gnoman 0.1.0

package/gnoman2.0/backend/services/sandboxService.ts

@@ -0,0 +1,157 @@
+import sandboxManager from '../../modules/sandbox';
+import type {
+  ContractSimulationRequest,
+  ContractSimulationResult,
+  SafeSimulationRequest
+} from '../../modules/sandbox/types';
+
+interface LegacyCallStaticRequest {
+  rpcUrl: string;
+  contractAddress: string;
+  abi: string;
+  method: string;
+  args?: unknown[];
+  value?: string;
+}
+
+interface AbiRequestBody {
+  abi: string;
+  name?: string;
+}
+
+interface SimulationBody extends ContractSimulationRequest {
+  abi: string;
+  abiName?: string;
+}
+
+const defaultForkCommands = ['anvil'];
+const allowedForkCommands = (() => {
+  const fromEnv = process.env.GNOMAN_FORK_ALLOWLIST?.split(',').map((value) => value.trim()).filter(Boolean);
+  if (fromEnv && fromEnv.length > 0) {
+    const normalized = new Set(fromEnv.map((command) => command.toLowerCase()));
+    defaultForkCommands.forEach((command) => normalized.add(command));
+    return normalized;
+  }
+  return new Set(defaultForkCommands.map((command) => command.toLowerCase()));
+})();
+
+const sanitizeRpcUrl = (rpcUrl: unknown) => {
+  if (typeof rpcUrl !== 'string' || rpcUrl.trim().length === 0) {
+    throw new Error('rpcUrl is required');
+  }
+  try {
+    const url = new URL(rpcUrl);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+      throw new Error('rpcUrl must use http or https');
+    }
+    url.hash = '';
+    return url.toString();
+  } catch (error) {
+    throw new Error('Invalid rpcUrl');
+  }
+};
+
+const sanitizePort = (port: unknown) => {
+  if (port === undefined || port === null || port === '') {
+    return undefined;
+  }
+  if (typeof port === 'string' && port.trim().length > 0) {
+    if (!/^[0-9]+$/.test(port)) {
+      throw new Error('Port must be a number');
+    }
+    return sanitizePort(Number(port));
+  }
+  if (typeof port !== 'number' || !Number.isInteger(port)) {
+    throw new Error('Port must be an integer');
+  }
+  if (port < 1024 || port > 65535) {
+    throw new Error('Port must be between 1024 and 65535');
+  }
+  return port;
+};
+
+const sanitizeBlockNumber = (blockNumber: unknown) => {
+  if (blockNumber === undefined || blockNumber === null || blockNumber === '') {
+    return undefined;
+  }
+  if (typeof blockNumber === 'string' && blockNumber.trim().length > 0) {
+    if (!/^[0-9]+$/.test(blockNumber)) {
+      throw new Error('blockNumber must be a number');
+    }
+    return sanitizeBlockNumber(Number(blockNumber));
+  }
+  if (typeof blockNumber !== 'number' || !Number.isInteger(blockNumber)) {
+    throw new Error('blockNumber must be an integer');
+  }
+  if (blockNumber < 0) {
+    throw new Error('blockNumber cannot be negative');
+  }
+  return blockNumber;
+};
+
+const sanitizeForkCommand = (command: unknown) => {
+  if (command === undefined || command === null || command === '') {
+    return undefined;
+  }
+  if (typeof command !== 'string') {
+    throw new Error('command must be a string');
+  }
+  const trimmed = command.trim();
+  if (trimmed.length === 0) {
+    return undefined;
+  }
+  if (!/^[A-Za-z0-9._-]+$/.test(trimmed)) {
+    throw new Error('command contains unsupported characters');
+  }
+  if (!allowedForkCommands.has(trimmed.toLowerCase())) {
+    throw new Error('command is not allowed');
+  }
+  return trimmed;
+};
+
+export const loadAbi = ({ abi, name }: AbiRequestBody) => sandboxManager.loadAbi(abi, name);
+
+export const listAbis = () => sandboxManager.listAbis();
+
+export const simulateCallStatic = async (body: LegacyCallStaticRequest) => {
+  const metadata = sandboxManager.loadAbi(body.abi, 'Inline ABI');
+  const parameters = (body.args ?? []).reduce<Record<string, unknown>>((acc, value, index) => {
+    const input = metadata.functions.find((fn) => fn.name === body.method)?.inputs[index];
+    const key = input?.name ? input.name : `arg_${index}`;
+    acc[key] = value;
+    return acc;
+  }, {});
+
+  return sandboxManager.simulate(metadata, {
+    rpcUrl: body.rpcUrl,
+    contractAddress: body.contractAddress,
+    functionName: body.method,
+    parameters,
+    value: body.value
+  });
+};
+
+export const simulateContract = async (body: SimulationBody): Promise<ContractSimulationResult> => {
+  const metadata = body.abiName ? sandboxManager.getAbi(body.abiName) : undefined;
+  const abiMetadata = metadata ?? sandboxManager.loadAbi(body.abi, body.abiName ?? 'Contract');
+  const { abi: _abi, abiName: _name, ...request } = body;
+  return sandboxManager.simulate(abiMetadata, request);
+};
+
+export const simulateSafe = async (body: SafeSimulationRequest) => sandboxManager.simulateSafe(body);
+
+export const getHistory = () => sandboxManager.getHistory();
+
+export const clearHistory = () => sandboxManager.clearHistory();
+
+export const startFork = (rpcUrl: string, blockNumber?: number, port?: number, command?: string) => {
+  const sanitizedRpcUrl = sanitizeRpcUrl(rpcUrl);
+  const sanitizedBlockNumber = sanitizeBlockNumber(blockNumber);
+  const sanitizedPort = sanitizePort(port);
+  const sanitizedCommand = sanitizeForkCommand(command);
+  return sandboxManager.startFork(sanitizedRpcUrl, sanitizedBlockNumber, sanitizedPort, sanitizedCommand);
+};
+
+export const stopFork = () => sandboxManager.stopFork();
+
+export const forkStatus = () => sandboxManager.forkStatus();

package/gnoman2.0/backend/services/secureSettingsService.ts

@@ -0,0 +1,45 @@
+import crypto from 'crypto';
+import keyringAccessor from './keyringAccessor';
+
+function encode(value: unknown) {
+  return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+}
+
+function decode<T>(encoded: string | null, fallback: T): T {
+  if (!encoded) {
+    return fallback;
+  }
+  try {
+    const raw = Buffer.from(encoded, 'base64url').toString('utf8');
+    return JSON.parse(raw) as T;
+  } catch (error) {
+    console.warn('Unable to decode secure setting payload. Resetting to fallback.', error);
+    return fallback;
+  }
+}
+
+export async function setSecureSetting<T>(key: string, value: T) {
+  const encoded = encode(value);
+  await keyringAccessor.set(key, encoded);
+}
+
+export async function getSecureSetting<T>(key: string, fallback: T) {
+  const encoded = await keyringAccessor.get(key);
+  return decode(encoded, fallback);
+}
+
+export async function deleteSecureSetting(key: string) {
+  await keyringAccessor.delete(key);
+}
+
+export function generateSecureKey(length = 32) {
+  return crypto.randomBytes(length).toString('hex');
+}
+
+export function getActiveKeyringService() {
+  const backend = keyringAccessor.currentBackend();
+  return {
+    service: backend,
+    backend
+  };
+}

package/gnoman2.0/backend/services/transactionHoldService.ts

@@ -0,0 +1,223 @@
+import Database from 'better-sqlite3';
+import path from 'path';
+import fs from 'fs';
+import { getSecureSetting } from './secureSettingsService';
+
+const HOLD_MAX_HOURS = 24 * 14; // two weeks safety window
+
+export interface HoldPolicy {
+  safeAddress: string;
+  enabled: boolean;
+  holdHours: number;
+  updatedAt: string;
+}
+
+export interface HoldRecord {
+  txHash: string;
+  safeAddress: string;
+  createdAt: string;
+  holdUntil: string;
+  executed: number;
+  holdHours: number;
+}
+
+class TransactionHoldService {
+  private db: InstanceType<typeof Database>;
+
+  constructor() {
+    const storageDir = path.join(process.cwd(), '.gnoman');
+    if (!fs.existsSync(storageDir)) {
+      fs.mkdirSync(storageDir, { recursive: true });
+    }
+    const dbPath = path.join(storageDir, 'holds.sqlite');
+    this.db = new Database(dbPath);
+    this.prepare();
+  }
+
+  private prepare() {
+    this.db
+      .prepare(`
+        CREATE TABLE IF NOT EXISTS tx_holds (
+          txHash TEXT PRIMARY KEY,
+          safeAddress TEXT,
+          createdAt DATETIME,
+          holdUntil DATETIME,
+          executed INTEGER DEFAULT 0,
+          holdHours INTEGER DEFAULT 24,
+          updatedAt DATETIME DEFAULT CURRENT_TIMESTAMP
+        )
+      `)
+      .run();
+    this.db
+      .prepare(`
+        CREATE TABLE IF NOT EXISTS hold_settings (
+          safeAddress TEXT PRIMARY KEY,
+          enabled INTEGER DEFAULT 0,
+          holdHours INTEGER DEFAULT 24,
+          updatedAt DATETIME DEFAULT CURRENT_TIMESTAMP
+        )
+      `)
+      .run();
+    try {
+      this.db.prepare(`ALTER TABLE hold_settings ADD COLUMN updatedAt DATETIME`).run();
+    } catch (error) {
+      if (!(error instanceof Error) || !/duplicate column/i.test(error.message)) {
+        throw error;
+      }
+    }
+    this.purgeExpired();
+  }
+
+  private normalizeHours(requested: number) {
+    if (!Number.isFinite(requested)) {
+      return 24;
+    }
+    const hours = Math.max(1, Math.min(Math.round(requested), HOLD_MAX_HOURS));
+    return hours;
+  }
+
+  private purgeExpired() {
+    this.db
+      .prepare(
+        `DELETE FROM tx_holds
+         WHERE executed = 1 AND datetime(holdUntil) < datetime('now', '-90 days')`
+      )
+      .run();
+    this.db
+      .prepare(
+        `DELETE FROM tx_holds
+         WHERE executed = 0 AND datetime(createdAt) < datetime('now', '-180 days')`
+      )
+      .run();
+  }
+
+  async setHoldState(safeAddress: string, enabled: boolean, holdHours: number) {
+    const normalizedHours = this.normalizeHours(holdHours);
+    this.db
+      .prepare(
+        `INSERT INTO hold_settings (safeAddress, enabled, holdHours, updatedAt)
+         VALUES (@safeAddress, @enabled, @holdHours, CURRENT_TIMESTAMP)
+         ON CONFLICT(safeAddress) DO UPDATE SET
+           enabled=@enabled,
+           holdHours=@holdHours,
+           updatedAt=CURRENT_TIMESTAMP`
+      )
+      .run({ safeAddress, enabled: enabled ? 1 : 0, holdHours: normalizedHours });
+    return this.getHoldState(safeAddress);
+  }
+
+  getHoldState(safeAddress: string) {
+    const row = this.db
+      .prepare(`SELECT enabled, holdHours, updatedAt FROM hold_settings WHERE safeAddress = ?`)
+      .get(safeAddress) as { enabled: number; holdHours: number; updatedAt: string } | undefined;
+    return {
+      safeAddress,
+      enabled: row ? Boolean(row.enabled) : true,
+      holdHours: this.normalizeHours(row?.holdHours ?? 24),
+      updatedAt: row?.updatedAt ?? new Date(0).toISOString()
+    } satisfies HoldPolicy;
+  }
+
+  listHoldPolicies() {
+    const rows = this.db
+      .prepare(`SELECT safeAddress, enabled, holdHours, updatedAt FROM hold_settings ORDER BY updatedAt DESC`)
+      .all() as { safeAddress: string; enabled: number; holdHours: number; updatedAt: string }[];
+    return rows.map((row) => ({
+      safeAddress: row.safeAddress,
+      enabled: Boolean(row.enabled),
+      holdHours: this.normalizeHours(row.holdHours),
+      updatedAt: row.updatedAt
+    })) satisfies HoldPolicy[];
+  }
+
+  async getEffectivePolicy(safeAddress: string) {
+    const [globalPolicy, localPolicy] = await Promise.all([
+      getSecureSetting('SAFE_TX_HOLD_ENABLED', { enabled: true, holdHours: 24 }),
+      Promise.resolve(this.getHoldState(safeAddress))
+    ]);
+    const normalizedGlobalHours = this.normalizeHours(globalPolicy.holdHours ?? 24);
+    return {
+      global: { enabled: Boolean(globalPolicy.enabled), holdHours: normalizedGlobalHours },
+      local: localPolicy
+    };
+  }
+
+  async createHold(txHash: string, safeAddress: string) {
+    const { global, local } = await this.getEffectivePolicy(safeAddress);
+    if (!global.enabled) {
+      return null;
+    }
+    if (!local.enabled) {
+      return null;
+    }
+    const createdAt = new Date();
+    const holdHours = this.normalizeHours(local.holdHours);
+    const holdUntil = new Date(createdAt.getTime() + holdHours * 60 * 60 * 1000);
+    this.db
+      .prepare(
+        `INSERT OR REPLACE INTO tx_holds (txHash, safeAddress, createdAt, holdUntil, executed, holdHours)
+         VALUES (@txHash, @safeAddress, @createdAt, @holdUntil, 0, @holdHours)`
+      )
+      .run({
+        txHash,
+        safeAddress,
+        createdAt: createdAt.toISOString(),
+        holdUntil: holdUntil.toISOString(),
+        holdHours
+      });
+    return this.getHold(txHash);
+  }
+
+  getHold(txHash: string) {
+    return this.db
+      .prepare(`SELECT * FROM tx_holds WHERE txHash = ?`)
+      .get(txHash) as HoldRecord | undefined;
+  }
+
+  listHolds(safeAddress: string) {
+    return this.db
+      .prepare(`SELECT * FROM tx_holds WHERE safeAddress = ? ORDER BY createdAt DESC`)
+      .all(safeAddress) as HoldRecord[];
+  }
+
+  canExecute(hold: HoldRecord) {
+    if (hold.executed) {
+      return true;
+    }
+    return new Date(hold.holdUntil).getTime() <= Date.now();
+  }
+
+  markExecuted(txHash: string) {
+    this.db.prepare(`UPDATE tx_holds SET executed = 1 WHERE txHash = ?`).run(txHash);
+  }
+
+  releaseNow(txHash: string) {
+    this.db
+      .prepare(
+        `UPDATE tx_holds
+         SET holdUntil = datetime('now'), executed = executed
+         WHERE txHash = ?`
+      )
+      .run(txHash);
+    return this.getHold(txHash);
+  }
+
+  summarize(safeAddress: string) {
+    const summary = this.db
+      .prepare(
+        `SELECT
+            SUM(CASE WHEN executed = 1 THEN 1 ELSE 0 END) AS executed,
+            SUM(CASE WHEN executed = 0 THEN 1 ELSE 0 END) AS pending
+         FROM tx_holds
+         WHERE safeAddress = ?`
+      )
+      .get(safeAddress) as { executed: number | null; pending: number | null } | undefined;
+    const totals = {
+      executed: summary?.executed ?? 0,
+      pending: summary?.pending ?? 0
+    };
+    return totals;
+  }
+}
+
+export const holdService = new TransactionHoldService();