aios-core 1.0.0

package/.aios-core/core/utils/output-formatter.js

@@ -0,0 +1,298 @@
+/**
+ * Personalized Output Formatter - Layer 2 of Agent Identity System
+ *
+ * Implements template engine with personality injection while maintaining
+ * fixed output structure (familiaridade + personalização).
+ *
+ * @module core/utils/output-formatter
+ * @migrated Story 2.2 - Core Module Creation
+ * Story: 6.1.6 - Output Formatter Implementation
+ * Performance Target: <50ms per output generation
+ */
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+/**
+ * Personalized Output Formatter
+ *
+ * Generates standardized task execution reports with agent personality injection.
+ * Maintains fixed structure (Duration line 7, Tokens line 8, Metrics last) while
+ * allowing flexible tone/vocabulary in status messages.
+ */
+class PersonalizedOutputFormatter {
+  /**
+   * @param {Object} agent - Agent definition object
+   * @param {Object} task - Task information
+   * @param {Object} results - Task execution results
+   */
+  constructor(agent, task, results) {
+    this.agent = agent;
+    this.task = task;
+    this.results = results;
+    this.personaProfile = null;
+    this.vocabularyCache = new Map();
+
+    // Load persona_profile from agent
+    this._loadPersonaProfile();
+  }
+
+  /**
+   * Load persona_profile from agent file
+   * @private
+   */
+  _loadPersonaProfile() {
+    try {
+      if (!this.agent || !this.agent.id) {
+        console.warn('[OutputFormatter] Agent ID missing, using neutral profile');
+        this.personaProfile = this._getNeutralProfile();
+        return;
+      }
+
+      const agentPath = path.join(process.cwd(), '.aios-core', 'agents', `${this.agent.id}.md`);
+
+      if (!fs.existsSync(agentPath)) {
+        console.warn(`[OutputFormatter] Agent file not found: ${agentPath}`);
+        this.personaProfile = this._getNeutralProfile();
+        return;
+      }
+
+      const content = fs.readFileSync(agentPath, 'utf8');
+      const yamlMatch = content.match(/```ya?ml\r?\n([\s\S]*?)\r?\n```/);
+
+      if (!yamlMatch) {
+        console.warn('[OutputFormatter] No YAML block found in agent file');
+        this.personaProfile = this._getNeutralProfile();
+        return;
+      }
+
+      const agentConfig = yaml.load(yamlMatch[1]);
+      this.personaProfile = agentConfig.persona_profile || this._getNeutralProfile();
+
+      // Cache vocabulary for performance
+      if (this.personaProfile.communication?.vocabulary) {
+        this.vocabularyCache.set(this.agent.id, this.personaProfile.communication.vocabulary);
+      }
+    } catch (error) {
+      console.warn(`[OutputFormatter] Error loading persona_profile: ${error.message}`);
+      this.personaProfile = this._getNeutralProfile();
+    }
+  }
+
+  /**
+   * Get neutral profile for graceful degradation
+   * @private
+   * @returns {Object} Neutral persona profile
+   */
+  _getNeutralProfile() {
+    return {
+      archetype: 'Agent',
+      communication: {
+        tone: 'neutral',
+        emoji_frequency: 'low',
+        vocabulary: ['completar', 'executar', 'finalizar'],
+        greeting_levels: {
+          minimal: 'Agent ready',
+          named: 'Agent ready',
+          archetypal: 'Agent ready',
+        },
+        signature_closing: '— Agent',
+      },
+    };
+  }
+
+  /**
+   * Generate complete formatted output
+   * @returns {string} Formatted markdown output
+   */
+  format() {
+    const startTime = process.hrtime.bigint();
+
+    try {
+      const header = this.buildFixedHeader();
+      const status = this.buildPersonalizedStatus();
+      const output = this.buildOutput();
+      const metrics = this.buildFixedMetrics();
+      const signature = this.buildSignature();
+
+      const formatted = [
+        header,
+        '',
+        '---',
+        '',
+        status,
+        '',
+        output,
+        '',
+        metrics,
+        '',
+        '---',
+        signature,
+      ].join('\n');
+
+      const duration = Number(process.hrtime.bigint() - startTime) / 1000000; // Convert to ms
+      if (duration > 100) {
+        console.warn(`[OutputFormatter] Performance warning: ${duration.toFixed(2)}ms (target: <50ms)`);
+      }
+
+      return formatted;
+    } catch (error) {
+      console.error(`[OutputFormatter] Format error: ${error.message}`);
+      throw error;
+    }
+  }
+
+  /**
+   * Build fixed header section (always same format)
+   * Line 7: Duration
+   * Line 8: Tokens Used
+   * @returns {string} Header markdown
+   */
+  buildFixedHeader() {
+    const agentName = this.agent?.name || this.agent?.id || 'Agent';
+    const archetype = this.personaProfile?.archetype || 'Agent';
+    const taskName = this.task?.name || 'task';
+    const startTime = this.results?.startTime || new Date().toISOString();
+    const endTime = this.results?.endTime || new Date().toISOString();
+    const duration = this.results?.duration || '0s';
+    const tokensTotal = this.results?.tokens?.total || 0;
+    const tokensFormatted = tokensTotal.toLocaleString('en-US');
+
+    return `## 📊 Task Execution Report
+
+**Agent:** ${agentName} (${archetype})
+**Task:** ${taskName}
+**Started:** ${startTime}
+**Completed:** ${endTime}
+**Duration:** ${duration}
+**Tokens Used:** ${tokensFormatted} total`;
+  }
+
+  /**
+   * Build personalized status message
+   * Uses agent vocabulary and tone for personality injection
+   * @returns {string} Status section markdown
+   */
+  buildPersonalizedStatus() {
+    const tone = this.personaProfile?.communication?.tone || 'neutral';
+    const vocabulary = this.personaProfile?.communication?.vocabulary || [];
+    const verb = this.selectVerbFromVocabulary(vocabulary);
+    const message = this.generateSuccessMessage(tone, verb);
+    const statusIcon = this.results?.success !== false ? '✅' : '❌';
+
+    return `### Status
+${statusIcon} ${message}`;
+  }
+
+  /**
+   * Build output section with task-specific content
+   * @returns {string} Output section markdown
+   */
+  buildOutput() {
+    const outputContent = this.results?.output || this.results?.content || 'Task completed successfully.';
+
+    return `### Output
+${outputContent}`;
+  }
+
+  /**
+   * Build fixed metrics section (always last)
+   * @returns {string} Metrics section markdown
+   */
+  buildFixedMetrics() {
+    const testsPassed = this.results?.tests?.passed || 0;
+    const testsTotal = this.results?.tests?.total || 0;
+    const coverage = this.results?.coverage || 'N/A';
+    const lintStatus = this.results?.linting?.status || '✅ Clean';
+
+    return `### Metrics
+- Tests: ${testsPassed}/${testsTotal}
+- Coverage: ${coverage}%
+- Linting: ${lintStatus}`;
+  }
+
+  /**
+   * Build signature closing with personality
+   * @returns {string} Signature markdown
+   */
+  buildSignature() {
+    const signature = this.personaProfile?.communication?.signature_closing || '— Agent';
+    return signature;
+  }
+
+  /**
+   * Select appropriate verb from vocabulary array
+   * @param {Array<string>} vocabulary - Agent vocabulary array
+   * @returns {string} Selected verb
+   */
+  selectVerbFromVocabulary(vocabulary) {
+    if (!vocabulary || vocabulary.length === 0) {
+      return 'completar';
+    }
+
+    // Simple selection: use first verb (can be enhanced with context-aware selection)
+    return vocabulary[0];
+  }
+
+  /**
+   * Generate success message based on tone
+   * @param {string} tone - Agent tone (pragmatic, empathetic, analytical, collaborative, neutral)
+   * @param {string} verb - Selected verb from vocabulary
+   * @returns {string} Personalized status message
+   */
+  generateSuccessMessage(tone, verb) {
+    const verbPast = this._getPastTense(verb);
+
+    switch (tone) {
+      case 'pragmatic':
+        return `Tá pronto! ${this._capitalize(verbPast)} com sucesso.`;
+
+      case 'empathetic':
+        return `${this._capitalize(verbPast)} com cuidado e atenção aos detalhes.`;
+
+      case 'analytical':
+        return `${this._capitalize(verbPast)} rigorosamente. Todos os critérios validados.`;
+
+      case 'collaborative':
+        return `${this._capitalize(verbPast)} e harmonizado. Todos os aspectos alinhados.`;
+
+      case 'neutral':
+      default:
+        return `Task ${verbPast} successfully.`;
+    }
+  }
+
+  /**
+   * Get past tense of Portuguese verb (simple conversion)
+   * @private
+   * @param {string} verb - Verb in infinitive form
+   * @returns {string} Past tense verb
+   */
+  _getPastTense(verb) {
+    // Simple Portuguese past tense conversion
+    if (verb.endsWith('ar')) {
+      return verb.replace(/ar$/, 'ado');
+    } else if (verb.endsWith('er')) {
+      return verb.replace(/er$/, 'ido');
+    } else if (verb.endsWith('ir')) {
+      return verb.replace(/ir$/, 'ido');
+    } else if (verb.endsWith('or')) {
+      // Special case: construir -> construído (but we'll use simple form)
+      return verb.replace(/or$/, 'ido');
+    }
+    return verb; // Fallback
+  }
+
+  /**
+   * Capitalize first letter
+   * @private
+   * @param {string} str - String to capitalize
+   * @returns {string} Capitalized string
+   */
+  _capitalize(str) {
+    return str.charAt(0).toUpperCase() + str.slice(1);
+  }
+}
+
+module.exports = PersonalizedOutputFormatter;

package/.aios-core/core/utils/security-utils.js

@@ -0,0 +1,333 @@
+/**
+ * Security Utilities for Synkra AIOS
+ * Provides centralized security functions for input validation and sanitization
+ *
+ * @module security-utils
+ * @version 1.0.0
+ * @created 2025-12-05 (Story 4.1)
+ */
+
+const path = require('path');
+
+/**
+ * Validates a file path to prevent path traversal attacks
+ *
+ * @param {string} filePath - The path to validate
+ * @param {Object} options - Validation options
+ * @param {string} [options.basePath] - Base path to restrict operations to
+ * @param {boolean} [options.allowAbsolute=false] - Whether to allow absolute paths
+ * @returns {Object} Validation result with {valid: boolean, normalized: string, errors: string[]}
+ */
+function validatePath(filePath, options = {}) {
+  const result = {
+    valid: true,
+    normalized: null,
+    errors: [],
+  };
+
+  // Check for null/undefined input
+  if (!filePath || typeof filePath !== 'string') {
+    result.valid = false;
+    result.errors.push('Path must be a non-empty string');
+    return result;
+  }
+
+  // Normalize the path
+  const normalized = path.normalize(filePath);
+  result.normalized = normalized;
+
+  // Check for path traversal attempts (../ or ..\)
+  if (filePath.includes('..') || normalized.includes('..')) {
+    result.valid = false;
+    result.errors.push('Path traversal detected: ".." is not allowed');
+  }
+
+  // Check for null bytes (null byte injection)
+  if (filePath.includes('\0')) {
+    result.valid = false;
+    result.errors.push('Null byte detected in path');
+  }
+
+  // Check for absolute paths if not allowed
+  if (!options.allowAbsolute && path.isAbsolute(normalized)) {
+    result.valid = false;
+    result.errors.push('Absolute paths are not allowed');
+  }
+
+  // If basePath is provided, ensure the resolved path stays within it
+  if (options.basePath && result.valid) {
+    const resolvedPath = path.resolve(options.basePath, normalized);
+    const resolvedBase = path.resolve(options.basePath);
+
+    if (!resolvedPath.startsWith(resolvedBase + path.sep) && resolvedPath !== resolvedBase) {
+      result.valid = false;
+      result.errors.push('Path escapes the allowed base directory');
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Sanitizes user input to prevent injection attacks
+ *
+ * @param {string} input - The input to sanitize
+ * @param {string} type - Type of sanitization ('general'|'filename'|'identifier'|'shell'|'html')
+ * @returns {string} Sanitized input
+ */
+function sanitizeInput(input, type = 'general') {
+  if (typeof input !== 'string') {
+    return input;
+  }
+
+  // Remove null bytes from all inputs
+  let sanitized = input.replace(/\0/g, '');
+
+  switch (type) {
+    case 'filename':
+      // Allow only safe filename characters
+      sanitized = sanitized.replace(/[^a-zA-Z0-9\-_\.]/g, '_');
+      // Prevent hidden files/directories
+      sanitized = sanitized.replace(/^\.+/, '');
+      break;
+
+    case 'identifier':
+      // Allow only alphanumeric, dash, and underscore
+      sanitized = sanitized.replace(/[^a-zA-Z0-9\-_]/g, '_');
+      break;
+
+    case 'shell':
+      // Escape shell special characters
+      sanitized = sanitized.replace(/[;&|`$(){}[\]<>!#*?\\'"]/g, '');
+      break;
+
+    case 'html':
+      // Escape HTML entities
+      sanitized = sanitized
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#x27;')
+        .replace(/\//g, '&#x2F;');
+      break;
+
+    case 'general':
+    default:
+      // Basic sanitization - remove control characters except newlines and tabs
+      sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+      break;
+  }
+
+  return sanitized;
+}
+
+/**
+ * Validates JSON input safely
+ *
+ * @param {string} jsonString - JSON string to validate and parse
+ * @param {Object} options - Options
+ * @param {number} [options.maxSize=1048576] - Maximum allowed size in bytes (default 1MB)
+ * @param {number} [options.maxDepth=10] - Maximum allowed nesting depth
+ * @returns {Object} Result with {valid: boolean, data: any, error: string}
+ */
+function validateJSON(jsonString, options = {}) {
+  const { maxSize = 1048576, maxDepth = 10 } = options;
+  const result = {
+    valid: true,
+    data: null,
+    error: null,
+  };
+
+  // Check for null/undefined input
+  if (!jsonString || typeof jsonString !== 'string') {
+    result.valid = false;
+    result.error = 'JSON input must be a non-empty string';
+    return result;
+  }
+
+  // Check size limit
+  if (jsonString.length > maxSize) {
+    result.valid = false;
+    result.error = `JSON exceeds maximum size of ${maxSize} bytes`;
+    return result;
+  }
+
+  // Parse JSON
+  try {
+    result.data = JSON.parse(jsonString);
+  } catch (error) {
+    result.valid = false;
+    result.error = `Invalid JSON: ${error.message}`;
+    return result;
+  }
+
+  // Check nesting depth
+  const depth = getObjectDepth(result.data);
+  if (depth > maxDepth) {
+    result.valid = false;
+    result.error = `JSON nesting depth (${depth}) exceeds maximum of ${maxDepth}`;
+    return result;
+  }
+
+  return result;
+}
+
+/**
+ * Gets the maximum depth of a nested object
+ * @private
+ */
+function getObjectDepth(obj, currentDepth = 0) {
+  if (typeof obj !== 'object' || obj === null) {
+    return currentDepth;
+  }
+
+  let maxDepth = currentDepth;
+  for (const value of Object.values(obj)) {
+    if (typeof value === 'object' && value !== null) {
+      const depth = getObjectDepth(value, currentDepth + 1);
+      maxDepth = Math.max(maxDepth, depth);
+    }
+  }
+
+  return maxDepth;
+}
+
+/**
+ * Simple in-memory rate limiter
+ *
+ * @class RateLimiter
+ */
+class RateLimiter {
+  /**
+   * @param {Object} options - Rate limiter options
+   * @param {number} [options.maxRequests=100] - Maximum requests per window
+   * @param {number} [options.windowMs=60000] - Time window in milliseconds
+   */
+  constructor(options = {}) {
+    this.maxRequests = options.maxRequests || 100;
+    this.windowMs = options.windowMs || 60000; // 1 minute default
+    this.requests = new Map();
+  }
+
+  /**
+   * Check if a request should be allowed
+   *
+   * @param {string} key - Unique identifier for the requester (e.g., user ID, IP)
+   * @returns {Object} Result with {allowed: boolean, remaining: number, resetTime: number}
+   */
+  check(key) {
+    const now = Date.now();
+    const windowStart = now - this.windowMs;
+
+    // Get or create request history for this key
+    let history = this.requests.get(key);
+    if (!history) {
+      history = [];
+      this.requests.set(key, history);
+    }
+
+    // Remove old requests outside the window
+    history = history.filter(timestamp => timestamp > windowStart);
+    this.requests.set(key, history);
+
+    // Check if limit exceeded
+    const allowed = history.length < this.maxRequests;
+    const remaining = Math.max(0, this.maxRequests - history.length);
+    const resetTime = history.length > 0 ? history[0] + this.windowMs : now + this.windowMs;
+
+    // Record this request if allowed
+    if (allowed) {
+      history.push(now);
+    }
+
+    return {
+      allowed,
+      remaining,
+      resetTime,
+      retryAfter: allowed ? 0 : Math.ceil((resetTime - now) / 1000),
+    };
+  }
+
+  /**
+   * Reset the rate limiter for a specific key
+   * @param {string} key - Key to reset
+   */
+  reset(key) {
+    this.requests.delete(key);
+  }
+
+  /**
+   * Clear all rate limit data
+   */
+  clear() {
+    this.requests.clear();
+  }
+
+  /**
+   * Clean up expired entries (call periodically for memory management)
+   */
+  cleanup() {
+    const now = Date.now();
+    const windowStart = now - this.windowMs;
+
+    for (const [key, history] of this.requests.entries()) {
+      const filtered = history.filter(timestamp => timestamp > windowStart);
+      if (filtered.length === 0) {
+        this.requests.delete(key);
+      } else {
+        this.requests.set(key, filtered);
+      }
+    }
+  }
+}
+
+/**
+ * Creates a safe path within a base directory
+ *
+ * @param {string} basePath - The base directory
+ * @param {...string} segments - Path segments to join
+ * @returns {string|null} Safe path or null if validation fails
+ */
+function safePath(basePath, ...segments) {
+  const joinedPath = path.join(...segments);
+  const validation = validatePath(joinedPath, { basePath });
+
+  if (!validation.valid) {
+    return null;
+  }
+
+  return path.join(basePath, validation.normalized);
+}
+
+/**
+ * Checks if a value is a safe string (no injection attempts)
+ *
+ * @param {any} value - Value to check
+ * @returns {boolean} True if safe
+ */
+function isSafeString(value) {
+  if (typeof value !== 'string') {
+    return false;
+  }
+
+  // Check for common injection patterns
+  const dangerousPatterns = [
+    /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/, // Control characters
+    /\.\.\//,  // Path traversal
+    /\$\{/,    // Template injection
+    /\0/,      // Null byte
+  ];
+
+  return !dangerousPatterns.some(pattern => pattern.test(value));
+}
+
+module.exports = {
+  validatePath,
+  sanitizeInput,
+  validateJSON,
+  RateLimiter,
+  safePath,
+  isSafeString,
+  getObjectDepth,
+};