ai-control-center 1.15.2

package/lib/utils/plugin-runner.js

@@ -0,0 +1,234 @@
+/**
+ * Plugin Stage Architecture — extensible pipeline hooks.
+ *
+ * Plugins can hook into any pipeline stage to run custom logic
+ * before or after the stage executes. Supports lifecycle hooks,
+ * custom commands, and event-driven execution.
+ *
+ * Plugin format in aicc.config.js:
+ *   plugins: [
+ *     {
+ *       name: 'my-plugin',
+ *       stages: ['review', 'deploy'],       // which stages to hook into
+ *       beforeStage: async (ctx) => { },     // runs before stage
+ *       afterStage: async (ctx) => { },      // runs after stage
+ *       commands: { '/mycommand': handler }, // custom Telegram/CLI commands
+ *       onEvent: { 'feature_approved': handler }, // event listeners
+ *     }
+ *   ]
+ *
+ * Or as a path to a module:
+ *   plugins: ['./plugins/my-plugin.js']
+ */
+import { existsSync } from 'fs';
+import { resolve } from 'path';
+import { getConfig } from '../config.js';
+import { audit, AUDIT_EVENTS } from './audit-logger.js';
+
+// ─── Plugin Registry ─────────────────────────────────────────────────────────
+
+let _loadedPlugins = [];
+let _initialized = false;
+
+/**
+ * Load and initialize all plugins from config.
+ *
+ * @returns {Array} Loaded plugin objects
+ */
+export async function loadPlugins() {
+  if (_initialized) return _loadedPlugins;
+
+  try {
+    const config = getConfig();
+    const pluginDefs = config.plugins || [];
+    _loadedPlugins = [];
+
+    for (const def of pluginDefs) {
+      try {
+        let plugin;
+
+        if (typeof def === 'string') {
+          // Path to a plugin module
+          const pluginPath = resolve(config._root || '.', def);
+          if (!existsSync(pluginPath)) {
+            audit(AUDIT_EVENTS.PLUGIN_ERROR, { name: def, error: 'File not found' });
+            continue;
+          }
+          const mod = await import(pluginPath);
+          plugin = mod.default || mod;
+        } else if (typeof def === 'object') {
+          plugin = def;
+        } else {
+          continue;
+        }
+
+        // Validate plugin
+        if (!plugin.name) {
+          plugin.name = `plugin-${_loadedPlugins.length + 1}`;
+        }
+
+        _loadedPlugins.push({
+          name: plugin.name,
+          stages: plugin.stages || [],
+          beforeStage: plugin.beforeStage || null,
+          afterStage: plugin.afterStage || null,
+          commands: plugin.commands || {},
+          onEvent: plugin.onEvent || {},
+          enabled: plugin.enabled !== false,
+        });
+
+        audit(AUDIT_EVENTS.PLUGIN_LOADED, { name: plugin.name, stages: plugin.stages });
+      } catch (err) {
+        audit(AUDIT_EVENTS.PLUGIN_ERROR, {
+          name: typeof def === 'string' ? def : def?.name || 'unknown',
+          error: err.message,
+        });
+      }
+    }
+
+    _initialized = true;
+    return _loadedPlugins;
+  } catch {
+    _initialized = true;
+    return _loadedPlugins;
+  }
+}
+
+/**
+ * Run beforeStage hooks for all plugins registered for this stage.
+ *
+ * @param {string} stage    - Pipeline stage name
+ * @param {object} context  - Stage context (prompt, featureId, config, etc.)
+ * @returns {object} Modified context (plugins can mutate it)
+ */
+export async function runBeforeStage(stage, context = {}) {
+  const plugins = await loadPlugins();
+  const applicable = plugins.filter(p => p.enabled && p.beforeStage && (p.stages.length === 0 || p.stages.includes(stage)));
+
+  for (const plugin of applicable) {
+    try {
+      const result = await plugin.beforeStage({ ...context, stage, pluginName: plugin.name });
+      if (result && typeof result === 'object') {
+        Object.assign(context, result); // Allow plugins to modify context
+      }
+      audit(AUDIT_EVENTS.PLUGIN_EXECUTED, {
+        name: plugin.name,
+        hook: 'beforeStage',
+        stage,
+      });
+    } catch (err) {
+      audit(AUDIT_EVENTS.PLUGIN_ERROR, {
+        name: plugin.name,
+        hook: 'beforeStage',
+        stage,
+        error: err.message,
+      });
+    }
+  }
+
+  return context;
+}
+
+/**
+ * Run afterStage hooks for all plugins registered for this stage.
+ *
+ * @param {string} stage    - Pipeline stage name
+ * @param {object} context  - Stage context + result from stage execution
+ * @returns {object} Modified context
+ */
+export async function runAfterStage(stage, context = {}) {
+  const plugins = await loadPlugins();
+  const applicable = plugins.filter(p => p.enabled && p.afterStage && (p.stages.length === 0 || p.stages.includes(stage)));
+
+  for (const plugin of applicable) {
+    try {
+      const result = await plugin.afterStage({ ...context, stage, pluginName: plugin.name });
+      if (result && typeof result === 'object') {
+        Object.assign(context, result);
+      }
+      audit(AUDIT_EVENTS.PLUGIN_EXECUTED, {
+        name: plugin.name,
+        hook: 'afterStage',
+        stage,
+      });
+    } catch (err) {
+      audit(AUDIT_EVENTS.PLUGIN_ERROR, {
+        name: plugin.name,
+        hook: 'afterStage',
+        stage,
+        error: err.message,
+      });
+    }
+  }
+
+  return context;
+}
+
+/**
+ * Fire a plugin event — runs all plugins listening for this event.
+ *
+ * @param {string} eventName - Event name
+ * @param {object} data      - Event data
+ */
+export async function firePluginEvent(eventName, data = {}) {
+  const plugins = await loadPlugins();
+
+  for (const plugin of plugins) {
+    if (!plugin.enabled || !plugin.onEvent[eventName]) continue;
+
+    try {
+      await plugin.onEvent[eventName](data);
+    } catch (err) {
+      audit(AUDIT_EVENTS.PLUGIN_ERROR, {
+        name: plugin.name,
+        hook: 'onEvent',
+        event: eventName,
+        error: err.message,
+      });
+    }
+  }
+}
+
+/**
+ * Get all custom commands registered by plugins.
+ *
+ * @returns {object} Map of command → { pluginName, handler }
+ */
+export async function getPluginCommands() {
+  const plugins = await loadPlugins();
+  const commands = {};
+
+  for (const plugin of plugins) {
+    if (!plugin.enabled) continue;
+    for (const [cmd, handler] of Object.entries(plugin.commands)) {
+      commands[cmd] = { pluginName: plugin.name, handler };
+    }
+  }
+
+  return commands;
+}
+
+/**
+ * Get loaded plugin info for status display.
+ *
+ * @returns {Array} Plugin metadata
+ */
+export function getPluginStatus() {
+  return _loadedPlugins.map(p => ({
+    name: p.name,
+    enabled: p.enabled,
+    stages: p.stages,
+    hasBeforeStage: !!p.beforeStage,
+    hasAfterStage: !!p.afterStage,
+    commands: Object.keys(p.commands),
+    events: Object.keys(p.onEvent),
+  }));
+}
+
+/**
+ * Reset plugin registry (for testing or config reload).
+ */
+export function resetPlugins() {
+  _loadedPlugins = [];
+  _initialized = false;
+}

package/lib/utils/rate-limiter.js

@@ -0,0 +1,84 @@
+export const DEFAULT_RATE_LIMIT = {
+  windowMs: 60_000,
+  max: 60,
+  keyGenerator: (req) => req.ip,
+  skipPaths: ['/api/status', '/metrics'],
+};
+
+/** @type {Map<string, { timestamps: number[], blocked: number }>} */
+const clients = new Map();
+let totalBlocked = 0;
+let cleanupTimer = null;
+
+function startCleanup(windowMs) {
+  if (cleanupTimer) return;
+  cleanupTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of clients) {
+      entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+      if (entry.timestamps.length === 0) clients.delete(key);
+    }
+  }, 60_000);
+  if (cleanupTimer.unref) cleanupTimer.unref();
+}
+
+export function createRateLimiter(options = {}) {
+  const opts = { ...DEFAULT_RATE_LIMIT, ...options };
+  const { windowMs, max, keyGenerator, skipPaths } = opts;
+
+  startCleanup(windowMs);
+
+  return function rateLimitMiddleware(req, res, next) {
+    // Skip WebSocket upgrades
+    if (req.headers.upgrade === 'websocket') return next();
+
+    // Skip configured paths
+    if (skipPaths.some((p) => req.path === p || req.path.startsWith(p + '/'))) {
+      return next();
+    }
+
+    const key = keyGenerator(req);
+    const now = Date.now();
+
+    if (!clients.has(key)) {
+      clients.set(key, { timestamps: [], blocked: 0 });
+    }
+
+    const entry = clients.get(key);
+    // Sliding window: keep only timestamps within the current window
+    entry.timestamps = entry.timestamps.filter((t) => now - t < windowMs);
+
+    if (entry.timestamps.length >= max) {
+      const oldestInWindow = entry.timestamps[0];
+      const retryAfter = Math.ceil((oldestInWindow + windowMs - now) / 1000);
+
+      entry.blocked++;
+      totalBlocked++;
+
+      res.set('Retry-After', String(retryAfter));
+      return res.status(429).json({
+        error: 'Too many requests',
+        retryAfter,
+      });
+    }
+
+    entry.timestamps.push(now);
+    return next();
+  };
+}
+
+export function getRateLimitStatus() {
+  let activeClients = 0;
+  let totalTracked = 0;
+  for (const entry of clients.values()) {
+    if (entry.timestamps.length > 0) {
+      activeClients++;
+      totalTracked += entry.timestamps.length;
+    }
+  }
+  return {
+    activeClients,
+    totalTracked,
+    totalBlocked,
+  };
+}

package/lib/utils/rbac.js

@@ -0,0 +1,74 @@
+import { getConfig } from '../config.js';
+
+export const ROLES = {
+  admin: {
+    permissions: [
+      'feature', 'deploy', 'approve', 'reject', 'review', 'implement',
+      'fix', 'reset', 'cleanup', 'config', 'retry', 'dryrun', 'audit',
+      'cost', 'status', 'logs', 'docs', 'health', 'ask'
+    ]
+  },
+  developer: {
+    permissions: [
+      'feature', 'review', 'implement', 'fix', 'status', 'logs',
+      'docs', 'cost', 'retry', 'dryrun', 'ask'
+    ]
+  },
+  viewer: {
+    permissions: ['status', 'logs', 'docs', 'health', 'cost', 'ask']
+  }
+};
+
+export const PERMISSIONS = [...new Set(
+  Object.values(ROLES).flatMap(r => r.permissions)
+)];
+
+function getRBACConfig() {
+  try {
+    const config = getConfig();
+    return config.rbac || null;
+  } catch {
+    return null;
+  }
+}
+
+export function isRBACEnabled() {
+  const rbac = getRBACConfig();
+  return rbac !== null && Object.keys(rbac).length > 0;
+}
+
+export function getUserRole(userId) {
+  if (!isRBACEnabled()) return 'admin';
+  const rbac = getRBACConfig();
+  const users = rbac.users || {};
+  return users[String(userId)] || rbac.defaultRole || 'viewer';
+}
+
+export function hasPermission(userId, action) {
+  const role = getUserRole(userId);
+  const roleDef = ROLES[role];
+  if (!roleDef) return false;
+  return roleDef.permissions.includes(action);
+}
+
+export function requirePermission(userId, action) {
+  if (!hasPermission(userId, action)) {
+    const role = getUserRole(userId);
+    throw new Error(
+      `Permission denied: role '${role}' cannot perform '${action}'`
+    );
+  }
+  return true;
+}
+
+export function checkApiKey(apiKey) {
+  if (!isRBACEnabled()) return 'admin';
+  const rbac = getRBACConfig();
+  const apiKeys = rbac.apiKeys || {};
+  return apiKeys[apiKey] || null;
+}
+
+export function listPermissions(role) {
+  const roleDef = ROLES[role];
+  return roleDef ? [...roleDef.permissions] : [];
+}