rterm-backend 2.7.0 → 2.7.2

package/bin/gybackend.js

@@ -254727,7 +254727,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL5 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -255387,7 +255387,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -255754,7 +255754,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -256055,7 +256055,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -360739,7 +360739,7 @@ var AgentService_v2 = class {
         state.messages
       );
       const messages = [...state.messages];
-      const lastMessage = messages[messages.length - 1];
+      const lastMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
       let pendingToolCalls = [];
       if (AIMessage.isInstance(lastMessage) && (hasEmptyMalformedToolCallFinishFlag(lastMessage) || isEmptyMalformedToolCallFinish(lastMessage, []))) {
         this.helpers.sendEvent(sessionId, {
@@ -361623,7 +361623,7 @@ ${reminder}`;
       const sessionId = state.sessionId;
       if (!sessionId) throw new Error("No session ID in state");
       const messages = [...state.messages];
-      const lastMessage = messages[messages.length - 1];
+      const lastMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
       const lastMessageIsAi = AIMessage.isInstance(lastMessage);
       const guardMessages = lastMessageIsAi || messages.length === 0 ? messages : messages.slice(0, -1);
       if (!lastMessageIsAi && lastMessage) {
@@ -361800,7 +361800,7 @@ ${reminder}`;
       const sessionId = state.sessionId;
       if (!sessionId) return state;
       const messages = Array.isArray(state.messages) ? [...state.messages] : [];
-      const lastMessage = messages[messages.length - 1];
+      const lastMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
       const finalBoundaryMessages = AIMessage.isInstance(lastMessage) || messages.length === 0 ? messages : messages.slice(0, -1);
       const queuedInsertionResult = this.appendQueuedInsertionMessagesForContinue(
         sessionId,
@@ -362362,7 +362362,7 @@ ${reminder}`;
       return "tools";
     }
     const messages = Array.isArray(state.messages) ? state.messages : [];
-    const lastMessage = messages[messages.length - 1];
+    const lastMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
     if (AIMessage.isInstance(lastMessage) && (hasEmptyMalformedToolCallFinishFlag(lastMessage) || isEmptyMalformedToolCallFinish(lastMessage, []))) {
       return "final_output";
     }
@@ -362409,8 +362409,8 @@ ${reminder}`;
     }
   }
   trimInterruptedToolCallHistory(messages, executedToolCall) {
-    const lastMessage = messages[messages.length - 1];
-    if (!AIMessage.isInstance(lastMessage)) {
+    const lastMessage = messages.length > 0 ? messages[messages.length - 1] : void 0;
+    if (!lastMessage || !AIMessage.isInstance(lastMessage)) {
       return;
     }
     const toolCalls = Array.isArray(lastMessage.tool_calls) ? lastMessage.tool_calls : [];
@@ -377401,8 +377401,8 @@ var MetricsLedger = class {
 var DEFAULT_WINDOW = 36e5;
 function percentile(sorted, p) {
   if (sorted.length === 0) return void 0;
-  const idx = Math.min(sorted.length - 1, Math.floor(p / 100 * sorted.length));
-  return sorted[idx];
+  const rank = Math.max(1, Math.ceil(p / 100 * sorted.length));
+  return sorted[Math.min(rank, sorted.length) - 1];
 }
 var GoldenSignals = class {
   constructor(deps) {
@@ -381941,16 +381941,19 @@ function parseAperfReport(text) {
   topProcs.sort((a, b) => b.cpuPercent - a.cpuPercent);
   if (topProcs.length > 0) summary.topCpuProcesses = topProcs.slice(0, 5);
   if (findings.length === 0) {
-    if ((summary.cpuUsagePercent ?? 0) >= 90) {
-      findings.push({ metric: "cpu_utilization", value: summary.cpuUsagePercent, severity: "critical", message: `aggregate CPU utilization is ${summary.cpuUsagePercent}% (>= 90%)` });
-    } else if ((summary.cpuUsagePercent ?? 0) >= 75) {
-      findings.push({ metric: "cpu_utilization", value: summary.cpuUsagePercent, severity: "warning", message: `aggregate CPU utilization is ${summary.cpuUsagePercent}% (>= 75%)` });
+    const cpu = summary.cpuUsagePercent;
+    if (cpu !== void 0 && cpu >= 90) {
+      findings.push({ metric: "cpu_utilization", value: cpu, severity: "critical", message: `aggregate CPU utilization is ${cpu}% (>= 90%)` });
+    } else if (cpu !== void 0 && cpu >= 75) {
+      findings.push({ metric: "cpu_utilization", value: cpu, severity: "warning", message: `aggregate CPU utilization is ${cpu}% (>= 75%)` });
     }
-    if ((summary.memUsagePercent ?? 0) >= 90) {
-      findings.push({ metric: "memory", value: summary.memUsagePercent, severity: "critical", message: `memory utilization is ${summary.memUsagePercent}% (>= 90%)` });
+    const mem = summary.memUsagePercent;
+    if (mem !== void 0 && mem >= 90) {
+      findings.push({ metric: "memory", value: mem, severity: "critical", message: `memory utilization is ${mem}% (>= 90%)` });
     }
-    if ((summary.diskUsagePercentMax ?? 0) >= 90) {
-      findings.push({ metric: "disk", value: summary.diskUsagePercentMax, severity: "critical", message: `a disk is at ${summary.diskUsagePercentMax}% utilization (>= 90%)` });
+    const disk = summary.diskUsagePercentMax;
+    if (disk !== void 0 && disk >= 90) {
+      findings.push({ metric: "disk", value: disk, severity: "critical", message: `a disk is at ${disk}% utilization (>= 90%)` });
     }
     if (summary.topCpuProcesses && summary.topCpuProcesses.length > 0) {
       const top = summary.topCpuProcesses[0];
@@ -382011,6 +382014,198 @@ function aperfSummaryToMetricPoint(result) {
   };
 }
 
+// ../../packages/backend/src/services/audit/auditLedger.ts
+import { createHash, randomUUID as randomUUID21 } from "crypto";
+var GENESIS_HASH = "0".repeat(64);
+function computeRecordHash(kind, actor, target, summary, detail, at, seq2) {
+  const payload = JSON.stringify({ kind, actor, target, summary, detail, at, seq: seq2 });
+  return createHash("sha256").update(payload).digest("hex");
+}
+var AuditLedger = class _AuditLedger {
+  records = [];
+  hashFn;
+  now;
+  constructor(deps = {}) {
+    this.hashFn = deps.hashFn ?? ((data) => createHash("sha256").update(data).digest("hex"));
+    this.now = deps.now ?? (() => Date.now());
+  }
+  /** Append an event to the audit ledger. Returns the record with hash + chain. */
+  append(event) {
+    const seq2 = this.records.length + 1;
+    const at = event.at ?? this.now();
+    const prevHash = this.records.length > 0 ? this.records[this.records.length - 1].hash : GENESIS_HASH;
+    const contentHash = computeRecordHash(
+      event.kind,
+      event.actor,
+      event.target,
+      event.summary,
+      event.detail,
+      at,
+      seq2
+    );
+    const hash2 = createHash("sha256").update(contentHash + prevHash).digest("hex");
+    const record2 = {
+      id: `audit-${randomUUID21().slice(0, 12)}`,
+      kind: event.kind,
+      actor: event.actor,
+      target: event.target,
+      summary: event.summary,
+      ...event.detail ? { detail: event.detail } : {},
+      at,
+      seq: seq2,
+      hash: hash2,
+      prevHash
+    };
+    this.records.push(record2);
+    return record2;
+  }
+  /** Get all records (ordered by seq). */
+  list() {
+    return [...this.records];
+  }
+  /** Get records by kind. */
+  listByKind(kind) {
+    return this.records.filter((r) => r.kind === kind);
+  }
+  /** Get records for a specific target. */
+  listByTarget(target) {
+    return this.records.filter((r) => r.target === target);
+  }
+  /** Get records for a specific actor. */
+  listByActor(actor) {
+    return this.records.filter((r) => r.actor === actor);
+  }
+  /** Get records in a time range. */
+  listInRange(fromAt, toAt) {
+    return this.records.filter((r) => r.at >= fromAt && r.at <= toAt);
+  }
+  /** Verify the hash chain integrity. Returns { valid: true } or { valid: false, brokenAt: seq }. */
+  verify() {
+    if (this.records.length === 0) return { valid: true };
+    for (let i = 0; i < this.records.length; i++) {
+      const record2 = this.records[i];
+      if (record2.seq !== i + 1) {
+        return { valid: false, brokenAt: record2.seq, detail: `seq mismatch: expected ${i + 1}, got ${record2.seq}` };
+      }
+      const expectedContentHash = computeRecordHash(
+        record2.kind,
+        record2.actor,
+        record2.target,
+        record2.summary,
+        record2.detail,
+        record2.at,
+        record2.seq
+      );
+      const expectedHash = createHash("sha256").update(expectedContentHash + record2.prevHash).digest("hex");
+      if (record2.hash !== expectedHash) {
+        return { valid: false, brokenAt: record2.seq, detail: `hash mismatch at seq ${record2.seq}` };
+      }
+      const expectedPrevHash = i === 0 ? GENESIS_HASH : this.records[i - 1].hash;
+      if (record2.prevHash !== expectedPrevHash) {
+        return { valid: false, brokenAt: record2.seq, detail: `prevHash mismatch at seq ${record2.seq}` };
+      }
+    }
+    return { valid: true };
+  }
+  /** Get the current chain tip (the latest record's hash). */
+  tip() {
+    if (this.records.length === 0) return GENESIS_HASH;
+    return this.records[this.records.length - 1].hash;
+  }
+  /** Get the total number of records. */
+  size() {
+    return this.records.length;
+  }
+  /** Export all records as JSON (for persistence). */
+  export() {
+    return JSON.stringify(this.records, null, 2);
+  }
+  /** Import records from JSON (for recovery). Verifies the chain on import. */
+  import(json3) {
+    let parsed;
+    try {
+      parsed = JSON.parse(json3);
+    } catch {
+      return { imported: 0, valid: false, detail: "invalid JSON" };
+    }
+    if (!Array.isArray(parsed)) {
+      return { imported: 0, valid: false, detail: "not an array" };
+    }
+    const tempLedger = new _AuditLedger({ hashFn: this.hashFn, now: this.now });
+    tempLedger.records = parsed;
+    const result = tempLedger.verify();
+    if (!result.valid) {
+      return { imported: 0, valid: false, detail: result.detail };
+    }
+    this.records = parsed;
+    return { imported: parsed.length, valid: true };
+  }
+};
+
+// ../../packages/backend/src/services/audit/evidenceSealer.ts
+import { createHash as createHash2 } from "crypto";
+function computeMerkleRoot(hashes) {
+  if (hashes.length === 0) return "0".repeat(64);
+  if (hashes.length === 1) return hashes[0];
+  const nextLevel = [];
+  for (let i = 0; i < hashes.length; i += 2) {
+    const left = hashes[i];
+    const right = i + 1 < hashes.length ? hashes[i + 1] : left;
+    nextLevel.push(createHash2("sha256").update(left + right).digest("hex"));
+  }
+  return computeMerkleRoot(nextLevel);
+}
+function verifyMerkleRoot(hashes, expectedRoot) {
+  return computeMerkleRoot(hashes) === expectedRoot;
+}
+var EvidenceSealer = class {
+  bundles = [];
+  now;
+  constructor(deps = {}) {
+    this.now = deps.now ?? (() => Date.now());
+  }
+  /** Seal the current state of the audit ledger into an evidence bundle. */
+  seal(ledger, sealId) {
+    const records = ledger.list();
+    const recordHashes = records.map((r) => r.hash);
+    const merkleRoot = computeMerkleRoot(recordHashes);
+    const bundle = {
+      merkleRoot,
+      recordCount: records.length,
+      fromAt: records.length > 0 ? records[0].at : 0,
+      toAt: records.length > 0 ? records[records.length - 1].at : 0,
+      tipHash: ledger.tip(),
+      recordHashes,
+      sealedAt: this.now(),
+      sealId: sealId ?? `seal-${Date.now().toString(36)}`
+    };
+    this.bundles.push(bundle);
+    return bundle;
+  }
+  /** Verify a sealed bundle against a set of records. */
+  verify(bundle, records) {
+    if (records.length !== bundle.recordCount) {
+      return { valid: false, detail: `record count mismatch: expected ${bundle.recordCount}, got ${records.length}` };
+    }
+    if (records.length > 0 && records[records.length - 1].hash !== bundle.tipHash) {
+      return { valid: false, detail: `tip hash mismatch` };
+    }
+    const hashes = records.map((r) => r.hash);
+    if (!verifyMerkleRoot(hashes, bundle.merkleRoot)) {
+      return { valid: false, detail: `Merkle root mismatch` };
+    }
+    return { valid: true };
+  }
+  /** Get all sealed bundles. */
+  listBundles() {
+    return [...this.bundles];
+  }
+  /** Get the latest sealed bundle. */
+  latest() {
+    return this.bundles.length > 0 ? this.bundles[this.bundles.length - 1] : void 0;
+  }
+};
+
 // ../../packages/backend/src/services/observability.ts
 function createObservability(deps) {
   const log = deps.onLog ?? (() => {
@@ -382087,6 +382282,8 @@ function createObservability(deps) {
   const aperfService = new AperfService({
     execSsh: async () => ""
   });
+  const auditLedger = new AuditLedger({});
+  const evidenceSealer = new EvidenceSealer({});
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
   const pluginRegistry = new PluginRegistry({
     scanRoots: [pluginScanRoot, "./plugins"],
@@ -382139,6 +382336,7 @@ function createObservability(deps) {
     dagu: { parseDaguYaml, parseDaguWorkflow, daguExecutionPlan },
     notify: { slackChannel, teamsChannel, smtpChannel, telegramChannel },
     aperf: { service: aperfService, toMetricPoint: aperfSummaryToMetricPoint },
+    audit: { ledger: auditLedger, sealer: evidenceSealer },
     pluginRegistry
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.0",
+  "version": "2.7.2",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",