codebot-ai 2.0.1 → 2.1.0

package/README.md

@@ -254,7 +254,7 @@ CodeBot v2.0.0 is built with security as a core architectural principle:
 - **SSRF protection** — blocks localhost, private IPs, cloud metadata endpoints
 - **Path safety** — blocks writes to system directories, detects path traversal
 
-See [SECURITY.md](SECURITY.md) and [docs/HARDENING.md](docs/HARDENING.md) for the full security model.
+See [SECURITY.md](SECURITY.md), [docs/HARDENING.md](docs/HARDENING.md), and [docs/SOC2_COMPLIANCE.md](docs/SOC2_COMPLIANCE.md) for the full security model and compliance readiness.
 
 ## Stability
 

package/dist/encryption.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Encryption at rest for CodeBot v2.1.0
+ *
+ * Provides AES-256-GCM encryption for audit logs, session files, and memory.
+ * Key derivation uses PBKDF2 from a user-supplied passphrase or machine identity.
+ *
+ * Encryption is opt-in: set CODEBOT_ENCRYPTION_KEY env var or
+ * configure encryption.passphrase in policy.json.
+ *
+ * NEVER throws — encryption failures fall back to plaintext with a warning.
+ */
+export interface EncryptionConfig {
+    /** Enable encryption at rest */
+    enabled: boolean;
+    /** Passphrase for key derivation (or use CODEBOT_ENCRYPTION_KEY env var) */
+    passphrase?: string;
+}
+/**
+ * Derives an AES-256 key from a passphrase using PBKDF2-SHA512.
+ * The salt is generated randomly and prepended to the output.
+ */
+export declare function deriveKey(passphrase: string, salt?: Buffer): {
+    key: Buffer;
+    salt: Buffer;
+};
+/**
+ * Get the encryption passphrase from environment or config.
+ * Returns null if encryption is not configured.
+ */
+export declare function getPassphrase(config?: EncryptionConfig): string | null;
+/**
+ * Check if encryption is enabled (passphrase available).
+ */
+export declare function isEncryptionEnabled(config?: EncryptionConfig): boolean;
+/**
+ * Encrypt plaintext using AES-256-GCM.
+ *
+ * Output format: HEADER(4) + salt(32) + iv(16) + tag(16) + ciphertext(...)
+ * All binary, base64-encoded as a string for storage.
+ *
+ * Returns null on failure (never throws).
+ */
+export declare function encrypt(plaintext: string, passphrase: string): string | null;
+/**
+ * Decrypt a base64-encoded ciphertext produced by encrypt().
+ * Returns null on failure (wrong key, tampered data, not encrypted).
+ */
+export declare function decrypt(encoded: string, passphrase: string): string | null;
+/**
+ * Encrypt a JSONL line for file storage.
+ * If encryption is not configured, returns the original line unchanged.
+ */
+export declare function encryptLine(line: string, config?: EncryptionConfig): string;
+/**
+ * Decrypt a JSONL line from file storage.
+ * Auto-detects encrypted vs plaintext lines.
+ */
+export declare function decryptLine(line: string, config?: EncryptionConfig): string;
+/**
+ * Encrypt an entire file's content (for memory files which are Markdown, not JSONL).
+ */
+export declare function encryptContent(content: string, config?: EncryptionConfig): string;
+/**
+ * Decrypt file content. Auto-detects encrypted vs plaintext.
+ */
+export declare function decryptContent(content: string, config?: EncryptionConfig): string;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/encryption.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * Encryption at rest for CodeBot v2.1.0
+ *
+ * Provides AES-256-GCM encryption for audit logs, session files, and memory.
+ * Key derivation uses PBKDF2 from a user-supplied passphrase or machine identity.
+ *
+ * Encryption is opt-in: set CODEBOT_ENCRYPTION_KEY env var or
+ * configure encryption.passphrase in policy.json.
+ *
+ * NEVER throws — encryption failures fall back to plaintext with a warning.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveKey = deriveKey;
+exports.getPassphrase = getPassphrase;
+exports.isEncryptionEnabled = isEncryptionEnabled;
+exports.encrypt = encrypt;
+exports.decrypt = decrypt;
+exports.encryptLine = encryptLine;
+exports.decryptLine = decryptLine;
+exports.encryptContent = encryptContent;
+exports.decryptContent = decryptContent;
+const crypto = __importStar(require("crypto"));
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16; // 128-bit IV for GCM
+const TAG_LENGTH = 16; // 128-bit auth tag
+const SALT_LENGTH = 32; // 256-bit salt for PBKDF2
+const KEY_LENGTH = 32; // 256-bit key
+const PBKDF2_ITERATIONS = 100_000;
+const HEADER = 'CBE1'; // CodeBot Encrypted v1 — 4-byte magic header
+/**
+ * Derives an AES-256 key from a passphrase using PBKDF2-SHA512.
+ * The salt is generated randomly and prepended to the output.
+ */
+function deriveKey(passphrase, salt) {
+    const s = salt || crypto.randomBytes(SALT_LENGTH);
+    const key = crypto.pbkdf2Sync(passphrase, s, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha512');
+    return { key, salt: s };
+}
+/**
+ * Get the encryption passphrase from environment or config.
+ * Returns null if encryption is not configured.
+ */
+function getPassphrase(config) {
+    // Environment variable takes priority
+    const envKey = process.env.CODEBOT_ENCRYPTION_KEY;
+    if (envKey)
+        return envKey;
+    // Policy config passphrase
+    if (config?.passphrase)
+        return config.passphrase;
+    return null;
+}
+/**
+ * Check if encryption is enabled (passphrase available).
+ */
+function isEncryptionEnabled(config) {
+    if (config && !config.enabled)
+        return false;
+    return getPassphrase(config) !== null;
+}
+/**
+ * Encrypt plaintext using AES-256-GCM.
+ *
+ * Output format: HEADER(4) + salt(32) + iv(16) + tag(16) + ciphertext(...)
+ * All binary, base64-encoded as a string for storage.
+ *
+ * Returns null on failure (never throws).
+ */
+function encrypt(plaintext, passphrase) {
+    try {
+        const { key, salt } = deriveKey(passphrase);
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+        const encrypted = Buffer.concat([
+            cipher.update(plaintext, 'utf-8'),
+            cipher.final(),
+        ]);
+        const tag = cipher.getAuthTag();
+        // Pack: header + salt + iv + tag + ciphertext
+        const packed = Buffer.concat([
+            Buffer.from(HEADER, 'ascii'),
+            salt,
+            iv,
+            tag,
+            encrypted,
+        ]);
+        return packed.toString('base64');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decrypt a base64-encoded ciphertext produced by encrypt().
+ * Returns null on failure (wrong key, tampered data, not encrypted).
+ */
+function decrypt(encoded, passphrase) {
+    try {
+        const packed = Buffer.from(encoded, 'base64');
+        // Check magic header
+        const header = packed.subarray(0, 4).toString('ascii');
+        if (header !== HEADER)
+            return null; // Not encrypted data
+        // Unpack
+        let offset = 4;
+        const salt = packed.subarray(offset, offset + SALT_LENGTH);
+        offset += SALT_LENGTH;
+        const iv = packed.subarray(offset, offset + IV_LENGTH);
+        offset += IV_LENGTH;
+        const tag = packed.subarray(offset, offset + TAG_LENGTH);
+        offset += TAG_LENGTH;
+        const ciphertext = packed.subarray(offset);
+        // Derive same key from salt
+        const { key } = deriveKey(passphrase, salt);
+        const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Encrypt a JSONL line for file storage.
+ * If encryption is not configured, returns the original line unchanged.
+ */
+function encryptLine(line, config) {
+    const passphrase = getPassphrase(config);
+    if (!passphrase)
+        return line;
+    const encrypted = encrypt(line, passphrase);
+    if (!encrypted)
+        return line; // Fall back to plaintext
+    return encrypted;
+}
+/**
+ * Decrypt a JSONL line from file storage.
+ * Auto-detects encrypted vs plaintext lines.
+ */
+function decryptLine(line, config) {
+    // Quick check: if it doesn't look like base64 or doesn't start with our header when decoded, it's plaintext
+    if (line.startsWith('{') || line.startsWith('['))
+        return line;
+    const passphrase = getPassphrase(config);
+    if (!passphrase)
+        return line;
+    const decrypted = decrypt(line, passphrase);
+    return decrypted || line; // Fall back to original if decryption fails
+}
+/**
+ * Encrypt an entire file's content (for memory files which are Markdown, not JSONL).
+ */
+function encryptContent(content, config) {
+    const passphrase = getPassphrase(config);
+    if (!passphrase)
+        return content;
+    return encrypt(content, passphrase) || content;
+}
+/**
+ * Decrypt file content. Auto-detects encrypted vs plaintext.
+ */
+function decryptContent(content, config) {
+    // If it starts with typical plaintext markers, it's not encrypted
+    if (content.startsWith('#') || content.startsWith('{') || content.startsWith('\n'))
+        return content;
+    const passphrase = getPassphrase(config);
+    if (!passphrase)
+        return content;
+    return decrypt(content, passphrase) || content;
+}
+//# sourceMappingURL=encryption.js.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "2.0.0";
+export declare const VERSION = "2.1.0";
 export { Agent } from './agent';
 export { OpenAIProvider } from './providers/openai';
 export { AnthropicProvider } from './providers/anthropic';
@@ -19,10 +19,14 @@ export type { IntegrityResult } from './integrity';
 export { ReplayProvider, loadSessionForReplay, compareOutputs, listReplayableSessions } from './replay';
 export type { SessionReplayData, ReplayDivergence } from './replay';
 export { MetricsCollector } from './metrics';
-export type { MetricsSnapshot, CounterValue, HistogramValue } from './metrics';
+export type { MetricsSnapshot, CounterValue, HistogramValue, Span, SpanEvent } from './metrics';
 export { RiskScorer } from './risk';
 export type { RiskAssessment, RiskFactor } from './risk';
 export { exportSarif, sarifToString } from './sarif';
 export type { SarifLog, SarifResult, SarifRule } from './sarif';
+export { PolicyEnforcer, loadPolicy, generateDefaultPolicyFile } from './policy';
+export type { Policy, PolicyRbac, PolicyRole } from './policy';
+export { encrypt, decrypt, encryptLine, decryptLine, encryptContent, decryptContent, isEncryptionEnabled, deriveKey, getPassphrase } from './encryption';
+export type { EncryptionConfig } from './encryption';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sarifToString = exports.exportSarif = exports.RiskScorer = exports.MetricsCollector = exports.listReplayableSessions = exports.compareOutputs = exports.loadSessionForReplay = exports.ReplayProvider = exports.verifyMessages = exports.verifyMessage = exports.signMessage = exports.deriveSessionKey = exports.CapabilityChecker = exports.detectProvider = exports.getModelInfo = exports.PROVIDER_DEFAULTS = exports.MODEL_REGISTRY = exports.loadMCPTools = exports.loadPlugins = exports.parseToolCalls = exports.MemoryManager = exports.SessionManager = exports.buildRepoMap = exports.ContextManager = exports.ToolRegistry = exports.AnthropicProvider = exports.OpenAIProvider = exports.Agent = exports.VERSION = void 0;
-exports.VERSION = '2.0.0';
+exports.getPassphrase = exports.deriveKey = exports.isEncryptionEnabled = exports.decryptContent = exports.encryptContent = exports.decryptLine = exports.encryptLine = exports.decrypt = exports.encrypt = exports.generateDefaultPolicyFile = exports.loadPolicy = exports.PolicyEnforcer = exports.sarifToString = exports.exportSarif = exports.RiskScorer = exports.MetricsCollector = exports.listReplayableSessions = exports.compareOutputs = exports.loadSessionForReplay = exports.ReplayProvider = exports.verifyMessages = exports.verifyMessage = exports.signMessage = exports.deriveSessionKey = exports.CapabilityChecker = exports.detectProvider = exports.getModelInfo = exports.PROVIDER_DEFAULTS = exports.MODEL_REGISTRY = exports.loadMCPTools = exports.loadPlugins = exports.parseToolCalls = exports.MemoryManager = exports.SessionManager = exports.buildRepoMap = exports.ContextManager = exports.ToolRegistry = exports.AnthropicProvider = exports.OpenAIProvider = exports.Agent = exports.VERSION = void 0;
+exports.VERSION = '2.1.0';
 var agent_1 = require("./agent");
 Object.defineProperty(exports, "Agent", { enumerable: true, get: function () { return agent_1.Agent; } });
 var openai_1 = require("./providers/openai");
@@ -62,5 +62,19 @@ Object.defineProperty(exports, "RiskScorer", { enumerable: true, get: function (
 var sarif_1 = require("./sarif");
 Object.defineProperty(exports, "exportSarif", { enumerable: true, get: function () { return sarif_1.exportSarif; } });
 Object.defineProperty(exports, "sarifToString", { enumerable: true, get: function () { return sarif_1.sarifToString; } });
+var policy_1 = require("./policy");
+Object.defineProperty(exports, "PolicyEnforcer", { enumerable: true, get: function () { return policy_1.PolicyEnforcer; } });
+Object.defineProperty(exports, "loadPolicy", { enumerable: true, get: function () { return policy_1.loadPolicy; } });
+Object.defineProperty(exports, "generateDefaultPolicyFile", { enumerable: true, get: function () { return policy_1.generateDefaultPolicyFile; } });
+var encryption_1 = require("./encryption");
+Object.defineProperty(exports, "encrypt", { enumerable: true, get: function () { return encryption_1.encrypt; } });
+Object.defineProperty(exports, "decrypt", { enumerable: true, get: function () { return encryption_1.decrypt; } });
+Object.defineProperty(exports, "encryptLine", { enumerable: true, get: function () { return encryption_1.encryptLine; } });
+Object.defineProperty(exports, "decryptLine", { enumerable: true, get: function () { return encryption_1.decryptLine; } });
+Object.defineProperty(exports, "encryptContent", { enumerable: true, get: function () { return encryption_1.encryptContent; } });
+Object.defineProperty(exports, "decryptContent", { enumerable: true, get: function () { return encryption_1.decryptContent; } });
+Object.defineProperty(exports, "isEncryptionEnabled", { enumerable: true, get: function () { return encryption_1.isEncryptionEnabled; } });
+Object.defineProperty(exports, "deriveKey", { enumerable: true, get: function () { return encryption_1.deriveKey; } });
+Object.defineProperty(exports, "getPassphrase", { enumerable: true, get: function () { return encryption_1.getPassphrase; } });
 __exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map

package/dist/metrics.d.ts

@@ -28,10 +28,32 @@ export interface MetricsSnapshot {
     counters: CounterValue[];
     histograms: HistogramValue[];
 }
+export interface SpanEvent {
+    name: string;
+    timestamp: number;
+    attributes?: Record<string, string | number | boolean>;
+}
+export interface Span {
+    traceId: string;
+    spanId: string;
+    parentSpanId?: string;
+    name: string;
+    kind: 'INTERNAL' | 'CLIENT' | 'SERVER';
+    startTimeUnixNano: number;
+    endTimeUnixNano: number;
+    attributes: Record<string, string | number | boolean>;
+    status: {
+        code: 0 | 1 | 2;
+        message?: string;
+    };
+    events: SpanEvent[];
+}
 export declare class MetricsCollector {
     private sessionId;
     private counters;
     private histograms;
+    private traceId;
+    private spans;
     constructor(sessionId?: string);
     getSessionId(): string;
     /** Increment a counter by delta (default 1) */
@@ -48,13 +70,25 @@ export declare class MetricsCollector {
     save(sessionId?: string): void;
     /** Human-readable per-tool breakdown */
     formatSummary(): string;
+    /** Start a new span for tracking tool execution or other operations */
+    startSpan(name: string, attributes?: Record<string, string | number | boolean>, parentSpanId?: string): string;
+    /** End a span, optionally with error status */
+    endSpan(spanId: string, error?: string): void;
+    /** Add an event to an active span */
+    addSpanEvent(spanId: string, name: string, attributes?: Record<string, string | number | boolean>): void;
+    /** Get completed spans */
+    getSpans(): Span[];
+    /** Export traces to OTLP endpoint */
+    exportTraces(): void;
     /**
      * Export snapshot in OTLP JSON format via HTTP POST.
      * Only fires when OTEL_EXPORTER_OTLP_ENDPOINT is set.
      * Fails silently — never blocks or crashes.
      */
     exportOtel(snap?: MetricsSnapshot): void;
-    /** Build OTLP-compatible JSON payload */
+    /** Build OTLP-compatible trace payload */
+    private buildOtlpTracePayload;
+    /** Build OTLP-compatible metrics JSON payload */
     private buildOtlpPayload;
 }
 //# sourceMappingURL=metrics.d.ts.map

package/dist/metrics.js

@@ -49,6 +49,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const http = __importStar(require("http"));
 const https = __importStar(require("https"));
+const crypto = __importStar(require("crypto"));
 // ── Helpers ──
 /** Encode a metric key: name|label1=val1|label2=val2 (sorted labels) */
 function encodeKey(name, labels) {
@@ -86,8 +87,11 @@ class MetricsCollector {
     sessionId;
     counters = new Map();
     histograms = new Map();
+    traceId;
+    spans = [];
     constructor(sessionId) {
         this.sessionId = sessionId || `${Date.now()}-${Math.random().toString(36).substring(2, 8)}`;
+        this.traceId = crypto.randomBytes(16).toString('hex');
     }
     getSessionId() {
         return this.sessionId;
@@ -207,6 +211,85 @@ class MetricsCollector {
         }
         return lines.join('\n');
     }
+    /** Start a new span for tracking tool execution or other operations */
+    startSpan(name, attributes, parentSpanId) {
+        const spanId = crypto.randomBytes(8).toString('hex');
+        const span = {
+            traceId: this.traceId,
+            spanId,
+            parentSpanId,
+            name,
+            kind: 'INTERNAL',
+            startTimeUnixNano: Date.now() * 1_000_000,
+            endTimeUnixNano: 0,
+            attributes: { 'session.id': this.sessionId, ...attributes },
+            status: { code: 0 },
+            events: [],
+        };
+        this.spans.push(span);
+        return spanId;
+    }
+    /** End a span, optionally with error status */
+    endSpan(spanId, error) {
+        const span = this.spans.find(s => s.spanId === spanId);
+        if (!span)
+            return;
+        span.endTimeUnixNano = Date.now() * 1_000_000;
+        if (error) {
+            span.status = { code: 2, message: error };
+            span.events.push({
+                name: 'exception',
+                timestamp: Date.now() * 1_000_000,
+                attributes: { 'exception.message': error },
+            });
+        }
+        else {
+            span.status = { code: 1 };
+        }
+    }
+    /** Add an event to an active span */
+    addSpanEvent(spanId, name, attributes) {
+        const span = this.spans.find(s => s.spanId === spanId);
+        if (!span)
+            return;
+        span.events.push({ name, timestamp: Date.now() * 1_000_000, attributes });
+    }
+    /** Get completed spans */
+    getSpans() {
+        return this.spans.filter(s => s.endTimeUnixNano > 0);
+    }
+    /** Export traces to OTLP endpoint */
+    exportTraces() {
+        try {
+            const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+            if (!endpoint)
+                return;
+            const completedSpans = this.getSpans();
+            if (completedSpans.length === 0)
+                return;
+            const payload = this.buildOtlpTracePayload(completedSpans);
+            const url = new URL('/v1/traces', endpoint);
+            const body = JSON.stringify(payload);
+            const mod = url.protocol === 'https:' ? https : http;
+            const req = mod.request(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Content-Length': Buffer.byteLength(body),
+                },
+                timeout: 5000,
+            });
+            req.on('error', () => { });
+            req.on('timeout', () => req.destroy());
+            req.write(body);
+            req.end();
+            // Clear exported spans
+            this.spans = this.spans.filter(s => s.endTimeUnixNano === 0);
+        }
+        catch {
+            // Trace export failures are non-fatal
+        }
+    }
     /**
      * Export snapshot in OTLP JSON format via HTTP POST.
      * Only fires when OTEL_EXPORTER_OTLP_ENDPOINT is set.
@@ -239,7 +322,52 @@ class MetricsCollector {
             // OTLP export failures are non-fatal
         }
     }
-    /** Build OTLP-compatible JSON payload */
+    /** Build OTLP-compatible trace payload */
+    buildOtlpTracePayload(spans) {
+        return {
+            resourceSpans: [{
+                    resource: {
+                        attributes: [
+                            { key: 'service.name', value: { stringValue: 'codebot' } },
+                            { key: 'service.version', value: { stringValue: '2.1.0' } },
+                            { key: 'session.id', value: { stringValue: this.sessionId } },
+                        ],
+                    },
+                    scopeSpans: [{
+                            scope: { name: 'codebot-agent', version: '2.1.0' },
+                            spans: spans.map(s => ({
+                                traceId: s.traceId,
+                                spanId: s.spanId,
+                                parentSpanId: s.parentSpanId || '',
+                                name: s.name,
+                                kind: s.kind === 'CLIENT' ? 3 : s.kind === 'SERVER' ? 2 : 1,
+                                startTimeUnixNano: String(s.startTimeUnixNano),
+                                endTimeUnixNano: String(s.endTimeUnixNano),
+                                attributes: Object.entries(s.attributes).map(([k, v]) => ({
+                                    key: k,
+                                    value: typeof v === 'number'
+                                        ? { intValue: v }
+                                        : typeof v === 'boolean'
+                                            ? { boolValue: v }
+                                            : { stringValue: String(v) },
+                                })),
+                                status: { code: s.status.code === 2 ? 2 : s.status.code === 1 ? 1 : 0, message: s.status.message || '' },
+                                events: s.events.map(e => ({
+                                    name: e.name,
+                                    timeUnixNano: String(e.timestamp),
+                                    attributes: e.attributes
+                                        ? Object.entries(e.attributes).map(([k, v]) => ({
+                                            key: k,
+                                            value: typeof v === 'number' ? { intValue: v } : { stringValue: String(v) },
+                                        }))
+                                        : [],
+                                })),
+                            })),
+                        }],
+                }],
+        };
+    }
+    /** Build OTLP-compatible metrics JSON payload */
     buildOtlpPayload(snap) {
         const metrics = [];
         for (const counter of snap.counters) {
@@ -285,7 +413,7 @@ class MetricsCollector {
                         ],
                     },
                     scopeMetrics: [{
-                            scope: { name: 'codebot-metrics', version: '1.9.0' },
+                            scope: { name: 'codebot-metrics', version: '2.1.0' },
                             metrics,
                         }],
                 }],

package/dist/policy.d.ts

@@ -48,6 +48,21 @@ export interface PolicyLimits {
     max_files_per_operation?: number;
     cost_limit_usd?: number;
 }
+export interface PolicyRole {
+    tools?: PolicyTools;
+    filesystem?: PolicyFilesystem;
+    limits?: PolicyLimits;
+}
+export interface PolicyRbac {
+    /** Map OS username or identifier to role name */
+    user_roles?: Record<string, string>;
+    /** Role definitions with scoped policies */
+    roles?: Record<string, PolicyRole>;
+    /** Default role for unrecognized users (falls back to base policy if not set) */
+    default_role?: string;
+    /** Enable RBAC enforcement (default: false for backward compatibility) */
+    enabled?: boolean;
+}
 export interface Policy {
     version?: string;
     execution?: PolicyExecution;
@@ -57,6 +72,7 @@ export interface Policy {
     git?: PolicyGit;
     mcp?: PolicyMcp;
     limits?: PolicyLimits;
+    rbac?: PolicyRbac;
 }
 export declare const DEFAULT_POLICY: Required<Policy>;
 /**
@@ -68,6 +84,16 @@ export declare class PolicyEnforcer {
     private policy;
     private projectRoot;
     constructor(policy?: Policy, projectRoot?: string);
+    /** Resolve the current user's role and return merged policy */
+    private currentUser;
+    /** Set the current user for RBAC resolution */
+    setUser(username: string): void;
+    /** Get the current OS username */
+    getCurrentUser(): string;
+    /** Resolve the role for the current user */
+    resolveRole(): string | null;
+    /** Get the effective policy for the current user (base policy merged with role overrides) */
+    getEffectivePolicy(): Policy;
     getPolicy(): Policy;
     /** Check if a tool is enabled by policy. Returns { allowed, reason }. */
     isToolAllowed(toolName: string): {

package/dist/policy.js

@@ -88,6 +88,12 @@ exports.DEFAULT_POLICY = {
         max_files_per_operation: 20,
         cost_limit_usd: 0, // 0 = no limit
     },
+    rbac: {
+        enabled: false,
+        user_roles: {},
+        roles: {},
+        default_role: undefined,
+    },
 };
 // ── Policy Loader ──
 /**
@@ -145,6 +151,8 @@ function validatePolicy(obj) {
         return false;
     if (p.limits !== undefined && typeof p.limits !== 'object')
         return false;
+    if (p.rbac !== undefined && typeof p.rbac !== 'object')
+        return false;
     return true;
 }
 /**
@@ -178,13 +186,60 @@ class PolicyEnforcer {
         this.policy = policy || loadPolicy(projectRoot);
         this.projectRoot = projectRoot || process.cwd();
     }
+    /** Resolve the current user's role and return merged policy */
+    currentUser = null;
+    /** Set the current user for RBAC resolution */
+    setUser(username) {
+        this.currentUser = username;
+    }
+    /** Get the current OS username */
+    getCurrentUser() {
+        return this.currentUser || os.userInfo().username || 'unknown';
+    }
+    /** Resolve the role for the current user */
+    resolveRole() {
+        const rbac = this.policy.rbac;
+        if (!rbac?.enabled)
+            return null;
+        const user = this.getCurrentUser();
+        const roleName = rbac.user_roles?.[user] || rbac.default_role || null;
+        return roleName;
+    }
+    /** Get the effective policy for the current user (base policy merged with role overrides) */
+    getEffectivePolicy() {
+        const rbac = this.policy.rbac;
+        if (!rbac?.enabled)
+            return this.policy;
+        const roleName = this.resolveRole();
+        if (!roleName || !rbac.roles?.[roleName])
+            return this.policy;
+        const role = rbac.roles[roleName];
+        // Merge role overrides on top of base policy
+        const effective = { ...this.policy };
+        if (role.tools) {
+            effective.tools = {
+                ...effective.tools,
+                ...role.tools,
+                permissions: { ...effective.tools?.permissions, ...role.tools.permissions },
+                capabilities: { ...effective.tools?.capabilities, ...role.tools.capabilities },
+            };
+        }
+        if (role.filesystem) {
+            effective.filesystem = { ...effective.filesystem, ...role.filesystem };
+        }
+        if (role.limits) {
+            effective.limits = { ...effective.limits, ...role.limits };
+        }
+        return effective;
+    }
     getPolicy() {
         return this.policy;
     }
     // ── Tool Access ──
     /** Check if a tool is enabled by policy. Returns { allowed, reason }. */
     isToolAllowed(toolName) {
-        const tools = this.policy.tools;
+        const effective = this.getEffectivePolicy();
+        const tools = effective.tools;
         if (!tools)
             return { allowed: true };
         // If explicit disabled list contains it, block
@@ -203,7 +258,7 @@ class PolicyEnforcer {
     }
     /** Get the permission level for a tool (policy override or null for default). */
     getToolPermission(toolName) {
-        return this.policy.tools?.permissions?.[toolName] || null;
+        return this.getEffectivePolicy().tools?.permissions?.[toolName] || null;
     }
     // ── Filesystem Access ──
     /** Check if a path is writable according to policy. */
@@ -331,11 +386,11 @@ class PolicyEnforcer {
     // ── Capabilities (v1.8.0) ──
     /** Get capability restrictions for a tool. undefined = unrestricted. */
     getToolCapabilities(toolName) {
-        return this.policy.tools?.capabilities?.[toolName];
+        return this.getEffectivePolicy().tools?.capabilities?.[toolName];
     }
     /** Check a specific capability for a tool. Returns { allowed, reason }. */
     checkCapability(toolName, capabilityType, value) {
-        const caps = this.policy.tools?.capabilities;
+        const caps = this.getEffectivePolicy().tools?.capabilities;
         if (!caps)
             return { allowed: true };
         const checker = new capabilities_1.CapabilityChecker(caps, this.projectRoot);
@@ -439,6 +494,32 @@ function generateDefaultPolicyFile() {
             max_files_per_operation: 20,
             cost_limit_usd: 0,
         },
+        rbac: {
+            enabled: false,
+            default_role: 'developer',
+            user_roles: {},
+            roles: {
+                admin: {
+                    tools: { disabled: [] },
+                    limits: { max_iterations: 100, cost_limit_usd: 50.0 },
+                },
+                developer: {
+                    tools: {
+                        disabled: ['ssh_remote'],
+                        permissions: { execute: 'prompt', write_file: 'prompt' },
+                    },
+                    limits: { max_iterations: 50, cost_limit_usd: 10.0 },
+                },
+                reviewer: {
+                    tools: {
+                        disabled: ['execute', 'write_file', 'edit_file', 'batch_edit', 'ssh_remote', 'docker', 'database'],
+                        permissions: {},
+                    },
+                    filesystem: { writable_paths: [] },
+                    limits: { max_iterations: 10, cost_limit_usd: 2.0 },
+                },
+            },
+        },
     }, null, 2) + '\n';
 }
 //# sourceMappingURL=policy.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebot-ai",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Zero-dependency autonomous AI agent. Code, browse, search, automate. Works with any LLM — Ollama, Claude, GPT, Gemini, DeepSeek, Groq, Mistral, Grok.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,7 +12,12 @@
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
     "test": "node --test dist/*.test.js dist/**/*.test.js",
-    "lint": "tsc --noEmit",
+    "lint": "eslint src/ && tsc --noEmit",
+    "lint:fix": "eslint src/ --fix",
+    "format": "prettier --write 'src/**/*.ts' '*.json' '*.md'",
+    "format:check": "prettier --check 'src/**/*.ts' '*.json' '*.md'",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -71,7 +76,12 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "typescript": "^5.5.0",
-    "@types/node": "^20.0.0"
+    "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "eslint": "^10.0.2",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.8.1",
+    "typescript": "^5.5.0"
   }
 }

package/dist/games/tic-tac-toe.d.ts

@@ -1,6 +0,0 @@
-declare const gameBoard: any[][];
-declare let currentPlayer: string;
-declare const printBoard: () => void;
-declare const checkWin: () => void;
-declare const gameLoop: () => void;
-//# sourceMappingURL=tic-tac-toe.d.ts.map

package/dist/games/tic-tac-toe.js

@@ -1,64 +0,0 @@
-"use strict";
-// src/games/tic-tac-toe.ts
-// Simple console-based Tic-Tac-Toe game
-const gameBoard = Array(3).fill(null).map(() => Array(3).fill(null));
-let currentPlayer = 'X';
-const printBoard = () => {
-    for (const row of gameBoard) {
-        console.log(row.join(' | '));
-    }
-};
-const checkWin = () => {
-    // Check rows
-    for (let i = 0; i < 3; i++) {
-        if (gameBoard[i][0] === currentPlayer &&
-            gameBoard[i][1] === currentPlayer &&
-            gameBoard[i][2] === currentPlayer) {
-            console.log(`Player ${currentPlayer} wins!`);
-            process.exit(0);
-        }
-    }
-    // Check columns
-    for (let j = 0; j < 3; j++) {
-        if (gameBoard[0][j] === currentPlayer &&
-            gameBoard[1][j] === currentPlayer &&
-            gameBoard[2][j] === currentPlayer) {
-            console.log(`Player ${currentPlayer} wins!`);
-            process.exit(0);
-        }
-    }
-    // Check diagonals
-    if ((gameBoard[0][0] === currentPlayer &&
-        gameBoard[1][1] === currentPlayer &&
-        gameBoard[2][2] === currentPlayer) ||
-        (gameBoard[0][2] === currentPlayer &&
-            gameBoard[1][1] === currentPlayer &&
-            gameBoard[2][0] === currentPlayer)) {
-        console.log(`Player ${currentPlayer} wins!`);
-        process.exit(0);
-    }
-};
-const gameLoop = () => {
-    printBoard();
-    process.stdin.on('data', (input) => {
-        const [row, col] = input.toString().trim()
-            .split(',')
-            .map(Number);
-        if (row < 0 || row > 2 || col < 0 || col > 2) {
-            console.log('Invalid move. Try again.');
-            return;
-        }
-        if (gameBoard[row][col]) {
-            console.log('Spot taken! Try again.');
-            return;
-        }
-        gameBoard[row][col] = currentPlayer;
-        checkWin();
-        currentPlayer = currentPlayer === 'X' ? 'O' : 'X';
-        process.stdin.removeAllListeners('data');
-        gameLoop();
-    });
-};
-// Start game
-gameLoop();
-//# sourceMappingURL=tic-tac-toe.js.map