rterm-backend 2.7.6 → 2.7.7

package/bin/gybackend.js

@@ -382290,6 +382290,107 @@ var MonitorStatusService = class {
   }
 };
 
+// ../../packages/backend/src/services/governance/agtPolicyEngine.ts
+var AgtPolicyEngine = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.agentIdentity = deps.agentIdentity ?? "rterm-agent";
+    this.sponsoringPrincipal = deps.sponsoringPrincipal ?? "unknown";
+  }
+  policy = null;
+  agentIdentity;
+  sponsoringPrincipal;
+  /** Load the policy document. Must be called before evaluate(). */
+  async load() {
+    this.policy = await this.deps.loadPolicy();
+  }
+  /** Evaluate an action against the policy. Returns the decision. */
+  evaluate(action, target) {
+    if (!this.policy) {
+      throw new Error("Policy not loaded. Call load() first.");
+    }
+    const actionLower = action.toLowerCase();
+    const targetLower = (target ?? "").toLowerCase();
+    for (const rule of this.policy.rules) {
+      const actionMatch = this.matchPattern(actionLower, rule.actionPattern.toLowerCase());
+      const targetMatch = !rule.targetPattern || this.matchPattern(targetLower, rule.targetPattern.toLowerCase());
+      if (actionMatch && targetMatch) {
+        return {
+          decision: rule.decision,
+          rule: rule.name,
+          reason: rule.reason ?? `matched rule '${rule.name}'`,
+          policyVersion: this.policy.version,
+          action,
+          target
+        };
+      }
+    }
+    return {
+      decision: this.policy.defaultDecision,
+      rule: "default",
+      reason: `no rule matched, using default '${this.policy.defaultDecision}'`,
+      policyVersion: this.policy.version,
+      action,
+      target
+    };
+  }
+  /** Get the current policy document. */
+  getPolicy() {
+    return this.policy;
+  }
+  /** Get the agent identity. */
+  getAgentIdentity() {
+    return this.agentIdentity;
+  }
+  /** Get the sponsoring principal. */
+  getSponsoringPrincipal() {
+    return this.sponsoringPrincipal;
+  }
+  /** Simple glob-style pattern matching: * matches any suffix. The value matches
+   * if it equals the pattern or starts with the pattern (for action patterns
+   * like "read" to match "read /etc/passwd"). */
+  matchPattern(value, pattern) {
+    if (pattern === "*") return true;
+    if (pattern.endsWith("*")) {
+      return value.startsWith(pattern.slice(0, -1));
+    }
+    return value === pattern || value.startsWith(pattern + " ");
+  }
+};
+function parsePolicyYaml(yaml) {
+  const lines = yaml.split(/\r?\n/);
+  const doc = { name: "", version: "1.0", defaultDecision: "deny", rules: [] };
+  let currentRule = null;
+  for (const line of lines) {
+    const l = line.trim();
+    if (!l || l.startsWith("#")) continue;
+    if (l.startsWith("name:")) {
+      if (currentRule?.name) {
+        doc.rules.push(currentRule);
+        currentRule = null;
+      }
+      doc.name = l.split(":")[1].trim();
+    } else if (l.startsWith("version:")) {
+      doc.version = l.split(":")[1].trim();
+    } else if (l.startsWith("defaultDecision:")) {
+      doc.defaultDecision = l.split(":")[1].trim();
+    } else if (l.startsWith("- name:")) {
+      if (currentRule?.name) doc.rules.push(currentRule);
+      currentRule = { name: l.split(":")[1].trim() };
+    } else if (l.startsWith("actionPattern:") && currentRule) {
+      currentRule.actionPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("targetPattern:") && currentRule) {
+      currentRule.targetPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("decision:") && currentRule) {
+      currentRule.decision = l.split(":")[1].trim();
+    } else if (l.startsWith("reason:") && currentRule) {
+      currentRule.reason = l.split(":").slice(1).join(":").trim();
+    }
+  }
+  if (currentRule?.name) doc.rules.push(currentRule);
+  return doc;
+}
+
 // ../../packages/backend/src/services/observability.ts
 function createObservability(deps) {
   const log = deps.onLog ?? (() => {
@@ -382369,6 +382470,40 @@ function createObservability(deps) {
   const auditLedger = new AuditLedger({});
   const evidenceSealer = new EvidenceSealer({});
   const monitorStatus = new MonitorStatusService(deps.resourceMonitorService, deps.terminalService);
+  const policyEngine = new AgtPolicyEngine({
+    loadPolicy: async () => {
+      const req = createRequire2(import.meta.url);
+      const fs22 = req("node:fs");
+      const path31 = req("node:path");
+      const policyPath = path31.join(".", "policy.yaml");
+      if (fs22.existsSync(policyPath)) {
+        return parsePolicyYaml(fs22.readFileSync(policyPath, "utf8"));
+      }
+      return {
+        name: "rterm-default",
+        version: "1.0",
+        defaultDecision: "deny",
+        rules: [
+          { name: "allow-read", actionPattern: "read", decision: "allow" },
+          { name: "allow-status", actionPattern: "status", decision: "allow" },
+          { name: "allow-list", actionPattern: "list", decision: "allow" },
+          { name: "deny-delete", actionPattern: "delete", decision: "deny" },
+          { name: "deny-drop", actionPattern: "drop", decision: "deny" },
+          { name: "deny-format", actionPattern: "format", decision: "deny" },
+          { name: "escalate-restart-prod", actionPattern: "restart", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-patch-prod", actionPattern: "patch", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-deploy-prod", actionPattern: "deploy", targetPattern: "prod-*", decision: "escalate" },
+          { name: "allow-restart", actionPattern: "restart", decision: "allow" },
+          { name: "allow-patch", actionPattern: "patch", decision: "allow" },
+          { name: "allow-deploy", actionPattern: "deploy", decision: "allow" }
+        ]
+      };
+    },
+    agentIdentity: `rterm-agent-v${process.env.GYBACKEND_VERSION ?? "2.7.7"}`,
+    sponsoringPrincipal: process.env.USER ?? "unknown"
+  });
+  void policyEngine.load().catch(() => {
+  });
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
   const bundlePluginRoot = new URL("../../plugins/", import.meta.url).pathname;
   const scanRoots = [pluginScanRoot, "./plugins"];
@@ -382442,6 +382577,7 @@ function createObservability(deps) {
     aperf: { service: aperfService, toMetricPoint: aperfSummaryToMetricPoint },
     audit: { ledger: auditLedger, sealer: evidenceSealer },
     monitorStatus,
+    governance: { policyEngine },
     pluginRegistry
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.6",
+  "version": "2.7.7",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",