neuralos 3.9.4 → 3.9.6

package/plugins/agentspan-bridge/playbookToWorkflowDef.mjs

@@ -1,209 +0,0 @@
-/**
- * playbookToWorkflowDef.mjs — map an RTerm playbook (PlaybookEntry) to a
- * Netflix-Conductor WorkflowDef so AgentSpan agents can invoke it as a step
- * (SUB_WORKFLOW) or RTerm can register + run it durably on the Conductor server.
- *
- * Pure mapping (no I/O):
- *   - command step → a run_command-style HTTP task carrying the command + target
- *   - script step  → an HTTP task that references the saved script id (the
- *                    Conductor worker resolves the script body by id)
- *   - wait step    → a Conductor WAIT task (durationSeconds)
- *   - sequential + dependsOn DAG ordering → Conductor task `taskReferenceName`
- *     graph with JOIN on multiple dependencies
- *   - retries (onError=continue → retry, else fail-fast) → Conductor `retryCount`
- *   - rollback steps → compensating tasks appended after the main flow
- *
- * The emitted WorkflowDef is valid for `POST /api/metadata/workflow` on any
- * Conductor OSS / AgentSpan server.
- */
-
-/** Sanitize a string into a Conductor-safe taskReferenceName ([A-Za-z0-9_]). */
-export function taskRef(id, fallback) {
-  const s = String(id ?? fallback ?? 'step').replace(/[^A-Za-z0-9_]/g, '_')
-  return s.length > 0 ? s : 'step'
-}
-
-/** Map a single RTerm playbook step to a Conductor task (no edges yet). */
-export function stepToTask(step, index, opts = {}) {
-  const ref = taskRef(step.id ?? `step_${index}`)
-  const name = step.name || ref
-  const base = {
-    name,
-    taskReferenceName: ref,
-    retryCount: step.onError === 'continue' ? (opts.continueRetryCount ?? 0) : 0,
-    startDelay: 0,
-    optional: false,
-    asyncComplete: false,
-  }
-
-  if (step.kind === 'wait') {
-    return {
-      ...base,
-      type: 'WAIT',
-      inputParameters: { duration: step.waitSeconds ?? 0 },
-    }
-  }
-
-  if (step.kind === 'script') {
-    // Reference the saved script by id; the Conductor-side worker resolves the
-    // script body (kept out of the def so it stays compact + secret-free).
-    return {
-      ...base,
-      type: 'SIMPLE',
-      inputParameters: {
-        kind: 'rterm_script',
-        scriptId: step.scriptId,
-        name,
-      },
-    }
-  }
-
-  // kind === 'command' (default): an HTTP task that invokes RTerm's command
-  // execution surface with the command + target scope.
-  return {
-    ...base,
-    type: 'HTTP',
-    inputParameters: {
-      http_request: {
-        uri: opts.execUri ?? '${workflow.input.rtermExecUri}',
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: {
-          kind: 'run_command',
-          command: step.command ?? '',
-          ...(step.validate ? { validate: step.validate } : {}),
-        },
-        connectionTimeOut: opts.connectionTimeOut ?? 5000,
-        readTimeOut: opts.readTimeOut ?? 300000,
-      },
-    },
-  }
-}
-
-/** Map a rollback action to a compensating Conductor task. */
-export function rollbackToTask(rollback, stepRef, index) {
-  const ref = taskRef(`rollback_${stepRef}_${index}`)
-  if (rollback.kind === 'script') {
-    return {
-      name: ref,
-      taskReferenceName: ref,
-      type: 'SIMPLE',
-      inputParameters: { kind: 'rterm_script', scriptId: rollback.scriptId, compensating: true },
-      retryCount: 0,
-      optional: true, // a failing rollback never blocks the workflow result
-      asyncComplete: false,
-    }
-  }
-  return {
-    name: ref,
-    taskReferenceName: ref,
-    type: 'HTTP',
-    inputParameters: {
-      http_request: {
-        uri: '${workflow.input.rtermExecUri}',
-        method: 'POST',
-        headers: { 'content-type': 'application/json' },
-        body: { kind: 'run_command', command: rollback.command ?? '', compensating: true },
-      },
-    },
-    retryCount: 0,
-    optional: true,
-    asyncComplete: false,
-  }
-}
-
-/**
- * Build the ordered task list with DAG edges from dependsOn.
- * Returns { tasks, order } where order is the topological order of step refs.
- * Steps with no dependsOn depend on the previous step (linear chain). Steps
- * with multiple dependsOn get a JOIN task.
- */
-export function buildDag(steps) {
-  const refs = steps.map((s, i) => taskRef(s.id ?? `step_${i}`))
-  const tasks = []
-  const joins = []
-  steps.forEach((s, i) => {
-    const ref = refs[i]
-    const deps = Array.isArray(s.dependsOn) && s.dependsOn.length > 0
-      ? s.dependsOn.map((d) => taskRef(d))
-      : (i === 0 ? [] : [refs[i - 1]])
-    if (deps.length > 1) {
-      const joinRef = taskRef(`join_${ref}`)
-      joins.push({ ref: joinRef, type: 'JOIN', joinOn: deps, taskReferenceName: joinRef, name: joinRef })
-    }
-  })
-  return { refs, joins }
-}
-
-/**
- * Map a full RTerm playbook to a Conductor WorkflowDef.
- * @param {object} playbook PlaybookEntry
- * @param {object} [opts] { execUri, connectionTimeOut, readTimeOut, continueRetryCount }
- * @returns {object} a Conductor WorkflowDef (POST /api/metadata/workflow)
- */
-export function playbookToWorkflowDef(playbook, opts = {}) {
-  if (!playbook || !Array.isArray(playbook.steps)) {
-    throw new Error('playbookToWorkflowDef needs a playbook with a steps array')
-  }
-  const name = String(playbook.name || playbook.id || 'rterm_playbook').replace(/\s+/g, '_')
-  const steps = playbook.steps
-  const tasks = []
-  const rollbackTasks = []
-
-  // Main flow: map each step, then wire sequential/DAG ordering by emitting
-  // tasks in dependency order (Conductor executes top-down; dependsOn edges are
-  // expressed via JOINs for fan-in).
-  const refs = steps.map((s, i) => taskRef(s.id ?? `step_${i}`))
-  const emittedJoins = new Set()
-
-  steps.forEach((step, i) => {
-    const ref = refs[i]
-    const task = stepToTask(step, i, opts)
-    // Wire dependency: Conductor's default is sequential task order, but we
-    // explicitly model dependsOn fan-in as a JOIN before this task when the
-    // step has multiple dependencies.
-    const deps = Array.isArray(step.dependsOn) && step.dependsOn.length > 0
-      ? step.dependsOn.map((d) => taskRef(d))
-      : []
-    if (deps.length > 1 && !emittedJoins.has(ref)) {
-      const joinRef = taskRef(`join_${ref}`)
-      tasks.push({
-        name: joinRef,
-        taskReferenceName: joinRef,
-        type: 'JOIN',
-        joinOn: deps,
-      })
-      emittedJoins.add(ref)
-    }
-    tasks.push(task)
-    if (step.rollback) {
-      rollbackTasks.push(rollbackToTask(step.rollback, ref, rollbackTasks.length))
-    }
-  })
-
-  // Compensating (rollback) tasks run after the main flow, in reverse step
-  // order (undo the most recent change first) — marked optional so they never
-  // mask the workflow's real result.
-  const orderedRollback = [...rollbackTasks].reverse()
-
-  return {
-    name,
-    description: playbook.description || `RTerm playbook: ${playbook.name ?? name}`,
-    version: 1,
-    tasks: [...tasks, ...orderedRollback],
-    inputParameters: [],
-    outputParameters: {},
-    schemaVersion: 2,
-    restartable: true,
-    workflowStatusListenerEnabled: false,
-    ownerEmail: 'rterm@hyperspace.ng',
-    timeoutPolicy: 'ALERT_ONLY',
-    timeoutSeconds: 0,
-    variables: {},
-    inputTemplate: {
-      rtermExecUri: opts.execUri ?? 'http://localhost:17888/rpc/exec',
-    },
-  }
-}
-
-export default { playbookToWorkflowDef, stepToTask, rollbackToTask, taskRef, buildDag }

package/plugins/agentspan-bridge/plugin.json

@@ -1,27 +0,0 @@
-{
-  "name": "agentspan-bridge",
-  "version": "1.0.0",
-  "description": "AgentSpan/Conductor bridge for RTerm — run durable, crash-resilient agents and workflows on an AgentSpan (Conductor) server from RTerm. Adds durable agent execution (resume-from-step on crash), plan-execute determinism, enterprise event triggers, and a live execution feed to RTerm's agent + dashboard. Server URL + optional auth are configured in Settings (agentspan block); secrets via the vault.",
-  "entry": "index.mjs",
-  "tools": [
-    "agentspan_health",
-    "agentspan_run",
-    "agentspan_status",
-    "agentspan_approve",
-    "agentspan_list",
-    "agentspan_stop",
-    "agentspan_export_playbook",
-    "agentspan_register_playbook",
-    "agentspan_delegate"
-  ],
-  "triggers": [
-    "agentspan_execution_failed"
-  ],
-  "panels": [
-    "agentspan-executions"
-  ],
-  "permissions": [
-    "exec",
-    "readLedger:metrics"
-  ]
-}

package/plugins/fraudops/index.d.mts

@@ -1,9 +0,0 @@
-// fraudops plugin type declarations
-export function register(ctx: any): void
-export function buildPipelineHealthCommand(): string
-export function buildNatsStatusCommand(): string
-export function buildKafkaLagCommand(): string
-export function parsePipelineHealth(output: string): { status: string; jobs: any[]; running: number; failed: number }
-export function buildStrCase(txnId: string, decision: string, indicators?: string[], assignedTo?: string): any
-export function buildDecisionSummary(decisions: Array<{ decision: string }> | null | undefined): { total: number; blocks: number; reviews: number; approves: number; blockRate: number; reviewRate: number; approveRate: number }
-export default any

package/plugins/fraudops/index.mjs

@@ -1,185 +0,0 @@
-/**
- * fraudops plugin — FraudOps for RTerm.
- *
- * Operational layer for the fraud detection pipeline. Monitors pipeline health
- * (Flink, NATS, Kafka), manages STR workflow, tracks fraud incidents, and
- * provides the unified fraud operations dashboard. Bridges Kafka/NATS metrics
- * into RTerm's SRE pillar.
- */
-
-// --- Pure: build pipeline health check command ---
-export function buildPipelineHealthCommand() {
-  return 'curl -s http://localhost:8081/jobs 2>/dev/null | head -20 || echo "flink not reachable"'
-}
-
-// --- Pure: build NATS JetStream status command ---
-export function buildNatsStatusCommand() {
-  return 'curl -s http://localhost:8222/streaming/channelsz 2>/dev/null | head -30 || echo "nats not reachable"'
-}
-
-// --- Pure: build Kafka consumer lag command ---
-export function buildKafkaLagCommand() {
-  return 'kafka-consumer-groups --bootstrap-server localhost:9092 --describe --group fraud-pipeline 2>/dev/null | head -20 || echo "kafka not reachable"'
-}
-
-// --- Pure: parse pipeline health output ---
-export function parsePipelineHealth(output) {
-  const health = { status: 'unknown', jobs: [], running: 0, failed: 0 }
-  try {
-    const parsed = JSON.parse(output)
-    if (parsed.jobs && Array.isArray(parsed.jobs)) {
-      health.jobs = parsed.jobs.map((j) => ({ id: j.jid, name: j.name, status: j.state }))
-      health.running = parsed.jobs.filter((j) => j.state === 'RUNNING').length
-      health.failed = parsed.jobs.filter((j) => j.state === 'FAILED').length
-      health.status = health.failed > 0 ? 'degraded' : health.running > 0 ? 'healthy' : 'unknown'
-    }
-  } catch { /* not JSON */ }
-  return health
-}
-
-// --- Pure: build an STR case record ---
-export function buildStrCase(txnId, decision, indicators, assignedTo) {
-  return {
-    id: `str-${txnId}-${Date.now().toString(36)}`,
-    txnId,
-    decision, // BLOCK | REVIEW
-    indicators: indicators ?? [],
-    assignedTo: assignedTo ?? 'unassigned',
-    status: 'pending', // pending | assigned | reviewed | filed | expired
-    deadline: Date.now() + 7 * 24 * 60 * 60 * 1000, // 7 days (CBN requirement)
-    createdAt: Date.now(),
-  }
-}
-
-// --- Pure: build a decision summary ---
-export function buildDecisionSummary(decisions) {
-  const list = Array.isArray(decisions) ? decisions : []
-  const total = list.length
-  const blocks = list.filter((d) => d.decision === 'BLOCK').length
-  const reviews = list.filter((d) => d.decision === 'REVIEW').length
-  const approves = list.filter((d) => d.decision === 'APPROVE').length
-  return {
-    total,
-    blocks,
-    reviews,
-    approves,
-    blockRate: total > 0 ? Math.round((blocks / total) * 100) : 0,
-    reviewRate: total > 0 ? Math.round((reviews / total) * 100) : 0,
-    approveRate: total > 0 ? Math.round((approves / total) * 100) : 0,
-  }
-}
-
-// --- Plugin entry ---
-export function register(ctx) {
-  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
-  const strCases = []
-
-  // Tool: fraudops_pipeline_status — check the health of the fraud pipeline
-  registerTool({
-    name: 'fraudops_pipeline_status',
-    description: 'Check the health of the fraud detection pipeline (Flink jobs, NATS JetStream, Kafka consumer lag). Returns status for each component.',
-    params: {},
-    handler: async () => {
-      const flinkOut = await exec(buildPipelineHealthCommand(), {})
-      const natsOut = await exec(buildNatsStatusCommand(), {})
-      const kafkaOut = await exec(buildKafkaLagCommand(), {})
-      const flink = parsePipelineHealth(flinkOut)
-      log(`[fraudops] pipeline status: flink=${flink.status} nats=${natsOut.slice(0, 50)} kafka=${kafkaOut.slice(0, 50)}`)
-      return { flink, nats: natsOut.slice(0, 500), kafka: kafkaOut.slice(0, 500) }
-    },
-  })
-
-  // Tool: fraudops_str_assign — assign an STR case to an analyst
-  registerTool({
-    name: 'fraudops_str_assign',
-    description: 'Assign an STR (Suspicious Transaction Report) case to an analyst. Creates the case with a 7-day CBN deadline.',
-    params: {
-      txnId: { type: 'string', description: 'Transaction ID' },
-      decision: { type: 'string', description: 'BLOCK or REVIEW' },
-      indicators: { type: 'array', description: 'Fraud indicators (e.g., ["high_velocity", "new_device"])' },
-      assignedTo: { type: 'string', description: 'Analyst username' },
-    },
-    handler: async (params) => {
-      const { txnId, decision, indicators, assignedTo } = params ?? {}
-      if (!txnId || !decision) return { error: 'txnId and decision are required' }
-      const strCase = buildStrCase(txnId, decision, indicators, assignedTo)
-      strCase.status = 'assigned'
-      strCases.push(strCase)
-      log(`[fraudops] STR case ${strCase.id} assigned to ${assignedTo}`)
-      return strCase
-    },
-  })
-
-  // Tool: fraudops_str_status — get STR case status
-  registerTool({
-    name: 'fraudops_str_status',
-    description: 'Get the status of STR cases. Filter by status, analyst, or overdue.',
-    params: {
-      status: { type: 'string', description: 'Filter by status: pending, assigned, reviewed, filed, expired' },
-      assignedTo: { type: 'string', description: 'Filter by analyst' },
-      overdue: { type: 'boolean', description: 'Only show overdue cases (past 7-day deadline)' },
-    },
-    handler: async (params) => {
-      let filtered = [...strCases]
-      if (params?.status) filtered = filtered.filter((c) => c.status === params.status)
-      if (params?.assignedTo) filtered = filtered.filter((c) => c.assignedTo === params.assignedTo)
-      if (params?.overdue) filtered = filtered.filter((c) => Date.now() > c.deadline)
-      return { total: filtered.length, cases: filtered }
-    },
-  })
-
-  // Tool: fraudops_decision_summary — summarize fraud decisions
-  registerTool({
-    name: 'fraudops_decision_summary',
-    description: 'Summarize fraud decisions (BLOCK/REVIEW/APPROVE counts and rates) from the decision stream.',
-    params: {
-      decisions: { type: 'array', description: 'Array of decision objects with { decision: "BLOCK"|"REVIEW"|"APPROVE" }' },
-    },
-    handler: async (params) => {
-      const decisions = params?.decisions ?? []
-      const summary = buildDecisionSummary(decisions)
-      log(`[fraudops] decision summary: ${summary.total} total, ${summary.blockRate}% block, ${summary.reviewRate}% review`)
-      return summary
-    },
-  })
-
-  // Trigger: fraudops_str_overdue — fires when an STR case is overdue
-  registerTrigger({
-    name: 'fraudops_str_overdue',
-    description: 'Fires when an STR case exceeds the 7-day CBN deadline. Use for escalation to senior analyst.',
-    match: (event) => {
-      if (event?.source !== 'fraudops') return false
-      return event.labels?.status === 'expired' || event.labels?.overdue === true
-    },
-    action: 'propose-change',
-  })
-
-  // Trigger: fraudops_pipeline_down — fires when a pipeline component is down
-  registerTrigger({
-    name: 'fraudops_pipeline_down',
-    description: 'Fires when a fraud pipeline component (Flink, NATS, Kafka) is detected as down. Use for immediate incident response.',
-    match: (event) => {
-      if (event?.source !== 'fraudops') return false
-      return event.labels?.status === 'down' || event.labels?.failed === true
-    },
-    action: 'run-playbook',
-  })
-
-  // Panel: fraudops-dashboard — unified fraud operations dashboard
-  registerPanel({
-    name: 'fraudops-dashboard',
-    title: 'Fraud Operations Dashboard',
-    render: (data) => {
-      const cases = Array.isArray(data?.cases) ? data.cases : strCases
-      const summary = data?.summary ?? { total: 0, blocks: 0, reviews: 0, approves: 0, blockRate: 0, reviewRate: 0, approveRate: 0 }
-      const rows = cases.map((c) =>
-        `<tr><td>${c.id}</td><td>${c.txnId}</td><td>${c.decision}</td><td>${c.assignedTo}</td><td>${c.status}</td><td>${new Date(c.deadline).toLocaleDateString()}</td></tr>`
-      ).join('')
-      return `<div class="fraudops-dashboard"><h3>Fraud Operations Dashboard</h3><p>Decisions: ${summary.total} | Block: ${summary.blockRate}% | Review: ${summary.reviewRate}% | Approve: ${summary.approveRate}%</p><p>STR Cases: ${cases.length} | Overdue: ${cases.filter((c) => Date.now() > c.deadline).length}</p><table><thead><tr><th>ID</th><th>Txn ID</th><th>Decision</th><th>Assigned</th><th>Status</th><th>Deadline</th></tr></thead><tbody>${rows}</tbody></table></div>`
-    },
-  })
-
-  log('[fraudops] registered: 4 tools, 2 triggers, 1 panel')
-}
-
-export default { register, buildPipelineHealthCommand, buildNatsStatusCommand, buildKafkaLagCommand, parsePipelineHealth, buildStrCase, buildDecisionSummary }

package/plugins/fraudops/plugin.json

@@ -1,10 +0,0 @@
-{
-  "name": "fraudops",
-  "version": "1.0.0",
-  "description": "FraudOps for RTerm — operational layer for the fraud detection pipeline. Monitors pipeline health (Flink, NATS, Kafka), manages STR workflow, tracks fraud incidents, and provides the unified fraud operations dashboard. Bridges Kafka/NATS metrics into RTerm's SRE pillar.",
-  "entry": "index.mjs",
-  "tools": ["fraudops_pipeline_status", "fraudops_str_assign", "fraudops_str_status", "fraudops_decision_summary"],
-  "triggers": ["fraudops_str_overdue", "fraudops_pipeline_down"],
-  "panels": ["fraudops-dashboard"],
-  "permissions": ["exec", "readLedger:metrics", "readLedger:incidents"]
-}

package/plugins/iam-connector/index.d.mts

@@ -1,10 +0,0 @@
-// iam-connector plugin type declarations
-export function register(ctx: any): void
-export function buildUserInfoCommand(username: string, os?: string): string
-export function buildUserGroupsCommand(username: string, os?: string): string
-export function buildDisableUserCommand(username: string, os?: string): string
-export function buildAccessReviewCommand(os?: string): string
-export function parseUserInfo(output: string | null | undefined, os?: string | null | undefined): { username: string; groups: string[]; enabled: boolean; locked: boolean }
-export function parseAccessReview(output: string | null | undefined, os?: string | null | undefined): Array<{ username: string; groups?: string[]; enabled?: boolean }>
-export function isPrivileged(userInfo: { groups: string[] } | null | undefined, privilegedGroups?: string[] | null | undefined): boolean
-export default any