rterm-backend 2.7.0 → 2.7.1

package/bin/gybackend.js

@@ -254727,7 +254727,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL5 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -255387,7 +255387,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -255754,7 +255754,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -256055,7 +256055,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -382011,6 +382011,193 @@ function aperfSummaryToMetricPoint(result) {
   };
 }
 
+// ../../packages/backend/src/services/audit/auditLedger.ts
+import { createHash, randomUUID as randomUUID21 } from "crypto";
+var GENESIS_HASH = "0".repeat(64);
+function computeRecordHash(kind, actor, target, summary, detail, at, seq2) {
+  const payload = JSON.stringify({ kind, actor, target, summary, detail, at, seq: seq2 });
+  return createHash("sha256").update(payload).digest("hex");
+}
+var AuditLedger = class _AuditLedger {
+  records = [];
+  hashFn;
+  now;
+  constructor(deps = {}) {
+    this.hashFn = deps.hashFn ?? ((data) => createHash("sha256").update(data).digest("hex"));
+    this.now = deps.now ?? (() => Date.now());
+  }
+  /** Append an event to the audit ledger. Returns the record with hash + chain. */
+  append(event) {
+    const seq2 = this.records.length + 1;
+    const at = event.at ?? this.now();
+    const prevHash = this.records.length > 0 ? this.records[this.records.length - 1].hash : GENESIS_HASH;
+    const contentHash = computeRecordHash(
+      event.kind,
+      event.actor,
+      event.target,
+      event.summary,
+      event.detail,
+      at,
+      seq2
+    );
+    const hash2 = createHash("sha256").update(contentHash + prevHash).digest("hex");
+    const record2 = {
+      id: `audit-${randomUUID21().slice(0, 12)}`,
+      kind: event.kind,
+      actor: event.actor,
+      target: event.target,
+      summary: event.summary,
+      ...event.detail ? { detail: event.detail } : {},
+      at,
+      seq: seq2,
+      hash: hash2,
+      prevHash
+    };
+    this.records.push(record2);
+    return record2;
+  }
+  /** Get all records (ordered by seq). */
+  list() {
+    return [...this.records];
+  }
+  /** Get records by kind. */
+  listByKind(kind) {
+    return this.records.filter((r) => r.kind === kind);
+  }
+  /** Get records for a specific target. */
+  listByTarget(target) {
+    return this.records.filter((r) => r.target === target);
+  }
+  /** Get records for a specific actor. */
+  listByActor(actor) {
+    return this.records.filter((r) => r.actor === actor);
+  }
+  /** Get records in a time range. */
+  listInRange(fromAt, toAt) {
+    return this.records.filter((r) => r.at >= fromAt && r.at <= toAt);
+  }
+  /** Verify the hash chain integrity. Returns { valid: true } or { valid: false, brokenAt: seq }. */
+  verify() {
+    if (this.records.length === 0) return { valid: true };
+    for (let i = 0; i < this.records.length; i++) {
+      const record2 = this.records[i];
+      if (record2.seq !== i + 1) {
+        return { valid: false, brokenAt: record2.seq, detail: `seq mismatch: expected ${i + 1}, got ${record2.seq}` };
+      }
+      const expectedContentHash = computeRecordHash(
+        record2.kind,
+        record2.actor,
+        record2.target,
+        record2.summary,
+        record2.detail,
+        record2.at,
+        record2.seq
+      );
+      const expectedHash = createHash("sha256").update(expectedContentHash + record2.prevHash).digest("hex");
+      if (record2.hash !== expectedHash) {
+        return { valid: false, brokenAt: record2.seq, detail: `hash mismatch at seq ${record2.seq}` };
+      }
+      const expectedPrevHash = i === 0 ? GENESIS_HASH : this.records[i - 1].hash;
+      if (record2.prevHash !== expectedPrevHash) {
+        return { valid: false, brokenAt: record2.seq, detail: `prevHash mismatch at seq ${record2.seq}` };
+      }
+    }
+    return { valid: true };
+  }
+  /** Get the current chain tip (the latest record's hash). */
+  tip() {
+    if (this.records.length === 0) return GENESIS_HASH;
+    return this.records[this.records.length - 1].hash;
+  }
+  /** Get the total number of records. */
+  size() {
+    return this.records.length;
+  }
+  /** Export all records as JSON (for persistence). */
+  export() {
+    return JSON.stringify(this.records, null, 2);
+  }
+  /** Import records from JSON (for recovery). Verifies the chain on import. */
+  import(json3) {
+    const parsed = JSON.parse(json3);
+    if (!Array.isArray(parsed)) {
+      return { imported: 0, valid: false, detail: "not an array" };
+    }
+    const tempLedger = new _AuditLedger({ hashFn: this.hashFn, now: this.now });
+    tempLedger.records = parsed;
+    const result = tempLedger.verify();
+    if (!result.valid) {
+      return { imported: 0, valid: false, detail: result.detail };
+    }
+    this.records = parsed;
+    return { imported: parsed.length, valid: true };
+  }
+};
+
+// ../../packages/backend/src/services/audit/evidenceSealer.ts
+import { createHash as createHash2 } from "crypto";
+function computeMerkleRoot(hashes) {
+  if (hashes.length === 0) return "0".repeat(64);
+  if (hashes.length === 1) return hashes[0];
+  const nextLevel = [];
+  for (let i = 0; i < hashes.length; i += 2) {
+    const left = hashes[i];
+    const right = i + 1 < hashes.length ? hashes[i + 1] : left;
+    nextLevel.push(createHash2("sha256").update(left + right).digest("hex"));
+  }
+  return computeMerkleRoot(nextLevel);
+}
+function verifyMerkleRoot(hashes, expectedRoot) {
+  return computeMerkleRoot(hashes) === expectedRoot;
+}
+var EvidenceSealer = class {
+  bundles = [];
+  now;
+  constructor(deps = {}) {
+    this.now = deps.now ?? (() => Date.now());
+  }
+  /** Seal the current state of the audit ledger into an evidence bundle. */
+  seal(ledger, sealId) {
+    const records = ledger.list();
+    const recordHashes = records.map((r) => r.hash);
+    const merkleRoot = computeMerkleRoot(recordHashes);
+    const bundle = {
+      merkleRoot,
+      recordCount: records.length,
+      fromAt: records.length > 0 ? records[0].at : 0,
+      toAt: records.length > 0 ? records[records.length - 1].at : 0,
+      tipHash: ledger.tip(),
+      recordHashes,
+      sealedAt: this.now(),
+      sealId: sealId ?? `seal-${Date.now().toString(36)}`
+    };
+    this.bundles.push(bundle);
+    return bundle;
+  }
+  /** Verify a sealed bundle against a set of records. */
+  verify(bundle, records) {
+    if (records.length !== bundle.recordCount) {
+      return { valid: false, detail: `record count mismatch: expected ${bundle.recordCount}, got ${records.length}` };
+    }
+    if (records.length > 0 && records[records.length - 1].hash !== bundle.tipHash) {
+      return { valid: false, detail: `tip hash mismatch` };
+    }
+    const hashes = records.map((r) => r.hash);
+    if (!verifyMerkleRoot(hashes, bundle.merkleRoot)) {
+      return { valid: false, detail: `Merkle root mismatch` };
+    }
+    return { valid: true };
+  }
+  /** Get all sealed bundles. */
+  listBundles() {
+    return [...this.bundles];
+  }
+  /** Get the latest sealed bundle. */
+  latest() {
+    return this.bundles.length > 0 ? this.bundles[this.bundles.length - 1] : void 0;
+  }
+};
+
 // ../../packages/backend/src/services/observability.ts
 function createObservability(deps) {
   const log = deps.onLog ?? (() => {
@@ -382087,6 +382274,8 @@ function createObservability(deps) {
   const aperfService = new AperfService({
     execSsh: async () => ""
   });
+  const auditLedger = new AuditLedger({});
+  const evidenceSealer = new EvidenceSealer({});
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
   const pluginRegistry = new PluginRegistry({
     scanRoots: [pluginScanRoot, "./plugins"],
@@ -382139,6 +382328,7 @@ function createObservability(deps) {
     dagu: { parseDaguYaml, parseDaguWorkflow, daguExecutionPlan },
     notify: { slackChannel, teamsChannel, smtpChannel, telegramChannel },
     aperf: { service: aperfService, toMetricPoint: aperfSummaryToMetricPoint },
+    audit: { ledger: auditLedger, sealer: evidenceSealer },
     pluginRegistry
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",