codex-linux 1.0.0

package/src/main/security/AdminConsoleManager.ts

@@ -0,0 +1,244 @@
+import { EventEmitter } from 'events';
+import log from 'electron-log';
+import * as fs from 'fs';
+import * as path from 'path';
+
+export interface AdminSettings {
+  disableCodeTab: boolean;
+  disableBypassPermissionsMode: boolean;
+  disableWebAccess: boolean;
+  allowedModels: string[];
+  blockedTools: string[];
+  networkConfig?: {
+    proxyUrl?: string;
+    allowedDomains?: string[];
+    blockedDomains?: string[];
+  };
+  sessionConfig?: {
+    maxConcurrentSessions: number;
+    sessionTimeoutMinutes: number;
+    idleTimeoutMinutes: number;
+  };
+  mcpConfig?: {
+    requireApprovalForNewServers: boolean;
+    allowedServerPatterns: string[];
+    blockedServerPatterns: string[];
+  };
+}
+
+export interface ManagedSettings {
+  settings: AdminSettings;
+  version: string;
+  updatedAt: string;
+  updatedBy: string;
+}
+
+export class AdminConsoleManager extends EventEmitter {
+  private settings: AdminSettings;
+  private settingsPath: string;
+  private watchInterval: NodeJS.Timeout | null = null;
+
+  constructor(configDir: string) {
+    super();
+    this.settingsPath = path.join(configDir, 'admin-settings.json');
+    this.settings = this.getDefaultSettings();
+    this.loadSettings();
+  }
+
+  private getDefaultSettings(): AdminSettings {
+    return {
+      disableCodeTab: false,
+      disableBypassPermissionsMode: false,
+      disableWebAccess: false,
+      allowedModels: [],
+      blockedTools: [],
+      networkConfig: {
+        allowedDomains: [],
+        blockedDomains: [],
+      },
+      sessionConfig: {
+        maxConcurrentSessions: 10,
+        sessionTimeoutMinutes: 120,
+        idleTimeoutMinutes: 30,
+      },
+      mcpConfig: {
+        requireApprovalForNewServers: true,
+        allowedServerPatterns: [],
+        blockedServerPatterns: [],
+      },
+    };
+  }
+
+  private loadSettings(): void {
+    try {
+      if (fs.existsSync(this.settingsPath)) {
+        const data = fs.readFileSync(this.settingsPath, 'utf-8');
+        const parsed = JSON.parse(data) as ManagedSettings;
+        this.settings = { ...this.getDefaultSettings(), ...parsed.settings };
+        log.info('Admin settings loaded');
+        this.emit('settings:loaded', this.settings);
+      }
+    } catch (error) {
+      log.error('Failed to load admin settings:', error);
+      this.settings = this.getDefaultSettings();
+    }
+  }
+
+  async saveSettings(settings: Partial<AdminSettings>): Promise<void> {
+    this.settings = { ...this.settings, ...settings };
+    
+    const managedSettings: ManagedSettings = {
+      settings: this.settings,
+      version: '1.0.0',
+      updatedAt: new Date().toISOString(),
+      updatedBy: 'admin',
+    };
+
+    try {
+      const dir = path.dirname(this.settingsPath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+      
+      fs.writeFileSync(this.settingsPath, JSON.stringify(managedSettings, null, 2));
+      log.info('Admin settings saved');
+      this.emit('settings:saved', this.settings);
+    } catch (error) {
+      log.error('Failed to save admin settings:', error);
+      throw error;
+    }
+  }
+
+  getSettings(): AdminSettings {
+    return { ...this.settings };
+  }
+
+  // Permission checks
+  isCodeTabEnabled(): boolean {
+    return !this.settings.disableCodeTab;
+  }
+
+  isBypassPermissionsAllowed(): boolean {
+    return !this.settings.disableBypassPermissionsMode;
+  }
+
+  isWebAccessAllowed(): boolean {
+    return !this.settings.disableWebAccess;
+  }
+
+  isModelAllowed(model: string): boolean {
+    if (this.settings.allowedModels.length === 0) {
+      return true;
+    }
+    return this.settings.allowedModels.includes(model);
+  }
+
+  isToolAllowed(toolName: string): boolean {
+    return !this.settings.blockedTools.includes(toolName);
+  }
+
+  isDomainAllowed(domain: string): boolean {
+    const { allowedDomains = [], blockedDomains = [] } = this.settings.networkConfig || {};
+    
+    if (blockedDomains.some(d => domain.includes(d))) {
+      return false;
+    }
+    
+    if (allowedDomains.length === 0) {
+      return true;
+    }
+    
+    return allowedDomains.some(d => domain.includes(d));
+  }
+
+  // Session config
+  getMaxConcurrentSessions(): number {
+    return this.settings.sessionConfig?.maxConcurrentSessions || 10;
+  }
+
+  getSessionTimeoutMinutes(): number {
+    return this.settings.sessionConfig?.sessionTimeoutMinutes || 120;
+  }
+
+  getIdleTimeoutMinutes(): number {
+    return this.settings.sessionConfig?.idleTimeoutMinutes || 30;
+  }
+
+  // MCP config
+  isMCPApprovalRequired(): boolean {
+    return this.settings.mcpConfig?.requireApprovalForNewServers ?? true;
+  }
+
+  isMCPServerAllowed(serverName: string): boolean {
+    const { allowedServerPatterns = [], blockedServerPatterns = [] } = this.settings.mcpConfig || {};
+    
+    if (blockedServerPatterns.some(p => new RegExp(p).test(serverName))) {
+      return false;
+    }
+    
+    if (allowedServerPatterns.length === 0) {
+      return true;
+    }
+    
+    return allowedServerPatterns.some(p => new RegExp(p).test(serverName));
+  }
+
+  // Watch for external changes
+  startWatching(): void {
+    if (this.watchInterval) return;
+    
+    this.watchInterval = setInterval(() => {
+      const currentMtime = fs.statSync(this.settingsPath).mtime;
+      if (this.lastMtime && currentMtime.getTime() > this.lastMtime.getTime()) {
+        this.loadSettings();
+        this.emit('settings:changed', this.settings);
+      }
+      this.lastMtime = currentMtime;
+    }, 5000);
+  }
+
+  private lastMtime: Date | null = null;
+
+  stopWatching(): void {
+    if (this.watchInterval) {
+      clearInterval(this.watchInterval);
+      this.watchInterval = null;
+    }
+  }
+
+  // Export settings for deployment
+  exportSettings(): ManagedSettings {
+    return {
+      settings: this.settings,
+      version: '1.0.0',
+      updatedAt: new Date().toISOString(),
+      updatedBy: 'admin',
+    };
+  }
+
+  // Import settings from file
+  async importSettings(filePath: string): Promise<void> {
+    try {
+      const data = fs.readFileSync(filePath, 'utf-8');
+      const imported = JSON.parse(data) as ManagedSettings;
+      
+      if (!imported.settings) {
+        throw new Error('Invalid settings file format');
+      }
+      
+      await this.saveSettings(imported.settings);
+      log.info('Admin settings imported from', filePath);
+      this.emit('settings:imported', imported.settings);
+    } catch (error) {
+      log.error('Failed to import admin settings:', error);
+      throw error;
+    }
+  }
+
+  cleanup(): void {
+    this.stopWatching();
+    this.removeAllListeners();
+  }
+}
+
+export default AdminConsoleManager;

package/src/main/security/AuditLogger.ts

@@ -0,0 +1,143 @@
+import { app } from 'electron';
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import { createWriteStream } from 'fs';
+import { format } from 'date-fns';
+
+interface AuditEvent {
+  id: string;
+  timestamp: Date;
+  action: string;
+  userId: string;
+  details: Record<string, any>;
+  ip?: string;
+  userAgent?: string;
+}
+
+export class AuditLogger {
+  private logDir: string;
+  private currentLogFile: string;
+  private writeStream: ReturnType<typeof createWriteStream> | null = null;
+  private rotateInterval: NodeJS.Timeout | null = null;
+
+  constructor() {
+    this.logDir = path.join(app.getPath('userData'), 'audit-logs');
+    this.currentLogFile = '';
+  }
+
+  async initialize(): Promise<void> {
+    await fs.mkdir(this.logDir, { recursive: true });
+    await this.rotateLogFile();
+    
+    this.rotateInterval = setInterval(() => this.rotateLogFile(), 60 * 60 * 1000);
+  }
+
+  async cleanup(): Promise<void> {
+    if (this.rotateInterval) {
+      clearInterval(this.rotateInterval);
+      this.rotateInterval = null;
+    }
+    if (this.writeStream) {
+      this.writeStream.end();
+      this.writeStream = null;
+    }
+  }
+
+  private async rotateLogFile(): Promise<void> {
+    if (this.writeStream) {
+      this.writeStream.end();
+    }
+
+    const timestamp = format(new Date(), 'yyyy-MM-dd-HH');
+    this.currentLogFile = path.join(this.logDir, `audit-${timestamp}.log`);
+    
+    this.writeStream = createWriteStream(this.currentLogFile, { flags: 'a' });
+  }
+
+  async log(
+    action: string,
+    details: Record<string, any>,
+    metadata?: { ip?: string; userAgent?: string }
+  ): Promise<void> {
+    const event: AuditEvent = {
+      id: this.generateId(),
+      timestamp: new Date(),
+      action,
+      userId: 'current-user', // In real app, get from auth context
+      details,
+      ...metadata,
+    };
+
+    const logLine = JSON.stringify(event) + '\n';
+    
+    if (this.writeStream) {
+      this.writeStream.write(logLine);
+    }
+
+    // Also keep recent events in memory for quick access
+    this.recentEvents.unshift(event);
+    if (this.recentEvents.length > 1000) {
+      this.recentEvents.pop();
+    }
+  }
+
+  private recentEvents: AuditEvent[] = [];
+
+  async getRecentEvents(limit: number = 100): Promise<AuditEvent[]> {
+    return this.recentEvents.slice(0, limit);
+  }
+
+  async getEventsByAction(action: string, limit: number = 100): Promise<AuditEvent[]> {
+    return this.recentEvents
+      .filter(e => e.action === action)
+      .slice(0, limit);
+  }
+
+  async getEventsByDateRange(startDate: Date, endDate: Date): Promise<AuditEvent[]> {
+    // Read from log files
+    const files = await fs.readdir(this.logDir);
+    const events: AuditEvent[] = [];
+
+    for (const file of files) {
+      if (!file.endsWith('.log')) continue;
+      
+      const filePath = path.join(this.logDir, file);
+      const content = await fs.readFile(filePath, 'utf-8');
+      const lines = content.split('\n').filter(Boolean);
+
+      for (const line of lines) {
+        try {
+          const event: AuditEvent = JSON.parse(line);
+          const eventDate = new Date(event.timestamp);
+          
+          if (eventDate >= startDate && eventDate <= endDate) {
+            events.push(event);
+          }
+        } catch {
+          // Skip invalid lines
+        }
+      }
+    }
+
+    return events.sort((a, b) => 
+      new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    );
+  }
+
+  async exportLogs(exportPath: string): Promise<void> {
+    const events = await this.getEventsByDateRange(
+      new Date(0),
+      new Date()
+    );
+    
+    await fs.writeFile(
+      exportPath,
+      JSON.stringify(events, null, 2),
+      'utf-8'
+    );
+  }
+
+  private generateId(): string {
+    return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+  }
+}

package/src/main/security/PermissionManager.ts

@@ -0,0 +1,184 @@
+import { EventEmitter } from 'events';
+import { v4 as uuidv4 } from 'uuid';
+import log from 'electron-log';
+import { PermissionMode, PermissionRequest } from '../../shared/types';
+
+export type PermissionActionType = 'edit' | 'command' | 'tool';
+
+export interface PermissionAction {
+  type: PermissionActionType;
+  action: string;
+  details: Record<string, any>;
+}
+
+export class PermissionManager extends EventEmitter {
+  private pendingRequests: Map<string, PermissionRequest> = new Map();
+  private agentModes: Map<string, PermissionMode> = new Map();
+  private settings: {
+    allowBypassMode: boolean;
+    defaultMode: PermissionMode;
+  } = {
+    allowBypassMode: false,
+    defaultMode: PermissionMode.ASK
+  };
+
+  constructor() {
+    super();
+  }
+
+  setAllowBypassMode(allowed: boolean): void {
+    this.settings.allowBypassMode = allowed;
+    log.info(`Bypass permission mode ${allowed ? 'enabled' : 'disabled'}`);
+  }
+
+  isBypassAllowed(): boolean {
+    return this.settings.allowBypassMode;
+  }
+
+  setDefaultMode(mode: PermissionMode): void {
+    this.settings.defaultMode = mode;
+  }
+
+  getDefaultMode(): PermissionMode {
+    return this.settings.defaultMode;
+  }
+
+  setAgentMode(agentId: string, mode: PermissionMode): void {
+    if (mode === PermissionMode.BYPASS && !this.settings.allowBypassMode) {
+      throw new Error('Bypass permission mode is not enabled. Enable it in settings first.');
+    }
+    this.agentModes.set(agentId, mode);
+    this.emit('mode:changed', { agentId, mode });
+    log.info(`Permission mode set to ${mode} for agent ${agentId}`);
+  }
+
+  getAgentMode(agentId: string): PermissionMode {
+    return this.agentModes.get(agentId) || this.settings.defaultMode;
+  }
+
+  async checkPermission(
+    agentId: string,
+    action: PermissionAction
+  ): Promise<{ allowed: boolean; requestId?: string }> {
+    const mode = this.getAgentMode(agentId);
+
+    switch (mode) {
+      case PermissionMode.ASK:
+        // Always ask for permission
+        const request = await this.createPermissionRequest(agentId, action);
+        return { allowed: false, requestId: request.id };
+
+      case PermissionMode.AUTO_ACCEPT_EDITS:
+        // Auto-accept edits, ask for commands and tools
+        if (action.type === 'edit') {
+          return { allowed: true };
+        }
+        const editRequest = await this.createPermissionRequest(agentId, action);
+        return { allowed: false, requestId: editRequest.id };
+
+      case PermissionMode.PLAN:
+        // In plan mode, never execute actions
+        return { allowed: false };
+
+      case PermissionMode.BYPASS:
+        // Bypass all permissions
+        return { allowed: true };
+
+      default:
+        return { allowed: false };
+    }
+  }
+
+  private async createPermissionRequest(
+    agentId: string,
+    action: PermissionAction
+  ): Promise<PermissionRequest> {
+    const request: PermissionRequest = {
+      id: uuidv4(),
+      agentId,
+      type: action.type,
+      action: action.action,
+      details: action.details,
+      status: 'pending',
+      createdAt: new Date()
+    };
+
+    this.pendingRequests.set(request.id, request);
+    this.emit('permission:requested', request);
+    
+    log.info(`Permission requested for agent ${agentId}: ${action.type} - ${action.action}`);
+    
+    return request;
+  }
+
+  async approveRequest(requestId: string): Promise<void> {
+    const request = this.pendingRequests.get(requestId);
+    if (!request) {
+      throw new Error(`Permission request ${requestId} not found`);
+    }
+
+    request.status = 'approved';
+    request.resolvedAt = new Date();
+    
+    this.emit('permission:approved', request);
+    log.info(`Permission request ${requestId} approved`);
+  }
+
+  async rejectRequest(requestId: string): Promise<void> {
+    const request = this.pendingRequests.get(requestId);
+    if (!request) {
+      throw new Error(`Permission request ${requestId} not found`);
+    }
+
+    request.status = 'rejected';
+    request.resolvedAt = new Date();
+    
+    this.pendingRequests.delete(requestId);
+    this.emit('permission:rejected', request);
+    log.info(`Permission request ${requestId} rejected`);
+  }
+
+  getPendingRequests(agentId?: string): PermissionRequest[] {
+    const requests = Array.from(this.pendingRequests.values())
+      .filter(r => r.status === 'pending');
+    
+    if (agentId) {
+      return requests.filter(r => r.agentId === agentId);
+    }
+    
+    return requests;
+  }
+
+  getRequest(requestId: string): PermissionRequest | undefined {
+    return this.pendingRequests.get(requestId);
+  }
+
+  clearResolvedRequests(): void {
+    for (const [id, request] of this.pendingRequests) {
+      if (request.status !== 'pending') {
+        this.pendingRequests.delete(id);
+      }
+    }
+  }
+
+  getPermissionModeDescription(mode: PermissionMode): string {
+    switch (mode) {
+      case PermissionMode.ASK:
+        return 'Ask before editing files or running commands';
+      case PermissionMode.AUTO_ACCEPT_EDITS:
+        return 'Auto-accept file edits, ask for commands';
+      case PermissionMode.PLAN:
+        return 'Analyze only, no changes or commands';
+      case PermissionMode.BYPASS:
+        return 'Run without any permission prompts (dangerous)';
+      default:
+        return '';
+    }
+  }
+
+  cleanup(): void {
+    this.pendingRequests.clear();
+    this.agentModes.clear();
+    this.removeAllListeners();
+  }
+}