:t.defaultKeyId,logLevel:process.env.LBE_LOG_LEVEL||"WARN",logSilent:!1})}var rt=new Wt({name:"lbe-core",version:"0.4.4"},{capabilities:{tools:{}}});rt.setRequestHandler(Jt,async()=>({tools:Yt}));rt.setRequestHandler(Gt,async e=>{let{name:t,arguments:r}=e.params;return!Re&&t!=="lbe_workspace_context"&&t!=="lbe_health"?{content:[{type:"text",text:JSON.stringify(tt,null,2)}],isError:!0}:!Re&&t==="lbe_health"?{content:[{type:"text",text:JSON.stringify({ok:!1,...tt},null,2)}],isError:!0}:Ut(t,r||{},Re,zt)});var is=new Ht;await rt.connect(is);console.error("[lbe-mcp] LBE-Core MCP server ready \u2014 default actor:",zt);
|