rterm-backend 2.7.5 → 2.7.7

package/bin/gybackend.js

@@ -382209,6 +382209,188 @@ var EvidenceSealer = class {
   }
 };
 
+// ../../packages/backend/src/services/sre/monitorStatusService.ts
+var MonitorStatusService = class {
+  constructor(monitor, terminalService, now = () => Date.now()) {
+    this.monitor = monitor;
+    this.terminalService = terminalService;
+    this.now = now;
+  }
+  /** Build the full monitor status report. */
+  report() {
+    const publisherWired = this.monitor.publisher !== null;
+    const entries = [];
+    const issues = [];
+    const terminals = this.terminalService.getDisplayTerminals();
+    const now = this.now();
+    for (const terminal of terminals) {
+      const terminalId = terminal.id;
+      const connected = terminal.runtimeState === "ready";
+      const platform2 = terminal.remoteOs ?? terminal.type ?? "unknown";
+      const sessions = this.monitor.sessions;
+      const session = sessions?.get(terminalId);
+      const hasSession = session !== void 0;
+      const inFlight = session?.inFlight === true;
+      const lastCollectAt = session?.lastCollectAt ?? 0;
+      const lastCollectAgoMs = lastCollectAt > 0 ? now - lastCollectAt : -1;
+      let diagnosis = "ok";
+      if (!connected) {
+        diagnosis = "terminal_not_connected";
+      } else if (!hasSession) {
+        diagnosis = "no_monitor_session";
+      } else if (inFlight) {
+        diagnosis = "collection_stuck_in_flight";
+      } else if (lastCollectAt === 0) {
+        diagnosis = "never_collected";
+      } else if (lastCollectAgoMs > 3e4) {
+        diagnosis = `stale_collection (${Math.round(lastCollectAgoMs / 1e3)}s ago)`;
+      }
+      entries.push({
+        terminalId,
+        connected,
+        platform: platform2,
+        hasSession,
+        inFlight,
+        lastCollectAt,
+        lastCollectAgoMs,
+        diagnosis
+      });
+      if (diagnosis !== "ok") {
+        issues.push(`${terminalId}: ${diagnosis}`);
+      }
+    }
+    if (!publisherWired) {
+      issues.unshift("publisher_not_wired \u2014 createObservability may not have been called");
+    }
+    if (entries.length === 0) {
+      issues.push("no_terminals \u2014 no terminals connected");
+    }
+    return {
+      publisherWired,
+      terminalCount: entries.length,
+      entries,
+      issues
+    };
+  }
+  /** Build a compact summary string for the agent. */
+  summary() {
+    const r = this.report();
+    const parts = [];
+    parts.push(`publisher=${r.publisherWired ? "wired" : "NOT WIRED"}`);
+    parts.push(`terminals=${r.terminalCount}`);
+    if (r.issues.length > 0) {
+      parts.push(`issues=${r.issues.length}:`);
+      for (const issue2 of r.issues) {
+        parts.push(`  - ${issue2}`);
+      }
+    } else {
+      parts.push("all terminals collecting normally");
+    }
+    return parts.join("\n");
+  }
+};
+
+// ../../packages/backend/src/services/governance/agtPolicyEngine.ts
+var AgtPolicyEngine = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.agentIdentity = deps.agentIdentity ?? "rterm-agent";
+    this.sponsoringPrincipal = deps.sponsoringPrincipal ?? "unknown";
+  }
+  policy = null;
+  agentIdentity;
+  sponsoringPrincipal;
+  /** Load the policy document. Must be called before evaluate(). */
+  async load() {
+    this.policy = await this.deps.loadPolicy();
+  }
+  /** Evaluate an action against the policy. Returns the decision. */
+  evaluate(action, target) {
+    if (!this.policy) {
+      throw new Error("Policy not loaded. Call load() first.");
+    }
+    const actionLower = action.toLowerCase();
+    const targetLower = (target ?? "").toLowerCase();
+    for (const rule of this.policy.rules) {
+      const actionMatch = this.matchPattern(actionLower, rule.actionPattern.toLowerCase());
+      const targetMatch = !rule.targetPattern || this.matchPattern(targetLower, rule.targetPattern.toLowerCase());
+      if (actionMatch && targetMatch) {
+        return {
+          decision: rule.decision,
+          rule: rule.name,
+          reason: rule.reason ?? `matched rule '${rule.name}'`,
+          policyVersion: this.policy.version,
+          action,
+          target
+        };
+      }
+    }
+    return {
+      decision: this.policy.defaultDecision,
+      rule: "default",
+      reason: `no rule matched, using default '${this.policy.defaultDecision}'`,
+      policyVersion: this.policy.version,
+      action,
+      target
+    };
+  }
+  /** Get the current policy document. */
+  getPolicy() {
+    return this.policy;
+  }
+  /** Get the agent identity. */
+  getAgentIdentity() {
+    return this.agentIdentity;
+  }
+  /** Get the sponsoring principal. */
+  getSponsoringPrincipal() {
+    return this.sponsoringPrincipal;
+  }
+  /** Simple glob-style pattern matching: * matches any suffix. The value matches
+   * if it equals the pattern or starts with the pattern (for action patterns
+   * like "read" to match "read /etc/passwd"). */
+  matchPattern(value, pattern) {
+    if (pattern === "*") return true;
+    if (pattern.endsWith("*")) {
+      return value.startsWith(pattern.slice(0, -1));
+    }
+    return value === pattern || value.startsWith(pattern + " ");
+  }
+};
+function parsePolicyYaml(yaml) {
+  const lines = yaml.split(/\r?\n/);
+  const doc = { name: "", version: "1.0", defaultDecision: "deny", rules: [] };
+  let currentRule = null;
+  for (const line of lines) {
+    const l = line.trim();
+    if (!l || l.startsWith("#")) continue;
+    if (l.startsWith("name:")) {
+      if (currentRule?.name) {
+        doc.rules.push(currentRule);
+        currentRule = null;
+      }
+      doc.name = l.split(":")[1].trim();
+    } else if (l.startsWith("version:")) {
+      doc.version = l.split(":")[1].trim();
+    } else if (l.startsWith("defaultDecision:")) {
+      doc.defaultDecision = l.split(":")[1].trim();
+    } else if (l.startsWith("- name:")) {
+      if (currentRule?.name) doc.rules.push(currentRule);
+      currentRule = { name: l.split(":")[1].trim() };
+    } else if (l.startsWith("actionPattern:") && currentRule) {
+      currentRule.actionPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("targetPattern:") && currentRule) {
+      currentRule.targetPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("decision:") && currentRule) {
+      currentRule.decision = l.split(":")[1].trim();
+    } else if (l.startsWith("reason:") && currentRule) {
+      currentRule.reason = l.split(":").slice(1).join(":").trim();
+    }
+  }
+  if (currentRule?.name) doc.rules.push(currentRule);
+  return doc;
+}
+
 // ../../packages/backend/src/services/observability.ts
 function createObservability(deps) {
   const log = deps.onLog ?? (() => {
@@ -382287,6 +382469,41 @@ function createObservability(deps) {
   });
   const auditLedger = new AuditLedger({});
   const evidenceSealer = new EvidenceSealer({});
+  const monitorStatus = new MonitorStatusService(deps.resourceMonitorService, deps.terminalService);
+  const policyEngine = new AgtPolicyEngine({
+    loadPolicy: async () => {
+      const req = createRequire2(import.meta.url);
+      const fs22 = req("node:fs");
+      const path31 = req("node:path");
+      const policyPath = path31.join(".", "policy.yaml");
+      if (fs22.existsSync(policyPath)) {
+        return parsePolicyYaml(fs22.readFileSync(policyPath, "utf8"));
+      }
+      return {
+        name: "rterm-default",
+        version: "1.0",
+        defaultDecision: "deny",
+        rules: [
+          { name: "allow-read", actionPattern: "read", decision: "allow" },
+          { name: "allow-status", actionPattern: "status", decision: "allow" },
+          { name: "allow-list", actionPattern: "list", decision: "allow" },
+          { name: "deny-delete", actionPattern: "delete", decision: "deny" },
+          { name: "deny-drop", actionPattern: "drop", decision: "deny" },
+          { name: "deny-format", actionPattern: "format", decision: "deny" },
+          { name: "escalate-restart-prod", actionPattern: "restart", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-patch-prod", actionPattern: "patch", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-deploy-prod", actionPattern: "deploy", targetPattern: "prod-*", decision: "escalate" },
+          { name: "allow-restart", actionPattern: "restart", decision: "allow" },
+          { name: "allow-patch", actionPattern: "patch", decision: "allow" },
+          { name: "allow-deploy", actionPattern: "deploy", decision: "allow" }
+        ]
+      };
+    },
+    agentIdentity: `rterm-agent-v${process.env.GYBACKEND_VERSION ?? "2.7.7"}`,
+    sponsoringPrincipal: process.env.USER ?? "unknown"
+  });
+  void policyEngine.load().catch(() => {
+  });
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
   const bundlePluginRoot = new URL("../../plugins/", import.meta.url).pathname;
   const scanRoots = [pluginScanRoot, "./plugins"];
@@ -382359,6 +382576,8 @@ function createObservability(deps) {
     notify: { slackChannel, teamsChannel, smtpChannel, telegramChannel },
     aperf: { service: aperfService, toMetricPoint: aperfSummaryToMetricPoint },
     audit: { ledger: auditLedger, sealer: evidenceSealer },
+    monitorStatus,
+    governance: { policyEngine },
     pluginRegistry
   };
 }
@@ -384364,6 +384583,7 @@ async function startGyBackend() {
     automationManager,
     agentRunLedger,
     gatewayService,
+    resourceMonitorService,
     setMonitorPublisher: (pub) => resourceMonitorService.setPublisher((channel, data) => {
       pub(channel, data);
     }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.5",
+  "version": "2.7.7",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",