sdlc-agent-4-enterprise-server 1.38.0 → 1.42.0

package/.code-intel/database.example.json

@@ -0,0 +1,27 @@
+{
+  "activeEngine": "sqlite",
+  "engines": {
+    "sqlite": { "dbPath": "index.db", "active": true },
+    "postgresql": {
+      "host": "<PG_HOST>",
+      "port": 5432,
+      "username": "<PG_USER>",
+      "password": "<PG_PASSWORD>",
+      "database": "<PG_DATABASE>",
+      "ssl": false,
+      "active": false,
+      "pool": { "min": 2, "max": 10 }
+    },
+    "mysql": {
+      "host": "<MYSQL_HOST>",
+      "port": 3306,
+      "username": "<MYSQL_USER>",
+      "password": "<MYSQL_PASSWORD>",
+      "database": "<MYSQL_DATABASE>",
+      "ssl": false,
+      "active": false,
+      "pool": { "min": 2, "max": 10 }
+    }
+  },
+  "migration": { "lastMigration": null, "backupSqlitePaths": [] }
+}

package/.env.example

@@ -4,6 +4,11 @@
 # --- Server ---
 NODE_ENV=development
 PORT=48721
+# Per-IP rate limit (requests per minute). Defaults: 6000 in production, 10000 otherwise.
+# Raise this when many clients share one egress IP (proxy/NAT) behind the remote server.
+RATE_LIMIT_MAX_RPM=6000
+# Set to 'true' when behind a reverse proxy so x-forwarded-for is used for the client IP.
+TRUST_PROXY=false
 
 # --- Database ---
 DATABASE_ADAPTER=postgresql
@@ -34,3 +39,36 @@ API_KEY_REQUIRED=false
 # --- Logging ---
 LOG_LEVEL=info
 LOG_FORMAT=pretty
+
+# =============================================================================
+# SA4E-241 — Incremental Checksum Indexing (env template — placeholders only)
+# =============================================================================
+
+# --- Auth / tenant isolation (SEC-01) ---
+# When true, /pega/* requires identity (X-Project-Id header or JWT `pid` claim).
+# projectId is derived from the authenticated identity — body.projectId is only
+# used to cross-check (mismatch -> 403). NEVER a hardcoded default.
+CODE_INTEL_REQUIRE_AUTH=false
+# JWT signing/verification secret. Set a strong random value in real envs.
+# Leave EMPTY here — do NOT commit a real secret. Use a secret manager in prod.
+KB_TOKEN_SECRET=
+
+# --- Pega credentials (SEC-03) — DO NOT hardcode; DO NOT commit real values ---
+# Credentials must be provided by the extension via VS Code SecretStorage and
+# forwarded per-request (authHeader). These template keys exist only for local
+# manual testing. The leaked pair SSA@TGB / pega123! MUST be rotated and is
+# blocked by scripts/check-secrets.sh — use your own operator id/password here.
+PEGA_ENDPOINT=http://localhost:8080/prweb
+PEGA_USERNAME=<your-pega-operator-id>
+PEGA_PASSWORD=<your-pega-password>
+
+# --- Checksum download / zip-bomb guards (SEC-05) ---
+# Trần tài nguyên cho resumable download + ZIP extraction (chống DoS/zip-bomb).
+CHECKSUM_MAX_TOTAL_SIZE=209715200        # 200 MB — trần tổng bytes tải về
+CHECKSUM_MAX_CHUNKS=4096                  # trần số chunk (chống loop vô hạn)
+CHECKSUM_MAX_UNCOMPRESSED_SIZE=524288000  # 500 MB — trần tổng bytes sau giải nén
+CHECKSUM_MAX_ZIP_ENTRIES=50000            # trần số entry trong ZIP
+
+# --- Bulk-check limits (SEC-04) ---
+# Server-side cap on checksums per bulk-check request (client batches <= 1000).
+BULK_CHECK_MAX_CHECKSUMS=5000

package/.lintstagedrc.json

@@ -5,5 +5,8 @@
   ],
   "src/**/*.{ts,test.ts}": [
     "vitest related --run"
+  ],
+  "backend/src/**/*.ts": [
+    "bash -c 'bash \"$(git rev-parse --show-toplevel)/scripts/check-line-count.sh\" --staged'"
   ]
 }

package/Dockerfile

@@ -1,6 +1,6 @@
 # SA4E-44 Backend Dockerfile
-# Node.js 20 + Hono backend for Code Intelligence MCP Server
-FROM node:20-alpine AS base
+# Node.js 22 + Hono backend for Code Intelligence MCP Server
+FROM node:22-alpine AS base
 
 WORKDIR /app
 
@@ -21,7 +21,7 @@ COPY src/ ./src/
 RUN npm run build
 
 # --- Production stage ---
-FROM node:20-alpine AS production
+FROM node:22-alpine AS production
 
 WORKDIR /app
 
@@ -49,3 +49,41 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD wget --no-verbose --tries=1 --spider http://localhost:48721/health || exit 1
 
 CMD ["node", "dist/index.js"]
+
+# -----------------------------------------------------------------------------
+# Development stage — hot reload (tsx watch) for local dev. Non-root user.
+# Build: docker compose -f docker-compose.yml -f docker-compose.dev.yml up
+# -----------------------------------------------------------------------------
+FROM base AS development
+WORKDIR /app
+ENV NODE_ENV=development
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY tsconfig.json ./
+COPY src/ ./src/
+RUN addgroup -g 1001 -S sa4e && \
+    adduser -S sa4e -u 1001 -G sa4e && \
+    chown -R sa4e:sa4e /app
+USER sa4e
+EXPOSE 48721
+CMD ["npx", "tsx", "watch", "--ignore", ".code-intel/**", "src/index.ts"]
+
+# -----------------------------------------------------------------------------
+# Test stage — runs the vitest unit suite inside the container (non-root).
+# Build: docker build --target test -t sa4e-backend-test .
+# Run:   docker run --rm sa4e-backend-test
+# -----------------------------------------------------------------------------
+FROM base AS test
+WORKDIR /app
+ENV NODE_ENV=test
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY tsconfig.json ./
+COPY src/ ./src/
+COPY tests/ ./tests/
+COPY .env.test ./
+RUN addgroup -g 1001 -S sa4e && \
+    adduser -S sa4e -u 1001 -G sa4e && \
+    chown -R sa4e:sa4e /app
+USER sa4e
+CMD ["npx", "vitest", "run"]

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-1.38.0-blue?style=for-the-badge" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.42.0-blue?style=for-the-badge" alt="Version">
   <img src="https://img.shields.io/badge/tools-66+-teal?style=for-the-badge" alt="Tools">
   <img src="https://img.shields.io/badge/node-%3E%3D18-green?style=for-the-badge" alt="Node">
 </p>
@@ -38,7 +38,7 @@ Server starts at **http://localhost:48721**. Verify it's running:
 
 ```bash
 curl http://localhost:48721/health
-# → {"status":"healthy","version":"1.19.1","uptime":5,"tools_loaded":52}
+# → {"status":"healthy","version":"1.42.0","uptime":5,"tools_loaded":52}
 ```
 
 ### Development Mode (auto-reload)
@@ -233,6 +233,7 @@ The embedding model is expected at `.code-intel/models/model.onnx`. Download it:
 
 | Version | Date | Ticket | Changes |
 |---------|------|--------|---------|
+| 1.42.0 | 2026-09-08 | SA4E-301 | Multi-language tree-sitter parsers (C/C++/C#/PHP/Ruby/Scala/Swift/Kotlin) via shared GenericTreeSitterParser + regex fallback; symbol-kind fixes (struct/enum naming, method promotion, variable/property/constant separation, dedupe). Salesforce indexing (Apex/LWC/Aura/Visualforce/meta) with grammars copied to dist. KB Graph edges rebuilt from `relationships` (MembershipEdgeStrategy CONTAINS + FileContainsSymbolStrategy + inherits/implements resolve-by-name); auto-heal backfill (ensure-sa4e-301), unused edge tables dropped (303), unique index (302). Enrichment dedup (single CodeEnrichmentTaskCreator + PENDING guard, orphan task cleanup 300). Continuous budget-driven KB Graph LOD renderer. Node.js 22 LTS. |
 | 1.38.0 | 2026-08-25 | SA4E-214 | Extension-driven schema creation for Pega rule types. Dual-strategy harness analysis (HarnessParser + LlmSectionExtractor fallback for stream-rendered harnesses), new `/api/v1/pega/schema/{analyze,store,find,update}` endpoints, schema-guided code enrichment. Fixed: TaskWorker delegates CODE_ENRICHMENT to CodeEnrichmentHandler (Pega flow summary/pseudo_code), enrichment percent Math.floor, admin static vendor asset MIME type. Backend 2634 tests ✓. |
 | 1.37.2 | 2026-08-24 | — | Proxy bug fix: global-fetch-patch defensive fallback for curl/powershell mode, cookie jar persistence, followRedirects, workspace-scoped config, PowerShell CLM compat, pwsh binary. SA4E-204/205/206 parallel orchestration docs. |
 | 1.37.0 | 2026-08-24 | SA4E-193 | Config Commands — 4 slash commands (/create-new-agent, hook, steering, skill) with ValidationGate schema enforcement (closes GAP-01, fixes D-1..D-7), offline-safe template fallback. Consolidated release carrying SA4E-190 content. Ext tests 1621 ✓ · Backend 2621 ✓ |

package/dist/admin/db/core.d.ts

@@ -31,7 +31,7 @@ export declare function initAdapters(): Promise<void>;
 /** Reset cached DB instance and adapter (used after DB switch/migration) */
 export declare function resetAdminDb(): void;
 /**
- * Get the raw better-sqlite3 Database instance.
+ * Get the raw DB instance.
  * @deprecated Use getDbAdapter() for new code. Kept for backward compat with tests.
  */
-export declare function getAdminDb(): import('better-sqlite3').Database;
+export declare function getAdminDb(): any;

package/dist/admin/db/core.js

@@ -30,6 +30,12 @@ export function getActiveEngine() {
         if (!fs.existsSync(configPath))
             return 'sqlite';
         const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+        // Source of truth: per-engine `active` flag. Fallback to legacy activeEngine.
+        const engines = raw.engines || {};
+        for (const e of ['postgresql', 'mysql', 'sqlite']) {
+            if (engines[e] && engines[e].active === true)
+                return e;
+        }
         return raw.activeEngine || 'sqlite';
     }
     catch {
@@ -43,10 +49,18 @@ export function getActiveDbConfig() {
         if (!fs.existsSync(configPath))
             return { engine: 'sqlite', dbPath: DB_PATH };
         const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-        if (raw.activeEngine === 'sqlite' || !raw.activeEngine) {
+        const engines = raw.engines || {};
+        let engine = raw.activeEngine;
+        for (const e of ['postgresql', 'mysql', 'sqlite']) {
+            if (engines[e] && engines[e].active === true) {
+                engine = e;
+                break;
+            }
+        }
+        if (engine === 'sqlite' || !engine) {
             return { engine: 'sqlite', dbPath: DB_PATH };
         }
-        return { engine: raw.activeEngine, ...raw.engines[raw.activeEngine] };
+        return { engine, ...engines[engine] };
     }
     catch {
         return { engine: 'sqlite', dbPath: DB_PATH };
@@ -109,6 +123,14 @@ export async function initAdapters() {
     const adapter = DatabaseAdapterFactory.create(activeConfig);
     await adapter.connect();
     dbAdapter = adapter;
+    // Initialize schema and seed defaults for PostgreSQL/MySQL
+    try {
+        initSchema(adapter);
+        seedDefaults(adapter);
+    }
+    catch (err) {
+        logger.error({ err }, '[admin] Failed to init schema/seed defaults');
+    }
     logger.info({ engine }, '[admin] DB adapter connected and ready');
 }
 /** Reset cached DB instance and adapter (used after DB switch/migration) */
@@ -120,11 +142,12 @@ export function resetAdminDb() {
     }
 }
 /**
- * Get the raw better-sqlite3 Database instance.
+ * Get the raw DB instance.
  * @deprecated Use getDbAdapter() for new code. Kept for backward compat with tests.
  */
 export function getAdminDb() {
     const adapter = getUnifiedSqliteAdapter();
-    return adapter.getRawDb();
+    // getRawDb removed; return adapter directly for compat
+    return adapter;
 }
 //# sourceMappingURL=core.js.map

package/dist/admin/db/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/admin/db/core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAClE,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAE5D,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,QAAQ,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C;;;;GAIG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,oEAAoE;QACpE,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,mDAAmD;AAEnD,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;YACrD,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxD,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,SAAS,GAAG,OAAO,CAAC;IAEpB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY;IAC1B,SAAS,GAAG,IAAI,CAAC;IACjB,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/admin/db/core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAClE,4DAA4D;AAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAE5D,mFAAmF;AACnF,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,QAAQ,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,QAAQ,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAAC,MAAM,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C;;;;GAIG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,oEAAoE;QACpE,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,mDAAmD;AAEnD,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,SAAS,GAAG,uBAAuB,EAAE,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;YACrD,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxD,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,YAAY,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,SAAS,GAAG,OAAO,CAAC;IAEpB,2DAA2D;IAC3D,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6CAA6C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY;IAC1B,SAAS,GAAG,IAAI,CAAC;IACjB,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,aAAa,CAAC,UAAU,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,uDAAuD;IACvD,OAAO,OAAc,CAAC;AACxB,CAAC"}

package/dist/admin/db/schema.js

@@ -39,6 +39,8 @@ export function seedDefaults(db) {
     if (!groupExists) {
         seedAccessGroups(db);
     }
+    // Ensure admin group has all permissions even after code changes
+    ensureAdminPermissions(db);
     const userExists = db.get('SELECT 1 FROM users WHERE username = ?', ['admin']);
     if (!userExists) {
         seedAdminUser(db);
@@ -46,33 +48,43 @@ export function seedDefaults(db) {
 }
 function seedAccessGroups(db) {
     const now = new Date().toISOString();
-    db.run(`INSERT INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
+    db.run(`INSERT OR IGNORE INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
      VALUES (?, ?, 1, ?, ?)`, ['grp-admin', 'Administrators', now, now]);
     const allPerms = [
         'DASHBOARD_VIEW', 'KB_READ', 'KB_WRITE', 'KB_PROMOTE', 'KB_IMPORT_EXPORT',
         'MCP_ACCESS', 'MCP_MANAGE', 'USER_MANAGE', 'RBAC_MANAGE', 'CONFIG_EDIT',
-        'SEARCH_EXPLORE', 'AUDIT_VIEW', 'GRAPH_VIEW', 'ANALYTICS_VIEW',
+        'SEARCH_EXPLORE', 'AUDIT_VIEW', 'GRAPH_VIEW', 'ANALYTICS_VIEW', 'GRAPH_MAINTAIN',
     ];
     for (const perm of allPerms) {
-        db.run('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-admin', perm, '{}']);
+        db.run('INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-admin', perm, '{}']);
     }
-    db.run(`INSERT INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
+    db.run(`INSERT OR IGNORE INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
      VALUES (?, ?, 0, ?, ?)`, ['grp-dev', 'Developers', now, now]);
     const devPerms = ['DASHBOARD_VIEW', 'KB_READ', 'KB_WRITE', 'MCP_ACCESS', 'SEARCH_EXPLORE', 'GRAPH_VIEW', 'ANALYTICS_VIEW'];
     for (const perm of devPerms) {
-        db.run('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-dev', perm, '{}']);
+        db.run('INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-dev', perm, '{}']);
     }
-    db.run(`INSERT INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
+    db.run(`INSERT OR IGNORE INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
      VALUES (?, ?, 0, ?, ?)`, ['grp-viewer', 'Viewers', now, now]);
     const viewerPerms = ['DASHBOARD_VIEW', 'KB_READ', 'SEARCH_EXPLORE', 'GRAPH_VIEW', 'ANALYTICS_VIEW'];
     for (const perm of viewerPerms) {
-        db.run('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-viewer', perm, '{}']);
+        db.run('INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-viewer', perm, '{}']);
     }
-    db.run(`INSERT INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
+    db.run(`INSERT OR IGNORE INTO access_groups (access_group_id, access_group_name, is_system_group, created_at, updated_at)
      VALUES (?, ?, 0, ?, ?)`, ['grp-mcp-ops', 'MCP Operators', now, now]);
     const mcpPerms = ['DASHBOARD_VIEW', 'MCP_ACCESS', 'MCP_MANAGE'];
     for (const perm of mcpPerms) {
-        db.run('INSERT INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-mcp-ops', perm, '{}']);
+        db.run('INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-mcp-ops', perm, '{}']);
+    }
+}
+function ensureAdminPermissions(db) {
+    const allPerms = [
+        'DASHBOARD_VIEW', 'KB_READ', 'KB_WRITE', 'KB_PROMOTE', 'KB_IMPORT_EXPORT',
+        'MCP_ACCESS', 'MCP_MANAGE', 'USER_MANAGE', 'RBAC_MANAGE', 'CONFIG_EDIT',
+        'SEARCH_EXPLORE', 'AUDIT_VIEW', 'GRAPH_VIEW', 'ANALYTICS_VIEW', 'GRAPH_MAINTAIN',
+    ];
+    for (const perm of allPerms) {
+        db.run('INSERT OR IGNORE INTO group_permissions (access_group_id, permission_id, role_data) VALUES (?, ?, ?)', ['grp-admin', perm, '{}']);
     }
 }
 function seedAdminUser(db) {

package/dist/admin/db/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/admin/db/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,EAAuB;IAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE1B,uEAAuE;IACvE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5F,EAAE,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAEzF,4DAA4D;IAC5D,EAAE,CAAC,IAAI,CAAC;;;;;;;;GAQP,CAAC,CAAC;IAEH,2DAA2D;IAC3D,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AAC9F,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,EAAuB;IAClD,MAAM,WAAW,GAAG,EAAE,CAAC,GAAG,CACxB,uDAAuD,EAAE,CAAC,WAAW,CAAC,CACvE,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,GAAG,CACvB,wCAAwC,EAAE,CAAC,OAAO,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,aAAa,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAuB;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1C,CAAC;IAEF,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;QACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;QACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB;KAC/D,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,4FAA4F,EAC5F,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CACpC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC3H,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,4FAA4F,EAC5F,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CACpC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CACJ,4FAA4F,EAC5F,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAC3B,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,4FAA4F,EAC5F,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAuB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACvD,MAAM,eAAe,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,IAAI,EAAE;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3C,EAAE,CAAC,GAAG,CACJ;sDACkD,EAClD,CAAC,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAC1D,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAClE,0DAA0D;YAC1D,kCAAkC,eAAe,IAAI;YACrD,qEAAqE;YACrE,8CAA8C;YAC9C,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsGxB,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/admin/db/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,EAAuB;IAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE1B,uEAAuE;IACvE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC5F,EAAE,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAEzF,4DAA4D;IAC5D,EAAE,CAAC,IAAI,CAAC;;;;;;;;GAQP,CAAC,CAAC;IAEH,2DAA2D;IAC3D,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AAC9F,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,EAAuB;IAClD,MAAM,WAAW,GAAG,EAAE,CAAC,GAAG,CACxB,uDAAuD,EAAE,CAAC,WAAW,CAAC,CACvE,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,iEAAiE;IACjE,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE3B,MAAM,UAAU,GAAG,EAAE,CAAC,GAAG,CACvB,wCAAwC,EAAE,CAAC,OAAO,CAAC,CACpD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,aAAa,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAuB;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;QACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;QACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;KACjF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,sGAAsG,EACtG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CACpC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC3H,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,sGAAsG,EACtG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CACpC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CACJ,sGAAsG,EACtG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAC3B,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,GAAG,CACJ;4BACwB,EACxB,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,sGAAsG,EACtG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,EAAuB;IACrD,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB;QACzE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;QACvE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;KACjF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,sGAAsG,EACtG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAuB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACvD,MAAM,eAAe,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,IAAI,EAAE;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3C,EAAE,CAAC,GAAG,CACJ;sDACkD,EAClD,CAAC,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAC1D,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kEAAkE;YAClE,0DAA0D;YAC1D,kCAAkC,eAAe,IAAI;YACrD,qEAAqE;YACrE,8CAA8C;YAC9C,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsGxB,CAAC"}

package/dist/admin/types/rbac.types.d.ts

@@ -31,7 +31,7 @@ export interface Permission {
     description?: string;
     roleDataSchema: object;
 }
-export type PermissionId = 'DASHBOARD_VIEW' | 'KB_READ' | 'KB_WRITE' | 'KB_PROMOTE' | 'KB_IMPORT_EXPORT' | 'MCP_ACCESS' | 'MCP_MANAGE' | 'USER_MANAGE' | 'RBAC_MANAGE' | 'CONFIG_EDIT' | 'SEARCH_EXPLORE' | 'AUDIT_VIEW' | 'GRAPH_VIEW' | 'ANALYTICS_VIEW';
+export type PermissionId = 'DASHBOARD_VIEW' | 'KB_READ' | 'KB_WRITE' | 'KB_PROMOTE' | 'KB_IMPORT_EXPORT' | 'MCP_ACCESS' | 'MCP_MANAGE' | 'USER_MANAGE' | 'RBAC_MANAGE' | 'CONFIG_EDIT' | 'SEARCH_EXPLORE' | 'AUDIT_VIEW' | 'GRAPH_VIEW' | 'ANALYTICS_VIEW' | 'GRAPH_MAINTAIN';
 export interface Session {
     sessionId: string;
     userId: string;

package/dist/config/SandboxConfig.d.ts

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+/**
+ * SA4E-6 — Sandbox module configuration schema.
+ * Loaded as `config.sandbox` from the unified backend config (see config/index.ts).
+ * All values have safe defaults; do NOT hardcode these in executor code — read from here.
+ */
+export declare const DEFAULT_MOUNT_EXCLUDE_PATTERNS: string[];
+export declare const DEFAULT_SANDBOX_RESOURCES: {
+    readonly memory: "512m";
+    readonly cpu: "1.0";
+    readonly disk: "1g";
+    readonly pidsLimit: 100;
+};
+/**
+ * Resolve the default sandbox execution mode for the current host at runtime.
+ *
+ * Full container isolation (cgroup memory/pid limits + `NetworkMode: 'none'`
+ * enforcement) is only reliable on a native Linux Docker Engine. Docker Desktop for
+ * Windows/macOS runs containers inside a WSL2/LinuxKit VM that ignores
+ * `NetworkMode: 'none'` at the network layer and enforces memory limits at the VM
+ * kernel layer, so those isolation guarantees do not hold there.
+ *
+ * Resolution rule (read `process.platform` + env var at runtime — do NOT hardcode):
+ *   - Linux host                    → `docker`
+ *   - Non-Linux host (Win/macOS)    → `local`, UNLESS `SANDBOX_FULL_ISOLATION=true`
+ *                                     is set (then `docker`)
+ *
+ * This is invoked lazily via zod's function-default, so the platform/env are read at
+ * parse time rather than import time.
+ */
+export declare function resolveDefaultSandboxMode(): 'docker' | 'local';
+export declare const SandboxConfigSchema: z.ZodObject<{
+    defaultMode: z.ZodDefault<z.ZodEnum<["docker", "local"]>>;
+    fallbackToLocal: z.ZodDefault<z.ZodBoolean>;
+    maxSessions: z.ZodDefault<z.ZodNumber>;
+    defaultTtl: z.ZodDefault<z.ZodNumber>;
+    defaultImage: z.ZodDefault<z.ZodString>;
+    reaperIntervalMs: z.ZodDefault<z.ZodNumber>;
+    maxOutputBytes: z.ZodDefault<z.ZodNumber>;
+    commandTimeoutDefault: z.ZodDefault<z.ZodNumber>;
+    commandTimeoutMax: z.ZodDefault<z.ZodNumber>;
+    mountExcludePatterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    defaultResources: z.ZodDefault<z.ZodObject<{
+        memory: z.ZodDefault<z.ZodString>;
+        cpu: z.ZodDefault<z.ZodString>;
+        disk: z.ZodDefault<z.ZodString>;
+        pidsLimit: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        memory: string;
+        cpu: string;
+        disk: string;
+        pidsLimit: number;
+    }, {
+        memory?: string | undefined;
+        cpu?: string | undefined;
+        disk?: string | undefined;
+        pidsLimit?: number | undefined;
+    }>>;
+    dockerSocket: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    defaultMode: "docker" | "local";
+    fallbackToLocal: boolean;
+    maxSessions: number;
+    defaultTtl: number;
+    defaultImage: string;
+    reaperIntervalMs: number;
+    maxOutputBytes: number;
+    commandTimeoutDefault: number;
+    commandTimeoutMax: number;
+    mountExcludePatterns: string[];
+    defaultResources: {
+        memory: string;
+        cpu: string;
+        disk: string;
+        pidsLimit: number;
+    };
+    dockerSocket?: string | undefined;
+}, {
+    defaultMode?: "docker" | "local" | undefined;
+    fallbackToLocal?: boolean | undefined;
+    maxSessions?: number | undefined;
+    defaultTtl?: number | undefined;
+    defaultImage?: string | undefined;
+    reaperIntervalMs?: number | undefined;
+    maxOutputBytes?: number | undefined;
+    commandTimeoutDefault?: number | undefined;
+    commandTimeoutMax?: number | undefined;
+    mountExcludePatterns?: string[] | undefined;
+    defaultResources?: {
+        memory?: string | undefined;
+        cpu?: string | undefined;
+        disk?: string | undefined;
+        pidsLimit?: number | undefined;
+    } | undefined;
+    dockerSocket?: string | undefined;
+}>;
+export type SandboxConfig = z.infer<typeof SandboxConfigSchema>;

package/dist/config/SandboxConfig.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+/**
+ * SA4E-6 — Sandbox module configuration schema.
+ * Loaded as `config.sandbox` from the unified backend config (see config/index.ts).
+ * All values have safe defaults; do NOT hardcode these in executor code — read from here.
+ */
+export const DEFAULT_MOUNT_EXCLUDE_PATTERNS = [
+    '.env',
+    '.env.*',
+    '*.pem',
+    '*.key',
+    '*.p12',
+    '.git/credentials',
+    '.ssh/',
+    '.aws/',
+    '.docker/config.json',
+    'node_modules/.cache/*/secrets*',
+];
+export const DEFAULT_SANDBOX_RESOURCES = {
+    memory: '512m',
+    cpu: '1.0',
+    disk: '1g',
+    pidsLimit: 100,
+};
+/**
+ * Resolve the default sandbox execution mode for the current host at runtime.
+ *
+ * Full container isolation (cgroup memory/pid limits + `NetworkMode: 'none'`
+ * enforcement) is only reliable on a native Linux Docker Engine. Docker Desktop for
+ * Windows/macOS runs containers inside a WSL2/LinuxKit VM that ignores
+ * `NetworkMode: 'none'` at the network layer and enforces memory limits at the VM
+ * kernel layer, so those isolation guarantees do not hold there.
+ *
+ * Resolution rule (read `process.platform` + env var at runtime — do NOT hardcode):
+ *   - Linux host                    → `docker`
+ *   - Non-Linux host (Win/macOS)    → `local`, UNLESS `SANDBOX_FULL_ISOLATION=true`
+ *                                     is set (then `docker`)
+ *
+ * This is invoked lazily via zod's function-default, so the platform/env are read at
+ * parse time rather than import time.
+ */
+export function resolveDefaultSandboxMode() {
+    const fullIsolation = process.env.SANDBOX_FULL_ISOLATION === 'true' || process.platform === 'linux';
+    return fullIsolation ? 'docker' : 'local';
+}
+export const SandboxConfigSchema = z.object({
+    defaultMode: z.enum(['docker', 'local']).default(resolveDefaultSandboxMode),
+    fallbackToLocal: z.boolean().default(true),
+    maxSessions: z.number().int().positive().default(5),
+    defaultTtl: z.number().int().positive().default(1800),
+    defaultImage: z.string().default('node:20'),
+    reaperIntervalMs: z.number().int().positive().default(60000),
+    maxOutputBytes: z.number().int().positive().default(1048576),
+    commandTimeoutDefault: z.number().int().positive().default(300),
+    commandTimeoutMax: z.number().int().positive().default(600),
+    mountExcludePatterns: z.array(z.string()).default(DEFAULT_MOUNT_EXCLUDE_PATTERNS),
+    defaultResources: z
+        .object({
+        memory: z.string().default('512m'),
+        cpu: z.string().default('1.0'),
+        disk: z.string().default('1g'),
+        pidsLimit: z.number().int().positive().default(100),
+    })
+        .default(DEFAULT_SANDBOX_RESOURCES),
+    dockerSocket: z.string().optional(),
+});
+//# sourceMappingURL=SandboxConfig.js.map

package/dist/config/SandboxConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxConfig.js","sourceRoot":"","sources":["../../src/config/SandboxConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,kBAAkB;IAClB,OAAO;IACP,OAAO;IACP,qBAAqB;IACrB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,GAAG;CACN,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAChF,OAAO,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC3E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3D,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC;IACjF,gBAAgB,EAAE,CAAC;SAChB,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;KACpD,CAAC;SACD,OAAO,CAAC,yBAAyB,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC"}