lucifer-gate 0.1.0-alpha.1

package/dist/server/domains/command-gateway/api/register_execute_routes.js

@@ -0,0 +1,338 @@
+import { randomUUID } from 'node:crypto';
+import { authenticateRequest, createRateLimiter } from '../service/authenticate_request.js';
+import { analyzeCommandRisk } from '../service/analyze_command_risk.js';
+import { executeCommand } from '../service/execute_command.js';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('routes');
+const completedResults = new Map();
+// Clean up completed results older than 10 minutes
+setInterval(() => {
+    const cutoff = Date.now() - 10 * 60_000;
+    for (const [id, entry] of completedResults.entries()) {
+        if (entry.completedAt < cutoff) {
+            completedResults.delete(id);
+        }
+    }
+}, 60_000);
+export function registerExecuteRoutes(router, config, apiKeyStore, commandRulesStore, approvalStore, pendingStore, auditLog, approvalChannel) {
+    const rateLimiter = createRateLimiter(process.env.NODE_ENV === 'development' ? 1000 : config.rateLimitPerMinute);
+    router.post('/api/v1/execute', async (req, res) => {
+        const rawKey = req.headers['x-api-key'];
+        const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ?? req.socket.remoteAddress ?? 'unknown';
+        const { command, cwd } = req.body;
+        if (!command || typeof command !== 'string') {
+            res.status(400).json({
+                code: 'MISSING_COMMAND',
+                message: 'Request body must include a "command" string',
+                retryable: false,
+            });
+            return;
+        }
+        if (command.length > 4096) {
+            res.status(400).json({
+                code: 'COMMAND_TOO_LONG',
+                message: 'Command exceeds 4096 character limit',
+                retryable: false,
+            });
+            return;
+        }
+        // Validate cwd if provided
+        if (cwd !== undefined) {
+            if (typeof cwd !== 'string' || cwd.includes('..') || !cwd.startsWith('/')) {
+                res.status(400).json({
+                    code: 'INVALID_CWD',
+                    message: 'cwd must be an absolute path without ".." components',
+                    retryable: false,
+                });
+                return;
+            }
+        }
+        const authResult = authenticateRequest(apiKeyStore, rateLimiter, rawKey, ip);
+        if (!authResult.ok) {
+            res.status(authResult.statusCode).json(authResult.error);
+            return;
+        }
+        const requestId = randomUUID();
+        const apiKeyName = authResult.keyConfig.name;
+        const isSync = req.query.sync === 'true';
+        auditLog.append({
+            ts: new Date().toISOString(),
+            type: 'request',
+            requestId,
+            command,
+            apiKeyName,
+            ip,
+        });
+        // Match against command rules
+        const ruleMatch = commandRulesStore.matchRule(command);
+        auditLog.append({
+            ts: new Date().toISOString(),
+            type: 'rule_match',
+            requestId,
+            command,
+            ruleAction: ruleMatch.action,
+        });
+        if (ruleMatch.action === 'always_deny') {
+            auditLog.append({ ts: new Date().toISOString(), type: 'denied', requestId, command });
+            res.status(403).json({
+                code: 'COMMAND_DENIED',
+                message: 'Command is not permitted by policy',
+                retryable: false,
+            });
+            return;
+        }
+        if (ruleMatch.action === 'always_approve') {
+            auditLog.append({ ts: new Date().toISOString(), type: 'approved', requestId, command, duration: 'policy' });
+            const result = await executeCommand({
+                command,
+                requestId,
+                cwd,
+                timeoutMs: config.executionTimeoutSeconds * 1000,
+                maxOutputBytes: config.maxOutputBytes,
+                maxConcurrent: config.maxConcurrentExecutions,
+            });
+            auditLog.append({
+                ts: new Date().toISOString(),
+                type: 'executed',
+                requestId,
+                command,
+                exitCode: result.exitCode,
+                durationMs: result.durationMs,
+                error: result.error,
+            });
+            res.json(result);
+            return;
+        }
+        // telegram_approve: check existing approval in SQLite
+        const existingApproval = approvalStore.findApproval(command);
+        if (existingApproval) {
+            auditLog.append({
+                ts: new Date().toISOString(),
+                type: 'approval_check',
+                requestId,
+                command,
+                duration: 'cached',
+            });
+            const result = await executeCommand({
+                command,
+                requestId,
+                cwd,
+                timeoutMs: config.executionTimeoutSeconds * 1000,
+                maxOutputBytes: config.maxOutputBytes,
+                maxConcurrent: config.maxConcurrentExecutions,
+            });
+            auditLog.append({
+                ts: new Date().toISOString(),
+                type: 'executed',
+                requestId,
+                command,
+                exitCode: result.exitCode,
+                durationMs: result.durationMs,
+                error: result.error,
+            });
+            res.json(result);
+            return;
+        }
+        // Need Telegram approval
+        const riskAnalysis = analyzeCommandRisk(command);
+        const abortController = new AbortController();
+        // Coalesce: check if same command from same key is already pending
+        const existingPending = pendingStore.findByCommand(command, apiKeyName);
+        if (!isSync) {
+            // Async mode (default): return requestId, process in background
+            if (!existingPending) {
+                pendingStore.add({
+                    requestId,
+                    command,
+                    apiKeyName,
+                    ip,
+                    createdAt: new Date().toISOString(),
+                    resolve: () => { },
+                    reject: () => { },
+                    abortController,
+                });
+                // Fire and forget the approval request + execution
+                processApprovalAsync(requestId, command, apiKeyName, ip, cwd, riskAnalysis, config, approvalChannel, pendingStore, auditLog, abortController);
+            }
+            res.status(202).json({
+                requestId: existingPending?.requestId ?? requestId,
+                status: 'pending_approval',
+            });
+            return;
+        }
+        // Sync mode: block until decision
+        if (existingPending) {
+            // Wait for the existing pending request to resolve
+            // For simplicity in sync mode, just wait for a bit then poll
+            res.status(202).json({
+                requestId: existingPending.requestId,
+                status: 'pending_approval',
+                message: 'Another request for the same command is pending. Poll for status.',
+            });
+            return;
+        }
+        try {
+            pendingStore.add({
+                requestId,
+                command,
+                apiKeyName,
+                ip,
+                createdAt: new Date().toISOString(),
+                resolve: () => { },
+                reject: () => { },
+                abortController,
+            });
+            req.on('close', () => {
+                abortController.abort();
+                pendingStore.remove(requestId);
+            });
+            const approvalResult = await Promise.race([
+                approvalChannel.requestApproval(command, apiKeyName, ip, requestId, riskAnalysis),
+                new Promise((_, reject) => {
+                    setTimeout(() => reject(new Error('Approval timed out')), config.approvalTimeoutSeconds * 1000);
+                }),
+            ]);
+            if (approvalResult.decision === 'denied') {
+                res.status(403).json({
+                    requestId,
+                    status: 'denied',
+                    code: 'DENIED',
+                    message: 'Command was denied via Telegram',
+                    retryable: false,
+                });
+                return;
+            }
+            const result = await executeCommand({
+                command,
+                requestId,
+                cwd,
+                timeoutMs: config.executionTimeoutSeconds * 1000,
+                maxOutputBytes: config.maxOutputBytes,
+                maxConcurrent: config.maxConcurrentExecutions,
+                abortSignal: abortController.signal,
+            });
+            auditLog.append({
+                ts: new Date().toISOString(),
+                type: 'executed',
+                requestId,
+                command,
+                exitCode: result.exitCode,
+                durationMs: result.durationMs,
+                error: result.error,
+            });
+            res.json(result);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Unknown error';
+            if (message.includes('timed out')) {
+                res.status(408).json({
+                    requestId,
+                    status: 'timed_out',
+                    code: 'APPROVAL_TIMEOUT',
+                    message: 'Approval timed out. No response from Telegram.',
+                    retryable: true,
+                });
+            }
+            else {
+                res.status(503).json({
+                    requestId,
+                    code: 'APPROVAL_ERROR',
+                    message: `Approval channel error: ${message}`,
+                    retryable: true,
+                });
+            }
+        }
+        finally {
+            pendingStore.remove(requestId);
+        }
+    });
+    router.get('/api/v1/status/:requestId', (req, res) => {
+        const requestId = Array.isArray(req.params.requestId) ? req.params.requestId[0] : req.params.requestId;
+        // Auth check: require valid API key for status queries
+        const rawKey = req.headers['x-api-key'];
+        const ip = req.headers['x-forwarded-for']?.split(',')[0]?.trim() ?? req.socket.remoteAddress ?? 'unknown';
+        const authResult = authenticateRequest(apiKeyStore, rateLimiter, rawKey, ip);
+        if (!authResult.ok) {
+            res.status(authResult.statusCode).json(authResult.error);
+            return;
+        }
+        // Check completed results cache
+        const completed = completedResults.get(requestId);
+        if (completed) {
+            res.json(completed.result);
+            return;
+        }
+        // Check pending store
+        const pending = pendingStore.get(requestId);
+        if (pending) {
+            // Scope check: only the same API key can query status
+            if (pending.apiKeyName !== authResult.keyConfig.name) {
+                res.status(404).json({
+                    code: 'NOT_FOUND',
+                    message: 'Request not found',
+                    retryable: false,
+                });
+                return;
+            }
+            res.json({ requestId, status: 'pending_approval' });
+            return;
+        }
+        res.status(404).json({
+            code: 'NOT_FOUND',
+            message: 'Request not found or expired',
+            retryable: false,
+        });
+    });
+}
+async function processApprovalAsync(requestId, command, apiKeyName, ip, cwd, riskAnalysis, config, approvalChannel, pendingStore, auditLog, abortController) {
+    try {
+        const approvalResult = await Promise.race([
+            approvalChannel.requestApproval(command, apiKeyName, ip, requestId, riskAnalysis),
+            new Promise((_, reject) => {
+                setTimeout(() => reject(new Error('Approval timed out')), config.approvalTimeoutSeconds * 1000);
+            }),
+        ]);
+        if (approvalResult.decision === 'denied') {
+            completedResults.set(requestId, {
+                result: { requestId, status: 'denied' },
+                completedAt: Date.now(),
+            });
+            return;
+        }
+        const result = await executeCommand({
+            command,
+            requestId,
+            cwd,
+            timeoutMs: config.executionTimeoutSeconds * 1000,
+            maxOutputBytes: config.maxOutputBytes,
+            maxConcurrent: config.maxConcurrentExecutions,
+            abortSignal: abortController.signal,
+        });
+        auditLog.append({
+            ts: new Date().toISOString(),
+            type: 'executed',
+            requestId,
+            command,
+            exitCode: result.exitCode,
+            durationMs: result.durationMs,
+            error: result.error,
+        });
+        completedResults.set(requestId, { result, completedAt: Date.now() });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        log.error({ requestId, err: message }, 'Async approval/execution failed');
+        completedResults.set(requestId, {
+            result: {
+                requestId,
+                status: message.includes('timed out') ? 'timed_out' : 'failed',
+                error: message,
+            },
+            completedAt: Date.now(),
+        });
+    }
+    finally {
+        pendingStore.remove(requestId);
+    }
+}
+//# sourceMappingURL=register_execute_routes.js.map

package/dist/server/domains/command-gateway/api/register_execute_routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register_execute_routes.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/api/register_execute_routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAOxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,mDAAmD;AACnD,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACxC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;YAC/B,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,MAAM,CAAC,CAAC;AAEX,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,MAAqB,EACrB,WAAwB,EACxB,iBAAoC,EACpC,aAA4B,EAC5B,YAAiC,EACjC,QAAkB,EAClB,eAAgC;IAEhC,MAAM,WAAW,GAAG,iBAAiB,CACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAC1E,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;QAC9D,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACtH,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAA0C,CAAC;QAExE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,8CAA8C;gBACvD,SAAS,EAAE,KAAK;aACO,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sCAAsC;gBAC/C,SAAS,EAAE,KAAK;aACO,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,sDAAsD;oBAC/D,SAAS,EAAE,KAAK;iBACO,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;QAEzC,QAAQ,CAAC,MAAM,CAAC;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,SAAS;YACf,SAAS;YACT,OAAO;YACP,UAAU;YACV,EAAE;SACH,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,QAAQ,CAAC,MAAM,CAAC;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,YAAY;YAClB,SAAS;YACT,OAAO;YACP,UAAU,EAAE,SAAS,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,oCAAoC;gBAC7C,SAAS,EAAE,KAAK;aACO,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,OAAO;gBACP,SAAS;gBACT,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,uBAAuB,GAAG,IAAI;gBAChD,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,MAAM,CAAC,uBAAuB;aAC9C,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC;gBACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,gBAAgB,EAAE,CAAC;YACrB,QAAQ,CAAC,MAAM,CAAC;gBACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,gBAAgB;gBACtB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,OAAO;gBACP,SAAS;gBACT,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,uBAAuB,GAAG,IAAI;gBAChD,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,MAAM,CAAC,uBAAuB;aAC9C,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC;gBACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAE9C,mEAAmE;QACnE,MAAM,eAAe,GAAG,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAExE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,gEAAgE;YAChE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,YAAY,CAAC,GAAG,CAAC;oBACf,SAAS;oBACT,OAAO;oBACP,UAAU;oBACV,EAAE;oBACF,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;oBACjB,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;oBAChB,eAAe;iBAChB,CAAC,CAAC;gBAEH,mDAAmD;gBACnD,oBAAoB,CAClB,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EACrD,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,CACjE,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,eAAe,EAAE,SAAS,IAAI,SAAS;gBAClD,MAAM,EAAE,kBAAmC;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,IAAI,eAAe,EAAE,CAAC;YACpB,mDAAmD;YACnD,6DAA6D;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,MAAM,EAAE,kBAAmC;gBAC3C,OAAO,EAAE,mEAAmE;aAC7E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,YAAY,CAAC,GAAG,CAAC;gBACf,SAAS;gBACT,OAAO;gBACP,UAAU;gBACV,EAAE;gBACF,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;gBACjB,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;gBAChB,eAAe;aAChB,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,eAAe,CAAC,KAAK,EAAE,CAAC;gBACxB,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxC,eAAe,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC;gBACjF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;gBAClG,CAAC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,SAAS;oBACT,MAAM,EAAE,QAAyB;oBACjC,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,iCAAiC;oBAC1C,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,OAAO;gBACP,SAAS;gBACT,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,uBAAuB,GAAG,IAAI;gBAChD,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,aAAa,EAAE,MAAM,CAAC,uBAAuB;gBAC7C,WAAW,EAAE,eAAe,CAAC,MAAM;aACpC,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC;gBACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,SAAS;oBACT,MAAM,EAAE,WAA4B;oBACpC,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,gDAAgD;oBACzD,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,SAAS;oBACT,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,2BAA2B,OAAO,EAAE;oBAC7C,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;QAEvG,uDAAuD;QACvD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;QAC9D,MAAM,EAAE,GAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACtH,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,sDAAsD;YACtD,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,mBAAmB;oBAC5B,SAAS,EAAE,KAAK;iBACO,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAmC,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,8BAA8B;YACvC,SAAS,EAAE,KAAK;SACO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,OAAe,EACf,UAAkB,EAClB,EAAU,EACV,GAAuB,EACvB,YAAmD,EACnD,MAAqB,EACrB,eAAgC,EAChC,YAAiC,EACjC,QAAkB,EAClB,eAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACxC,eAAe,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC;YACjF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;YAClG,CAAC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC9B,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACvC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,SAAS;YACT,GAAG;YACH,SAAS,EAAE,MAAM,CAAC,uBAAuB,GAAG,IAAI;YAChD,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,uBAAuB;YAC7C,WAAW,EAAE,eAAe,CAAC,MAAM;SACpC,CAAC,CAAC;QAEH,QAAQ,CAAC,MAAM,CAAC;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,UAAU;YAChB,SAAS;YACT,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QAEH,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAE1E,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE;YAC9B,MAAM,EAAE;gBACN,SAAS;gBACT,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;gBAC9D,KAAK,EAAE,OAAO;aACf;YACD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/server/domains/command-gateway/config/gateway_config.js

@@ -0,0 +1,46 @@
+import { resolve } from 'node:path';
+import { loadJsonConfig } from '../../../lib/json_config_loader.js';
+function isLuciferConfig(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const d = data;
+    if (typeof d.port !== 'undefined' && typeof d.port !== 'number')
+        return false;
+    return true;
+}
+const defaults = {
+    port: Number(process.env.PORT) || 3001,
+    telegramChatId: process.env.LUCIFER_TELEGRAM_CHAT_ID,
+    approvalTimeoutSeconds: 300,
+    executionTimeoutSeconds: 120,
+    maxConcurrentExecutions: 5,
+    maxOutputBytes: 10 * 1024 * 1024,
+    rateLimitPerMinute: 10,
+    onApprovalTimeout: 'deny',
+    dataDir: './data',
+};
+export function loadGatewayConfig(configPath) {
+    if (!configPath) {
+        return { ...defaults };
+    }
+    const resolvedPath = resolve(configPath);
+    const loaded = loadJsonConfig(resolvedPath, isLuciferConfig);
+    return {
+        ...defaults,
+        ...loaded,
+        port: loaded.port ?? defaults.port,
+        dataDir: loaded.dataDir ?? defaults.dataDir,
+    };
+}
+export function getTelegramToken() {
+    const token = process.env.LUCIFER_TELEGRAM_TOKEN;
+    if (!token) {
+        throw new Error('LUCIFER_TELEGRAM_TOKEN environment variable is required. ' +
+            'Create a bot via @BotFather on Telegram and set the token.');
+    }
+    return token;
+}
+export function getAdminSecret() {
+    return process.env.LUCIFER_ADMIN_SECRET;
+}
+//# sourceMappingURL=gateway_config.js.map

package/dist/server/domains/command-gateway/config/gateway_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway_config.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/config/gateway_config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAAkB;IAC9B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI;IACtC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;IACpD,sBAAsB,EAAE,GAAG;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,uBAAuB,EAAE,CAAC;IAC1B,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAChC,kBAAkB,EAAE,EAAE;IACtB,iBAAiB,EAAE,MAAM;IACzB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,UAAmB;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAE7D,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAC1C,CAAC"}

package/dist/server/domains/command-gateway/repository/api_key_store.js

@@ -0,0 +1,44 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { loadJsonConfig } from '../../../lib/json_config_loader.js';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('api-key-store');
+function isApiKeysConfig(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const d = data;
+    return Array.isArray(d.keys);
+}
+export function hashApiKey(key, salt) {
+    return createHash('sha256').update(salt + key).digest('hex');
+}
+export function generateApiKey() {
+    const key = 'luc_' + randomBytes(24).toString('hex');
+    const salt = randomBytes(16).toString('hex');
+    const keyHash = hashApiKey(key, salt);
+    return { key, salt, keyHash };
+}
+export function createApiKeyStore(configPath) {
+    let config;
+    function load() {
+        config = loadJsonConfig(configPath, isApiKeysConfig);
+        log.info({ keyCount: config.keys.length }, 'API keys loaded');
+    }
+    load();
+    return {
+        findByKey(rawKey) {
+            for (const keyConfig of config.keys) {
+                if (!keyConfig.active)
+                    continue;
+                const hash = hashApiKey(rawKey, keyConfig.salt);
+                if (hash === keyConfig.keyHash) {
+                    return keyConfig;
+                }
+            }
+            return undefined;
+        },
+        reload() {
+            load();
+        },
+    };
+}
+//# sourceMappingURL=api_key_store.js.map

package/dist/server/domains/command-gateway/repository/api_key_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_key_store.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/api_key_store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAE/C,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAOD,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,MAAqB,CAAC;IAE1B,SAAS,IAAI;QACX,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,EAAE,CAAC;IAEP,OAAO;QACL,SAAS,CAAC,MAAc;YACtB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,SAAS,CAAC,MAAM;oBAAE,SAAS;gBAChC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChD,IAAI,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM;YACJ,IAAI,EAAE,CAAC;QACT,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/repository/approval_store.js

@@ -0,0 +1,83 @@
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('approval-store');
+export function createApprovalStore(db) {
+    const APPROVAL_COLUMNS = `id, command, match_type as matchType, duration, approved_at as approvedAt, expires_at as expiresAt, approved_by as approvedBy`;
+    const findExact = db.prepare(`SELECT ${APPROVAL_COLUMNS} FROM approvals
+     WHERE match_type = 'exact' AND command = ?
+     AND (expires_at IS NULL OR expires_at > ?)
+     ORDER BY approved_at DESC LIMIT 1`);
+    const findPrefix = db.prepare(`SELECT ${APPROVAL_COLUMNS} FROM approvals
+     WHERE match_type = 'prefix' AND ? LIKE (command || '%')
+     AND (expires_at IS NULL OR expires_at > ?)
+     ORDER BY LENGTH(command) DESC LIMIT 1`);
+    const insertApproval = db.prepare(`INSERT INTO approvals (command, match_type, duration, approved_at, expires_at, approved_by)
+     VALUES (?, ?, ?, ?, ?, ?)`);
+    const deleteExpired = db.prepare(`DELETE FROM approvals WHERE expires_at IS NOT NULL AND expires_at <= ?`);
+    const selectAll = db.prepare(`SELECT ${APPROVAL_COLUMNS} FROM approvals ORDER BY approved_at DESC LIMIT ? OFFSET ?`);
+    const deleteById = db.prepare(`DELETE FROM approvals WHERE id = ?`);
+    return {
+        findApproval(command) {
+            const now = new Date().toISOString();
+            const exact = findExact.get(command, now);
+            if (exact) {
+                log.debug({ command, approvalId: exact.id, matchType: 'exact' }, 'Exact approval found');
+                return exact;
+            }
+            const prefix = findPrefix.get(command, now);
+            if (prefix) {
+                log.debug({ command, approvalId: prefix.id, matchType: 'prefix', prefix: prefix.command }, 'Prefix approval found');
+                return prefix;
+            }
+            return undefined;
+        },
+        addApproval(command, matchType, duration, approvedBy) {
+            const approvedAt = new Date().toISOString();
+            let expiresAt = null;
+            if (duration !== 'permanent') {
+                const hours = parseInt(duration, 10);
+                if (!isNaN(hours) && hours > 0) {
+                    const expires = new Date(Date.now() + hours * 3600_000);
+                    expiresAt = expires.toISOString();
+                }
+            }
+            // Prefix approvals capped at 8h per security policy
+            if (matchType === 'prefix' && (duration === 'permanent' || parseInt(duration, 10) > 8)) {
+                const capped = new Date(Date.now() + 8 * 3600_000);
+                expiresAt = capped.toISOString();
+                log.warn({ command, matchType, duration }, 'Prefix approval capped at 8h');
+            }
+            const result = insertApproval.run(command, matchType, duration, approvedAt, expiresAt, approvedBy);
+            const approval = {
+                id: result.lastInsertRowid,
+                command,
+                matchType: matchType,
+                duration,
+                approvedAt,
+                expiresAt,
+                approvedBy,
+            };
+            log.info({ approvalId: approval.id, command, matchType, duration, expiresAt }, 'Approval added');
+            return approval;
+        },
+        removeExpired() {
+            const now = new Date().toISOString();
+            const result = deleteExpired.run(now);
+            if (result.changes > 0) {
+                log.info({ removed: result.changes }, 'Expired approvals cleaned up');
+            }
+            return result.changes;
+        },
+        listAll(limit = 100, offset = 0) {
+            return selectAll.all(limit, offset);
+        },
+        revokeById(id) {
+            const result = deleteById.run(id);
+            if (result.changes > 0) {
+                log.info({ approvalId: id }, 'Approval revoked');
+                return true;
+            }
+            return false;
+        },
+    };
+}
+//# sourceMappingURL=approval_store.js.map

package/dist/server/domains/command-gateway/repository/approval_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval_store.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/approval_store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;AAehD,MAAM,UAAU,mBAAmB,CAAC,EAAqB;IACvD,MAAM,gBAAgB,GAAG,+HAA+H,CAAC;IAEzJ,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B,UAAU,gBAAgB;;;uCAGS,CACpC,CAAC;IAEF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,UAAU,gBAAgB;;;2CAGa,CACxC,CAAC;IAEF,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC/B;+BAC2B,CAC5B,CAAC;IAEF,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAC9B,wEAAwE,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B,UAAU,gBAAgB,4DAA4D,CACvF,CAAC;IAEF,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,oCAAoC,CACrC,CAAC;IAEF,OAAO;QACL,YAAY,CAAC,OAAe;YAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAErC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBACzF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;gBACpH,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YAClD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,SAAS,GAAkB,IAAI,CAAC;YAEpC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;oBACxD,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;gBACpC,CAAC;YACH,CAAC;YAED,oDAAoD;YACpD,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvF,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;gBACnD,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAoB;gBAChC,EAAE,EAAE,MAAM,CAAC,eAAyB;gBACpC,OAAO;gBACP,SAAS,EAAE,SAAS;gBACpB,QAAQ;gBACR,UAAU;gBACV,SAAS;gBACT,UAAU;aACX,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACjG,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,aAAa;YACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC;YAC7B,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,UAAU,CAAC,EAAU;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/repository/audit_log.js

@@ -0,0 +1,24 @@
+export function createAuditLog(db) {
+    const insert = db.prepare(`INSERT INTO audit_log (ts, type, request_id, command, api_key_name, ip, rule_action, duration, approved_by, exit_code, duration_ms, error)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    const selectRecent = db.prepare(`SELECT ts, type, request_id as requestId, command, api_key_name as apiKeyName, ip,
+            rule_action as ruleAction, duration, approved_by as approvedBy,
+            exit_code as exitCode, duration_ms as durationMs, error
+     FROM audit_log ORDER BY id DESC LIMIT ? OFFSET ?`);
+    const selectByRequest = db.prepare(`SELECT ts, type, request_id as requestId, command, api_key_name as apiKeyName, ip,
+            rule_action as ruleAction, duration, approved_by as approvedBy,
+            exit_code as exitCode, duration_ms as durationMs, error
+     FROM audit_log WHERE request_id = ? ORDER BY id ASC`);
+    return {
+        append(entry) {
+            insert.run(entry.ts, entry.type, entry.requestId, entry.command ?? null, entry.apiKeyName ?? null, entry.ip ?? null, entry.ruleAction ?? null, entry.duration ?? null, entry.approvedBy ?? null, entry.exitCode ?? null, entry.durationMs ?? null, entry.error ?? null);
+        },
+        query(limit = 100, offset = 0) {
+            return selectRecent.all(limit, offset);
+        },
+        queryByRequestId(requestId) {
+            return selectByRequest.all(requestId);
+        },
+    };
+}
+//# sourceMappingURL=audit_log.js.map

package/dist/server/domains/command-gateway/repository/audit_log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/audit_log.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,cAAc,CAAC,EAAqB;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;iDAC6C,CAC9C,CAAC;IAEF,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC7B;;;sDAGkD,CACnD,CAAC;IAEF,MAAM,eAAe,GAAG,EAAE,CAAC,OAAO,CAChC;;;yDAGqD,CACtD,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAiB;YACtB,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,EAAE,IAAI,IAAI,EAChB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,KAAK,IAAI,IAAI,CACpB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC;YAC3B,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,gBAAgB,CAAC,SAAiB;YAChC,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/domains/command-gateway/repository/command_rules_store.js

@@ -0,0 +1,42 @@
+import { loadJsonConfig } from '../../../lib/json_config_loader.js';
+import { createChildLogger } from '../../../lib/logger.js';
+const log = createChildLogger('command-rules');
+function isCommandRulesConfig(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const d = data;
+    if (!Array.isArray(d.rules))
+        return false;
+    const validActions = ['always_approve', 'telegram_approve', 'always_deny'];
+    if (d.defaultAction && !validActions.includes(d.defaultAction))
+        return false;
+    return true;
+}
+export function createCommandRulesStore(configPath) {
+    let config;
+    function load() {
+        config = loadJsonConfig(configPath, isCommandRulesConfig);
+        if (!config.defaultAction) {
+            config.defaultAction = 'always_deny';
+        }
+        log.info({ ruleCount: config.rules.length, defaultAction: config.defaultAction }, 'Command rules loaded');
+    }
+    load();
+    return {
+        matchRule(command) {
+            const trimmed = command.trim();
+            for (const rule of config.rules) {
+                if (trimmed.startsWith(rule.prefix)) {
+                    log.debug({ command: trimmed, matchedPrefix: rule.prefix, action: rule.action }, 'Rule matched');
+                    return { rule, action: rule.action };
+                }
+            }
+            log.debug({ command: trimmed, action: config.defaultAction }, 'No rule matched, using default');
+            return { rule: null, action: config.defaultAction };
+        },
+        reload() {
+            load();
+        },
+    };
+}
+//# sourceMappingURL=command_rules_store.js.map

package/dist/server/domains/command-gateway/repository/command_rules_store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command_rules_store.js","sourceRoot":"","sources":["../../../../../server/src/domains/command-gateway/repository/command_rules_store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;AAE/C,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,IAAI,MAA0B,CAAC;IAE/B,SAAS,IAAI;QACX,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;QACvC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,EAAE,CAAC;IAEP,OAAO;QACL,SAAS,CAAC,OAAe;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;oBACjG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAChG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;QACtD,CAAC;QAED,MAAM;YACJ,IAAI,EAAE,CAAC;QACT,CAAC;KACF,CAAC;AACJ,CAAC"}