deepdebug-local-agent 1.0.23 → 1.2.0

package/src/detectors/multi-project-detector.js

@@ -9,24 +9,24 @@ import { FileReader } from "../workspace/file-reader.js";
 /**
  * MultiProjectDetector
  *
- * Detecta múltiplos projetos dentro de um workspace
- * Escaneia subpastas em busca de projetos independentes (pom.xml, package.json, etc)
+ * Detects multiple projects within a workspace
+ * Scans subfolders looking for independent projects (pom.xml, package.json, etc)
  */
 export class MultiProjectDetector {
     constructor(workspaceRoot) {
         this.workspaceRoot = workspaceRoot;
-        this.maxDepth = 2; // Escanear até 2 níveis de profundidade
+        this.maxDepth = 2; // Scan up to 2 levels deep
     }
 
     /**
-     * Detecta todos os projetos no workspace
+     * Detects all projects in the workspace
      */
     async detectProjects() {
         console.log(`🔍 Scanning workspace for multiple projects: ${this.workspaceRoot}`);
 
         const projects = [];
 
-        // 1️⃣ Verificar se o próprio workspace root é um projeto
+        // 1️⃣ Check whether the workspace root itself is a project
         if (await this.isProject(this.workspaceRoot)) {
             console.log(`✅ Root is a project`);
             projects.push({
@@ -36,13 +36,13 @@ export class MultiProjectDetector {
             });
         }
 
-        // 2️⃣ Escanear subpastas em busca de projetos
+        // 2️⃣ Scan subfolders looking for projects
         const subProjects = await this.scanSubdirectories(this.workspaceRoot, 0);
         projects.push(...subProjects);
 
         console.log(`✅ Found ${projects.length} project(s) in workspace`);
 
-        // 3️⃣ Detectar serviços para cada projeto
+        // 3️⃣ Detect services for each project
         const allServices = [];
         for (const project of projects) {
             console.log(`🔎 Detecting services in: ${project.name}`);
@@ -55,7 +55,7 @@ export class MultiProjectDetector {
     }
 
     /**
-     * Verifica se um diretório é um projeto
+     * Checks whether a directory is a project
      */
     async isProject(dir) {
         const markers = [
@@ -67,12 +67,12 @@ export class MultiProjectDetector {
             'pyproject.toml',    // Python Poetry
             'go.mod',            // Go
             'Cargo.toml',        // Rust
-            '.csproj',           // .NET (qualquer arquivo .csproj)
+            '.csproj',           // .NET (any .csproj file)
             '.sln'               // .NET solution
         ];
 
         for (const marker of markers) {
-            // Para .csproj e .sln, procurar qualquer arquivo com extensão
+            // For .csproj and .sln, look for any file with that extension
             if (marker.startsWith('.')) {
                 try {
                     const files = await readdir(dir);
@@ -83,7 +83,7 @@ export class MultiProjectDetector {
                     continue;
                 }
             } else {
-                // Para markers específicos, verificar se existe
+                // For specific markers, check whether they exist
                 if (await exists(path.join(dir, marker))) {
                     return true;
                 }
@@ -94,7 +94,7 @@ export class MultiProjectDetector {
     }
 
     /**
-     * Escaneia subdiretórios recursivamente
+     * Scans subdirectories recursively
      */
     async scanSubdirectories(dir, depth) {
         if (depth >= this.maxDepth) {
@@ -109,7 +109,7 @@ export class MultiProjectDetector {
             for (const entry of entries) {
                 if (!entry.isDirectory()) continue;
 
-                // Ignorar pastas comuns que não são projetos
+                // Ignore common folders that are not projects
                 const ignoreDirs = [
                     'node_modules', 'target', 'build', 'dist', 'out',
                     '.git', '.idea', '.vscode', '__pycache__',
@@ -123,7 +123,7 @@ export class MultiProjectDetector {
 
                 const fullPath = path.join(dir, entry.name);
 
-                // Verificar se é um projeto
+                // Check whether it is a project
                 if (await this.isProject(fullPath)) {
                     console.log(`✅ Found project: ${entry.name}`);
                     projects.push({
@@ -131,11 +131,11 @@ export class MultiProjectDetector {
                         path: fullPath,
                         isRoot: false
                     });
-                    // Não escanear dentro de projetos encontrados
+                    // Do not scan inside projects that were found
                     continue;
                 }
 
-                // Continuar escaneando recursivamente
+                // Keep scanning recursively
                 const subProjects = await this.scanSubdirectories(fullPath, depth + 1);
                 projects.push(...subProjects);
             }
@@ -147,19 +147,19 @@ export class MultiProjectDetector {
     }
 
     /**
-     * Detecta serviços em um projeto específico
+     * Detects services in a specific project
      */
     async detectServicesInProject(project) {
         try {
-            // Usar o scanner para analisar o projeto
+            // Use the scanner to analyze the project
             const scanner = new WorkspaceScanner(project.path);
             const structure = await scanner.scan();
 
-            // Detectar linguagem
+            // Detect the language
             const languageDetector = new LanguageDetector(structure.files);
             const languageInfo = languageDetector.detect();
 
-            // Detectar framework
+            // Detect the framework
             const fileReader = new FileReader(project.path);
             const frameworkDetector = new FrameworkDetector(
                 languageInfo.primary,
@@ -168,7 +168,7 @@ export class MultiProjectDetector {
             );
             const frameworkInfo = await frameworkDetector.detect();
 
-            // Detectar serviços
+            // Detect the services
             const serviceDetector = new ServiceDetector(
                 project.path,
                 languageInfo,
@@ -177,7 +177,7 @@ export class MultiProjectDetector {
 
             const services = await serviceDetector.detect();
 
-            // Adicionar nome do workspace a cada serviço
+            // Add the workspace name to each service
             return services.map(service => ({
                 ...service,
                 workspaceName: project.name,

package/src/detectors/service-detector.js

@@ -4,8 +4,8 @@ import { exists, readFile } from "../fs-utils.js";
 /**
  * ServiceDetector
  *
- * Detecta serviços/microservices em um workspace
- * Identifica: nome, porta, tipo, comando de start
+ * Detects services/microservices in a workspace
+ * Identifies: name, port, type, start command
  */
 export class ServiceDetector {
     constructor(root, languageInfo, frameworkInfo) {
@@ -16,12 +16,12 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta todos os serviços no workspace
+     * Detects all services in the workspace
      */
     async detect() {
         const services = [];
 
-        // Detectar por tipo de projeto
+        // Detect by project type
         if (this.language === "java" && this.framework === "spring-boot") {
             const service = await this.detectSpringBootService();
             if (service) services.push(service);
@@ -41,20 +41,20 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta serviço Spring Boot
+     * Detects a Spring Boot service
      */
     async detectSpringBootService() {
         const pomPath = path.join(this.root, "pom.xml");
         const gradlePath = path.join(this.root, "build.gradle");
 
-        let serviceName = path.basename(this.root); // Fallback: nome da pasta
+        let serviceName = path.basename(this.root); // Fallback: folder name
         let port = 8080;
 
-        // Tentar extrair nome do pom.xml (ignorando o parent)
+        // Try to extract the name from pom.xml (ignoring the parent)
         if (await exists(pomPath)) {
             const content = await readFile(pomPath, "utf8");
 
-            // Remove o bloco <parent>...</parent> para não pegar o artifactId errado
+            // Remove the <parent>...</parent> block so we do not pick the wrong artifactId
             const contentWithoutParent = content.replace(/<parent>[\s\S]*?<\/parent>/gi, '');
             const artifactIdMatch = contentWithoutParent.match(/<artifactId>([^<]+)<\/artifactId>/);
 
@@ -63,7 +63,7 @@ export class ServiceDetector {
             }
         }
 
-        // Tentar extrair do build.gradle
+        // Try to extract it from build.gradle
         if (await exists(gradlePath)) {
             const content = await readFile(gradlePath, "utf8");
             const nameMatch = content.match(/rootProject\.name\s*=\s*['"]([^'"]+)['"]/);
@@ -72,7 +72,7 @@ export class ServiceDetector {
             }
         }
 
-        // Tentar detectar porta do application.yml/properties
+        // Try to detect the port from application.yml/properties
         port = await this.detectSpringBootPort();
 
         return {
@@ -89,7 +89,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta porta do Spring Boot
+     * Detects the Spring Boot port
      */
     async detectSpringBootPort() {
         const candidates = [
@@ -103,21 +103,21 @@ export class ServiceDetector {
             if (await exists(fullPath)) {
                 const content = await readFile(fullPath, "utf8");
 
-                // YAML - múltiplos padrões
+                // YAML - multiple patterns
                 if (rel.endsWith(".yml") || rel.endsWith(".yaml")) {
-                    // Padrão 1: server:\n  port: 8080
+                    // Pattern 1: server:\n  port: 8080
                     let match = content.match(/server:\s*\n\s*port:\s*(\d+)/);
                     if (match) return parseInt(match[1]);
 
-                    // Padrão 2: server.port: 8080
+                    // Pattern 2: server.port: 8080
                     match = content.match(/server\.port:\s*(\d+)/);
                     if (match) return parseInt(match[1]);
 
-                    // Padrão 3: port: ${PORT:8080}
+                    // Pattern 3: port: ${PORT:8080}
                     match = content.match(/port:\s*\$\{[^}]*:(\d+)\}/);
                     if (match) return parseInt(match[1]);
 
-                    // Padrão 4: server:\n    port: 8080 (com mais espaços)
+                    // Pattern 4: server:\n    port: 8080 (with more spaces)
                     match = content.match(/server:\s*[\r\n]+\s*port:\s*(\d+)/);
                     if (match) return parseInt(match[1]);
                 }
@@ -134,7 +134,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta serviço Node.js
+     * Detects a Node.js service
      */
     async detectNodeService() {
         const pkgPath = path.join(this.root, "package.json");
@@ -157,10 +157,10 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta porta do Node.js
+     * Detects the Node.js port
      */
     async detectNodePort() {
-        // Tentar .env
+        // Try .env
         const envPath = path.join(this.root, ".env");
         if (await exists(envPath)) {
             const content = await readFile(envPath, "utf8");
@@ -168,7 +168,7 @@ export class ServiceDetector {
             if (match) return parseInt(match[1]);
         }
 
-        // Defaults por framework
+        // Defaults per framework
         const defaults = {
             "next": 3000,
             "express": 3000,
@@ -179,7 +179,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta serviço Python
+     * Detects a Python service
      */
     async detectPythonService() {
         return {
@@ -196,7 +196,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta porta do Python
+     * Detects the Python port
      */
     async detectPythonPort() {
         const defaults = {
@@ -209,7 +209,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta serviço .NET
+     * Detects a .NET service
      */
     detectDotNetService() {
         return {
@@ -226,7 +226,7 @@ export class ServiceDetector {
     }
 
     /**
-     * Detecta serviço Go
+     * Detects a Go service
      */
     detectGoService() {
         return {

package/src/dlp/engine.js

@@ -0,0 +1,111 @@
+/**
+ * DLP engine: pure functions, no env, no I/O, no module state.
+ *
+ * maskSensitive(text, opts) -> { text, redactions, total, blocked, blockedClasses, ... }
+ *   mode 'off'     text returned untouched, nothing scanned.
+ *   mode 'warn'    text returned untouched; redactions/blocked report what enforce WOULD do.
+ *   mode 'enforce' text returned with every hit replaced by [REDACTED:<rule_id>];
+ *                  when a hit belongs to a class in blockClasses the whole text is
+ *                  replaced by [BLOCKED:<class>] and `blocked` is true.
+ * The matched value is never returned, logged or counted: only rule ids and counts.
+ */
+import { RULES, RULESET_VERSION } from './rules.js';
+import { createHash } from 'node:crypto';
+
+export const MODES = Object.freeze(['off', 'warn', 'enforce']);
+export const DEFAULT_MAX_BYTES = 2_000_000;
+
+/** @param {unknown} v @returns {'off'|'warn'|'enforce'} unknown values fall back to 'off'. */
+export function normalizeMode(v) {
+    const m = typeof v === 'string' ? v.trim().toLowerCase() : '';
+    return MODES.includes(m) ? m : 'off';
+}
+
+/** Stable hash of the active ruleset (sent with config.update / heartbeat). */
+export function rulesetHash(rules = RULES) {
+    const h = createHash('sha256');
+    h.update(RULESET_VERSION);
+    for (const rule of rules) h.update(`\n${rule.id}|${rule.class}|${rule.re.source}|${rule.re.flags}|${rule.group ?? 0}`);
+    return h.digest('hex');
+}
+
+export const REDACTED = (id) => `[REDACTED:${id}]`;
+export const BLOCKED = (cls) => `[BLOCKED:${cls}]`;
+export const OVERSIZE = '[REDACTED:dlp_oversize]';
+
+/**
+ * @param {string} text
+ * @param {{mode?: string, rules?: ReadonlyArray<object>, blockClasses?: Iterable<string>, maxBytes?: number}} [opts]
+ */
+export function maskSensitive(text, opts = {}) {
+    const mode = normalizeMode(opts.mode);
+    const empty = { text, mode, redactions: {}, total: 0, blocked: false, blockedClasses: [], oversize: false, rulesetVersion: RULESET_VERSION };
+    if (mode === 'off' || typeof text !== 'string' || text.length === 0) return empty;
+
+    const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+    if (text.length > maxBytes) {
+        // Cannot scan safely in bounded time: enforce fails closed, warn only reports.
+        return { ...empty, text: mode === 'enforce' ? OVERSIZE : text, oversize: true };
+    }
+
+    const rules = opts.rules ?? RULES;
+    const blockSet = new Set(opts.blockClasses ?? []);
+    const redactions = {};
+    const hitClasses = new Set();
+    let out = text;
+    let total = 0;
+
+    for (const rule of rules) {
+        const re = new RegExp(rule.re.source, rule.re.flags.includes('g') ? rule.re.flags : rule.re.flags + 'g');
+        out = out.replace(re, (...args) => {
+            const match = args[0];
+            const groupIdx = rule.group ?? 0;
+            const target = groupIdx === 0 ? match : args[groupIdx];
+            if (typeof target !== 'string' || target.length === 0) return match;
+            if (target.includes('[REDACTED:')) return match; // never re-mask a placeholder (idempotence)
+            if (rule.validate && !rule.validate(target)) return match;
+            redactions[rule.id] = (redactions[rule.id] || 0) + 1;
+            hitClasses.add(rule.class);
+            total++;
+            if (groupIdx === 0) return REDACTED(rule.id);
+            const at = match.lastIndexOf(target);
+            return match.slice(0, at) + REDACTED(rule.id) + match.slice(at + target.length);
+        });
+    }
+
+    const blockedClasses = [...hitClasses].filter((c) => blockSet.has(c));
+    const blocked = blockedClasses.length > 0;
+    if (mode === 'warn') return { ...empty, redactions, total, blocked, blockedClasses };
+    return { ...empty, text: blocked ? BLOCKED(blockedClasses[0]) : out, redactions, total, blocked, blockedClasses };
+}
+
+/**
+ * Apply maskSensitive to every string in a JSON-like value (objects, arrays).
+ * Keys are not touched. Returns a new value plus the merged report.
+ */
+export function maskDeep(value, opts = {}) {
+    const report = { redactions: {}, total: 0, blocked: false, blockedClasses: [], oversize: false };
+    const seen = new WeakSet();
+    const walk = (v) => {
+        if (typeof v === 'string') {
+            const res = maskSensitive(v, opts);
+            for (const [k, n] of Object.entries(res.redactions)) report.redactions[k] = (report.redactions[k] || 0) + n;
+            report.total += res.total;
+            report.blocked ||= res.blocked;
+            report.oversize ||= res.oversize;
+            for (const c of res.blockedClasses) if (!report.blockedClasses.includes(c)) report.blockedClasses.push(c);
+            return res.text;
+        }
+        if (v === null || typeof v !== 'object') return v;
+        if (seen.has(v)) return '[circular]';
+        seen.add(v);
+        if (Array.isArray(v)) return v.map(walk);
+        const o = {};
+        for (const [k, x] of Object.entries(v)) o[k] = walk(x);
+        return o;
+    };
+    const mode = normalizeMode(opts.mode);
+    if (mode === 'off') return { value, mode, ...report };
+    const masked = walk(value);
+    return { value: mode === 'warn' ? value : masked, mode, ...report };
+}

package/src/dlp/index.js

@@ -0,0 +1,137 @@
+/**
+ * DLP for the Local Agent (T4-09): public API.
+ *
+ * Pure, reusable core (no env, no state):  maskSensitive, maskDeep  (engine.js)
+ * Configured wrappers (env + counters):     protectEgress, protectEgressAsync, protectDeep
+ *
+ * Flag: LOCAL_AGENT_DLP_MODE=off|warn|enforce   (default off: output byte-identical to before)
+ *       LOCAL_AGENT_DLP_BLOCK_CLASSES=private-key,cloud-credential   (default none; enforce only)
+ *       LOCAL_AGENT_DLP_MAX_BYTES=2000000                            (enforce fails closed above it)
+ *
+ * Fail-closed (D19): in enforce, an internal DLP error, an oversize input or a
+ * PolicyGate decision that is not an explicit ALLOW (including offline/timeout)
+ * withholds the content ([DLP_DENIED]) instead of letting it out.
+ *
+ * Reports carry rule ids and counts only; never the matched value.
+ */
+import { maskSensitive, maskDeep, normalizeMode, rulesetHash, DEFAULT_MAX_BYTES } from './engine.js';
+import { RULES, RULESET_VERSION, RULE_CLASSES } from './rules.js';
+
+export { maskSensitive, maskDeep, normalizeMode, rulesetHash, RULES, RULESET_VERSION, RULE_CLASSES };
+
+export const DENIED = '[DLP_DENIED]';
+const NOOP = () => {};
+
+/** Read the DLP configuration from an env-like object. */
+export function dlpConfigFromEnv(env = process.env) {
+    const maxRaw = Number.parseInt(env.LOCAL_AGENT_DLP_MAX_BYTES ?? '', 10);
+    const blockClasses = String(env.LOCAL_AGENT_DLP_BLOCK_CLASSES ?? '')
+        .split(',').map((s) => s.trim()).filter((c) => RULE_CLASSES.includes(c));
+    return {
+        mode: normalizeMode(env.LOCAL_AGENT_DLP_MODE),
+        blockClasses,
+        maxBytes: Number.isFinite(maxRaw) && maxRaw > 0 ? maxRaw : DEFAULT_MAX_BYTES,
+    };
+}
+
+// ---- counters (for heartbeat / dlp_redactions_total) -------------------------
+const counters = { scanned: 0, redactedTotal: 0, blocked: 0, denied: 0, byRule: new Map() };
+
+function record(res) {
+    counters.scanned++;
+    counters.redactedTotal += res.total;
+    if (res.blocked) counters.blocked++;
+    for (const [id, n] of Object.entries(res.redactions)) counters.byRule.set(id, (counters.byRule.get(id) || 0) + n);
+}
+
+/** Snapshot for the heartbeat: counts only. `dlp_redactions_total` is per rule id. */
+export function getDlpStats(env = process.env) {
+    const cfg = dlpConfigFromEnv(env);
+    return {
+        mode: cfg.mode,
+        ruleset_version: RULESET_VERSION,
+        ruleset_hash: rulesetHash(),
+        scanned: counters.scanned,
+        blocked: counters.blocked,
+        denied: counters.denied,
+        dlp_redactions_total: Object.fromEntries(counters.byRule),
+    };
+}
+
+export function resetDlpStats() {
+    counters.scanned = 0; counters.redactedTotal = 0; counters.blocked = 0; counters.denied = 0;
+    counters.byRule.clear();
+}
+
+function localLog(log, source, res) {
+    if (res.total === 0 && !res.oversize) return;
+    try {
+        // Counts per rule id only. The masked value is never part of the record.
+        log({ dlp: true, source: source || 'unknown', mode: res.mode, total: res.total, rules: res.redactions, blocked: res.blocked, oversize: res.oversize }, '[dlp] sensitive content detected');
+    } catch { /* logging must never break the data path */ }
+}
+
+/**
+ * Mask one string leaving the agent.
+ * @param {string} text
+ * @param {{env?: object, source?: string, log?: Function}} [opts]
+ * @returns {{text: string, mode: string, redactions: Record<string, number>, total: number, blocked: boolean, denied: boolean}}
+ */
+export function protectEgress(text, opts = {}) {
+    const cfg = dlpConfigFromEnv(opts.env ?? process.env);
+    if (cfg.mode === 'off') return { text, mode: 'off', redactions: {}, total: 0, blocked: false, denied: false };
+    try {
+        const res = maskSensitive(text, cfg);
+        record(res);
+        localLog(opts.log ?? NOOP, opts.source, res);
+        return { text: res.text, mode: cfg.mode, redactions: res.redactions, total: res.total, blocked: res.blocked, denied: false };
+    } catch {
+        if (cfg.mode !== 'enforce') return { text, mode: cfg.mode, redactions: {}, total: 0, blocked: false, denied: false };
+        counters.denied++;
+        return { text: DENIED, mode: cfg.mode, redactions: {}, total: 0, blocked: false, denied: true };
+    }
+}
+
+/**
+ * Same as protectEgress, plus a per-action PolicyGate decision (D19).
+ * `policyDecision` is optional; when given, enforce requires an explicit 'ALLOW'.
+ * Offline, throwing, timing out or answering anything else = DENY.
+ * @param {string} text
+ * @param {{policyDecision?: () => Promise<string>|string, timeoutMs?: number, env?: object, source?: string, log?: Function}} [opts]
+ */
+export async function protectEgressAsync(text, opts = {}) {
+    const cfg = dlpConfigFromEnv(opts.env ?? process.env);
+    if (cfg.mode === 'enforce' && typeof opts.policyDecision === 'function') {
+        let verdict;
+        let timer;
+        try {
+            const timeout = new Promise((_, rej) => { timer = setTimeout(() => rej(new Error('policy timeout')), opts.timeoutMs ?? 3000); });
+            verdict = await Promise.race([Promise.resolve().then(opts.policyDecision), timeout]);
+        } catch {
+            verdict = undefined;
+        } finally {
+            clearTimeout(timer);
+        }
+        if (verdict !== 'ALLOW') {
+            counters.denied++;
+            return { text: DENIED, mode: cfg.mode, redactions: {}, total: 0, blocked: false, denied: true };
+        }
+    }
+    return protectEgress(text, opts);
+}
+
+/** Mask every string in a JSON-like payload. Returns { value, ... } with the same report fields. */
+export function protectDeep(value, opts = {}) {
+    const cfg = dlpConfigFromEnv(opts.env ?? process.env);
+    if (cfg.mode === 'off') return { value, mode: 'off', redactions: {}, total: 0, blocked: false, denied: false };
+    try {
+        const res = maskDeep(value, cfg);
+        record(res);
+        localLog(opts.log ?? NOOP, opts.source, { ...res, mode: cfg.mode });
+        return { ...res, denied: false };
+    } catch {
+        if (cfg.mode !== 'enforce') return { value, mode: cfg.mode, redactions: {}, total: 0, blocked: false, denied: false };
+        counters.denied++;
+        return { value: DENIED, mode: cfg.mode, redactions: {}, total: 0, blocked: false, denied: true };
+    }
+}