@nosserb/prmt 0.0.0-stage → 2.0.0

package/lib/server/status.js

@@ -0,0 +1,157 @@
+/** État de la plateforme pour le tableau de bord. Tout vient de mesures réelles : journal, audits, Ollama, moteur. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { countBySeverity, MODULES } from './audits/registry.js';
+import { VERSION } from './config.js';
+import { APPS, CMDLETS } from './engine/catalog.js';
+import { RENDEZVOUS } from './lien.js';
+const DAYS = 14;
+const dayKey = (d) => `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+export function catalogItems(settings) {
+    const unlocked = new Set(settings.allowlist.unlocked.map((u) => u.toLowerCase()));
+    const items = [];
+    for (const [name, rule] of CMDLETS)
+        items.push({ name, level: rule.level, category: rule.category, note: rule.note ?? '', ...(rule.level === 'destructive' ? { unlocked: unlocked.has(name) } : {}) });
+    for (const [name, rule] of APPS)
+        items.push({ name: `${name}.exe`, level: rule.level, category: rule.category, note: rule.note ?? '', ...(rule.level === 'destructive' || rule.unlockable ? { unlocked: unlocked.has(name) } : {}) });
+    for (const c of settings.allowlist.custom)
+        items.push({ name: c.name, level: c.level, category: 'liste personnelle', note: 'ajoutée par toi, arguments non contrôlés', custom: true });
+    return items.sort((a, b) => a.name.localeCompare(b.name));
+}
+export function dayStats(entries, now) {
+    const days = new Map();
+    for (let i = DAYS - 1; i >= 0; i--) {
+        const d = new Date(now);
+        d.setDate(d.getDate() - i);
+        const date = dayKey(d);
+        days.set(date, { date, executed: 0, failed: 0, refused: 0 });
+    }
+    for (const e of entries) {
+        if (e.kind !== 'command' && e.kind !== 'refusal')
+            continue;
+        const stat = days.get(dayKey(new Date(e.at)));
+        if (!stat)
+            continue;
+        if (e.kind === 'refusal')
+            stat.refused++;
+        else if (e.outcome === 'ok')
+            stat.executed++;
+        // Une commande annulée (par toi, ici ou dans la TUI) n'est pas un échec
+        else if (e.outcome !== 'cancelled')
+            stat.failed++;
+    }
+    return [...days.values()];
+}
+export class StatusService {
+    health = null;
+    searchHealthCache = null;
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** L'état d'Ollama est gardé trois secondes pour ne pas l'interroger à chaque rafraîchissement. */
+    async providerHealth() {
+        if (this.health && Date.now() - this.health.at < 3000)
+            return this.health.value;
+        const value = await this.deps.provider().health();
+        this.health = { at: Date.now(), value };
+        return value;
+    }
+    /** SearXNG n'est interrogé que si la recherche est active, et pas plus d'une fois toutes les trois secondes. */
+    async searchHealth(settings) {
+        const { enabled, url } = settings.search;
+        if (!enabled)
+            return { enabled, url, available: false, latencyMs: null, error: null };
+        const cache = this.searchHealthCache;
+        if (cache && cache.url === url && Date.now() - cache.at < 3000)
+            return { enabled, url, ...cache.value };
+        const value = await this.deps.search().health();
+        this.searchHealthCache = { at: Date.now(), url, value };
+        return { enabled, url, ...value };
+    }
+    alerts(entries) {
+        const alerts = [];
+        const { probe, audits, guardRejections } = this.deps;
+        const now = new Date().toISOString();
+        if (!probe.available)
+            alerts.push({ id: 'engine', at: now, severity: 'high', title: 'Moteur PowerShell indisponible', detail: probe.error ?? 'PowerShell ne répond pas.', source: 'system' });
+        const guard = guardRejections();
+        if (guard.count > 0 && guard.last)
+            alerts.push({ id: 'guard', at: guard.last, severity: 'medium', title: `${guard.count} requête${guard.count > 1 ? 's' : ''} refusée${guard.count > 1 ? 's' : ''} par la garde de l’API`, detail: `Dernier motif : ${guard.reason ?? 'inconnu'}. Une autre page ou un autre programme a tenté d’appeler le serveur local.`, source: 'guard' });
+        for (const run of audits.latest()) {
+            for (const f of run.findings) {
+                if (f.severity !== 'critical' && f.severity !== 'high')
+                    continue;
+                alerts.push({ id: `${run.id}-${f.id}`, at: run.startedAt, severity: f.severity, title: f.title, detail: `${run.target} · ${f.detail}`, source: 'audit' });
+            }
+        }
+        const weekAgo = Date.now() - 7 * 86_400_000;
+        for (let i = entries.length - 1, kept = 0; i >= 0 && kept < 5; i--) {
+            const e = entries[i];
+            if (!e || e.kind !== 'refusal' || new Date(e.at).getTime() < weekAgo)
+                continue;
+            const codes = Array.isArray(e.data?.codes) ? e.data.codes.map(String) : [];
+            if (!codes.some((c) => ['forbidden', 'destructive', 'method-call', 'static-member', 'dynamic-command', 'target-out-of-scope', 'out-of-scope', 'unc-path', 'env-assign', 'drive-variable'].includes(c)))
+                continue;
+            kept++;
+            alerts.push({ id: e.id, at: e.at, severity: 'low', title: 'Commande refusée par la politique', detail: `${e.title}${e.data?.origin === 'ai' ? ' (proposée par le modèle)' : e.data?.origin === 'tui' ? ' (dans la TUI prmt)' : ''}`, source: 'policy' });
+        }
+        const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+        return alerts.sort((a, b) => order[a.severity] - order[b.severity] || b.at.localeCompare(a.at)).slice(0, 12);
+    }
+    async snapshot() {
+        const { config, journal, audits, brain, engine, probe, settings, targets, startedAt } = this.deps;
+        const s = settings();
+        const [health, search] = await Promise.all([this.providerHealth(), this.searchHealth(s)]);
+        let models = { installed: [], loaded: [], selected: null };
+        if (health.available) {
+            try {
+                models = await brain.models();
+            }
+            catch {
+                /* Ollama a répondu à /api/version mais pas à la suite : on garde les listes vides */
+            }
+        }
+        const entries = journal.all();
+        const days = dayStats(entries, new Date());
+        const levels = { read: 0, sensitive: 0, destructive: 0, forbidden: 0 };
+        for (const rule of [...CMDLETS.values(), ...APPS.values()])
+            levels[rule.level]++;
+        const findings = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+        const latest = audits.latest();
+        for (const run of latest) {
+            const counts = countBySeverity(run.findings);
+            for (const key of Object.keys(findings))
+                findings[key] += counts[key];
+        }
+        const history = audits.history();
+        const ai = entries.filter((e) => e.kind === 'ai' && e.outcome === 'ok');
+        // Activité de la TUI : les entrées de son journal (commandes exécutées, refusées, annulées)
+        const fromTui = entries.filter((e) => e.data?.origin === 'tui' && (e.kind === 'command' || e.kind === 'refusal'));
+        const speeds = ai.map((e) => Number(e.data?.tokensPerSec ?? 0)).filter((v) => v > 0).slice(-20);
+        return {
+            server: { version: VERSION, startedAt, listen: `${config.host}:${config.port}`, dataDir: config.dataDir, phone: this.deps.phone() },
+            tui: { linked: fs.existsSync(path.join(config.tuiDir, RENDEZVOUS)), lastAt: fromTui.at(-1)?.at ?? null, actions: fromTui.length },
+            ollama: { available: health.available, version: health.version, latencyMs: health.latencyMs, error: health.error, baseUrl: s.ollama.baseUrl },
+            models,
+            search,
+            fullCyber: s.fullCyber,
+            autoRun: s.autoRun,
+            engine: { available: probe.available, version: probe.version, codePage: probe.codePage, constrained: s.engine.constrainedLanguage, running: engine.running, timeoutSec: s.engine.timeoutSec, error: probe.error },
+            policy: { ...levels, custom: s.allowlist.custom.length, targets: targets().length },
+            stats: {
+                days,
+                executed: days.reduce((n, d) => n + d.executed, 0),
+                refused: days.reduce((n, d) => n + d.refused, 0),
+                failed: days.reduce((n, d) => n + d.failed, 0),
+                audits: history.length,
+                aiReplies: ai.length,
+                speeds,
+                findings,
+            },
+            recent: journal.query({ limit: 8 }),
+            alerts: this.alerts(entries),
+            audits: MODULES.map((m) => ({ module: m.info.id, title: m.info.title, last: history.find((h) => h.module === m.info.id) ?? null })),
+        };
+    }
+}

package/lib/server/stores.js

@@ -0,0 +1,141 @@
+/** Données persistantes : réglages, périmètre autorisé. Fichiers JSON écrits de façon atomique. */
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { badRequest, notFound } from './errors.js';
+import { isLoopback } from './engine/paths.js';
+export function readJson(file, fallback) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Écrit dans un fichier voisin puis renomme : un arrêt brutal ne laisse pas de fichier à moitié écrit. */
+export function writeJson(file, value) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${randomBytes(4).toString('hex')}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(value, null, 2), 'utf8');
+    fs.renameSync(tmp, file);
+}
+/** Date de modification d'un fichier, ou 0 s'il n'existe pas. */
+const stamp = (file) => (file ? (fs.statSync(file, { throwIfNoEntry: false })?.mtimeMs ?? 0) : 0);
+export class SettingsStore {
+    current;
+    file;
+    defaults;
+    seen = 0;
+    constructor(file, defaults) {
+        this.file = file;
+        this.defaults = defaults;
+        this.current = this.read();
+    }
+    read() {
+        const saved = this.file ? readJson(this.file, {}) : {};
+        this.seen = stamp(this.file);
+        return {
+            model: saved.model ?? this.defaults.model,
+            engine: { ...this.defaults.engine, ...saved.engine },
+            allowlist: { ...this.defaults.allowlist, ...saved.allowlist },
+            ollama: { ...this.defaults.ollama, ...saved.ollama },
+            search: { ...this.defaults.search, ...saved.search },
+            fullCyber: saved.fullCyber ?? this.defaults.fullCyber,
+            autoRun: saved.autoRun ?? this.defaults.autoRun,
+        };
+    }
+    /** La console et la TUI partagent ce fichier : il est relu dès que l'autre l'a modifié. */
+    get() {
+        if (this.file && stamp(this.file) !== this.seen)
+            this.current = this.read();
+        return this.current;
+    }
+    patch(patch) {
+        const base = this.get();
+        const next = {
+            model: patch.model === undefined ? base.model : patch.model,
+            engine: { ...base.engine, ...patch.engine },
+            allowlist: { ...base.allowlist, ...patch.allowlist },
+            ollama: { ...base.ollama, ...patch.ollama },
+            search: { ...base.search, ...patch.search },
+            fullCyber: patch.fullCyber ?? base.fullCyber,
+            autoRun: patch.autoRun ?? base.autoRun,
+        };
+        if (patch.engine?.roots) {
+            next.engine.roots = patch.engine.roots.map((root) => {
+                const resolved = path.win32.resolve(root);
+                if (!path.win32.isAbsolute(root) || /^[\\/]{2}/.test(root))
+                    throw badRequest(`« ${root} » doit être un chemin local absolu.`);
+                if (path.win32.parse(resolved).root === resolved)
+                    throw badRequest('Un lecteur entier ne peut pas être autorisé en écriture.');
+                let stat;
+                try {
+                    stat = fs.statSync(resolved);
+                }
+                catch {
+                    throw badRequest(`Le dossier « ${resolved} » n’existe pas.`);
+                }
+                if (!stat.isDirectory())
+                    throw badRequest(`« ${resolved} » n’est pas un dossier.`);
+                return resolved;
+            });
+        }
+        this.current = next;
+        if (this.file) {
+            writeJson(this.file, next);
+            this.seen = stamp(this.file);
+        }
+        return next;
+    }
+}
+export class ScopeStore {
+    targets = [];
+    file;
+    seen = 0;
+    constructor(file) {
+        this.file = file;
+        this.reload();
+    }
+    reload() {
+        this.targets = this.file ? readJson(this.file, []) : this.targets;
+        this.seen = stamp(this.file);
+    }
+    list() {
+        if (this.file && stamp(this.file) !== this.seen)
+            this.reload();
+        return this.targets;
+    }
+    add(input) {
+        this.list();
+        if (isLoopback(input.host))
+            throw badRequest('La machine locale est toujours autorisée, inutile de la déclarer.');
+        if (this.targets.some((t) => t.host === input.host))
+            throw badRequest(`« ${input.host} » est déjà dans le périmètre.`);
+        if (this.targets.length >= 100)
+            throw badRequest('Le périmètre est limité à 100 cibles.');
+        const target = {
+            id: randomBytes(6).toString('hex'),
+            host: input.host,
+            note: input.note,
+            includeSubdomains: input.includeSubdomains,
+            attestedAt: new Date().toISOString(),
+        };
+        this.targets = [...this.targets, target];
+        this.save();
+        return target;
+    }
+    remove(id) {
+        const target = this.list().find((t) => t.id === id);
+        if (!target)
+            throw notFound('Cible introuvable dans le périmètre.');
+        this.targets = this.targets.filter((t) => t.id !== id);
+        this.save();
+        return target;
+    }
+    save() {
+        if (!this.file)
+            return;
+        writeJson(this.file, this.targets);
+        this.seen = stamp(this.file);
+    }
+}