codebot-ai 2.0.2 → 2.1.1

package/dist/policy.js

@@ -88,6 +88,12 @@ exports.DEFAULT_POLICY = {
         max_files_per_operation: 20,
         cost_limit_usd: 0, // 0 = no limit
     },
+    rbac: {
+        enabled: false,
+        user_roles: {},
+        roles: {},
+        default_role: undefined,
+    },
 };
 // ── Policy Loader ──
 /**
@@ -145,6 +151,8 @@ function validatePolicy(obj) {
         return false;
     if (p.limits !== undefined && typeof p.limits !== 'object')
         return false;
+    if (p.rbac !== undefined && typeof p.rbac !== 'object')
+        return false;
     return true;
 }
 /**
@@ -178,13 +186,60 @@ class PolicyEnforcer {
         this.policy = policy || loadPolicy(projectRoot);
         this.projectRoot = projectRoot || process.cwd();
     }
+    /** Resolve the current user's role and return merged policy */
+    currentUser = null;
+    /** Set the current user for RBAC resolution */
+    setUser(username) {
+        this.currentUser = username;
+    }
+    /** Get the current OS username */
+    getCurrentUser() {
+        return this.currentUser || os.userInfo().username || 'unknown';
+    }
+    /** Resolve the role for the current user */
+    resolveRole() {
+        const rbac = this.policy.rbac;
+        if (!rbac?.enabled)
+            return null;
+        const user = this.getCurrentUser();
+        const roleName = rbac.user_roles?.[user] || rbac.default_role || null;
+        return roleName;
+    }
+    /** Get the effective policy for the current user (base policy merged with role overrides) */
+    getEffectivePolicy() {
+        const rbac = this.policy.rbac;
+        if (!rbac?.enabled)
+            return this.policy;
+        const roleName = this.resolveRole();
+        if (!roleName || !rbac.roles?.[roleName])
+            return this.policy;
+        const role = rbac.roles[roleName];
+        // Merge role overrides on top of base policy
+        const effective = { ...this.policy };
+        if (role.tools) {
+            effective.tools = {
+                ...effective.tools,
+                ...role.tools,
+                permissions: { ...effective.tools?.permissions, ...role.tools.permissions },
+                capabilities: { ...effective.tools?.capabilities, ...role.tools.capabilities },
+            };
+        }
+        if (role.filesystem) {
+            effective.filesystem = { ...effective.filesystem, ...role.filesystem };
+        }
+        if (role.limits) {
+            effective.limits = { ...effective.limits, ...role.limits };
+        }
+        return effective;
+    }
     getPolicy() {
         return this.policy;
     }
     // ── Tool Access ──
     /** Check if a tool is enabled by policy. Returns { allowed, reason }. */
     isToolAllowed(toolName) {
-        const tools = this.policy.tools;
+        const effective = this.getEffectivePolicy();
+        const tools = effective.tools;
         if (!tools)
             return { allowed: true };
         // If explicit disabled list contains it, block
@@ -203,7 +258,7 @@ class PolicyEnforcer {
     }
     /** Get the permission level for a tool (policy override or null for default). */
     getToolPermission(toolName) {
-        return this.policy.tools?.permissions?.[toolName] || null;
+        return this.getEffectivePolicy().tools?.permissions?.[toolName] || null;
     }
     // ── Filesystem Access ──
     /** Check if a path is writable according to policy. */
@@ -331,11 +386,11 @@ class PolicyEnforcer {
     // ── Capabilities (v1.8.0) ──
     /** Get capability restrictions for a tool. undefined = unrestricted. */
     getToolCapabilities(toolName) {
-        return this.policy.tools?.capabilities?.[toolName];
+        return this.getEffectivePolicy().tools?.capabilities?.[toolName];
     }
     /** Check a specific capability for a tool. Returns { allowed, reason }. */
     checkCapability(toolName, capabilityType, value) {
-        const caps = this.policy.tools?.capabilities;
+        const caps = this.getEffectivePolicy().tools?.capabilities;
         if (!caps)
             return { allowed: true };
         const checker = new capabilities_1.CapabilityChecker(caps, this.projectRoot);
@@ -439,6 +494,32 @@ function generateDefaultPolicyFile() {
             max_files_per_operation: 20,
             cost_limit_usd: 0,
         },
+        rbac: {
+            enabled: false,
+            default_role: 'developer',
+            user_roles: {},
+            roles: {
+                admin: {
+                    tools: { disabled: [] },
+                    limits: { max_iterations: 100, cost_limit_usd: 50.0 },
+                },
+                developer: {
+                    tools: {
+                        disabled: ['ssh_remote'],
+                        permissions: { execute: 'prompt', write_file: 'prompt' },
+                    },
+                    limits: { max_iterations: 50, cost_limit_usd: 10.0 },
+                },
+                reviewer: {
+                    tools: {
+                        disabled: ['execute', 'write_file', 'edit_file', 'batch_edit', 'ssh_remote', 'docker', 'database'],
+                        permissions: {},
+                    },
+                    filesystem: { writable_paths: [] },
+                    limits: { max_iterations: 10, cost_limit_usd: 2.0 },
+                },
+            },
+        },
     }, null, 2) + '\n';
 }
 //# sourceMappingURL=policy.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebot-ai",
-  "version": "2.0.2",
+  "version": "2.1.1",
   "description": "Zero-dependency autonomous AI agent. Code, browse, search, automate. Works with any LLM — Ollama, Claude, GPT, Gemini, DeepSeek, Groq, Mistral, Grok.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,7 +12,12 @@
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
     "test": "node --test dist/*.test.js dist/**/*.test.js",
-    "lint": "tsc --noEmit",
+    "lint": "eslint src/ && tsc --noEmit",
+    "lint:fix": "eslint src/ --fix",
+    "format": "prettier --write 'src/**/*.ts' '*.json' '*.md'",
+    "format:check": "prettier --check 'src/**/*.ts' '*.json' '*.md'",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -71,7 +76,12 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "typescript": "^5.5.0",
-    "@types/node": "^20.0.0"
+    "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "eslint": "^10.0.2",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.8.1",
+    "typescript": "^5.5.0"
   }
 }