catui-agent 1.0.0-beta.0

package/dist/extensions/builtin/security-audit/README.md

@@ -0,0 +1,289 @@
+# Security Audit Extension
+
+## 概述
+
+Security Audit Extension 为 Catui 提供安全审计能力，包括：
+- 审计日志记录所有操作
+- 危险命令模式检测
+- 敏感文件访问保护
+- 可选的拦截机制
+
+## 快速开始
+
+### 安装
+
+安全审计作为内置扩展，默认启用。无需额外安装。
+
+### 基本使用
+
+```bash
+# 查看安全面板
+/security
+
+# 查看详细日志
+/security-logs
+
+# 查看统计数据
+/security-stats
+
+# 清除日志
+/security-clear
+```
+
+## 架构设计
+
+### 分层设计
+
+```
+┌─────────────────────────────────────────────────┐
+│           Security Audit Extension              │
+├─────────────────────────────────────────────────┤
+│  ┌─────────────────────────────────────────┐ │
+│  │           Security Interface              │ │  ← 可替换的接口层
+│  │  (标准化接口，支持不同实现)                 │ │
+│  └─────────────────────────────────────────┘ │
+│                      │                         │
+│    ┌─────────────────┼─────────────────┐      │
+│    ▼                 ▼                 ▼      │
+│ ┌────────┐    ┌───────────┐    ┌──────────┐  │
+│ │  v1    │    │   v2     │    │   v3     │  │
+│ │ Light  │    │   Med    │    │  Heavy   │  │  ← 可升级的实现
+│ │ Audit  │    │  Secure  │    │  Guard   │  │
+│ └────────┘    └───────────┘    └──────────┘  │
+└─────────────────────────────────────────────────┘
+```
+
+### 实现层级
+
+| 层级 | 功能 | 模式 |
+|------|------|------|
+| L1 | 审计日志 | 必须 |
+| L2 | 危险识别 | 必须 |
+| L3 | 拦截确认 | 可选 |
+| L4 | 白名单 | 可选 |
+
+## 危险模式
+
+### 默认检测的危险命令模式
+
+```typescript
+const DANGEROUS_PATTERNS = [
+  // 递归删除
+  "rm\\s+-rf",
+  "rmdir\\s+/s",
+  "del\\s+/s",
+
+  // 系统修改
+  "sudo\\s+",
+  "chmod\\s+777",
+  "chown\\s+",
+
+  // 进程控制
+  "kill\\s+-9",
+  "pkill\\s+-9",
+  "killall\\s+",
+
+  // 网络下载执行
+  "curl\\s+.*\\|\\s*sh",
+  "wget\\s+.*\\|\\s*sh",
+
+  // Git 危险操作
+  "git\\s+push\\s+--force",
+
+  // 容器/系统
+  "docker\\s+rm\\s+-f",
+  "systemctl\\s+stop",
+];
+```
+
+### 敏感路径
+
+```typescript
+const SENSITIVE_PATHS = [
+  "~/.ssh/",      // SSH 密钥
+  "~/.aws/",      // AWS 凭证
+  "~/.azure/",    // Azure 凭证
+  ".env",         // 环境变量文件
+  ".env.local",   // 本地环境变量
+  ".env.production", // 生产环境变量
+];
+```
+
+## 插拔指南
+
+### 禁用安全审计
+
+如需禁用安全审计，可以在 `settings.json` 中设置：
+
+```json
+{
+  "extensions": {
+    "security-audit": {
+      "enabled": false
+    }
+  }
+}
+```
+
+### 自定义危险模式
+
+在扩展配置中添加自定义检测模式：
+
+```json
+{
+  "security": {
+    "dangerousPatterns": [
+      "rm\\s+-rf",
+      "custom-pattern"
+    ],
+    "sensitivePaths": [
+      "~/.ssh/",
+      "~/custom-sensitive/"
+    ]
+  }
+}
+```
+
+### 白名单命令
+
+将常用命令加入白名单：
+
+```json
+{
+  "security": {
+    "whitelist": [
+      "npm install",
+      "npm run dev",
+      "git status"
+    ]
+  }
+}
+```
+
+## 升级指南
+
+### 当前版本 (v1 - Light Audit)
+
+- ✅ 审计日志记录
+- ✅ 危险命令检测
+- ✅ 敏感文件检测
+- ⚠️ 警告提示
+
+### 计划: v2 - Med Secure
+
+- ✅ 所有 v1 功能
+- 🔄 用户确认机制
+- 🔄 可配置的拦截级别
+
+### 计划: v3 - Heavy Guard
+
+- ✅ 所有 v2 功能
+- 🔄 沙箱执行环境
+- 🔄 AI 语义分析
+- 🔄 完整操作拦截
+
+### 升级步骤
+
+升级到更高安全级别：
+
+1. **备份配置**
+   ```bash
+   cp ~/.catui/agent/settings.json ~/.catui/agent/settings.json.bak
+   ```
+
+2. **更新扩展**
+   ```bash
+   npm install -g @catui/agent@latest
+   ```
+
+3. **配置新级别**
+   ```json
+   {
+     "security": {
+       "mode": "strict",
+       "enableInterception": true
+     }
+   }
+   ```
+
+## API 参考
+
+### SecurityEngine 接口
+
+```typescript
+interface SecurityEngine {
+  // 检查命令是否安全
+  checkCommand(command: string, cwd: string): SecurityCheckResult;
+
+  // 检查文件操作
+  checkFileOperation(operation: string, path: string): SecurityCheckResult;
+
+  // 记录审计日志
+  log(event: AuditEvent): AuditEvent;
+
+  // 查询日志
+  queryLogs(options?: LogQueryOptions): AuditEvent[];
+
+  // 获取统计
+  getStats(): SecurityStats;
+
+  // 清除日志
+  clearLogs(): void;
+
+  // 导出日志
+  exportLogs(format?: "json" | "html"): string;
+}
+```
+
+### 审计日志格式
+
+```json
+{
+  "id": "a1b2c3d4e5f6",
+  "timestamp": "2024-01-01T10:00:00.000Z",
+  "type": "command",
+  "operation": "bash",
+  "target": "rm -rf /tmp/test",
+  "cwd": "/Users/demo/project",
+  "level": "dangerous",
+  "status": "warning",
+  "reason": "Command matches dangerous pattern: rm\\s+-rf",
+  "pattern": "rm\\s+-rf"
+}
+```
+
+## 故障排除
+
+### 日志位置
+
+审计日志存储在：
+```
+~/.catui/agent/security-audit.json
+```
+
+### 查看日志
+
+```bash
+# 使用 catui 命令
+/security-logs 50
+
+# 或直接查看文件
+cat ~/.catui/agent/security-audit.json
+```
+
+### 常见问题
+
+**Q: 危险命令仍然执行了？**
+A: 当前版本 (v1) 只记录和警告，不阻止执行。升级到 v2+ 可启用拦截。
+
+**Q: 如何添加自定义检测？**
+A: 修改扩展配置中的 `dangerousPatterns` 和 `sensitivePaths`。
+
+**Q: 日志太大怎么办？**
+A: 使用 `/security-clear` 清除，或配置 `maxLogEntries` 限制大小。
+
+## 相关文档
+
+- [Extension 开发指南](./extensions)
+- [Settings 配置](./settings)
+- [安全最佳实践](./security)

package/dist/extensions/builtin/security-audit/engine/detector.d.ts

@@ -0,0 +1,44 @@
+/**
+ * [WHO]: DangerDetector
+ * [FROM]: Depends on node:os, node:path, ../interface.js
+ * [TO]: Consumed by extension entry point (./index.ts)
+ * [HERE]: extensions/builtin/security-audit/engine/detector.ts -
+ */
+import type { SecurityCheckResult, SecurityConfig } from "../interface.js";
+/**
+ * Danger Detector class
+ */
+export declare class DangerDetector {
+    private dangerousPatterns;
+    private sensitivePaths;
+    private whitelist;
+    constructor(config?: Partial<SecurityConfig>);
+    /**
+     * Check if command is dangerous
+     */
+    checkCommand(command: string): SecurityCheckResult;
+    /**
+     * Check if file operation is allowed
+     */
+    checkFileOperation(operation: "read" | "write" | "edit", path: string): SecurityCheckResult;
+    /**
+     * Get human-readable reason for pattern
+     */
+    private getReasonForPattern;
+    /**
+     * Get human-readable reason for sensitive path
+     */
+    private getReasonForSensitivePath;
+    /**
+     * Update dangerous patterns
+     */
+    setDangerousPatterns(patterns: string[]): void;
+    /**
+     * Update sensitive paths
+     */
+    setSensitivePaths(paths: string[]): void;
+    /**
+     * Update whitelist
+     */
+    setWhitelist(whitelist: string[]): void;
+}

package/dist/extensions/builtin/security-audit/engine/detector.js

@@ -0,0 +1 @@
+var d=Object.defineProperty;var a=(n,e)=>d(n,"name",{value:e,configurable:!0});import{homedir as l}from"node:os";import{resolve as u}from"node:path";import{DEFAULT_SECURITY_CONFIG as f}from"../interface.js";function c(n){return n.startsWith("~")?u(l(),n.slice(1)):u(n)}a(c,"expandHome");function g(n){const e=c(n),s=l();return e.startsWith(s)}a(g,"isUnderHome");class v{static{a(this,"DangerDetector")}dangerousPatterns;sensitivePaths;whitelist;constructor(e={}){const s={...f,...e};this.dangerousPatterns=s.dangerousPatterns.map(r=>new RegExp(r,"i")),this.sensitivePaths=s.sensitivePaths.map(r=>c(r)),this.whitelist=s.whitelist.map(r=>r.toLowerCase())}checkCommand(e){const s=e.toLowerCase().trim();for(const t of this.whitelist)if(s.includes(t.toLowerCase()))return{allowed:!0,level:"safe",reason:"Command is in whitelist"};for(const t of this.dangerousPatterns)if(t.test(e))return{allowed:!1,level:"dangerous",reason:this.getReasonForPattern(t.source),pattern:t.source,requiresConfirm:!0};const r=[{pattern:/git\s+reset/i,reason:"Git reset can lose changes"},{pattern:/git\s+checkout\s+--force/i,reason:"Forced checkout can overwrite changes"},{pattern:/\|\s*bash/i,reason:"Piping to shell can be dangerous"},{pattern:/>\s*\/dev\//i,reason:"Writing to device file"},{pattern:/npm\s+exec/i,reason:"npm exec can run arbitrary commands"},{pattern:/npm\s+run\s+.*&&/i,reason:"Chained commands after npm run"}];for(const{pattern:t,reason:i}of r)if(t.test(e))return{allowed:!0,level:"warning",reason:i,pattern:t.source};return{allowed:!0,level:"safe",reason:"Command appears safe"}}checkFileOperation(e,s){const r=c(s);for(const i of this.sensitivePaths)if(r.includes(i))return{allowed:!1,level:"dangerous",reason:this.getReasonForSensitivePath(i),requiresConfirm:!0};const t=[{pattern:/\.ssh\/id_/,reason:"SSH private key"},{pattern:/\.aws\/credentials/,reason:"AWS credentials"},{pattern:/\.env$/,reason:"Environment file may contain secrets"},{pattern:/\.npmrc$/,reason:"npm config may contain auth tokens"},{pattern:/\.git\/credentials/,reason:"Git credentials"},{pattern:/\/passwords?/i,reason:"Password file"},{pattern:/\/secrets?/i,reason:"Secret file"}];for(const{pattern:i,reason:o}of t)if(i.test(r))return e==="read"?{allowed:!0,level:"warning",reason:o,requiresConfirm:!0}:{allowed:!1,level:"dangerous",reason:o,requiresConfirm:!0};if(e==="write"||e==="edit"){const i=["/etc/","/usr/bin/","/usr/local/bin/","/System/","/Windows/System32/"];for(const o of i)if(r.startsWith(o))return{allowed:!1,level:"dangerous",reason:"System directory modification",requiresConfirm:!0}}return{allowed:!0,level:"safe",reason:"File operation appears safe"}}getReasonForPattern(e){const s={"rm\\s+-rf":"Recursive deletion can permanently remove files","rmdir\\s+/s":"Recursive directory deletion","del\\s+/s":"Recursive file deletion (Windows)",sudo:"sudo gives administrative privileges","chmod\\s+777":"World-writable permissions are insecure","chown\\s+":"Ownership change can break system","kill\\s+-9":"Force kill can cause data loss","pkill\\s+-9":"Force process kill can cause data loss","killall\\s+":"Kill all processes can crash system","curl\\s+.*\\|\\s*sh":"Download and execute is extremely dangerous","wget\\s+.*\\|\\s*sh":"Download and execute is extremely dangerous","Invoke-Expression.*WebRequest":"PowerShell download and execute","git\\s+push\\s+--force":"Force push can overwrite remote history","git\\s+push\\s+-f":"Force push can overwrite remote history","docker\\s+rm\\s+-f":"Force remove container","docker\\s+run\\s+--rm":"Auto-remove container","systemctl\\s+stop":"System service stop","systemctl\\s+restart":"System service restart"};for(const[r,t]of Object.entries(s))if(e.includes(r))return t;return"Command matches dangerous pattern"}getReasonForSensitivePath(e){return e.includes(".ssh")?"SSH directory contains private keys":e.includes(".aws")?"AWS directory contains credentials":e.includes(".azure")?"Azure credentials directory":e.includes(".gcloud")?"Google Cloud credentials directory":e.includes("passwd")?"System password file":e.includes("shadow")?"System shadow file (password hashes)":e.includes("sudoers")?"sudo configuration file":e.includes("git/config")?"Git configuration may contain credentials":"Path contains sensitive information"}setDangerousPatterns(e){this.dangerousPatterns=e.map(s=>new RegExp(s,"i"))}setSensitivePaths(e){this.sensitivePaths=e.map(s=>c(s))}setWhitelist(e){this.whitelist=e.map(s=>s.toLowerCase())}}export{v as DangerDetector};

package/dist/extensions/builtin/security-audit/engine/interceptor.d.ts

@@ -0,0 +1,61 @@
+/**
+ * [WHO]: InterceptorResult, Interceptor
+ * [FROM]: Depends on ./detector.js, ./logger.js
+ * [TO]: Consumed by extension entry point (./index.ts)
+ * [HERE]: extensions/builtin/security-audit/engine/interceptor.ts -
+ */
+import type { SecurityConfig, AuditEvent } from "../interface.js";
+import { DangerDetector } from "./detector.js";
+import { AuditLogger } from "./logger.js";
+/**
+ * Interceptor Result
+ */
+export interface InterceptorResult {
+    /** Whether to proceed with the operation */
+    proceed: boolean;
+    /** The audit event */
+    event?: AuditEvent;
+    /** Message to display to user */
+    message?: string;
+}
+/**
+ * Interceptor class
+ */
+export declare class Interceptor {
+    private detector;
+    private logger;
+    private config;
+    constructor(detector: DangerDetector, logger: AuditLogger, config: SecurityConfig);
+    /**
+     * Intercept a bash command
+     */
+    interceptCommand(command: string, cwd: string): InterceptorResult;
+    /**
+     * Intercept a file operation
+     */
+    interceptFile(operation: "read" | "write" | "edit", path: string, cwd: string): InterceptorResult;
+    /**
+     * Format warning message for command
+     */
+    private formatWarningMessage;
+    /**
+     * Format blocked message for command
+     */
+    private formatBlockedMessage;
+    /**
+     * Format warning message for file operation
+     */
+    private formatFileWarningMessage;
+    /**
+     * Format blocked message for file operation
+     */
+    private formatFileBlockedMessage;
+    /**
+     * Update configuration
+     */
+    updateConfig(config: SecurityConfig): void;
+    /**
+     * Update detector
+     */
+    updateDetector(detector: DangerDetector): void;
+}

package/dist/extensions/builtin/security-audit/engine/interceptor.js

@@ -0,0 +1,27 @@
+var a=Object.defineProperty;var n=(i,e)=>a(i,"name",{value:e,configurable:!0});class l{static{n(this,"Interceptor")}detector;logger;config;constructor(e,t,r){this.detector=e,this.logger=t,this.config=r}interceptCommand(e,t){const r=this.detector.checkCommand(e),s=this.logger.log({type:"command",operation:"bash",target:e,cwd:t,level:r.level,status:"allowed",reason:r.reason,pattern:r.pattern});if(!this.config.enableInterception)return{proceed:!0,event:s};switch(this.config.mode){case"audit":return{proceed:!0,event:s};case"confirm":return r.level==="dangerous"&&r.requiresConfirm?{proceed:!1,event:{...s,status:"warning"},message:this.formatWarningMessage(e,r)}:{proceed:!0,event:s};case"strict":return r.level==="dangerous"?{proceed:!1,event:{...s,status:"blocked"},message:this.formatBlockedMessage(e,r)}:{proceed:!0,event:s};default:return{proceed:!0,event:s}}}interceptFile(e,t,r){const s=this.detector.checkFileOperation(e,t),o=this.logger.log({type:`file_${e}`,operation:e,target:t,cwd:r,level:s.level,status:"allowed",reason:s.reason});if(!this.config.enableInterception)return{proceed:!0,event:o};switch(this.config.mode){case"audit":return{proceed:!0,event:o};case"confirm":return s.level==="dangerous"&&s.requiresConfirm?{proceed:!1,event:{...o,status:"warning"},message:this.formatFileWarningMessage(e,t,s)}:{proceed:!0,event:o};case"strict":return s.level!=="safe"?{proceed:!1,event:{...o,status:"blocked"},message:this.formatFileBlockedMessage(e,t,s)}:{proceed:!0,event:o};default:return{proceed:!0,event:o}}}formatWarningMessage(e,t){return`\u26A0\uFE0F  Dangerous operation detected
+
+Command: ${e}
+
+Risk: ${t.reason||"Matches dangerous pattern"}
+
+Operation will be logged to audit trail.`}formatBlockedMessage(e,t){return`\u{1F534} Operation blocked
+
+Command: ${e}
+
+Reason: ${t.reason||"Security policy blocked"}
+
+This operation requires admin privileges or removal from whitelist.`}formatFileWarningMessage(e,t,r){return`\u26A0\uFE0F  Sensitive file operation
+
+Operation: ${e}
+Path: ${t}
+
+Risk: ${r.reason||"File contains sensitive information"}
+
+Operation will be logged to audit trail.`}formatFileBlockedMessage(e,t,r){return`\u{1F534} Access denied
+
+Operation: ${e}
+Path: ${t}
+
+Reason: ${r.reason||"Security policy blocks access to this file"}
+
+This file is protected by security policy.`}updateConfig(e){this.config=e}updateDetector(e){this.detector=e}}export{l as Interceptor};

package/dist/extensions/builtin/security-audit/engine/logger.d.ts

@@ -0,0 +1,65 @@
+/**
+ * [WHO]: AuditLogger
+ * [FROM]: Depends on node:fs, node:path, node:crypto, ../../../../config.js
+ * [TO]: Consumed by extension entry point (./index.ts)
+ * [HERE]: extensions/builtin/security-audit/engine/logger.ts -
+ */
+import type { AuditEvent, LogQueryOptions, SecurityStats } from "../interface.js";
+import { AgentDirContext } from "../../../../core/agent-dir/agent-dir-context.js";
+/**
+ * Audit Logger class
+ */
+export declare class AuditLogger {
+    private logs;
+    private maxEntries;
+    private ctx;
+    /**
+     * @param maxEntries Maximum number of entries to keep
+     * @param ctx Agent directory context.
+     */
+    constructor(maxEntries?: number, ctx?: AgentDirContext);
+    /**
+     * Get audit log file path
+     */
+    private getLogPath;
+    /**
+     * Ensure log directory exists
+     */
+    private ensureLogDir;
+    /**
+     * Load logs from disk
+     */
+    load(): void;
+    /**
+     * Save logs to file
+     */
+    private saveLogs;
+    /**
+     * Record an audit event
+     */
+    log(event: Omit<AuditEvent, "id" | "timestamp">): AuditEvent;
+    /**
+     * Query logs with filters
+     */
+    query(options?: LogQueryOptions): AuditEvent[];
+    /**
+     * Get statistics
+     */
+    getStats(options?: LogQueryOptions): SecurityStats;
+    /**
+     * Clear all logs
+     */
+    clear(): void;
+    /**
+     * Export logs as JSON
+     */
+    exportJson(): string;
+    /**
+     * Export logs as HTML
+     */
+    exportHtml(): string;
+    /**
+     * Get total log count
+     */
+    getCount(): number;
+}

package/dist/extensions/builtin/security-audit/engine/logger.js

@@ -0,0 +1,65 @@
+var u=Object.defineProperty;var o=(d,t)=>u(d,"name",{value:t,configurable:!0});import{existsSync as g,mkdirSync as m,readFileSync as p,writeFileSync as v}from"node:fs";import{join as y}from"node:path";import{randomBytes as b}from"node:crypto";import{defaultAgentDirContext as x}from"../../../../core/agent-dir/agent-dir-context.js";function S(){return b(8).toString("hex")}o(S,"generateId");class E{static{o(this,"AuditLogger")}logs=[];maxEntries;ctx;constructor(t=1e4,e=x()){this.maxEntries=t,this.ctx=e,this.load()}getLogPath(){return y(this.ctx.path,"security-audit.json")}ensureLogDir(){g(this.ctx.path)||m(this.ctx.path,{recursive:!0})}load(){const t=this.getLogPath();try{if(g(t)){const e=p(t,"utf-8"),s=JSON.parse(e);this.logs=Array.isArray(s)?s:[]}}catch{this.logs=[]}}saveLogs(){this.ensureLogDir();const t=this.getLogPath();v(t,JSON.stringify(this.logs,null,2),"utf-8")}log(t){const e={...t,id:S(),timestamp:new Date().toISOString()};return this.logs.push(e),this.logs.length>this.maxEntries&&(this.logs=this.logs.slice(-this.maxEntries)),this.saveLogs(),e}query(t){let e=[...this.logs];return t&&(t.startDate&&(e=e.filter(s=>new Date(s.timestamp)>=t.startDate)),t.endDate&&(e=e.filter(s=>new Date(s.timestamp)<=t.endDate)),t.types&&t.types.length>0&&(e=e.filter(s=>t.types.includes(s.type))),t.levels&&t.levels.length>0&&(e=e.filter(s=>t.levels.includes(s.level))),t.offset&&(e=e.slice(t.offset)),t.limit&&(e=e.slice(0,t.limit))),e}getStats(t){const e=this.query(t),s={command:0,file_read:0,file_write:0,file_edit:0,network:0,extension:0,session_start:0,session_end:0},i={safe:0,warning:0,dangerous:0},r={allowed:0,blocked:0,warning:0,confirmed:0},l=new Map;for(const a of e)a.type in s&&s[a.type]++,a.level in i&&i[a.level]++,a.status in r&&r[a.status]++,a.pattern&&l.set(a.pattern,(l.get(a.pattern)||0)+1);const c=Array.from(l.entries()).map(([a,n])=>({pattern:a,count:n})).sort((a,n)=>n.count-a.count).slice(0,10),h=e.length>0?e[0].timestamp:new Date().toISOString(),f=e.length>0?e[e.length-1].timestamp:new Date().toISOString();return{totalEvents:e.length,byType:s,byLevel:i,byStatus:r,dangerousPatterns:c,periodStart:h,periodEnd:f}}clear(){this.logs=[],this.saveLogs()}exportJson(){return JSON.stringify(this.logs,null,2)}exportHtml(){const t=this.logs.slice(-100),e=t.map(s=>`
+		<tr>
+			<td>${s.timestamp.split("T")[1].split(".")[0]}</td>
+			<td>${s.type}</td>
+			<td class="${s.level==="dangerous"?"danger":s.level==="warning"?"warning":"safe"}">${s.level}</td>
+			<td><code>${s.target.substring(0,50)}${s.target.length>50?"...":""}</code></td>
+			<td>${s.status}</td>
+		</tr>`).join(`
+`);return`<!DOCTYPE html>
+<html>
+<head>
+	<meta charset="UTF-8">
+	<title>Security Audit Log - Catui</title>
+	<style>
+		body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; margin: 20px; background: #1a1a2e; color: #eee; }
+		h1 { color: #00d4ff; }
+		table { width: 100%; border-collapse: collapse; margin-top: 20px; }
+		th, td { padding: 10px; text-align: left; border-bottom: 1px solid #333; }
+		th { background: #16213e; }
+		tr:hover { background: #1f1f3a; }
+		code { background: #2a2a4a; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
+		.danger { color: #ff4757; }
+		.warning { color: #ffa502; }
+		.safe { color: #2ed573; }
+		.summary { display: flex; gap: 20px; margin: 20px 0; }
+		.stat { background: #16213e; padding: 15px 25px; border-radius: 8px; }
+		.stat-value { font-size: 2em; font-weight: bold; color: #00d4ff; }
+		.stat-label { color: #888; }
+	</style>
+</head>
+<body>
+	<h1>\u{1F512} Security Audit Log</h1>
+	<p>Generated: ${new Date().toISOString()}</p>
+
+	<div class="summary">
+		<div class="stat">
+			<div class="stat-value">${t.length}</div>
+			<div class="stat-label">Events</div>
+		</div>
+		<div class="stat">
+			<div class="stat-value">${t.filter(s=>s.level==="dangerous").length}</div>
+			<div class="stat-label">Dangerous</div>
+		</div>
+		<div class="stat">
+			<div class="stat-value">${t.filter(s=>s.status==="blocked").length}</div>
+			<div class="stat-label">Blocked</div>
+		</div>
+	</div>
+
+	<table>
+		<thead>
+			<tr>
+				<th>Time</th>
+				<th>Type</th>
+				<th>Level</th>
+				<th>Target</th>
+				<th>Status</th>
+			</tr>
+		</thead>
+		<tbody>
+			${e}
+		</tbody>
+	</table>
+</body>
+</html>`}getCount(){return this.logs.length}}export{E as AuditLogger};

package/dist/extensions/builtin/security-audit/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * [WHO]: SecurityAudit extension - audit logging and dangerous pattern detection
+ * [FROM]: Depends on core/extensions-host/types, ./engine/detector, ./engine/logger, ./interface
+ * [TO]: Consumed by builtin-extensions.ts as default extension
+ * [HERE]: extensions/builtin/security-audit/index.ts - security auditing for Catui operations
+ *
+ * Features:
+ * - Audit logging for all operations
+ * - Dangerous pattern detection
+ * - Optional interception for dangerous operations
+ */
+import type { ExtensionAPI } from "../../../core/extensions-host/types.js";
+export default function securityAuditExtension(api: ExtensionAPI): void;

package/dist/extensions/builtin/security-audit/index.js

@@ -0,0 +1,49 @@
+var w=Object.defineProperty;var g=(o,a)=>w(o,"name",{value:a,configurable:!0});import{AuditLogger as b}from"./engine/logger.js";import{DangerDetector as T}from"./engine/detector.js";import{DEFAULT_SECURITY_CONFIG as C}from"./interface.js";const m="security-audit",E=[{value:"dashboard",label:"dashboard",description:"Show recent warnings and blocked actions"},{value:"logs",label:"logs",description:"Show detailed event history"},{value:"stats",label:"stats",description:"Show event counts"},{value:"clear",label:"clear",description:"Clear saved events"}],h=["10","20","50","100"],y=process.env.SECURITY_MODE||"strict",v=new T({...C,mode:y==="audit"||y==="confirm"||y==="strict"?y:"strict"}),$=new Map;function f(o){const a=o.sessionManager.getAgentCtx?.()||{id:"default",path:o.agentDir};let i=$.get(a.id);return i||(i=new b(1e4,a),$.set(a.id,i)),i}g(f,"getLogger");function p(o,a){o.sendMessage({customType:m,content:a,display:!0},{triggerTurn:!0})}g(p,"sendSecurityNotice");function L(o,a){const i=o.trim().toLowerCase();if(a?.previousTokens[0]==="logs"&&a.tokenIndex===1){const l=h.filter(r=>r.startsWith(i)).map(r=>({value:r,label:r,description:`Show ${r} events`}));return l.length>0?l:null}if(a&&a.tokenIndex>0)return null;const d=E.filter(l=>l.value.startsWith(i));return d.length>0?d.map(l=>({...l})):null}g(L,"getSecurityArgumentCompletions");function k(o){const a=o.trim(),i=h.filter(d=>d.startsWith(a)).map(d=>({value:d,label:d,description:`Show ${d} events`}));return i.length>0?i:null}g(k,"getSecurityLogLimitCompletions");function _(o,a,i){const d=f(i),l=a.toolName,r=a.input||{};if(l==="bash"||l==="Bash"){const t=r.command;if(!t)return;const e=v.checkCommand(t),n=e.level==="dangerous"&&y==="strict";if(d.log({type:"command",operation:"bash",target:t,cwd:i.cwd,level:e.level,status:n?"blocked":e.level==="safe"?"allowed":"warning",reason:e.reason,pattern:e.pattern}),e.level!=="dangerous")return;if(n){const s=`Security blocked bash command: ${e.reason}`;return p(o,`${s}
+
+Command: \`${t}\``),{block:!0,reason:s}}p(o,`Security warning: ${e.reason}
+
+Command: \`${t}\`
+
+This will be logged to security audit.`);return}if(l==="write"||l==="Write"||l==="edit"||l==="Edit"){const t=r,e=t.file_path||t.path||t.filePath;if(!e)return;const n=l==="write"||l==="Write"?"write":"edit",s=v.checkFileOperation(n,e),c=s.level==="dangerous";if(d.log({type:`file_${n}`,operation:n,target:e,cwd:i.cwd,level:s.level,status:c?"blocked":s.level==="safe"?"allowed":"warning",reason:s.reason}),!c)return;const u=`Security blocked ${n}: ${s.reason}`;return p(o,`${u}
+
+Path: \`${e}\``),{block:!0,reason:u}}}g(_,"auditAndGateToolCall");function I(o){const a=g(r=>{const t=f(r),e=t.getStats(),n=t.query({limit:20});let s=`# \u{1F512} Security Audit
+
+`;if(s+=`## Statistics
+`,s+=`- Total Events: ${e.totalEvents}
+`,s+=`- Dangerous: ${e.byLevel.dangerous}
+`,s+=`- Warnings: ${e.byLevel.warning}
+`,s+=`- Blocked: ${e.byStatus.blocked}
+
+`,e.dangerousPatterns.length>0){s+=`## Dangerous Patterns
+`;for(const c of e.dangerousPatterns.slice(0,5))s+=`- \`${c.pattern}\`: ${c.count}
+`;s+=`
+`}s+=`## Recent Events
+`,s+=`| Time | Type | Level | Target |
+`,s+=`|------|------|-------|--------|
+`;for(const c of n){const u=c.timestamp.split("T")[1].split(".")[0];s+=`| ${u} | ${c.type} | ${c.level} | \`${c.target.slice(0,30)}...\` |
+`}o.sendMessage({customType:m,content:s,display:!0},{triggerTurn:!1})},"showDashboard"),i=g((r,t)=>{const e=f(t),n=parseInt(r)||50,s=e.query({limit:n});let c=`# Security Audit Logs (${s.length} entries)
+
+`;for(const u of s){const S=u.status==="blocked"?"\u{1F534}":u.level==="dangerous"?"\u26A0\uFE0F":"\u2705";c+=`${S} [${u.timestamp}] ${u.type}: ${u.operation}
+`,c+=`   Target: ${u.target}
+`,c+=`   Level: ${u.level}, Status: ${u.status}
+`,u.reason&&(c+=`   Reason: ${u.reason}
+`),c+=`
+`}o.sendMessage({customType:m,content:c,display:!0},{triggerTurn:!1})},"showLogs"),d=g(r=>{const e=f(r).getStats();let n=`# Security Statistics
+
+`;if(n+=`## Overview
+`,n+=`- Period: ${e.periodStart.split("T")[0]} ~ ${e.periodEnd.split("T")[0]}
+`,n+=`- Total Events: ${e.totalEvents}
+
+`,n+=`## By Level
+`,n+=`- Safe: ${e.byLevel.safe}
+`,n+=`- Warning: ${e.byLevel.warning}
+`,n+=`- Dangerous: ${e.byLevel.dangerous}
+
+`,n+=`## By Status
+`,n+=`- Allowed: ${e.byStatus.allowed}
+`,n+=`- Blocked: ${e.byStatus.blocked}
+`,n+=`- Confirmed: ${e.byStatus.confirmed}
+
+`,e.dangerousPatterns.length>0){n+=`## Dangerous Patterns
+`;for(const s of e.dangerousPatterns)n+=`- \`${s.pattern}\`: ${s.count}
+`}o.sendMessage({customType:m,content:n,display:!0},{triggerTurn:!1})},"showStats"),l=g(r=>{f(r).clear(),o.sendMessage({customType:m,content:"\u2705 Security audit logs cleared.",display:!0},{triggerTurn:!1})},"clearLogs");o.registerCommand("security",{description:"Review security activity, logs, stats, or clear saved events",getArgumentCompletions:L,handler:g(async(r,t)=>{const[e,...n]=r.trim().split(/\s+/);switch(e){case"":case"dashboard":a(t);return;case"logs":i(n.join(" "),t);return;case"stats":d(t);return;case"clear":l(t);return;default:t.ui.notify("Usage: /security [dashboard|logs|stats|clear]","info")}},"handler")}),o.registerCommand("security-logs",{description:"Show detailed security event history",getArgumentCompletions:k,handler:g(async(r,t)=>{i(r,t)},"handler")}),o.registerCommand("security-stats",{description:"Show security event counts",handler:g(async(r,t)=>{d(t)},"handler")}),o.registerCommand("security-clear",{description:"Clear saved security events",handler:g(async(r,t)=>{l(t)},"handler")}),o.on("tool_call",(r,t)=>_(o,r,t))}g(I,"securityAuditExtension");export{I as default};