@nexus-cortex/core 4.26.0

package/dist/middleware/permissions/PermissionAuditLogger.js

@@ -0,0 +1,267 @@
+/**
+ * Permission Audit Logger
+ *
+ * JSONL-based audit logging for all permission decisions.
+ * Each line is a JSON object representing a single audit entry.
+ *
+ * Features:
+ * - Append-only logging (tamper-evident)
+ * - JSONL format (one JSON object per line)
+ * - Query interface for audit entries
+ * - Session and tool filtering
+ *
+ * @module permissions/PermissionAuditLogger
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { createInterface } from 'node:readline';
+/**
+ * Permission audit logger with JSONL storage
+ *
+ * @example
+ * ```typescript
+ * const logger = new PermissionAuditLogger('/path/to/audit.log');
+ *
+ * await logger.log({
+ *   timestamp: new Date(),
+ *   sessionId: '123',
+ *   toolName: 'read_file',
+ *   toolInput: { file_path: '/workspace/file.txt' },
+ *   decision: { allowed: true },
+ *   approvalRequested: false
+ * });
+ *
+ * const entries = await logger.query({ sessionId: '123' });
+ * ```
+ */
+export class PermissionAuditLogger {
+    logPath;
+    options;
+    writeStream = null;
+    /**
+     * Create a new permission audit logger
+     *
+     * @param logPath Path to the audit log file
+     * @param options Logger options
+     */
+    constructor(logPath, options = {}) {
+        this.logPath = path.resolve(logPath);
+        this.options = {
+            maxFileSizeBytes: options.maxFileSizeBytes ?? 10 * 1024 * 1024, // 10MB
+            enableRotation: options.enableRotation ?? true,
+            maxRotatedFiles: options.maxRotatedFiles ?? 5,
+        };
+        // Ensure directory exists
+        this.ensureDirectoryExists();
+    }
+    /**
+     * Log a permission audit entry
+     */
+    async log(entry) {
+        // Check if rotation is needed
+        if (this.options.enableRotation) {
+            await this.rotateIfNeeded();
+        }
+        // Convert entry to JSON line
+        const jsonLine = JSON.stringify(entry) + '\n';
+        // Write to file
+        await this.writeToFile(jsonLine);
+    }
+    /**
+     * Query audit entries with filtering
+     */
+    async query(options = {}) {
+        if (!fs.existsSync(this.logPath)) {
+            return [];
+        }
+        const entries = [];
+        const stream = createReadStream(this.logPath, { encoding: 'utf-8' });
+        const rl = createInterface({ input: stream });
+        for await (const line of rl) {
+            if (!line.trim())
+                continue;
+            try {
+                const entry = JSON.parse(line);
+                // Convert timestamp string back to Date
+                entry.timestamp = new Date(entry.timestamp);
+                // Apply filters
+                if (options.sessionId && entry.sessionId !== options.sessionId) {
+                    continue;
+                }
+                if (options.toolName && entry.toolName !== options.toolName) {
+                    continue;
+                }
+                if (options.deniedOnly && entry.decision.allowed) {
+                    continue;
+                }
+                if (options.approvedOnly && !entry.decision.allowed) {
+                    continue;
+                }
+                if (options.startDate && entry.timestamp < options.startDate) {
+                    continue;
+                }
+                if (options.endDate && entry.timestamp > options.endDate) {
+                    continue;
+                }
+                entries.push(entry);
+                // Check limit
+                if (options.limit && entries.length >= options.limit) {
+                    break;
+                }
+            }
+            catch (error) {
+                console.error('[PermissionAuditLogger] Error parsing line:', error);
+                // Continue processing other lines
+            }
+        }
+        return entries;
+    }
+    /**
+     * Get entries for a specific session
+     */
+    async getEntriesBySession(sessionId) {
+        return this.query({ sessionId });
+    }
+    /**
+     * Get entries for a specific tool
+     */
+    async getEntriesByTool(toolName) {
+        return this.query({ toolName });
+    }
+    /**
+     * Get all denied operations
+     */
+    async getDeniedOperations() {
+        return this.query({ deniedOnly: true });
+    }
+    /**
+     * Get all operations that required approval
+     */
+    async getApprovalRequests() {
+        const entries = await this.query();
+        return entries.filter((e) => e.approvalRequested);
+    }
+    /**
+     * Get audit statistics
+     */
+    async getStatistics() {
+        const entries = await this.query();
+        const uniqueSessions = new Set(entries.map((e) => e.sessionId));
+        const uniqueTools = new Set(entries.map((e) => e.toolName));
+        return {
+            totalEntries: entries.length,
+            allowedCount: entries.filter((e) => e.decision.allowed).length,
+            deniedCount: entries.filter((e) => !e.decision.allowed).length,
+            approvalRequestCount: entries.filter((e) => e.approvalRequested).length,
+            approvalGrantedCount: entries.filter((e) => e.approvalGranted === true)
+                .length,
+            uniqueSessions: uniqueSessions.size,
+            uniqueTools,
+        };
+    }
+    /**
+     * Clear the audit log
+     * WARNING: This is a destructive operation
+     */
+    async clear() {
+        if (this.writeStream) {
+            this.writeStream.close();
+            this.writeStream = null;
+        }
+        if (fs.existsSync(this.logPath)) {
+            await fs.promises.unlink(this.logPath);
+        }
+    }
+    /**
+     * Close the logger and cleanup resources
+     */
+    async close() {
+        if (this.writeStream) {
+            return new Promise((resolve) => {
+                this.writeStream.end(() => {
+                    this.writeStream = null;
+                    resolve();
+                });
+            });
+        }
+    }
+    /**
+     * Ensure the log directory exists
+     */
+    ensureDirectoryExists() {
+        const dir = path.dirname(this.logPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    }
+    /**
+     * Write to file with append
+     */
+    async writeToFile(data) {
+        return new Promise((resolve, reject) => {
+            if (!this.writeStream) {
+                this.writeStream = createWriteStream(this.logPath, { flags: 'a' });
+            }
+            this.writeStream.write(data, (error) => {
+                if (error) {
+                    reject(error);
+                }
+                else {
+                    resolve();
+                }
+            });
+        });
+    }
+    /**
+     * Rotate log file if size exceeds limit
+     *
+     * Round 9 (parallel-bench output): previously called `fs.existsSync`
+     * before the async `fs.promises.stat`. This method is called from `log()`
+     * on every audit-log write — i.e. per permission check (10-20× per
+     * multi-iter turn). Sync I/O inside an async hot path blocks the event
+     * loop. The async `stat` already throws `ENOENT` when the file doesn't
+     * exist; we catch and treat as "no rotation needed", eliminating the
+     * sync `existsSync` call.
+     */
+    async rotateIfNeeded() {
+        let stats;
+        try {
+            stats = await fs.promises.stat(this.logPath);
+        }
+        catch (err) {
+            if (err && err.code === 'ENOENT')
+                return; // file doesn't exist yet
+            throw err;
+        }
+        if (stats.size >= this.options.maxFileSizeBytes) {
+            // Close current stream
+            if (this.writeStream) {
+                await this.close();
+            }
+            // Rotate files
+            await this.rotateFiles();
+        }
+    }
+    /**
+     * Rotate log files
+     */
+    async rotateFiles() {
+        // Delete oldest file if it exists
+        const oldestFile = `${this.logPath}.${this.options.maxRotatedFiles}`;
+        if (fs.existsSync(oldestFile)) {
+            await fs.promises.unlink(oldestFile);
+        }
+        // Shift existing rotated files
+        for (let i = this.options.maxRotatedFiles - 1; i >= 1; i--) {
+            const oldFile = `${this.logPath}.${i}`;
+            const newFile = `${this.logPath}.${i + 1}`;
+            if (fs.existsSync(oldFile)) {
+                await fs.promises.rename(oldFile, newFile);
+            }
+        }
+        // Rotate current file
+        await fs.promises.rename(this.logPath, `${this.logPath}.1`);
+    }
+}
+//# sourceMappingURL=PermissionAuditLogger.js.map

package/dist/middleware/permissions/PermissionAuditLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionAuditLogger.js","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionAuditLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAkEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,qBAAqB;IACxB,OAAO,CAAS;IAChB,OAAO,CAAyC;IAChD,WAAW,GAA0B,IAAI,CAAC;IAElD;;;;;OAKG;IACH,YAAY,OAAe,EAAE,UAAwC,EAAE;QACrE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG;YACb,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;YACvE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;SAC9C,CAAC;QAEF,0BAA0B;QAC1B,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAA2B;QACnC,8BAA8B;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9B,CAAC;QAED,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAE9C,gBAAgB;QAChB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAA6B,EAAE;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAE3B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;gBAEvD,wCAAwC;gBACxC,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAE5C,gBAAgB;gBAChB,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACjD,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpD,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7D,SAAS;gBACX,CAAC;gBAED,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBACzD,SAAS;gBACX,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAEpB,cAAc;gBACd,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACrD,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACpE,kCAAkC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QASjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE5D,OAAO;YACL,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM;YAC9D,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM;YAC9D,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM;YACvE,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC;iBACpE,MAAM;YACT,cAAc,EAAE,cAAc,CAAC,IAAI;YACnC,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,WAAY,CAAC,GAAG,CAAC,GAAG,EAAE;oBACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;oBACxB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,IAAY;QACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,IAAI,CAAC,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,yBAAyB;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAChD,uBAAuB;YACvB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;YAED,eAAe;YACf,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW;QACvB,kCAAkC;QAClC,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACrE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,+BAA+B;QAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAE3C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/middleware/permissions/PermissionConfig.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Permission Configuration Types
+ *
+ * Type definitions for permission system configuration files.
+ *
+ * @module permissions/PermissionConfig
+ */
+/**
+ * Policy configuration
+ */
+export interface PolicyConfig {
+    /**
+     * Policy type identifier
+     */
+    type: 'whitelist' | 'blacklist' | 'file-operation' | 'bash-command' | 'custom';
+    /**
+     * Policy priority (optional, uses default if not specified)
+     */
+    priority?: number;
+    /**
+     * Whether the policy is enabled
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Policy-specific configuration
+     */
+    config: Record<string, any>;
+}
+/**
+ * File operation policy configuration
+ */
+export interface FileOperationPolicyConfig {
+    /**
+     * Allowed path prefixes
+     */
+    allowedPaths: string[];
+    /**
+     * Blocked path patterns
+     */
+    blockedPaths: string[];
+    /**
+     * Require approval for delete operations
+     * @default true
+     */
+    requireApprovalForDelete?: boolean;
+    /**
+     * Require approval for write operations
+     * @default false
+     */
+    requireApprovalForWrite?: boolean;
+    /**
+     * Maximum file path length
+     * @default 4096
+     */
+    maxPathLength?: number;
+}
+/**
+ * Bash command policy configuration
+ */
+export interface BashCommandPolicyConfig {
+    /**
+     * Allowed command prefixes (whitelist mode)
+     */
+    allowedCommands: string[];
+    /**
+     * Blocked command prefixes (blacklist mode)
+     */
+    blockedCommands: string[];
+    /**
+     * Require approval for dangerous commands
+     * @default true
+     */
+    requireApprovalForDangerous?: boolean;
+    /**
+     * Custom dangerous patterns
+     */
+    customDangerousPatterns?: string[];
+}
+/**
+ * Whitelist policy configuration
+ */
+export interface WhitelistPolicyConfig {
+    /**
+     * Allowed tool names
+     */
+    allowedTools: string[];
+}
+/**
+ * Blacklist policy configuration
+ */
+export interface BlacklistPolicyConfig {
+    /**
+     * Blocked tool names
+     */
+    blockedTools: string[];
+}
+/**
+ * Audit log configuration
+ */
+export interface AuditLogConfig {
+    /**
+     * Whether audit logging is enabled
+     * @default true
+     */
+    enabled: boolean;
+    /**
+     * Path to the audit log file
+     * @default '.nexus-cortex/audit/permissions.log'
+     */
+    path?: string;
+    /**
+     * Maximum file size before rotation (bytes)
+     * @default 10485760 (10MB)
+     */
+    maxFileSizeBytes?: number;
+    /**
+     * Enable file rotation
+     * @default true
+     */
+    enableRotation?: boolean;
+    /**
+     * Number of rotated files to keep
+     * @default 5
+     */
+    maxRotatedFiles?: number;
+}
+/**
+ * Complete permission configuration
+ */
+export interface PermissionConfig {
+    /**
+     * Whether permission system is enabled
+     * @default true
+     */
+    enabled: boolean;
+    /**
+     * Default policy when no policies match
+     * @default 'deny'
+     */
+    defaultPolicy: 'allow' | 'deny';
+    /**
+     * Configured policies
+     */
+    policies: PolicyConfig[];
+    /**
+     * Approval handler type
+     */
+    approvalHandler?: 'cli' | 'auto-approve' | 'deny-all';
+    /**
+     * Audit log configuration
+     */
+    auditLog?: AuditLogConfig;
+    /**
+     * Enable debug logging
+     * @default false
+     */
+    enableLogging?: boolean;
+}
+/**
+ * Environment-specific configuration presets
+ */
+export declare const PermissionPresets: {
+    /**
+     * Development environment (permissive)
+     */
+    readonly development: () => PermissionConfig;
+    /**
+     * Production environment (strict)
+     */
+    readonly production: () => PermissionConfig;
+    /**
+     * Testing/CI environment (auto-approve)
+     */
+    readonly testing: () => PermissionConfig;
+    /**
+     * Disabled permissions (no checks)
+     */
+    readonly disabled: () => PermissionConfig;
+};
+//# sourceMappingURL=PermissionConfig.d.ts.map

package/dist/middleware/permissions/PermissionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionConfig.d.ts","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,cAAc,GAAG,QAAQ,CAAC;IAE/E;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B;;OAEG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAEtC;;OAEG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEzB;;OAEG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,cAAc,GAAG,UAAU,CAAC;IAEtD;;OAEG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;gCACc,gBAAgB;IA4BjC;;OAEG;+BACa,gBAAgB;IAiChC;;OAEG;4BACU,gBAAgB;IAmB7B;;OAEG;6BACW,gBAAgB;CAQtB,CAAC"}

package/dist/middleware/permissions/PermissionConfig.js

@@ -0,0 +1,110 @@
+/**
+ * Permission Configuration Types
+ *
+ * Type definitions for permission system configuration files.
+ *
+ * @module permissions/PermissionConfig
+ */
+/**
+ * Environment-specific configuration presets
+ */
+export const PermissionPresets = {
+    /**
+     * Development environment (permissive)
+     */
+    development: () => ({
+        enabled: true,
+        defaultPolicy: 'allow',
+        policies: [
+            {
+                type: 'file-operation',
+                config: {
+                    allowedPaths: [process.cwd()],
+                    blockedPaths: ['/.git', '/node_modules', '/.env'],
+                    requireApprovalForDelete: true,
+                },
+            },
+            {
+                type: 'bash-command',
+                config: {
+                    allowedCommands: [],
+                    blockedCommands: ['rm -rf /', 'sudo rm'],
+                    requireApprovalForDangerous: true,
+                },
+            },
+        ],
+        approvalHandler: 'cli',
+        auditLog: {
+            enabled: true,
+            path: '.nexus-cortex/audit/permissions.log',
+        },
+    }),
+    /**
+     * Production environment (strict)
+     */
+    production: () => ({
+        enabled: true,
+        defaultPolicy: 'deny',
+        policies: [
+            {
+                type: 'whitelist',
+                config: {
+                    allowedTools: ['read_file', 'list_files', 'grep', 'create_artifact'],
+                },
+            },
+            {
+                type: 'blacklist',
+                priority: 100,
+                config: {
+                    blockedTools: ['execute_bash', 'write_file', 'delete_file'],
+                },
+            },
+            {
+                type: 'file-operation',
+                config: {
+                    allowedPaths: ['/workspace/public'],
+                    blockedPaths: ['*'],
+                    requireApprovalForDelete: false,
+                },
+            },
+        ],
+        approvalHandler: 'deny-all',
+        auditLog: {
+            enabled: true,
+            path: '/var/log/cortex/permissions.log',
+        },
+    }),
+    /**
+     * Testing/CI environment (auto-approve)
+     */
+    testing: () => ({
+        enabled: true,
+        defaultPolicy: 'allow',
+        policies: [
+            {
+                type: 'file-operation',
+                config: {
+                    allowedPaths: ['/tmp/test-workspace'],
+                    blockedPaths: [],
+                    requireApprovalForDelete: false,
+                },
+            },
+        ],
+        approvalHandler: 'auto-approve',
+        auditLog: {
+            enabled: false,
+        },
+    }),
+    /**
+     * Disabled permissions (no checks)
+     */
+    disabled: () => ({
+        enabled: false,
+        defaultPolicy: 'allow',
+        policies: [],
+        auditLog: {
+            enabled: false,
+        },
+    }),
+};
+//# sourceMappingURL=PermissionConfig.js.map

package/dist/middleware/permissions/PermissionConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionConfig.js","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionConfig.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoLH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;;OAEG;IACH,WAAW,EAAE,GAAqB,EAAE,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC7B,YAAY,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;oBACjD,wBAAwB,EAAE,IAAI;iBAC/B;aACF;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,EAAE;oBACnB,eAAe,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;oBACxC,2BAA2B,EAAE,IAAI;iBAClC;aACF;SACF;QACD,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,qCAAqC;SAC5C;KACF,CAAC;IAEF;;OAEG;IACH,UAAU,EAAE,GAAqB,EAAE,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC;iBACrE;aACF;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,GAAG;gBACb,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,aAAa,CAAC;iBAC5D;aACF;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,mBAAmB,CAAC;oBACnC,YAAY,EAAE,CAAC,GAAG,CAAC;oBACnB,wBAAwB,EAAE,KAAK;iBAChC;aACF;SACF;QACD,eAAe,EAAE,UAAU;QAC3B,QAAQ,EAAE;YACR,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,iCAAiC;SACxC;KACF,CAAC;IAEF;;OAEG;IACH,OAAO,EAAE,GAAqB,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,qBAAqB,CAAC;oBACrC,YAAY,EAAE,EAAE;oBAChB,wBAAwB,EAAE,KAAK;iBAChC;aACF;SACF;QACD,eAAe,EAAE,cAAc;QAC/B,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK;SACf;KACF,CAAC;IAEF;;OAEG;IACH,QAAQ,EAAE,GAAqB,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK;SACf;KACF,CAAC;CACM,CAAC"}

package/dist/middleware/permissions/PermissionConfigLoader.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Permission Configuration Loader
+ *
+ * Loads permission configuration from JSON files and instantiates
+ * policies and handlers.
+ *
+ * @module permissions/PermissionConfigLoader
+ */
+import type { PermissionConfig } from './PermissionConfig.js';
+import type { PermissionPolicy } from '../contracts/MiddlewareContracts.js';
+import { PermissionsMiddleware } from '../PermissionsMiddleware.js';
+/**
+ * Options for configuration loader
+ */
+export interface ConfigLoaderOptions {
+    /**
+     * Whether to throw errors on invalid configuration
+     * @default true
+     */
+    throwOnError?: boolean;
+    /**
+     * Whether to log loading progress
+     * @default false
+     */
+    enableLogging?: boolean;
+}
+/**
+ * Configuration loader for permission system
+ *
+ * @example
+ * ```typescript
+ * const loader = new PermissionConfigLoader();
+ *
+ * const middleware = await loader.loadFromFile('/path/to/permissions.json');
+ * ```
+ */
+export declare class PermissionConfigLoader {
+    private options;
+    constructor(options?: ConfigLoaderOptions);
+    /**
+     * Load configuration from a JSON file
+     *
+     * @param filePath Path to the configuration file
+     * @returns Configured permissions middleware
+     */
+    loadFromFile(filePath: string): Promise<PermissionsMiddleware>;
+    /**
+     * Load policies from a JSON configuration file
+     *
+     * @param filePath Path to the configuration file
+     * @returns Array of configured permission policies
+     */
+    loadPoliciesFromFile(filePath: string): Promise<PermissionPolicy[]>;
+    /**
+     * Load configuration from an object
+     *
+     * @param config The permission configuration
+     * @returns Configured permissions middleware
+     */
+    loadFromConfig(config: PermissionConfig): PermissionsMiddleware;
+    /**
+     * Load policies from configuration
+     */
+    private loadPolicies;
+    /**
+     * Create a policy from configuration
+     */
+    private createPolicy;
+    /**
+     * Load approval handler from configuration
+     */
+    private loadApprovalHandler;
+    /**
+     * Load audit logger from configuration
+     */
+    private loadAuditLogger;
+    /**
+     * Create a default middleware with minimal configuration
+     */
+    private createDefaultMiddleware;
+    /**
+     * Validate configuration without loading
+     *
+     * @param config The configuration to validate
+     * @returns Array of validation errors (empty if valid)
+     */
+    validateConfig(config: PermissionConfig): string[];
+}
+//# sourceMappingURL=PermissionConfigLoader.d.ts.map

package/dist/middleware/permissions/PermissionConfigLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionConfigLoader.d.ts","sourceRoot":"","sources":["../../../src/middleware/permissions/PermissionConfigLoader.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAGjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAmB,MAAM,qCAAqC,CAAC;AAU7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,OAAO,CAAgC;gBAEnC,OAAO,GAAE,mBAAwB;IAO7C;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+BpE;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAsCzE;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,qBAAqB;IA+B/D;;OAEG;IACH,OAAO,CAAC,YAAY;IA6BpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAkEpB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE;CA2CnD"}