mecord-connect 1.0.0

package/runtime/app/src/core/audit.js

@@ -0,0 +1,295 @@
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { OperatorError } from './errors.js';
+import { appendDurableStateText, readDurableStateText, writeDurableStateText } from './durable-state.js';
+
+const SECRET_KEY = /(token|password|secret|authorization|cookie|private.?key|api.?key)/i;
+const AUDIT_CHAIN_VERSION = 1         ;
+const HASH_RE = /^[0-9a-f]{64}$/;
+const MAX_AUDIT_BYTES = 256 * 1024 * 1024;
+const MAX_AUDIT_HEAD_BYTES = 64 * 1024;
+const MAX_AUDIT_EVENT_BYTES = 256 * 1024;
+const MAX_REDACT_COLLECTION_ITEMS = 1000;
+const MAX_TAIL_EVENTS = 1000;
+const AUDIT_STATE_OPTIONS = {
+  maxBytes: MAX_AUDIT_BYTES,
+  errorCode: 'AUDIT_INTEGRITY_FAILED',
+  invalidMessage: 'Audit log file is invalid.'
+}         ;
+const AUDIT_HEAD_OPTIONS = {
+  maxBytes: MAX_AUDIT_HEAD_BYTES,
+  errorCode: 'AUDIT_INTEGRITY_FAILED',
+  invalidMessage: 'Audit head file is invalid.'
+}         ;
+
+function redact(value         , depth = 0)          {
+  if (depth > 8) return '[TRUNCATED_DEPTH]';
+  if (Array.isArray(value)) {
+    const output = value.slice(0, MAX_REDACT_COLLECTION_ITEMS).map((item) => redact(item, depth + 1));
+    if (value.length > MAX_REDACT_COLLECTION_ITEMS) output.push(`[TRUNCATED_${value.length - MAX_REDACT_COLLECTION_ITEMS}_ITEMS]`);
+    return output;
+  }
+  if (value && typeof value === 'object') {
+    const output                          = {};
+    const entries = Object.entries(value                           );
+    for (const [key, child] of entries.slice(0, MAX_REDACT_COLLECTION_ITEMS)) {
+      output[key] = SECRET_KEY.test(key) ? '[REDACTED]' : redact(child, depth + 1);
+    }
+    if (entries.length > MAX_REDACT_COLLECTION_ITEMS) output.__operatorTruncatedEntries = entries.length - MAX_REDACT_COLLECTION_ITEMS;
+    return output;
+  }
+  if (typeof value === 'string' && value.length > 16_384) return `${value.slice(0, 16_384)}…[TRUNCATED]`;
+  return value;
+}
+
+                             
+              
+                     
+                  
+                     
+                    
+                     
+                  
+                                                        
+               
+                          
+                         
+                                    
+                   
+                               
+                
+ 
+
+                     
+             
+                
+                          
+                    
+ 
+
+                         
+                       
+                
+                          
+ 
+
+                                       
+              
+                
+                          
+ 
+
+export class AuditLog {
+  #file        ;
+  #headFile        ;
+  #head                                                    = null;
+  #queue                = Promise.resolve();
+
+  constructor(stateDir        ) {
+    const root = path.resolve(stateDir);
+    this.#file = path.join(root, 'audit.ndjson');
+    this.#headFile = path.join(root, 'audit-head.json');
+  }
+
+  async append(event            )                      {
+    let appended             ;
+    const operation = this.#queue.then(async () => {
+      const head = await this.#loadHead();
+      const base = stripChain(redact({
+        ...event,
+        id: event.id ?? crypto.randomUUID(),
+        timestamp: event.timestamp ?? new Date().toISOString()
+      })              );
+      appended = chainEvent(base, head.headHash);
+      const line = `${JSON.stringify(appended)}\n`;
+      if (Buffer.byteLength(line, 'utf8') > MAX_AUDIT_EVENT_BYTES) {
+        throw new OperatorError('AUDIT_EVENT_TOO_LARGE', `Audit event exceeds ${MAX_AUDIT_EVENT_BYTES} UTF-8 bytes after redaction.`);
+      }
+      await appendDurableStateText(this.#file, line, AUDIT_STATE_OPTIONS);
+      const next = { count: head.count + 1, headHash: appended.hash  };
+      try {
+        await this.#writeHead(next);
+        this.#head = next;
+      } catch (error) {
+        this.#head = null;
+        throw error;
+      }
+    });
+    this.#queue = operation.then(() => undefined, () => undefined);
+    await operation;
+    return appended;
+  }
+
+  async tail(limit = 100)                        {
+    await this.#queue;
+    const verified = await this.#readAndVerify(true);
+    const parsed = Number(limit);
+    const bounded = Number.isFinite(parsed) ? Math.min(Math.max(Math.trunc(parsed), 1), MAX_TAIL_EVENTS) : 100;
+    return verified.events.slice(-bounded);
+  }
+
+  async verifyIntegrity()                                {
+    await this.#queue;
+    const verified = await this.#readAndVerify(true);
+    return { valid: true, count: verified.count, headHash: verified.headHash };
+  }
+
+  async #loadHead()                                                      {
+    if (this.#head) return this.#head;
+    const verified = await this.#readAndVerify(true);
+    this.#head = { count: verified.count, headHash: verified.headHash };
+    return this.#head;
+  }
+
+  async #readAndVerify(reconcileAnchor         )                         {
+    let text        ;
+    try {
+      text = await readDurableStateText(this.#file, AUDIT_STATE_OPTIONS);
+    } catch (error) {
+      if ((error                         ).code === 'ENOENT') {
+        const empty                = { events: [], count: 0, headHash: null };
+        if (reconcileAnchor) await this.#reconcileAnchor(empty);
+        return empty;
+      }
+      throw error;
+    }
+
+    const lines = text.split('\n').filter((line) => line.length > 0);
+    if (lines.length === 0) {
+      const empty                = { events: [], count: 0, headHash: null };
+      if (reconcileAnchor) await this.#reconcileAnchor(empty);
+      return empty;
+    }
+
+    let parsed              ;
+    try {
+      parsed = lines.map((line) => JSON.parse(line)              );
+    } catch {
+      throw integrityError('Audit log contains invalid or partial JSON.');
+    }
+
+    const chained = parsed.filter((event) => event.chainVersion === AUDIT_CHAIN_VERSION || event.hash !== undefined || event.previousHash !== undefined);
+    if (chained.length === 0) {
+      parsed = await this.#migrateLegacy(parsed);
+    } else if (chained.length !== parsed.length) {
+      throw integrityError('Audit log mixes chained and unchained records.');
+    }
+
+    let previousHash                = null;
+    for (let index = 0; index < parsed.length; index += 1) {
+      const event = parsed[index] ;
+      if (event.chainVersion !== AUDIT_CHAIN_VERSION || typeof event.hash !== 'string' || !HASH_RE.test(event.hash)) {
+        throw integrityError(`Audit record ${index} has invalid chain metadata.`);
+      }
+      if (event.previousHash !== previousHash) {
+        throw integrityError(`Audit record ${index} does not link to the preceding record.`);
+      }
+      const expected = eventHash(stripChain(event), previousHash);
+      if (!safeHashEqual(event.hash, expected)) {
+        throw integrityError(`Audit record ${index} hash verification failed.`);
+      }
+      previousHash = event.hash;
+    }
+
+    const verified = { events: parsed, count: parsed.length, headHash: previousHash };
+    if (reconcileAnchor) await this.#reconcileAnchor(verified);
+    return verified;
+  }
+
+  async #migrateLegacy(events              )                        {
+    let previousHash                = null;
+    const migrated = events.map((event) => {
+      const chained = chainEvent(stripChain(event), previousHash);
+      previousHash = chained.hash ;
+      return chained;
+    });
+    await writeDurableStateText(this.#file, `${migrated.map((event) => JSON.stringify(event)).join('\n')}\n`, AUDIT_STATE_OPTIONS);
+    await this.#writeHead({ count: migrated.length, headHash: previousHash });
+    return migrated;
+  }
+
+  async #reconcileAnchor(verified               )                {
+    let anchor                   = null;
+    try {
+      anchor = JSON.parse(await readDurableStateText(this.#headFile, AUDIT_HEAD_OPTIONS))             ;
+    } catch (error) {
+      if ((error                         ).code !== 'ENOENT') throw integrityError('Audit head metadata is unreadable.');
+    }
+
+    if (!anchor) {
+      if (verified.count > 0) await this.#writeHead({ count: verified.count, headHash: verified.headHash });
+      return;
+    }
+    if (anchor.version !== 1 || !Number.isSafeInteger(anchor.count) || anchor.count < 0 ||
+        (anchor.headHash !== null && (typeof anchor.headHash !== 'string' || !HASH_RE.test(anchor.headHash)))) {
+      throw integrityError('Audit head metadata is invalid.');
+    }
+    if (anchor.count === verified.count && anchor.headHash === verified.headHash) return;
+
+    // Recover only the narrow crash window where one fully chained line reached disk
+    // but its head-file update did not. Anything else fails closed.
+    if (verified.count === anchor.count + 1) {
+      const last = verified.events.at(-1) ;
+      if (last.previousHash === anchor.headHash) {
+        await this.#writeHead({ count: verified.count, headHash: verified.headHash });
+        return;
+      }
+    }
+    throw integrityError('Audit log and persisted head metadata disagree.');
+  }
+
+  async #writeHead(head                                            )                {
+    const record            = {
+      version: 1,
+      count: head.count,
+      headHash: head.headHash,
+      updatedAt: new Date().toISOString()
+    };
+    await writeDurableStateText(this.#headFile, `${JSON.stringify(record, null, 2)}\n`, AUDIT_HEAD_OPTIONS);
+  }
+}
+
+function stripChain(event            )             {
+  const { chainVersion: _chainVersion, previousHash: _previousHash, hash: _hash, ...base } = event;
+  return base;
+}
+
+function chainEvent(base            , previousHash               )             {
+  return {
+    ...base,
+    chainVersion: AUDIT_CHAIN_VERSION,
+    previousHash,
+    hash: eventHash(base, previousHash)
+  };
+}
+
+function eventHash(base            , previousHash               )         {
+  return crypto.createHash('sha256')
+    .update('operator-audit-chain-v1\n')
+    .update(previousHash ?? 'GENESIS')
+    .update('\n')
+    .update(canonicalJson(base))
+    .digest('hex');
+}
+
+function canonicalJson(value         )         {
+  if (value === null || value === undefined) return 'null';
+  if (typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value);
+  if (typeof value === 'number') return Number.isFinite(value) ? JSON.stringify(value) : 'null';
+  if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(',')}]`;
+  if (typeof value === 'object') {
+    const object = value                           ;
+    const keys = Object.keys(object).filter((key) => object[key] !== undefined).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(',')}}`;
+  }
+  return 'null';
+}
+
+function safeHashEqual(actual        , expected        )          {
+  if (!HASH_RE.test(actual) || !HASH_RE.test(expected)) return false;
+  return crypto.timingSafeEqual(Buffer.from(actual, 'hex'), Buffer.from(expected, 'hex'));
+}
+
+function integrityError(message        )                {
+  return new OperatorError('AUDIT_INTEGRITY_FAILED', message);
+}

package/runtime/app/src/core/capability-policy.js

@@ -0,0 +1,58 @@
+                                                            
+import { PolicyError } from './errors.js';
+
+                                                        
+
+export const CAPABILITY_RISK_RULES = Object.freeze                                    ({
+  'computer.inspect': 'read',
+  'project.inspect': 'read',
+  'project.command.inspect': 'read',
+  'project.command.run': 'dynamic',
+  'project.transaction.run': 'destructive',
+  'file.read': 'read',
+  'file.list': 'read',
+  'file.write': 'write',
+  'file.create': 'write',
+  'file.replace': 'destructive',
+  'git.status': 'read',
+  'git.diff': 'read',
+  'git.rev-parse': 'read',
+  'git.checkpoint.inspect': 'read',
+  'git.checkpoint.create': 'write',
+  'git.checkpoint.restore': 'destructive',
+  'git.write': 'write',
+  'docker.inspect': 'read',
+  'docker.manage': 'system',
+  'postgres.inspect': 'read',
+  'postgres.select': 'read',
+  'vscode.inspect': 'read',
+  'vscode.open': 'system',
+  'terminal.execute': 'destructive',
+  'browser.inspect': 'read',
+  'browser.navigate': 'write',
+  'browser.interact': 'external',
+  'browser.tab.focus': 'write',
+  'browser.tab.close': 'destructive',
+  'app.inspect': 'read',
+  'app.operate': 'external'
+});
+
+export function capabilityRiskRule(capability        )                     {
+  const rule = CAPABILITY_RISK_RULES[capability];
+  if (!rule) {
+    throw new PolicyError(
+      'CAPABILITY_RISK_UNREGISTERED',
+      `Capability ${capability} has no canonical risk policy.`
+    );
+  }
+  return rule;
+}
+
+export function assertCanonicalRisk(action               , canonicalRisk            )       {
+  if (action.risk === canonicalRisk) return;
+  throw new PolicyError(
+    'ACTION_RISK_MISMATCH',
+    `Capability ${action.capability} must be authorized as ${canonicalRisk}.`,
+    { suppliedRisk: action.risk, canonicalRisk }
+  );
+}

package/runtime/app/src/core/child-environment.js

@@ -0,0 +1,29 @@
+                                                                   
+
+const DESKTOP_ENV_KEYS = [
+  'PATH', 'Path', 'PATHEXT', 'SYSTEMROOT', 'WINDIR',
+  'HOME', 'USERPROFILE', 'HOMEDRIVE', 'HOMEPATH',
+  'USER', 'USERNAME', 'LOGNAME', 'TMP', 'TEMP', 'TMPDIR',
+  'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'COLORTERM', 'SHELL',
+  'PROGRAMFILES', 'PROGRAMFILES(X86)', 'PROGRAMW6432', 'PROGRAMDATA',
+  'LOCALAPPDATA', 'APPDATA', 'DISPLAY', 'WAYLAND_DISPLAY',
+  'XDG_RUNTIME_DIR', 'XDG_DATA_HOME', 'XDG_CONFIG_HOME',
+  'DBUS_SESSION_BUS_ADDRESS'
+]         ;
+
+const WINDOWS_NATIVE_ENV_KEYS = [
+  'SYSTEMROOT', 'WINDIR', 'USERPROFILE', 'LOCALAPPDATA', 'APPDATA',
+  'TMP', 'TEMP'
+]         ;
+
+export function safeChildEnvironment(
+  profile                         ,
+  source                    = process.env
+)                    {
+  const keys = profile === 'desktop' ? DESKTOP_ENV_KEYS : WINDOWS_NATIVE_ENV_KEYS;
+  const env                    = {};
+  for (const key of keys) {
+    if (source[key] !== undefined) env[key] = source[key];
+  }
+  return env;
+}