neuralos 3.9.4 → 3.9.6

package/plugins/iam-connector/index.mjs

@@ -1,229 +0,0 @@
-/**
- * iam-connector plugin — IAM integration for RTerm.
- *
- * User/group management, role assignment, access review, and audit trail for
- * Active Directory, local users, and service accounts. Covers user lifecycle
- * (create, disable, offboard), group membership, and access compliance.
- * Commands are built for both Linux (id, groups, usermod) and Windows
- * (Get-LocalUser, Get-LocalGroupMember, Disable-LocalUser).
- */
-
-// --- Pure: build user info command ---
-export function buildUserInfoCommand(username, os = 'linux') {
-  const o = String(os).toLowerCase()
-  if (o === 'windows' || o === 'win32') {
-    return `powershell -Command "Get-LocalUser -Name '${username}' | Select-Object Name,Enabled,LastLogon,PasswordExpires,LockedOut,Description | Format-List"`
-  }
-  return `id '${username}' 2>/dev/null && groups '${username}' 2>/dev/null && passwd -S '${username}' 2>/dev/null`
-}
-
-// --- Pure: build user groups command ---
-export function buildUserGroupsCommand(username, os = 'linux') {
-  const o = String(os).toLowerCase()
-  if (o === 'windows' || o === 'win32') {
-    return `powershell -Command "Get-LocalGroupMember -Group Administrators | Where-Object {$_.Name -like '*${username}*'} | Select-Object Name; Get-LocalUser -Name '${username}' | Select-Object Name,Enabled"`
-  }
-  return `groups '${username}' 2>/dev/null && id -Gn '${username}' 2>/dev/null`
-}
-
-// --- Pure: build disable user command ---
-export function buildDisableUserCommand(username, os = 'linux') {
-  const o = String(os).toLowerCase()
-  if (o === 'windows' || o === 'win32') {
-    return `powershell -Command "Disable-LocalUser -Name '${username}'; Get-LocalUser -Name '${username}' | Select-Object Name,Enabled"`
-  }
-  return `usermod -L '${username}' 2>/dev/null && echo "user ${username} disabled" || echo "failed to disable ${username}"`
-}
-
-// --- Pure: build access review command (list all users + groups) ---
-export function buildAccessReviewCommand(os = 'linux') {
-  const o = String(os).toLowerCase()
-  if (o === 'windows' || o === 'win32') {
-    return 'powershell -Command "Get-LocalUser | Select-Object Name,Enabled,LastLogon | Format-Table -AutoSize; Write-Host \'---\'; Get-LocalGroup | Select-Object Name | Format-Table -AutoSize"'
-  }
-  return 'cut -d: -f1 /etc/passwd | while read u; do echo "$u: $(id -Gn $u 2>/dev/null)"; done 2>/dev/null | head -50'
-}
-
-// --- Pure: parse user info output ---
-export function parseUserInfo(output, os = 'linux') {
-  const o = String(os ?? 'linux').toLowerCase()
-  const text = String(output ?? '')
-  const info = { username: '', groups: [], enabled: true, locked: false }
-
-  if (o === 'windows' || o === 'win32') {
-    const nameMatch = text.match(/Name\s+:\s+(\S+)/)
-    const enabledMatch = text.match(/Enabled\s+:\s+(True|False)/i)
-    const lockedMatch = text.match(/LockedOut\s+:\s+(True|False)/i)
-    if (nameMatch) info.username = nameMatch[1]
-    if (enabledMatch) info.enabled = enabledMatch[1].toLowerCase() === 'true'
-    if (lockedMatch) info.locked = lockedMatch[1].toLowerCase() === 'true'
-    return info
-  }
-
-  // Linux: parse id + groups + passwd -S output
-  const lines = text.split(/\r?\n/)
-  for (const line of lines) {
-    const l = line.trim()
-    const idMatch = l.match(/uid=\d+\((\S+)\)/)
-    if (idMatch) info.username = idMatch[1]
-    const groupsMatch = l.match(/groups=(.+)/)
-    if (groupsMatch) {
-      // groups=1000(john),27(sudo) — split by comma, then extract names from NNN(name) format
-      info.groups = groupsMatch[1]
-        .split(',')
-        .map((g) => g.replace(/\d+\(([^)]+)\)/, '$1').trim())
-        .filter(Boolean)
-    }
-    if (l.includes(' L ')) info.locked = true
-  }
-  return info
-}
-
-// --- Pure: parse access review output into a user list ---
-export function parseAccessReview(output, os = 'linux') {
-  const o = String(os ?? 'linux').toLowerCase()
-  const text = String(output ?? '')
-  const users = []
-
-  if (o === 'windows' || o === 'win32') {
-    const lines = text.split(/\r?\n/)
-    for (const line of lines) {
-      const l = line.trim()
-      const match = l.match(/^(\S+)\s+(True|False)\s+/)
-      if (match) {
-        users.push({ username: match[1], enabled: match[2].toLowerCase() === 'true' })
-      }
-    }
-    return users
-  }
-
-  // Linux: parse "user: group1 group2" lines
-  const lines = text.split(/\r?\n/)
-  for (const line of lines) {
-    const l = line.trim()
-    const match = l.match(/^(\S+):\s*(.*)/)
-    if (match) {
-      users.push({ username: match[1], groups: match[2].split(/\s+/).filter(Boolean) })
-    }
-  }
-  return users
-}
-
-// --- Pure: check if a user has privileged access ---
-export function isPrivileged(userInfo, privilegedGroups = ['sudo', 'wheel', 'admin', 'root', 'Administrators']) {
-  const groups = Array.isArray(userInfo?.groups) ? userInfo.groups : []
-  const privs = Array.isArray(privilegedGroups) ? privilegedGroups : []
-  return groups.some((g) => privs.some((pg) => String(g).toLowerCase().includes(String(pg).toLowerCase())))
-}
-
-// --- Plugin entry ---
-export function register(ctx) {
-  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
-
-  // Tool: iam_user_info — get user info
-  registerTool({
-    name: 'iam_user_info',
-    description: 'Get user information (username, groups, enabled status, locked status) for a user on a host.',
-    params: {
-      username: { type: 'string', description: 'Username to query' },
-      host: { type: 'string', description: 'Host to query' },
-      os: { type: 'string', description: 'OS type: linux, windows' },
-    },
-    handler: async (params) => {
-      const { username, host, os = 'linux' } = params ?? {}
-      if (!username || !host) return { error: 'username and host are required' }
-      const cmd = buildUserInfoCommand(username, os)
-      log(`[iam-connector] querying user ${username} on ${host}`)
-      const output = await exec(cmd, { host })
-      const info = parseUserInfo(output, os)
-      return { username, host, os, ...info, privileged: isPrivileged(info) }
-    },
-  })
-
-  // Tool: iam_user_groups — get user group memberships
-  registerTool({
-    name: 'iam_user_groups',
-    description: 'Get group memberships for a user on a host.',
-    params: {
-      username: { type: 'string', description: 'Username to query' },
-      host: { type: 'string', description: 'Host to query' },
-      os: { type: 'string', description: 'OS type' },
-    },
-    handler: async (params) => {
-      const { username, host, os = 'linux' } = params ?? {}
-      if (!username || !host) return { error: 'username and host are required' }
-      const cmd = buildUserGroupsCommand(username, os)
-      const output = await exec(cmd, { host })
-      const info = parseUserInfo(output, os)
-      return { username, host, groups: info.groups, privileged: isPrivileged(info) }
-    },
-  })
-
-  // Tool: iam_disable_user — disable a user account (requires approval)
-  registerTool({
-    name: 'iam_disable_user',
-    description: 'Disable a user account on a host. This is a destructive operation — requires approval. Returns the result.',
-    params: {
-      username: { type: 'string', description: 'Username to disable' },
-      host: { type: 'string', description: 'Host to disable on' },
-      os: { type: 'string', description: 'OS type' },
-    },
-    handler: async (params) => {
-      const { username, host, os = 'linux' } = params ?? {}
-      if (!username || !host) return { error: 'username and host are required' }
-      const cmd = buildDisableUserCommand(username, os)
-      log(`[iam-connector] disabling user ${username} on ${host}`)
-      const output = await exec(cmd, { host })
-      const info = parseUserInfo(output, os)
-      return { username, host, disabled: !info.enabled, output: output.slice(0, 500) }
-    },
-  })
-
-  // Tool: iam_access_review — review all user access on a host
-  registerTool({
-    name: 'iam_access_review',
-    description: 'Review all user accounts and group memberships on a host. Identifies privileged users.',
-    params: {
-      host: { type: 'string', description: 'Host to review' },
-      os: { type: 'string', description: 'OS type' },
-    },
-    handler: async (params) => {
-      const { host, os = 'linux' } = params ?? {}
-      if (!host) return { error: 'host is required' }
-      const cmd = buildAccessReviewCommand(os)
-      const output = await exec(cmd, { host })
-      const users = parseAccessReview(output, os)
-      const privilegedUsers = users.filter((u) => isPrivileged({ groups: u.groups ?? [] }))
-      return { host, totalUsers: users.length, privilegedUsers: privilegedUsers.length, users: users.slice(0, 50), privilegedUsers: privilegedUsers.map((u) => u.username) }
-    },
-  })
-
-  // Trigger: iam_privileged_change — fires when a privileged user's access changes
-  registerTrigger({
-    name: 'iam_privileged_change',
-    description: 'Fires when a privileged user account is modified (disabled, group change). Use for compliance monitoring.',
-    match: (event) => {
-      if (event?.source !== 'iam-connector') return false
-      return event.labels?.privileged === true
-    },
-    action: 'propose-change',
-  })
-
-  // Panel: iam-access-dashboard — IAM access dashboard
-  registerPanel({
-    name: 'iam-access-dashboard',
-    title: 'IAM Access Dashboard',
-    render: (data) => {
-      const users = Array.isArray(data) ? data : []
-      const privileged = users.filter((u) => isPrivileged({ groups: u.groups ?? [] }))
-      const rows = users.map((u) =>
-        `<tr><td>${u.username}</td><td>${(u.groups ?? []).join(', ')}</td><td>${u.enabled !== false ? '✅' : '❌'}</td><td>${isPrivileged({ groups: u.groups ?? [] }) ? '🔐' : ''}</td></tr>`
-      ).join('')
-      return `<div class="iam-access-dashboard"><h3>IAM Access Dashboard</h3><p>Total users: ${users.length} | Privileged: ${privileged.length}</p><table><thead><tr><th>User</th><th>Groups</th><th>Enabled</th><th>Privileged</th></tr></thead><tbody>${rows}</tbody></table></div>`
-    },
-  })
-
-  log('[iam-connector] registered: 4 tools, 1 trigger, 1 panel')
-}
-
-export default { register, buildUserInfoCommand, buildUserGroupsCommand, buildDisableUserCommand, buildAccessReviewCommand, parseUserInfo, parseAccessReview, isPrivileged }

package/plugins/iam-connector/plugin.json

@@ -1,10 +0,0 @@
-{
-  "name": "iam-connector",
-  "version": "1.0.0",
-  "description": "IAM integration for RTerm — user/group management, role assignment, access review, and audit trail for Active Directory, local users, and service accounts. Covers user lifecycle (create, disable, offboard), group membership, and access compliance.",
-  "entry": "index.mjs",
-  "tools": ["iam_user_info", "iam_user_groups", "iam_disable_user", "iam_access_review"],
-  "triggers": ["iam_privileged_change"],
-  "panels": ["iam-access-dashboard"],
-  "permissions": ["exec", "readLedger:incidents"]
-}

package/plugins/mitmproxy-bridge/index.d.mts

@@ -1,20 +0,0 @@
-// mitmproxy-bridge plugin type declarations
-export function register(ctx: any): void
-export function buildMitmCommand(opts: {
-  mode?: 'regular' | 'reverse'
-  listenPort?: number
-  upstreamTarget?: string
-  flowsFile: string
-  filterExpr?: string
-  extraArgs?: string[]
-}): { cmd: string; args: string[] }
-export function parseFlows(rawFlows: unknown): {
-  total: number
-  byHost: Record<string, { count: number; methods: Record<string, number> }>
-  byStatus: Record<string, number>
-  requests: Array<{ host: string; method: string; path: string; status: string; contentType: string }>
-  error?: string
-}
-export function detectSecrets(text: string | null | undefined): Array<{ kind: string; count: number; preview: string }>
-export function isHostAllowed(host: string, allowlist: string[]): boolean
-export default any

package/plugins/mitmproxy-bridge/index.mjs

@@ -1,256 +0,0 @@
-/**
- * mitmproxy-bridge — mitmproxy traffic capture for RTerm.
- *
- * Two use modes:
- *   1. Agent self-inspection — capture what the LLM actually sends over the
- *      wire (verify no secrets leak in prompts, inspect provider requests).
- *   2. Authorized interception — capture traffic on hosts you administer,
- *      following the APerf deploy pattern (run on the RTerm host as a sidecar).
- *
- * Pure + injectable: process spawning and file reads are injected; command
- * building, flow parsing, and secret detection are pure and fully testable.
- */
-
-// --- Pure: build the mitmdump command line ---
-
-export function buildMitmCommand(opts) {
-  const {
-    mode = 'regular',        // regular | reverse
-    listenPort = 8080,
-    upstreamTarget,          // for reverse mode: the upstream host:port
-    flowsFile,               // where to write the flow file
-    filterExpr,              // optional mitmproxy filter expression
-    extraArgs = [],
-  } = opts || {}
-
-  if (!flowsFile) throw new Error('buildMitmCommand needs flowsFile')
-  const args = ['mitmdump']
-
-  if (mode === 'reverse') {
-    if (!upstreamTarget) throw new Error('reverse mode needs upstreamTarget')
-    args.push('--mode', `reverse:${upstreamTarget}`)
-  } else {
-    args.push('--mode', 'regular')
-  }
-  args.push('--listen-port', String(listenPort))
-  args.push('-w', flowsFile)
-  if (filterExpr) args.push('--set', `flow_detail=0`, '--set', `intercept=${filterExpr}`)
-  for (const a of extraArgs) args.push(String(a))
-  return { cmd: 'mitmdump', args }
-}
-
-// --- Pure: parse a mitmproxy flows file (JSON lines from mitmdump --flow-detail) ---
-
-/**
- * Parse mitmproxy flow records (the JSON array/dump format) into a compact
- * summary: per-host request counts, methods, status codes, and content types.
- */
-export function parseFlows(rawFlows) {
-  const summary = {
-    total: 0,
-    byHost: {},
-    byStatus: {},
-    requests: [],
-  }
-
-  let flows = rawFlows
-  if (typeof rawFlows === 'string') {
-    try { flows = JSON.parse(rawFlows) } catch { return { ...summary, error: 'unparseable flows' } }
-  }
-  if (!Array.isArray(flows)) return { ...summary, error: 'flows is not an array' }
-
-  for (const f of flows) {
-    const host = String(f?.request?.host ?? f?.host ?? 'unknown')
-    const method = String(f?.request?.method ?? f?.method ?? '?')
-    const status = f?.response?.status_code ?? f?.status_code
-    const path = String(f?.request?.path ?? f?.path ?? '')
-    const contentType = String(f?.response?.headers?.['content-type'] ?? '')
-
-    summary.total += 1
-    const byHost = summary.byHost[host] || (summary.byHost[host] = { count: 0, methods: {} })
-    byHost.count += 1
-    byHost.methods[method] = (byHost.methods[method] || 0) + 1
-
-    const statusKey = status !== undefined && status !== null ? String(status) : 'no-response'
-    summary.byStatus[statusKey] = (summary.byStatus[statusKey] || 0) + 1
-
-    if (summary.requests.length < 100) {
-      summary.requests.push({ host, method, path: path.slice(0, 120), status: statusKey, contentType: contentType.slice(0, 60) })
-    }
-  }
-
-  return summary
-}
-
-// --- Pure: detect secret-looking content in captured request bodies ---
-
-const SECRET_PATTERNS = [
-  { re: /\bsk-[A-Za-z0-9]{20,}/g, name: 'openai-style-key' },
-  { re: /\bghp_[A-Za-z0-9]{30,}/g, name: 'github-token' },
-  { re: /\bAKIA[A-Z0-9]{16}\b/g, name: 'aws-access-key' },
-  { re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g, name: 'slack-token' },
-  // JWT: header/payload/signature. Real JWT headers are commonly exactly 20
-  // chars total (17 after the "eyJ" prefix) — {17,} catches those; {20,} was
-  // an FN that missed short-header JWTs.
-  { re: /\beyJ[A-Za-z0-9_-]{17,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}\b/g, name: 'jwt' },
-  { re: /\b(?:password|passwd|pwd|secret|token|api[_-]?key)\s*[:=]\s*['"]?[^\s'"]{8,}/gi, name: 'credential-assignment' },
-]
-
-export function detectSecrets(text) {
-  const findings = []
-  if (!text || typeof text !== 'string') return findings
-  for (const { re, name } of SECRET_PATTERNS) {
-    const matches = text.match(re)
-    if (matches) {
-      findings.push({
-        kind: name,
-        count: matches.length,
-        // redact: show only a prefix so the secret itself never lands in output
-        preview: matches[0].slice(0, 8) + '…',
-      })
-    }
-  }
-  return findings
-}
-
-// --- Pure: which hosts are allowed to be intercepted ---
-
-export function isHostAllowed(host, allowlist) {
-  if (!Array.isArray(allowlist) || allowlist.length === 0) return false
-  const h = String(host || '').toLowerCase()
-  return allowlist.some((a) => {
-    const pat = String(a || '').toLowerCase()
-    if (pat === h) return true
-    // allow "*.example.com" style suffix matching
-    if (pat.startsWith('*.')) return h.endsWith(pat.slice(1))
-    return false
-  })
-}
-
-// --- Plugin entry ---
-
-export function register(ctx) {
-  const { registerTool, registerPanel, log, spawnProcess } = ctx
-
-  let mitmChild = null
-  let lastSummary = null
-
-  registerTool({
-    name: 'mitm_start',
-    description: 'Start a mitmproxy capture. Mode "regular" listens as an HTTP proxy on listenPort; mode "reverse" forwards to upstreamTarget. Flows are written to a file for later analysis. Only start captures for hosts you are authorized to intercept.',
-    params: {
-      mode: { type: 'string', description: '"regular" (proxy) or "reverse" (forward to upstreamTarget)' },
-      listenPort: { type: 'number', description: 'Port to listen on (default 8080)' },
-      upstreamTarget: { type: 'string', description: 'For reverse mode: host:port to forward to' },
-      allowlist: { type: 'array', description: 'Hosts/patterns authorized for interception, e.g. ["api.example.com", "*.internal"]' },
-    },
-    handler: async (params) => {
-      if (typeof spawnProcess !== 'function') {
-        return { error: 'mitmproxy-bridge requires process spawning, which is not available in this RTerm build.' }
-      }
-      if (mitmChild) {
-        return { error: 'A mitmproxy capture is already running. Stop it with mitm_stop first.' }
-      }
-
-      const mode = params?.mode === 'reverse' ? 'reverse' : 'regular'
-      if (mode === 'reverse' && !params?.upstreamTarget) {
-        return { error: 'reverse mode needs upstreamTarget (host:port).' }
-      }
-      // Governance: an allowlist must be provided — no unbounded interception.
-      const allowlist = Array.isArray(params?.allowlist) ? params.allowlist : []
-      if (mode === 'reverse' && allowlist.length === 0) {
-        return { error: 'reverse mode requires an allowlist of authorized hosts. Unbounded interception is not permitted.' }
-      }
-
-      const fs = await import('node:fs')
-      const os = await import('node:os')
-      const path = await import('node:path')
-      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mitm-rterm-'))
-      const flowsFile = path.join(dir, 'flows.mitm')
-
-      let plan
-      try {
-        plan = buildMitmCommand({
-          mode,
-          listenPort: params?.listenPort,
-          upstreamTarget: params?.upstreamTarget,
-          flowsFile,
-        })
-      } catch (e) {
-        return { error: e?.message ?? String(e) }
-      }
-
-      log(`[mitmproxy] starting ${mode} capture on :${params?.listenPort ?? 8080} → ${flowsFile}`)
-      try {
-        mitmChild = spawnProcess(plan.cmd, plan.args, { stdio: 'pipe', detached: false })
-      } catch (e) {
-        return { error: `failed to spawn mitmdump: ${e?.message ?? e}. Is mitmproxy installed (pip install mitmproxy / brew install mitmproxy)?` }
-      }
-      if (!mitmChild) return { error: 'spawnProcess returned no child process' }
-
-      return {
-        started: true,
-        mode,
-        listenPort: params?.listenPort ?? 8080,
-        flowsFile,
-        note: mode === 'regular'
-          ? 'Configure clients to use this host as HTTP proxy. Stop with mitm_stop.'
-          : `Point clients at :${params?.listenPort ?? 8080}; traffic forwards to ${params?.upstreamTarget}. Stop with mitm_stop.`,
-      }
-    },
-  })
-
-  registerTool({
-    name: 'mitm_stop',
-    description: 'Stop the running mitmproxy capture and summarize the captured flows.',
-    params: {},
-    handler: async () => {
-      if (!mitmChild) return { error: 'No mitmproxy capture is running.' }
-      try { mitmChild.kill?.() } catch { /* ignore */ }
-      mitmChild = null
-      return { stopped: true }
-    },
-  })
-
-  registerTool({
-    name: 'mitm_flows',
-    description: 'Summarize captured flows from a mitmproxy flow dump: per-host counts, methods, status codes, and secret detection on request bodies. Use mitmdump -nr <flowsFile> --flow-detail 3 to export, or pass pre-parsed flows.',
-    params: {
-      flows: { type: 'array', description: 'Pre-parsed flow records [{request:{host,method,path}, response:{status_code}}]' },
-    },
-    handler: async (params) => {
-      const flows = Array.isArray(params?.flows) ? params.flows : []
-      if (flows.length === 0) {
-        return { error: 'No flows given. Export flows from the capture first (mitmdump -nr <file>) and pass the parsed records.' }
-      }
-      const summary = parseFlows(flows)
-
-      // Secret scan across request paths + any body text present in the records.
-      const textBlob = flows
-        .map((f) => `${f?.request?.path ?? ''} ${typeof f?.request?.body === 'string' ? f.request.body : ''}`)
-        .join('\n')
-        .slice(0, 200_000)
-      const secrets = detectSecrets(textBlob)
-
-      lastSummary = { summary, secrets }
-      log(`[mitmproxy] summarized ${summary.total} flows across ${Object.keys(summary.byHost).length} host(s); ${secrets.length} secret pattern(s) found`)
-      return { summary, secrets }
-    },
-  })
-
-  registerPanel({
-    name: 'mitmproxy-flows',
-    title: 'Traffic Capture',
-    render: async () => {
-      if (!lastSummary) return '<div class="panel-section"><h3>Traffic Capture</h3><p>No flows analyzed yet. Use mitm_start / mitm_flows.</p></div>'
-      const hostRows = Object.entries(lastSummary.summary.byHost)
-        .slice(0, 10)
-        .map(([h, s]) => `<tr><td>${h}</td><td>${s.count}</td></tr>`)
-        .join('')
-      return `<div class="panel-section"><h3>Traffic Capture — ${lastSummary.summary.total} flows</h3>
-        <table><tr><th>host</th><th>requests</th></tr>${hostRows}</table>
-        ${lastSummary.secrets.length ? `<p class="warn">⚠ ${lastSummary.secrets.length} secret pattern(s) detected</p>` : '<p>No secrets detected</p>'}
-      </div>`
-    },
-  })
-}

package/plugins/mitmproxy-bridge/plugin.json

@@ -1,17 +0,0 @@
-{
-  "name": "mitmproxy-bridge",
-  "version": "1.0.0",
-  "description": "mitmproxy traffic capture for RTerm — agent self-inspection (what the LLM sends over the wire) and authorized interception on administered hosts. Flow summaries + secret-pattern detection on captured bodies.",
-  "entry": "index.mjs",
-  "tools": [
-    "mitm_start",
-    "mitm_stop",
-    "mitm_flows"
-  ],
-  "panels": [
-    "mitmproxy-flows"
-  ],
-  "permissions": [
-    "spawnProcess"
-  ]
-}