@rafter-security/cli 0.1.0 → 0.4.0

package/dist/core/audit-logger.js

@@ -0,0 +1,203 @@
+import fs from "fs";
+import path from "path";
+import { getAuditLogPath } from "./config-defaults.js";
+import { ConfigManager } from "./config-manager.js";
+export class AuditLogger {
+    constructor(logPath) {
+        this.logPath = logPath || getAuditLogPath();
+        this.sessionId = this.generateSessionId();
+        this.configManager = new ConfigManager();
+        // Ensure log directory exists
+        const dir = path.dirname(this.logPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+    }
+    /**
+     * Log an audit event
+     */
+    log(entry) {
+        const config = this.configManager.load();
+        // Check if logging is enabled
+        if (!config.agent?.audit.logAllActions) {
+            return;
+        }
+        const fullEntry = {
+            ...entry,
+            timestamp: new Date().toISOString(),
+            sessionId: this.sessionId
+        };
+        // Append to log file
+        const line = JSON.stringify(fullEntry) + "\n";
+        fs.appendFileSync(this.logPath, line, "utf-8");
+    }
+    /**
+     * Log a command interception
+     */
+    logCommandIntercepted(command, passed, actionTaken, reason, agentType) {
+        this.log({
+            eventType: "command_intercepted",
+            agentType,
+            action: {
+                command,
+                riskLevel: this.assessCommandRisk(command)
+            },
+            securityCheck: {
+                passed,
+                reason
+            },
+            resolution: {
+                actionTaken
+            }
+        });
+    }
+    /**
+     * Log a secret detection
+     */
+    logSecretDetected(location, secretType, actionTaken, agentType) {
+        this.log({
+            eventType: "secret_detected",
+            agentType,
+            action: {
+                riskLevel: "critical"
+            },
+            securityCheck: {
+                passed: false,
+                reason: `${secretType} detected in ${location}`
+            },
+            resolution: {
+                actionTaken
+            }
+        });
+    }
+    /**
+     * Log content sanitization
+     */
+    logContentSanitized(contentType, patternsMatched, agentType) {
+        this.log({
+            eventType: "content_sanitized",
+            agentType,
+            securityCheck: {
+                passed: false,
+                reason: `${patternsMatched} sensitive patterns detected`,
+                details: { contentType, patternsMatched }
+            },
+            resolution: {
+                actionTaken: "redacted"
+            }
+        });
+    }
+    /**
+     * Log a policy override
+     */
+    logPolicyOverride(reason, command, agentType) {
+        this.log({
+            eventType: "policy_override",
+            agentType,
+            action: {
+                command,
+                riskLevel: "high"
+            },
+            securityCheck: {
+                passed: false,
+                reason: "Security policy overridden by user"
+            },
+            resolution: {
+                actionTaken: "overridden",
+                overrideReason: reason
+            }
+        });
+    }
+    /**
+     * Read audit log entries
+     */
+    read(filter) {
+        if (!fs.existsSync(this.logPath)) {
+            return [];
+        }
+        const content = fs.readFileSync(this.logPath, "utf-8");
+        const lines = content.split("\n").filter(line => line.trim());
+        let entries = lines.map(line => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return null;
+            }
+        }).filter(entry => entry !== null);
+        // Apply filters
+        if (filter) {
+            if (filter.eventType) {
+                entries = entries.filter(e => e.eventType === filter.eventType);
+            }
+            if (filter.agentType) {
+                entries = entries.filter(e => e.agentType === filter.agentType);
+            }
+            if (filter.since) {
+                entries = entries.filter(e => new Date(e.timestamp) >= filter.since);
+            }
+            if (filter.limit) {
+                entries = entries.slice(-filter.limit);
+            }
+        }
+        return entries;
+    }
+    /**
+     * Clean up old log entries based on retention policy
+     */
+    cleanup() {
+        const config = this.configManager.load();
+        const retentionDays = config.agent?.audit.retentionDays || 30;
+        const cutoffDate = new Date();
+        cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+        const entries = this.read();
+        const filtered = entries.filter(e => new Date(e.timestamp) >= cutoffDate);
+        // Rewrite log file with only retained entries
+        const content = filtered.map(e => JSON.stringify(e)).join("\n") + "\n";
+        fs.writeFileSync(this.logPath, content, "utf-8");
+    }
+    /**
+     * Generate a unique session ID
+     */
+    generateSessionId() {
+        return `${Date.now()}-${Math.random().toString(36).substring(7)}`;
+    }
+    /**
+     * Assess risk level of a command
+     */
+    assessCommandRisk(command) {
+        const critical = [
+            /rm\s+-rf\s+\//,
+            /:\(\)\{\s*:\|:&\s*\};:/, // fork bomb
+            /dd\s+if=.*of=\/dev\/sd/,
+            />\s*\/dev\/sd/
+        ];
+        const high = [
+            /rm\s+-rf/,
+            /sudo\s+rm/,
+            /chmod\s+777/,
+            /curl.*\|.*sh/,
+            /wget.*\|.*sh/,
+            /git\s+push\s+--force/
+        ];
+        const medium = [
+            /sudo/,
+            /chmod/,
+            /chown/,
+            /systemctl/
+        ];
+        for (const pattern of critical) {
+            if (pattern.test(command))
+                return "critical";
+        }
+        for (const pattern of high) {
+            if (pattern.test(command))
+                return "high";
+        }
+        for (const pattern of medium) {
+            if (pattern.test(command))
+                return "medium";
+        }
+        return "low";
+    }
+}

package/dist/core/command-interceptor.js

@@ -0,0 +1,165 @@
+import { ConfigManager } from "./config-manager.js";
+import { AuditLogger } from "./audit-logger.js";
+export class CommandInterceptor {
+    constructor() {
+        this.config = new ConfigManager();
+        this.audit = new AuditLogger();
+    }
+    /**
+     * Evaluate if a command should be allowed
+     */
+    evaluate(command) {
+        const cfg = this.config.load();
+        const policy = cfg.agent?.commandPolicy;
+        if (!policy) {
+            // No policy configured, allow by default
+            return {
+                command,
+                riskLevel: "low",
+                allowed: true,
+                requiresApproval: false
+            };
+        }
+        // Check blocked patterns (always block)
+        for (const pattern of policy.blockedPatterns) {
+            if (this.matchesPattern(command, pattern)) {
+                return {
+                    command,
+                    riskLevel: "critical",
+                    allowed: false,
+                    requiresApproval: false,
+                    reason: `Matches blocked pattern: ${pattern}`,
+                    matchedPattern: pattern
+                };
+            }
+        }
+        // Check approval patterns
+        for (const pattern of policy.requireApproval) {
+            if (this.matchesPattern(command, pattern)) {
+                const riskLevel = this.assessRisk(command);
+                return {
+                    command,
+                    riskLevel,
+                    allowed: false,
+                    requiresApproval: true,
+                    reason: `Matches approval pattern: ${pattern}`,
+                    matchedPattern: pattern
+                };
+            }
+        }
+        // Check policy mode
+        if (policy.mode === "deny-list") {
+            // If not in blocked or approval lists, allow
+            return {
+                command,
+                riskLevel: this.assessRisk(command),
+                allowed: true,
+                requiresApproval: false
+            };
+        }
+        else if (policy.mode === "approve-dangerous") {
+            // Assess risk and require approval for high/critical
+            const riskLevel = this.assessRisk(command);
+            if (riskLevel === "high" || riskLevel === "critical") {
+                return {
+                    command,
+                    riskLevel,
+                    allowed: false,
+                    requiresApproval: true,
+                    reason: `High risk command requires approval`
+                };
+            }
+            return {
+                command,
+                riskLevel,
+                allowed: true,
+                requiresApproval: false
+            };
+        }
+        else if (policy.mode === "allow-all") {
+            return {
+                command,
+                riskLevel: this.assessRisk(command),
+                allowed: true,
+                requiresApproval: false
+            };
+        }
+        // Default: allow
+        return {
+            command,
+            riskLevel: this.assessRisk(command),
+            allowed: true,
+            requiresApproval: false
+        };
+    }
+    /**
+     * Log command evaluation result
+     */
+    logEvaluation(evaluation, actionTaken) {
+        this.audit.logCommandIntercepted(evaluation.command, evaluation.allowed, actionTaken, evaluation.reason);
+    }
+    /**
+     * Match command against pattern
+     */
+    matchesPattern(command, pattern) {
+        try {
+            const regex = new RegExp(pattern);
+            return regex.test(command);
+        }
+        catch {
+            // If pattern is not valid regex, try exact match
+            return command.includes(pattern);
+        }
+    }
+    /**
+     * Assess risk level of command
+     */
+    assessRisk(command) {
+        // Critical patterns
+        const critical = [
+            /rm\s+-rf\s+\//,
+            /:\(\)\{\s*:\|:&\s*\};:/, // fork bomb
+            /dd\s+if=.*of=\/dev\/sd/,
+            />\s*\/dev\/sd/,
+            /mkfs/,
+            /fdisk/,
+            /parted/
+        ];
+        // High risk patterns
+        const high = [
+            /rm\s+-rf/,
+            /sudo\s+rm/,
+            /chmod\s+777/,
+            /curl.*\|.*sh/,
+            /wget.*\|.*sh/,
+            /git\s+push\s+--force/,
+            /docker\s+system\s+prune/,
+            /npm\s+publish/,
+            /pypi.*upload/
+        ];
+        // Medium risk patterns
+        const medium = [
+            /sudo/,
+            /chmod/,
+            /chown/,
+            /systemctl/,
+            /service/,
+            /kill\s+-9/,
+            /pkill/,
+            /killall/
+        ];
+        for (const pattern of critical) {
+            if (pattern.test(command))
+                return "critical";
+        }
+        for (const pattern of high) {
+            if (pattern.test(command))
+                return "high";
+        }
+        for (const pattern of medium) {
+            if (pattern.test(command))
+                return "medium";
+        }
+        return "low";
+    }
+}

package/dist/core/config-defaults.js

@@ -0,0 +1,71 @@
+import os from "os";
+import path from "path";
+export const CONFIG_VERSION = "1.0.0";
+export function getDefaultConfig() {
+    return {
+        version: CONFIG_VERSION,
+        initialized: new Date().toISOString(),
+        backend: {
+            endpoint: "https://rafter.so/api/"
+        },
+        agent: {
+            riskLevel: "moderate",
+            environments: {
+                openclaw: {
+                    enabled: false,
+                    skillPath: path.join(os.homedir(), ".openclaw", "skills", "rafter-security.md")
+                },
+                claudeCode: {
+                    enabled: false,
+                    mcpPath: path.join(os.homedir(), ".claude", "mcp", "rafter-security.json")
+                }
+            },
+            skills: {
+                autoUpdate: true,
+                installOnInit: true,
+                backupBeforeUpdate: true
+            },
+            commandPolicy: {
+                mode: "approve-dangerous",
+                blockedPatterns: [
+                    "rm -rf /",
+                    ":(){ :|:& };:", // fork bomb
+                    "dd if=/dev/zero of=/dev/sda",
+                    "> /dev/sda"
+                ],
+                requireApproval: [
+                    "rm -rf",
+                    "sudo rm",
+                    "curl.*|.*sh",
+                    "wget.*|.*sh",
+                    "chmod 777",
+                    "git push --force"
+                ]
+            },
+            outputFiltering: {
+                redactSecrets: true,
+                blockPatterns: true
+            },
+            audit: {
+                logAllActions: true,
+                retentionDays: 30,
+                logLevel: "info"
+            }
+        }
+    };
+}
+export function getRafterDir() {
+    return path.join(os.homedir(), ".rafter");
+}
+export function getConfigPath() {
+    return path.join(getRafterDir(), "config.json");
+}
+export function getAuditLogPath() {
+    return path.join(getRafterDir(), "audit.log");
+}
+export function getBinDir() {
+    return path.join(getRafterDir(), "bin");
+}
+export function getPatternsDir() {
+    return path.join(getRafterDir(), "patterns");
+}

package/dist/core/config-manager.js

@@ -0,0 +1,147 @@
+import fs from "fs";
+import path from "path";
+import { getDefaultConfig, getConfigPath, getRafterDir, CONFIG_VERSION } from "./config-defaults.js";
+export class ConfigManager {
+    constructor(configPath) {
+        this.configPath = configPath || getConfigPath();
+    }
+    /**
+     * Load config from disk, creating default if it doesn't exist
+     */
+    load() {
+        if (!fs.existsSync(this.configPath)) {
+            return getDefaultConfig();
+        }
+        try {
+            const content = fs.readFileSync(this.configPath, "utf-8");
+            const config = JSON.parse(content);
+            // Migrate config if needed
+            return this.migrate(config);
+        }
+        catch (e) {
+            console.error(`Failed to load config from ${this.configPath}: ${e}`);
+            return getDefaultConfig();
+        }
+    }
+    /**
+     * Save config to disk
+     */
+    save(config) {
+        // Ensure directory exists
+        const dir = path.dirname(this.configPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        // Write config
+        fs.writeFileSync(this.configPath, JSON.stringify(config, null, 2), "utf-8");
+    }
+    /**
+     * Update specific config values
+     */
+    update(updates) {
+        const config = this.load();
+        const merged = this.deepMerge(config, updates);
+        this.save(merged);
+        return merged;
+    }
+    /**
+     * Get a specific config value by path (e.g., "agent.riskLevel")
+     */
+    get(keyPath) {
+        const config = this.load();
+        const keys = keyPath.split(".");
+        let value = config;
+        for (const key of keys) {
+            if (value && typeof value === "object" && key in value) {
+                value = value[key];
+            }
+            else {
+                return undefined;
+            }
+        }
+        return value;
+    }
+    /**
+     * Set a specific config value by path
+     */
+    set(keyPath, value) {
+        const config = this.load();
+        const keys = keyPath.split(".");
+        let current = config;
+        for (let i = 0; i < keys.length - 1; i++) {
+            const key = keys[i];
+            if (!(key in current)) {
+                current[key] = {};
+            }
+            current = current[key];
+        }
+        const lastKey = keys[keys.length - 1];
+        current[lastKey] = value;
+        this.save(config);
+    }
+    /**
+     * Initialize config directory structure
+     */
+    async initialize() {
+        const rafterDir = getRafterDir();
+        // Create directories
+        const dirs = [
+            rafterDir,
+            path.join(rafterDir, "bin"),
+            path.join(rafterDir, "patterns")
+        ];
+        for (const dir of dirs) {
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+        }
+        // Create default config if it doesn't exist
+        if (!fs.existsSync(this.configPath)) {
+            const config = getDefaultConfig();
+            this.save(config);
+        }
+    }
+    /**
+     * Check if config exists
+     */
+    exists() {
+        return fs.existsSync(this.configPath);
+    }
+    /**
+     * Migrate config to latest version
+     */
+    migrate(config) {
+        // For now, just ensure version is current
+        // In future, handle version-specific migrations
+        if (config.version !== CONFIG_VERSION) {
+            config.version = CONFIG_VERSION;
+            this.save(config);
+        }
+        return config;
+    }
+    /**
+     * Deep merge two objects
+     */
+    deepMerge(target, source) {
+        const output = { ...target };
+        if (this.isObject(target) && this.isObject(source)) {
+            Object.keys(source).forEach(key => {
+                if (this.isObject(source[key])) {
+                    if (!(key in target)) {
+                        output[key] = source[key];
+                    }
+                    else {
+                        output[key] = this.deepMerge(target[key], source[key]);
+                    }
+                }
+                else {
+                    output[key] = source[key];
+                }
+            });
+        }
+        return output;
+    }
+    isObject(item) {
+        return item && typeof item === "object" && !Array.isArray(item);
+    }
+}

package/dist/core/config-schema.js

@@ -0,0 +1 @@
+export {};

package/dist/core/pattern-engine.js

@@ -0,0 +1,105 @@
+export class PatternEngine {
+    constructor(patterns) {
+        this.patterns = patterns;
+    }
+    /**
+     * Scan text for pattern matches
+     */
+    scan(text) {
+        const matches = [];
+        for (const pattern of this.patterns) {
+            const regex = this.createRegex(pattern.regex);
+            let match;
+            while ((match = regex.exec(text)) !== null) {
+                matches.push({
+                    pattern,
+                    match: match[0],
+                    redacted: this.redact(match[0])
+                });
+            }
+        }
+        return matches;
+    }
+    /**
+     * Scan text with line/column information
+     */
+    scanWithPosition(text) {
+        const matches = [];
+        const lines = text.split("\n");
+        for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+            const line = lines[lineNum];
+            for (const pattern of this.patterns) {
+                const regex = this.createRegex(pattern.regex);
+                let match;
+                while ((match = regex.exec(line)) !== null) {
+                    matches.push({
+                        pattern,
+                        match: match[0],
+                        line: lineNum + 1,
+                        column: match.index + 1,
+                        redacted: this.redact(match[0])
+                    });
+                }
+            }
+        }
+        return matches;
+    }
+    /**
+     * Redact text by replacing sensitive patterns
+     */
+    redactText(text) {
+        let redacted = text;
+        for (const pattern of this.patterns) {
+            const regex = this.createRegex(pattern.regex);
+            redacted = redacted.replace(regex, (match) => this.redact(match));
+        }
+        return redacted;
+    }
+    /**
+     * Check if text contains any sensitive patterns
+     */
+    hasMatches(text) {
+        return this.scan(text).length > 0;
+    }
+    /**
+     * Get patterns by severity
+     */
+    getPatternsBySeverity(severity) {
+        return this.patterns.filter(p => p.severity === severity);
+    }
+    /**
+     * Create RegExp from pattern string, extracting inline flags
+     */
+    createRegex(patternStr) {
+        // Extract inline flags like (?i) and convert to JS flags
+        let flags = "g";
+        let pattern = patternStr;
+        // Check for case-insensitive flag
+        if (pattern.startsWith("(?i)")) {
+            flags += "i";
+            pattern = pattern.substring(4);
+        }
+        try {
+            return new RegExp(pattern, flags);
+        }
+        catch (e) {
+            // If pattern is invalid, return a regex that matches nothing
+            console.error(`Invalid regex pattern: ${patternStr}`);
+            return /(?!)/;
+        }
+    }
+    /**
+     * Redact a single match
+     */
+    redact(match) {
+        if (match.length <= 8) {
+            return "*".repeat(match.length);
+        }
+        // Show first 4 and last 4 chars, redact middle
+        const visibleChars = 4;
+        const start = match.substring(0, visibleChars);
+        const end = match.substring(match.length - visibleChars);
+        const middle = "*".repeat(match.length - (visibleChars * 2));
+        return start + middle + end;
+    }
+}