atabey 0.0.37 → 0.1.0

package/dist/shared/src/modules/security/retention.js

@@ -0,0 +1,218 @@
+/**
+ * [KVKK/GDPR] Data Retention & Privacy Service
+ *
+ * KVKK Art. 4, 5, 7, 11 and GDPR Art. 5, 17 compliant data retention management.
+ *
+ * Features:
+ * - Automatic expired record cleanup
+ * - Data categorization (operational, user_data, api_call, security, compliance)
+ * - "Right to Erasure" support
+ * - Configurable retention policies
+ * - Periodic cleanup cron job
+ */
+import { Audit } from "../observability/audit.js";
+import { logger } from "../observability/logger.js";
+import { databaseHolder } from "../storage/database.js";
+import { clearChainAnchor, writeChainAnchor } from "../observability/audit-chain.js";
+/**
+ * Data retention categories and default durations (days)
+ */
+export const RETENTION_POLICIES = {
+    OPERATIONAL: 30, // Operational logs: 30 days
+    USER_DATA: 90, // User data: 90 days (KVKK Art. 5)
+    API_CALL: 180, // API call records: 180 days
+    SECURITY: 365, // Security logs: 1 year
+    COMPLIANCE: 730, // Compliance records: 2 years
+};
+/**
+ * [KVKK/GDPR] Data Retention Manager
+ */
+export class DataRetention {
+    static cleanupInterval = null;
+    /**
+   * Initialize data retention with automatic cleanup.
+   * Starts a periodic cleanup job.
+   *
+   * @param intervalMs Cleanup interval in milliseconds (default: 1 hour)
+   */
+    static initialize(intervalMs = 3600000) {
+        // Run initial cleanup
+        this.runCleanup();
+        // Schedule periodic cleanup
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+        }
+        this.cleanupInterval = setInterval(() => this.runCleanup(), intervalMs);
+        logger.info("[RETENTION] Data retention initialized. " +
+            `Cleanup interval: ${intervalMs / 60000}min. ` +
+            `Policies: ${Object.entries(RETENTION_POLICIES).map(([k, v]) => `${k}=${v}d`).join(", ")}`);
+    }
+    /**
+   * Run cleanup for all data stores.
+   * Cleans audit logs, messages, and logs based on retention policies.
+   */
+    static runCleanup() {
+        const result = { audit: 0, messages: 0, logs: 0 };
+        try {
+            // 1. Clean audit logs
+            result.audit = Audit.cleanExpired();
+            // 2. Clean old messages (Hermes message queue)
+            result.messages = this.cleanOldMessages();
+            // 3. Clean old logs
+            result.logs = this.cleanOldLogs();
+            if (result.audit > 0 || result.messages > 0 || result.logs > 0) {
+                logger.info("[RETENTION] Cleanup complete: " +
+                    `${result.audit} audit, ${result.messages} messages, ${result.logs} logs`);
+            }
+        }
+        catch (error) {
+            logger.error(`[RETENTION] Cleanup failed: ${error.message}`);
+        }
+        return result;
+    }
+    /**
+   * [KVKK Art. 7] "Right to Erasure" — Deletes all data for a given trace ID.
+   * Cleans audit records, messages, logs, and tasks.
+   *
+   * @param traceId Trace ID to erase
+   * @returns Total number of deleted records
+   */
+    static eraseTraceData(traceId) {
+        let total = 0;
+        const db = databaseHolder.getDB();
+        // Audit logs
+        total += Audit.deleteByFilter({ traceId });
+        // Messages
+        const msgResult = db.prepare("DELETE FROM messages WHERE trace_id = ?").run(traceId);
+        total += msgResult.changes;
+        // Tasks
+        const taskResult = db.prepare("DELETE FROM tasks WHERE trace_id = ?").run(traceId);
+        total += taskResult.changes;
+        // Logs
+        const logResult = db.prepare("DELETE FROM logs WHERE trace_id = ?").run(traceId);
+        total += logResult.changes;
+        if (logResult.changes > 0)
+            this.refreshLogAnchor();
+        // Costs (may carry trace_id / usage data)
+        total += db.prepare("DELETE FROM costs WHERE trace_id = ?").run(traceId).changes;
+        // Approvals (args + passcode)
+        total += db.prepare("DELETE FROM approvals WHERE trace_id = ?").run(traceId).changes;
+        logger.info(`[RETENTION] Trace ${traceId} erased: ${total} records deleted (KVKK Article 7)`);
+        return total;
+    }
+    /**
+   * [KVKK Art. 11] Erases all data across every store (full right-to-erasure).
+   * Only works with the confirmation code.
+   */
+    static eraseAllData(confirmationCode) {
+        if (confirmationCode !== "KVKK-RIGHT-TO-ERASURE") {
+            throw new Error("[RETENTION] Invalid confirmation code. Use 'KVKK-RIGHT-TO-ERASURE'");
+        }
+        let total = 0;
+        const db = databaseHolder.getDB();
+        total += Audit.clearAll(confirmationCode);
+        // Every table that can hold user/agent/personal data.
+        for (const table of [
+            "messages",
+            "tasks",
+            "logs",
+            "agents",
+            "metadata",
+            "costs",
+            "knowledge",
+            "users",
+            "loop_cooldowns",
+            "approvals",
+            "discipline",
+            "distributed_locks",
+        ]) {
+            try {
+                total += db.prepare(`DELETE FROM ${table}`).run().changes;
+            }
+            catch {
+                // Table may not exist in this schema version — skip.
+            }
+        }
+        // Both hash-chain anchors are now empty.
+        clearChainAnchor("agent-log");
+        clearChainAnchor("structured");
+        logger.warn(`[RETENTION] ALL DATA ERASED: ${total} records (KVKK Article 7 - Right to Erasure)`);
+        return total;
+    }
+    /**
+     * Recompute the agent-log chain anchor after a legitimate deletion so that
+     * verification does not mistake retention/erasure for tampering.
+     */
+    static refreshLogAnchor() {
+        try {
+            const db = databaseHolder.getDB();
+            const row = db.prepare("SELECT hash FROM logs WHERE hash IS NOT NULL ORDER BY id DESC LIMIT 1").get();
+            const count = db.prepare("SELECT COUNT(*) AS c FROM logs WHERE hash IS NOT NULL").get().c;
+            if (row?.hash && count > 0)
+                writeChainAnchor("agent-log", row.hash, count);
+            else
+                clearChainAnchor("agent-log");
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    /**
+   * Get retention statistics.
+   */
+    static getStats() {
+        const db = databaseHolder.getDB();
+        const auditExpired = db.prepare(`
+        SELECT COUNT(*) as count FROM audit_log
+        WHERE retentionDays IS NOT NULL
+        AND timestamp < datetime('now', '-' || retentionDays || ' days')
+      `).get().count;
+        const messageCount = db.prepare("SELECT COUNT(*) as count FROM messages").get().count;
+        const logCount = db.prepare("SELECT COUNT(*) as count FROM logs").get().count;
+        const taskCount = db.prepare("SELECT COUNT(*) as count FROM tasks").get().count;
+        return {
+            auditExpired,
+            messageCount,
+            logCount,
+            taskCount,
+            policies: { ...RETENTION_POLICIES },
+        };
+    }
+    /**
+   * Stop the periodic cleanup job.
+   */
+    static shutdown() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+            logger.info("[RETENTION] Cleanup job stopped");
+        }
+    }
+    /**
+   * Clean old messages from the Hermes queue.
+   * Messages older than 30 days are removed.
+   */
+    static cleanOldMessages() {
+        const db = databaseHolder.getDB();
+        const result = db.prepare(`
+      DELETE FROM messages
+      WHERE strftime('%Y-%m-%d %H:%M:%S', timestamp) < datetime('now', '-30 days')
+    `).run();
+        return result.changes;
+    }
+    /**
+   * Clean old logs.
+   * Logs older than 30 days are removed.
+   */
+    static cleanOldLogs() {
+        const db = databaseHolder.getDB();
+        const result = db.prepare(`
+      DELETE FROM logs
+      WHERE strftime('%Y-%m-%d %H:%M:%S', timestamp) < datetime('now', '-30 days')
+    `).run();
+        if (result.changes > 0)
+            this.refreshLogAnchor();
+        return result.changes;
+    }
+}
+//# sourceMappingURL=retention.js.map

package/dist/shared/src/modules/security/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/security/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAErF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACtD,WAAW,EAAE,EAAE,EAAK,4BAA4B;IAChD,SAAS,EAAE,EAAE,EAAO,mCAAmC;IACvD,QAAQ,EAAE,GAAG,EAAO,6BAA6B;IACjD,QAAQ,EAAE,GAAG,EAAO,wBAAwB;IAC5C,UAAU,EAAE,GAAG,EAAK,8BAA8B;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,aAAa;IACd,MAAM,CAAC,eAAe,GAA0C,IAAI,CAAC;IAE7E;;;;;KAKC;IACD,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,OAAO;QACtC,sBAAsB;QAClB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CACP,0CAA0C;YAChD,qBAAqB,UAAU,GAAG,KAAK,OAAO;YAC9C,aAAa,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;IACN,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,UAAU;QACb,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAElD,IAAI,CAAC;YACD,sBAAsB;YACtB,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAEpC,+CAA+C;YAC/C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAE1C,oBAAoB;YACpB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAElC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CACP,gCAAgC;oBAC1C,GAAG,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,OAAO,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;KAMC;IACD,MAAM,CAAC,cAAc,CAAC,OAAe;QACjC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,aAAa;QACb,KAAK,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3C,WAAW;QACX,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAE3B,QAAQ;QACR,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC;QAE5B,OAAO;QACP,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjF,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC;QAC3B,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAEnD,0CAA0C;QAC1C,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;QAEjF,8BAA8B;QAC9B,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;QAErF,MAAM,CAAC,IAAI,CAAC,qBAAqB,OAAO,YAAY,KAAK,mCAAmC,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;KAGC;IACD,MAAM,CAAC,YAAY,CAAC,gBAAwB;QACxC,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC1C,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI;YAChB,UAAU;YACV,OAAO;YACP,MAAM;YACN,QAAQ;YACR,UAAU;YACV,OAAO;YACP,WAAW;YACX,OAAO;YACP,gBAAgB;YAChB,WAAW;YACX,YAAY;YACZ,mBAAmB;SACtB,EAAE,CAAC;YACA,IAAI,CAAC;gBACD,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACL,qDAAqD;YACzD,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC9B,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAE/B,MAAM,CAAC,IAAI,CAAC,gCAAgC,KAAK,8CAA8C,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,gBAAgB;QAC3B,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,EAAkC,CAAC;YACtI,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;YAC7G,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;;gBACtE,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACL,YAAY;QAChB,CAAC;IACL,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QAOX,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAElC,MAAM,YAAY,GACpB,EAAE,CAAC,OAAO,CAAC;;;;OAIV,CAAC,CAAC,GAAG,EACH,CAAC,KAAK,CAAC;QAER,MAAM,YAAY,GAAI,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAC7G,MAAM,QAAQ,GAAI,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QACrG,MAAM,SAAS,GAAI,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,EAAwB,CAAC,KAAK,CAAC;QAEvG,OAAO;YACH,YAAY;YACZ,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,QAAQ,EAAE,EAAE,GAAG,kBAAkB,EAAE;SACtC,CAAC;IACN,CAAC;IAED;;KAEC;IACD,MAAM,CAAC,QAAQ;QACX,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,gBAAgB;QAC3B,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;KAGC;IACO,MAAM,CAAC,YAAY;QACvB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;KAG7B,CAAC,CAAC,GAAG,EAAE,CAAC;QACL,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC"}

package/dist/shared/src/modules/security/secrets.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Secret Management & Leak Guard (Phase 1.5)
+ *
+ * Provides:
+ *   1. Encrypted local secret vault (.atabey/secrets.vault.json) using AES-256-GCM
+ *      with per-secret random salt (HKDF-SHA256) and 96-bit IV.
+ *   2. Subprocess environment scrubber (strips sensitive keys before spawning child processes).
+ *   3. Secret leak scanner (detects API keys, cloud credentials, private keys, and vault values).
+ */
+export interface VaultEntry {
+    /** Base64-encoded 16-byte HKDF salt */
+    salt: string;
+    /** Base64-encoded 12-byte GCM initialization vector */
+    iv: string;
+    /** Base64-encoded 16-byte GCM authentication tag */
+    tag: string;
+    /** Base64-encoded ciphertext */
+    ciphertext: string;
+    /** ISO-8601 creation timestamp */
+    createdAt: string;
+    /** ISO-8601 last update timestamp */
+    updatedAt: string;
+    /** Optional non-sensitive description */
+    description?: string;
+}
+export interface VaultFile {
+    version: 1;
+    entries: Record<string, VaultEntry>;
+}
+export interface SecretMetadata {
+    name: string;
+    createdAt: string;
+    updatedAt: string;
+    description?: string;
+}
+export interface SecretFinding {
+    ruleId: string;
+    description: string;
+    matchPreview: string;
+    index: number;
+}
+export declare class SecretManager {
+    private static resolveVaultDir;
+    private static resolveMasterKey;
+    private static vaultFilePath;
+    private static readVault;
+    private static writeVault;
+    /**
+     * Encrypt and store a secret in the local AES-256-GCM vault.
+     */
+    static setSecret(name: string, value: string, options?: {
+        description?: string;
+        vaultDir?: string;
+    }): void;
+    /**
+     * Retrieve and decrypt a secret by name.
+     * Checks process.env[name] fallback only when allowEnvFallback is true.
+     */
+    static getSecret(name: string, options?: {
+        vaultDir?: string;
+        allowEnvFallback?: boolean;
+    }): string | null;
+    /**
+     * Delete a secret from the vault.
+     */
+    static deleteSecret(name: string, options?: {
+        vaultDir?: string;
+    }): boolean;
+    /**
+     * List stored secret metadata without exposing plaintext values.
+     */
+    static listSecrets(options?: {
+        vaultDir?: string;
+    }): SecretMetadata[];
+    /**
+     * Re-encrypt all vault entries under a new 32-byte master key.
+     *
+     * Safe ordering: decrypt everything first, build the new vault in memory,
+     * then atomically swap. The previous key is kept as `master.key.bak` for
+     * the duration of the swap and restored on failure, so a mid-rotation error
+     * cannot make the vault permanently undecryptable.
+     */
+    static rotateMasterKey(newKeyMaterial: string | Buffer, options?: {
+        vaultDir?: string;
+    }): number;
+}
+/**
+ * Scrub sensitive credentials from an environment object before passing to a child process.
+ */
+export declare function scrubEnvForSubprocess(env?: NodeJS.ProcessEnv, extraAllowedKeys?: string[]): NodeJS.ProcessEnv;
+/**
+ * Scan arbitrary text (command output, file content, tool arguments) for leaked secrets.
+ */
+export declare function scanForSecrets(text: string): SecretFinding[];
+/**
+ * Redact leaked secrets from text before it is returned to an AI/LLM.
+ * Complements PII masking with cloud-credential/private-key patterns.
+ */
+export declare function redactSecrets(text: string): string;