@way_marks/server 0.8.0 → 1.0.0

package/dist/rollback/blocker.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Auto-Block Rules Engine — Phase 4D
+ *
+ * Automatically blocks risky rollbacks based on:
+ * - Risk assessment score
+ * - Policy violations
+ * - Configured block rules
+ *
+ * Prevents rollback of:
+ * - High-risk operations (score > threshold)
+ * - Policy-violating operations
+ * - Manual block rules
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateAutoBlock = evaluateAutoBlock;
+exports.createBlock = createBlock;
+exports.unblockSession = unblockSession;
+exports.getDefaultBlockRules = getDefaultBlockRules;
+/**
+ * Evaluate if rollback should be auto-blocked
+ */
+function evaluateAutoBlock(session, actions, riskAssessment, policyViolations, blockRules, riskThreshold = 7.0, userRole = 'user') {
+    const blockingRules = [];
+    const blockedAt = new Date().toISOString();
+    const blockId = generateBlockId();
+    // Check risk score threshold
+    const isHighRisk = riskAssessment.score >= riskThreshold;
+    // Check matching block rules
+    const matchingRules = blockRules.filter(rule => rule.enabled && evaluateBlockRuleCondition(rule.condition, actions, session));
+    blockingRules.push(...matchingRules);
+    // Check policy violations with block action
+    const blockingViolations = policyViolations.filter(v => v.action === 'block');
+    // Determine if blocked
+    const hasBlockingViolations = blockingViolations.length > 0;
+    const blocked = isHighRisk || blockingRules.length > 0 || hasBlockingViolations;
+    // Generate reason
+    let reason = '';
+    const reasons = [];
+    if (isHighRisk) {
+        reasons.push(`Risk score ${riskAssessment.score.toFixed(1)}/10 exceeds threshold ${riskThreshold}`);
+    }
+    if (blockingRules.length > 0) {
+        reasons.push(`${blockingRules.length} block rule(s) matched`);
+    }
+    if (hasBlockingViolations) {
+        reasons.push(`${blockingViolations.length} policy violation(s) require blocking`);
+    }
+    reason = reasons.join('; ');
+    // Determine override capability
+    const canOverride = userRole === 'admin' || userRole === 'super_admin';
+    const overrideRole = userRole === 'admin' || userRole === 'super_admin' ? 'admin' : 'admin';
+    const result = {
+        blocked,
+        reason: blocked ? reason : undefined,
+        blocking_rules: blockingRules,
+        policy_violations: blockingViolations,
+        risk_score: riskAssessment.score,
+        can_override: canOverride,
+        override_required_role: overrideRole,
+    };
+    if (blocked) {
+        result.block_id = blockId;
+        result.blocked_at = blockedAt;
+    }
+    return result;
+}
+/**
+ * Evaluate block rule condition
+ */
+function evaluateBlockRuleCondition(condition, actions, session) {
+    // Use same logic as policy conditions
+    // Check if any action matches
+    for (const action of actions) {
+        if (matchCondition(condition, action, session)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Simple condition matcher
+ */
+function matchCondition(condition, action, session) {
+    switch (condition.type) {
+        case 'operation_type':
+        case 'tool_name':
+            return matchString(action.tool_name, condition.value, condition.operator);
+        case 'action_count':
+            return matchNumeric(session.action_count, condition.value, condition.operator);
+        case 'file_pattern':
+            const target = action.target || '';
+            return matchString(target, condition.value, condition.operator);
+        case 'error_present':
+            const hasError = action.status === 'error';
+            return hasError === (condition.value === 'true');
+        default:
+            return false;
+    }
+}
+/**
+ * String comparison
+ */
+function matchString(actual, expected, operator) {
+    if (operator === 'equals' || operator === 'in') {
+        if (Array.isArray(expected)) {
+            return expected.includes(actual);
+        }
+        return actual === String(expected);
+    }
+    if (operator === 'contains') {
+        if (Array.isArray(expected)) {
+            return expected.some(e => actual.includes(String(e)));
+        }
+        return actual.includes(String(expected));
+    }
+    if (operator === 'matches_regex') {
+        try {
+            const regex = new RegExp(String(expected));
+            return regex.test(actual);
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Numeric comparison
+ */
+function matchNumeric(actual, expected, operator) {
+    const expectedNum = typeof expected === 'number' ? expected : parseInt(String(expected), 10);
+    if (isNaN(expectedNum))
+        return false;
+    switch (operator) {
+        case 'equals':
+            return actual === expectedNum;
+        case 'greater_than':
+            return actual > expectedNum;
+        case 'less_than':
+            return actual < expectedNum;
+        default:
+            return false;
+    }
+}
+/**
+ * Create a block for a session
+ */
+function createBlock(sessionId, riskScore, reason, ruleId, policyViolationCount = 0) {
+    return {
+        block_id: generateBlockId(),
+        session_id: sessionId,
+        rule_id: ruleId,
+        policy_violation_count: policyViolationCount,
+        risk_score: riskScore,
+        reason,
+        blocked_at: new Date().toISOString(),
+    };
+}
+/**
+ * Unblock a session (admin override)
+ */
+function unblockSession(block, unblockedBy, reason, overrideToken) {
+    return {
+        ...block,
+        unblocked_at: new Date().toISOString(),
+        unblocked_by: unblockedBy,
+        unblock_reason: reason,
+        override_token: overrideToken,
+    };
+}
+/**
+ * Generate unique block ID
+ */
+function generateBlockId() {
+    return `block-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+}
+/**
+ * Get default block rules
+ */
+function getDefaultBlockRules() {
+    return [
+        {
+            rule_id: 'block-production-delete-hours',
+            name: 'Production Delete During Off-Hours',
+            description: 'Block delete operations in production environment during off-hours',
+            condition: {
+                type: 'operation_type',
+                operator: 'equals',
+                value: 'delete_file',
+            },
+            action: 'block',
+            severity: 'error',
+            message: 'Cannot delete files during off-hours in production',
+            enabled: true,
+            created_at: new Date().toISOString(),
+            created_by: 'system',
+        },
+        {
+            rule_id: 'block-large-batch-delete',
+            name: 'Large Batch Delete Protection',
+            description: 'Block deletion of more than 20 files in single session',
+            condition: {
+                type: 'action_count',
+                operator: 'greater_than',
+                value: 20,
+            },
+            action: 'require_approval',
+            severity: 'warning',
+            message: 'Large batch deletion requires approval',
+            enabled: true,
+            created_at: new Date().toISOString(),
+            created_by: 'system',
+        },
+    ];
+}
+exports.default = {
+    evaluateAutoBlock,
+    createBlock,
+    unblockSession,
+    getDefaultBlockRules,
+};

package/dist/rollback/manager.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * Rollback Manager
+ *
+ * Handles atomic, all-or-nothing rollback of entire agent sessions.
+ * Restores files from snapshots, records rollback operations, and maintains audit trail.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateRollbackable = validateRollbackable;
+exports.createRollbackTransaction = createRollbackTransaction;
+exports.executeRollbackTransaction = executeRollbackTransaction;
+exports.rollbackSession = rollbackSession;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const database_1 = require("../db/database");
+/**
+ * Parse a snapshot JSON to extract file information
+ */
+function parseSnapshot(snapshotJson) {
+    if (!snapshotJson)
+        return null;
+    try {
+        return JSON.parse(snapshotJson);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Validate that all actions in session are rollbackable
+ */
+function validateRollbackable(actions) {
+    const errors = [];
+    for (const action of actions) {
+        // Check if action is marked as reversible
+        if (action.is_reversible === 0) {
+            errors.push({
+                action_id: action.action_id,
+                reason: 'Action marked as non-reversible',
+            });
+        }
+        // For write_file actions, check if we have before_snapshot
+        if (action.tool_name === 'write_file' && !action.before_snapshot) {
+            errors.push({
+                action_id: action.action_id,
+                reason: 'Missing before_snapshot for write_file action',
+            });
+        }
+        // For bash actions, warn if they had side effects (e.g., database mutations)
+        if (action.tool_name === 'bash') {
+            const inputPayload = JSON.parse(action.input_payload || '{}');
+            const command = inputPayload.command || '';
+            // List of dangerous patterns that can't be rolled back
+            const irreversiblePatterns = [
+                /DROP\s+TABLE/i,
+                /DELETE\s+FROM/i,
+                /TRUNCATE/i,
+                /rm\s+-rf/,
+                /git\s+push/,
+                /npm\s+publish/,
+            ];
+            for (const pattern of irreversiblePatterns) {
+                if (pattern.test(command)) {
+                    errors.push({
+                        action_id: action.action_id,
+                        reason: `Bash command contains irreversible operation: "${command.substring(0, 50)}"`,
+                    });
+                }
+            }
+        }
+    }
+    return {
+        isValid: errors.length === 0,
+        errors,
+        warningCount: 0,
+    };
+}
+/**
+ * Create a rollback transaction (plan, don't execute)
+ */
+function createRollbackTransaction(session_id, actions) {
+    const fileRestores = [];
+    for (const action of actions) {
+        // Only process write_file actions for file restoration
+        if (action.tool_name === 'write_file') {
+            const snapshot = parseSnapshot(action.before_snapshot);
+            if (snapshot) {
+                fileRestores.push({
+                    action_id: action.action_id,
+                    file_path: snapshot.file_path,
+                    snapshot,
+                });
+            }
+        }
+    }
+    return {
+        session_id,
+        actions,
+        fileRestores,
+    };
+}
+/**
+ * Execute rollback transaction (atomic, all-or-nothing)
+ */
+function executeRollbackTransaction(transaction) {
+    try {
+        // Phase 1: Validate all files can be restored before making any changes
+        const projectRoot = process.env.WAYMARK_PROJECT_ROOT || process.cwd();
+        for (const restore of transaction.fileRestores) {
+            const fullPath = path.resolve(projectRoot, restore.file_path);
+            // Check write permissions
+            if (fs.existsSync(fullPath)) {
+                try {
+                    // Try to stat the file to ensure we can access it
+                    fs.statSync(fullPath);
+                }
+                catch (err) {
+                    throw new Error(`Cannot access file for rollback: ${fullPath}`);
+                }
+            }
+        }
+        // Phase 2: Restore all files (all-or-nothing)
+        let filesRestored = 0;
+        for (const restore of transaction.fileRestores) {
+            const fullPath = path.resolve(projectRoot, restore.file_path);
+            if (restore.snapshot.existed === false) {
+                // File didn't exist before, so delete it
+                if (fs.existsSync(fullPath)) {
+                    fs.unlinkSync(fullPath);
+                }
+            }
+            else {
+                // File existed, restore its content
+                const dir = path.dirname(fullPath);
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true });
+                }
+                fs.writeFileSync(fullPath, restore.snapshot.content || '', 'utf-8');
+            }
+            filesRestored++;
+        }
+        // Phase 3: Mark actions as rolled back in database
+        for (const action of transaction.actions) {
+            (0, database_1.markRolledBack)(action.action_id);
+        }
+        // Phase 4: Mark session as rolled back
+        (0, database_1.markSessionRolledBack)(transaction.session_id);
+        return {
+            success: true,
+            filesRestored,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            filesRestored: 0,
+            error: error.message,
+        };
+    }
+}
+/**
+ * Rollback entire session (high-level API)
+ *
+ * Steps:
+ * 1. Get all actions in session
+ * 2. Validate all are reversible
+ * 3. Create rollback transaction
+ * 4. Execute rollback (atomic)
+ * 5. Record audit trail
+ */
+function rollbackSession(session_id) {
+    try {
+        // Get actions
+        const actions = (0, database_1.getSessionActions)(session_id);
+        if (actions.length === 0) {
+            return {
+                success: false,
+                message: `Session ${session_id} has no actions to rollback`,
+            };
+        }
+        // Validate
+        const validation = validateRollbackable(actions);
+        if (!validation.isValid) {
+            const errorList = validation.errors.map((e) => `${e.action_id}: ${e.reason}`).join('; ');
+            return {
+                success: false,
+                message: `Cannot rollback session: ${errorList}`,
+            };
+        }
+        // Create transaction
+        const transaction = createRollbackTransaction(session_id, actions);
+        // Execute transaction
+        const result = executeRollbackTransaction(transaction);
+        if (!result.success) {
+            return {
+                success: false,
+                message: result.error || 'Unknown error during rollback',
+            };
+        }
+        return {
+            success: true,
+            message: `Successfully rolled back ${actions.length} action(s), restored ${result.filesRestored} file(s)`,
+            filesRestored: result.filesRestored,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            message: `Rollback failed: ${error.message}`,
+        };
+    }
+}