rterm-backend 2.7.6 → 2.7.8

package/bin/gybackend.js

@@ -382290,6 +382290,184 @@ var MonitorStatusService = class {
   }
 };
 
+// ../../packages/backend/src/services/governance/agtPolicyEngine.ts
+var AgtPolicyEngine = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.agentIdentity = deps.agentIdentity ?? "rterm-agent";
+    this.sponsoringPrincipal = deps.sponsoringPrincipal ?? "unknown";
+  }
+  policy = null;
+  agentIdentity;
+  sponsoringPrincipal;
+  /** Load the policy document. Must be called before evaluate(). */
+  async load() {
+    this.policy = await this.deps.loadPolicy();
+  }
+  /** Evaluate an action against the policy. Returns the decision. */
+  evaluate(action, target) {
+    if (!this.policy) {
+      throw new Error("Policy not loaded. Call load() first.");
+    }
+    const actionLower = action.toLowerCase();
+    const targetLower = (target ?? "").toLowerCase();
+    for (const rule of this.policy.rules) {
+      const actionMatch = this.matchPattern(actionLower, rule.actionPattern.toLowerCase());
+      const targetMatch = !rule.targetPattern || this.matchPattern(targetLower, rule.targetPattern.toLowerCase());
+      if (actionMatch && targetMatch) {
+        return {
+          decision: rule.decision,
+          rule: rule.name,
+          reason: rule.reason ?? `matched rule '${rule.name}'`,
+          policyVersion: this.policy.version,
+          action,
+          target
+        };
+      }
+    }
+    return {
+      decision: this.policy.defaultDecision,
+      rule: "default",
+      reason: `no rule matched, using default '${this.policy.defaultDecision}'`,
+      policyVersion: this.policy.version,
+      action,
+      target
+    };
+  }
+  /** Get the current policy document. */
+  getPolicy() {
+    return this.policy;
+  }
+  /** Get the agent identity. */
+  getAgentIdentity() {
+    return this.agentIdentity;
+  }
+  /** Get the sponsoring principal. */
+  getSponsoringPrincipal() {
+    return this.sponsoringPrincipal;
+  }
+  /** Simple glob-style pattern matching: * matches any suffix. The value matches
+   * if it equals the pattern or starts with the pattern (for action patterns
+   * like "read" to match "read /etc/passwd"). */
+  matchPattern(value, pattern) {
+    if (pattern === "*") return true;
+    if (pattern.endsWith("*")) {
+      return value.startsWith(pattern.slice(0, -1));
+    }
+    return value === pattern || value.startsWith(pattern + " ");
+  }
+};
+function parsePolicyYaml(yaml) {
+  const lines = yaml.split(/\r?\n/);
+  const doc = { name: "", version: "1.0", defaultDecision: "deny", rules: [] };
+  let currentRule = null;
+  for (const line of lines) {
+    const l = line.trim();
+    if (!l || l.startsWith("#")) continue;
+    if (l.startsWith("name:")) {
+      if (currentRule?.name) {
+        doc.rules.push(currentRule);
+        currentRule = null;
+      }
+      doc.name = l.split(":")[1].trim();
+    } else if (l.startsWith("version:")) {
+      doc.version = l.split(":")[1].trim();
+    } else if (l.startsWith("defaultDecision:")) {
+      doc.defaultDecision = l.split(":")[1].trim();
+    } else if (l.startsWith("- name:")) {
+      if (currentRule?.name) doc.rules.push(currentRule);
+      currentRule = { name: l.split(":")[1].trim() };
+    } else if (l.startsWith("actionPattern:") && currentRule) {
+      currentRule.actionPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("targetPattern:") && currentRule) {
+      currentRule.targetPattern = l.split(":")[1].trim();
+    } else if (l.startsWith("decision:") && currentRule) {
+      currentRule.decision = l.split(":")[1].trim();
+    } else if (l.startsWith("reason:") && currentRule) {
+      currentRule.reason = l.split(":").slice(1).join(":").trim();
+    }
+  }
+  if (currentRule?.name) doc.rules.push(currentRule);
+  return doc;
+}
+
+// ../../packages/backend/src/services/review/reviewService.ts
+var ReviewService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.reviewerId = deps.reviewerId ?? "review-model";
+    this.reviewMode = deps.reviewMode ?? "strict";
+  }
+  reviewerId;
+  reviewMode;
+  /** Review an action. Returns the review result. */
+  async review(action) {
+    if (this.reviewMode === "auto-approve" && this.isLowRisk(action)) {
+      return {
+        verdict: "approved",
+        issues: [],
+        confidence: 1,
+        reasoning: "auto-approved (low-risk action)",
+        reviewerId: this.reviewerId,
+        skipped: true
+      };
+    }
+    const prompt = this.buildReviewPrompt(action);
+    const result = await this.deps.runReviewModel(prompt);
+    let verdict = result.verdict;
+    if (this.reviewMode === "advisory" && verdict === "escalate") {
+      verdict = "needs_revision";
+    }
+    return {
+      verdict,
+      issues: result.issues ?? [],
+      confidence: result.confidence ?? 0.5,
+      reasoning: result.reasoning ?? "",
+      reviewerId: this.reviewerId,
+      skipped: false
+    };
+  }
+  /** Check if an action is low-risk (for auto-approve mode). */
+  isLowRisk(action) {
+    const type2 = action.type.toLowerCase();
+    const target = (action.target ?? "").toLowerCase();
+    if (["read", "status", "list", "show", "get", "describe", "check"].some((w) => type2.includes(w))) return true;
+    if (target.includes("dev") || target.includes("staging") || target.includes("test")) return true;
+    return false;
+  }
+  /** Build the review prompt for the review model. */
+  buildReviewPrompt(action) {
+    return `You are a review model. Independently verify the following action for correctness, completeness, safety, compliance, and accuracy.
+
+Action type: ${action.type}
+Target: ${action.target ?? "unknown"}
+Command: ${action.command ?? "none"}
+User request: ${action.userRequest ?? "unknown"}
+
+Evaluate the action on 5 dimensions:
+1. Correctness: Is this the right action for the user's intent?
+2. Completeness: Does this action fully address the user's request?
+3. Safety: Is this action safe (not destructive, not harmful)?
+4. Compliance: Does this action comply with policy?
+5. Accuracy: Is the information in this action accurate?
+
+Return your verdict: approved, needs_revision, or escalate, with issues and reasoning.`;
+  }
+};
+function createSkippedReviewResult() {
+  return {
+    verdict: "approved",
+    issues: [],
+    confidence: 1,
+    reasoning: "review skipped (no reviewModelId specified)",
+    reviewerId: "none",
+    skipped: true
+  };
+}
+function shouldSkipReview(reviewModelId) {
+  return !reviewModelId || reviewModelId.trim() === "";
+}
+
 // ../../packages/backend/src/services/observability.ts
 function createObservability(deps) {
   const log = deps.onLog ?? (() => {
@@ -382369,6 +382547,50 @@ function createObservability(deps) {
   const auditLedger = new AuditLedger({});
   const evidenceSealer = new EvidenceSealer({});
   const monitorStatus = new MonitorStatusService(deps.resourceMonitorService, deps.terminalService);
+  const policyEngine = new AgtPolicyEngine({
+    loadPolicy: async () => {
+      const req = createRequire2(import.meta.url);
+      const fs22 = req("node:fs");
+      const path31 = req("node:path");
+      const policyPath = path31.join(".", "policy.yaml");
+      if (fs22.existsSync(policyPath)) {
+        return parsePolicyYaml(fs22.readFileSync(policyPath, "utf8"));
+      }
+      return {
+        name: "rterm-default",
+        version: "1.0",
+        defaultDecision: "deny",
+        rules: [
+          { name: "allow-read", actionPattern: "read", decision: "allow" },
+          { name: "allow-status", actionPattern: "status", decision: "allow" },
+          { name: "allow-list", actionPattern: "list", decision: "allow" },
+          { name: "deny-delete", actionPattern: "delete", decision: "deny" },
+          { name: "deny-drop", actionPattern: "drop", decision: "deny" },
+          { name: "deny-format", actionPattern: "format", decision: "deny" },
+          { name: "escalate-restart-prod", actionPattern: "restart", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-patch-prod", actionPattern: "patch", targetPattern: "prod-*", decision: "escalate" },
+          { name: "escalate-deploy-prod", actionPattern: "deploy", targetPattern: "prod-*", decision: "escalate" },
+          { name: "allow-restart", actionPattern: "restart", decision: "allow" },
+          { name: "allow-patch", actionPattern: "patch", decision: "allow" },
+          { name: "allow-deploy", actionPattern: "deploy", decision: "allow" }
+        ]
+      };
+    },
+    agentIdentity: `rterm-agent-v${process.env.GYBACKEND_VERSION ?? "2.7.7"}`,
+    sponsoringPrincipal: process.env.USER ?? "unknown"
+  });
+  void policyEngine.load().catch(() => {
+  });
+  const reviewService = new ReviewService({
+    runReviewModel: deps.runReviewModel ?? (async (_prompt) => ({
+      verdict: "approved",
+      issues: [],
+      reasoning: "no review model configured",
+      confidence: 1
+    })),
+    reviewerId: deps.reviewerId ?? "review-model",
+    reviewMode: deps.reviewMode ?? "strict"
+  });
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
   const bundlePluginRoot = new URL("../../plugins/", import.meta.url).pathname;
   const scanRoots = [pluginScanRoot, "./plugins"];
@@ -382442,6 +382664,8 @@ function createObservability(deps) {
     aperf: { service: aperfService, toMetricPoint: aperfSummaryToMetricPoint },
     audit: { ledger: auditLedger, sealer: evidenceSealer },
     monitorStatus,
+    governance: { policyEngine },
+    review: { service: reviewService, shouldSkipReview, createSkippedReviewResult },
     pluginRegistry
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.6",
+  "version": "2.7.8",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",