shieldcortex 4.12.11 → 4.12.13

package/dist/api/routes/admin.js

@@ -4,10 +4,88 @@ import { queryAgentOperations, queryAgentRegistry, queryAgentTimeline, queryAudi
 import { approveQuarantineItem, approveQuarantineItems, rejectQuarantineItem, rejectQuarantineItems, } from '../../defence/quarantine/review.js';
 import { getLicense, getLicenseTier, getTrialStatus, activateLicense, deactivateLicense } from '../../license/store.js';
 import { listFeatures } from '../../license/gate.js';
+import { isFeatureEnabled } from '../../license/gate.js';
 import { validateOnceNow } from '../../license/validate.js';
 import { existsSync, readFileSync, readdirSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+function parseAnnotationJson(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return null;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function readTailLines(path, count) {
+    try {
+        if (!existsSync(path))
+            return [];
+        return readFileSync(path, 'utf-8').trim().split('\n').filter(Boolean).slice(-count);
+    }
+    catch {
+        return [];
+    }
+}
+function isModelCacheReady(cacheDir) {
+    try {
+        return existsSync(cacheDir) && readdirSync(cacheDir).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+const LOCAL_AI_SUBJECT_KINDS = new Set([
+    'memory',
+    'memory_file',
+    'xray_finding',
+    'quarantine_item',
+    'audit_event',
+    'generic',
+]);
+function cleanString(value, max) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed.slice(0, max) : undefined;
+}
+function cleanStringArray(value, maxItems, maxLength) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value
+        .map((item) => cleanString(item, maxLength))
+        .filter((item) => Boolean(item))
+        .slice(0, maxItems);
+}
+function cleanMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).slice(0, 40);
+    return Object.fromEntries(entries);
+}
+function parseLocalAiSubject(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const body = value;
+    const kind = body.kind;
+    const title = cleanString(body.title, 240);
+    const content = cleanString(body.content, 20_000);
+    if (typeof kind !== 'string' || !LOCAL_AI_SUBJECT_KINDS.has(kind))
+        return null;
+    if (!title || !content)
+        return null;
+    return {
+        kind: kind,
+        title,
+        content,
+        project: cleanString(body.project, 160) ?? null,
+        source: cleanString(body.source, 240) ?? null,
+        signals: cleanStringArray(body.signals, 20, 120),
+        metadata: cleanMetadata(body.metadata),
+    };
+}
 export function registerAdminRoutes(app, deps) {
     const { brainWorker, requireNotLocked, requireProFeature, requireIronDomeAction } = deps;
     app.get('/api/v1/audit', (req, res) => {
@@ -175,27 +253,236 @@ export function registerAdminRoutes(app, deps) {
     app.get('/api/v1/quarantine', (req, res) => {
         try {
             const db = getDatabase();
-            const status = req.query.status ?? 'pending';
+            const status = typeof req.query.status === 'string' && req.query.status.trim()
+                ? req.query.status.trim()
+                : 'pending';
             const limit = parseInt(req.query.limit, 10) || 50;
-            const project = req.query.project;
-            const sql = project
-                ? 'SELECT * FROM quarantine WHERE status = ? AND project = ? ORDER BY created_at DESC LIMIT ?'
-                : 'SELECT * FROM quarantine WHERE status = ? ORDER BY created_at DESC LIMIT ?';
-            const params = project ? [status, project, limit] : [status, limit];
-            const rows = db.prepare(sql).all(...params);
+            const project = typeof req.query.project === 'string' && req.query.project.trim()
+                ? req.query.project.trim()
+                : undefined;
+            const sourceType = typeof req.query.sourceType === 'string' && req.query.sourceType.trim()
+                ? req.query.sourceType.trim()
+                : undefined;
+            const clauses = ['status = ?'];
+            const params = [status];
+            if (project) {
+                clauses.push('project = ?');
+                params.push(project);
+            }
+            if (sourceType) {
+                clauses.push('source_type = ?');
+                params.push(sourceType);
+            }
+            const whereSql = clauses.join(' AND ');
+            const rows = db.prepare(`SELECT * FROM quarantine WHERE ${whereSql} ORDER BY created_at DESC LIMIT ?`)
+                .all(...params, limit);
+            const countSql = `SELECT COUNT(*) as count FROM quarantine WHERE ${whereSql}`;
+            const countParams = params;
+            const countRow = db.prepare(countSql).get(...countParams);
+            const annotationByItem = new Map();
+            const ids = rows
+                .map((row) => Number(row.id))
+                .filter((id) => Number.isInteger(id) && id > 0);
+            if (ids.length > 0) {
+                const placeholders = ids.map(() => '?').join(',');
+                const annotationRows = db.prepare(`
+          SELECT qa.item_id, qa.annotation_json
+          FROM quarantine_annotations qa
+          JOIN (
+            SELECT item_id, MAX(generated_at) AS generated_at
+            FROM quarantine_annotations
+            WHERE item_id IN (${placeholders})
+            GROUP BY item_id
+          ) latest
+            ON latest.item_id = qa.item_id
+           AND latest.generated_at = qa.generated_at
+        `).all(...ids);
+                for (const annotationRow of annotationRows) {
+                    annotationByItem.set(annotationRow.item_id, parseAnnotationJson(annotationRow.annotation_json));
+                }
+            }
             res.json({
                 items: rows.map((row) => ({
                     ...row,
                     title: row.original_title,
                     content: row.original_content,
+                    annotation: annotationByItem.get(Number(row.id)) ?? null,
                 })),
-                total: rows.length,
+                total: countRow?.count ?? rows.length,
             });
         }
         catch (error) {
             res.status(500).json({ error: error.message });
         }
     });
+    app.get('/api/v1/review-copilot/status', async (_req, res) => {
+        try {
+            const { getReviewCopilotConfig } = await import('../../cloud/config.js');
+            const config = getReviewCopilotConfig();
+            const cacheReady = isModelCacheReady(config.modelCacheDir);
+            const recentTelemetry = readTailLines(config.telemetryPath, 10)
+                .map((line) => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter(Boolean);
+            res.json({
+                enabled: config.enabled,
+                featureEnabled: isFeatureEnabled('local_ai_explainer'),
+                modelId: config.modelId,
+                modelCacheDir: config.modelCacheDir,
+                modelCached: cacheReady,
+                telemetryPath: config.telemetryPath,
+                inferenceTimeoutMs: config.inferenceTimeoutMs,
+                workerHeapMB: config.workerHeapMB,
+                recentTelemetry,
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.get('/api/v1/local-ai/status', async (_req, res) => {
+        try {
+            const { getReviewCopilotConfig } = await import('../../cloud/config.js');
+            const config = getReviewCopilotConfig();
+            const cacheReady = isModelCacheReady(config.modelCacheDir);
+            const recentTelemetry = readTailLines(config.telemetryPath, 10)
+                .map((line) => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter(Boolean);
+            res.json({
+                enabled: config.enabled,
+                featureEnabled: isFeatureEnabled('local_ai_explainer'),
+                modelId: config.modelId,
+                modelCacheDir: config.modelCacheDir,
+                modelCached: cacheReady,
+                telemetryPath: config.telemetryPath,
+                inferenceTimeoutMs: config.inferenceTimeoutMs,
+                workerHeapMB: config.workerHeapMB,
+                recentTelemetry,
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.post('/api/v1/local-ai/explain', requireNotLocked, requireProFeature('local_ai_explainer'), async (req, res) => {
+        try {
+            const subject = parseLocalAiSubject(req.body);
+            if (!subject) {
+                return res.status(400).json({ error: 'Invalid explanation subject' });
+            }
+            const { getReviewCopilotConfig } = await import('../../cloud/config.js');
+            const config = getReviewCopilotConfig();
+            if (!config.enabled) {
+                return res.status(409).json({ error: 'Local AI Explainer is disabled', code: 'LOCAL_AI_EXPLAINER_DISABLED' });
+            }
+            if (!isModelCacheReady(config.modelCacheDir)) {
+                return res.status(409).json({ error: 'Local AI Explainer model is not cached', code: 'LOCAL_AI_EXPLAINER_MODEL_NOT_CACHED' });
+            }
+            const { explainLocalAiSubject } = await import('../../defence/explainer/index.js');
+            const explanation = await explainLocalAiSubject(subject);
+            res.json({ success: true, explanation });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.post('/api/v1/memory-files/scan', requireNotLocked, requireProFeature('memory_file_scan'), async (_req, res) => {
+        try {
+            const { queueMemoryFileScanFindings, scanMemoryFilesDetailed } = await import('../../audit/memory-scanner.js');
+            const result = scanMemoryFilesDetailed();
+            const quarantine = queueMemoryFileScanFindings(result);
+            res.json({
+                success: true,
+                scannedAt: result.scannedAt,
+                summary: result.summary,
+                quarantine,
+                files: result.files,
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.get('/api/v1/quarantine/:id/annotation', (req, res) => {
+        try {
+            const id = parseInt(req.params.id, 10);
+            if (!Number.isInteger(id) || id <= 0) {
+                return res.status(400).json({ error: 'Invalid quarantine id' });
+            }
+            const db = getDatabase();
+            const row = db.prepare(`
+        SELECT annotation_json
+        FROM quarantine_annotations
+        WHERE item_id = ?
+        ORDER BY generated_at DESC
+        LIMIT 1
+      `).get(id);
+            res.json({ annotation: row ? parseAnnotationJson(row.annotation_json) : null });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.post('/api/v1/quarantine/:id/annotate', requireNotLocked, requireProFeature('local_ai_explainer'), async (req, res) => {
+        try {
+            const id = parseInt(req.params.id, 10);
+            if (!Number.isInteger(id) || id <= 0) {
+                return res.status(400).json({ error: 'Invalid quarantine id' });
+            }
+            const { getReviewCopilotConfig } = await import('../../cloud/config.js');
+            const config = getReviewCopilotConfig();
+            if (!config.enabled) {
+                return res.status(409).json({ error: 'Local AI Explainer is disabled', code: 'LOCAL_AI_EXPLAINER_DISABLED' });
+            }
+            if (!isModelCacheReady(config.modelCacheDir)) {
+                return res.status(409).json({ error: 'Local AI Explainer model is not cached', code: 'LOCAL_AI_EXPLAINER_MODEL_NOT_CACHED' });
+            }
+            const { annotateQuarantineItem } = await import('../../defence/judge/annotate.js');
+            const annotation = await annotateQuarantineItem(id);
+            res.json({ success: Boolean(annotation), annotation });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.post('/api/v1/quarantine/annotate-pending', requireNotLocked, requireProFeature('local_ai_explainer'), async (req, res) => {
+        try {
+            const limit = Number(req.body?.limit ?? 25);
+            if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+                return res.status(400).json({ error: 'limit must be an integer between 1 and 100' });
+            }
+            const { getReviewCopilotConfig } = await import('../../cloud/config.js');
+            const config = getReviewCopilotConfig();
+            if (!config.enabled) {
+                return res.status(409).json({ error: 'Local AI Explainer is disabled', code: 'LOCAL_AI_EXPLAINER_DISABLED' });
+            }
+            if (!isModelCacheReady(config.modelCacheDir)) {
+                return res.status(409).json({ error: 'Local AI Explainer model is not cached', code: 'LOCAL_AI_EXPLAINER_MODEL_NOT_CACHED' });
+            }
+            const project = typeof req.body?.project === 'string' && req.body.project.trim()
+                ? req.body.project.trim()
+                : undefined;
+            const { annotatePendingQuarantineItems } = await import('../../defence/judge/annotate.js');
+            const result = await annotatePendingQuarantineItems({ limit, project });
+            res.json({ success: true, ...result });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     app.post('/api/v1/quarantine/:id/approve', requireNotLocked, requireIronDomeAction({
         action: 'modify_records',
         channel: 'dashboard',

package/dist/api/visualization-server.js

@@ -103,6 +103,11 @@ export function startVisualizationServer(dbPath) {
     // Auth middleware: require Bearer token on all requests except public paths
     const publicPaths = ['/api/health', '/api/auth/session-token'];
     app.use((req, res, next) => {
+        // Dashboard pages and static assets must load before the client can fetch
+        // its API session token. Protect API routes, not the Next.js shell.
+        if (!req.path.startsWith('/api/')) {
+            return next();
+        }
         // Allow OPTIONS/HEAD for CORS preflight
         if (['OPTIONS', 'HEAD'].includes(req.method)) {
             return next();

package/dist/audit/index.d.ts

@@ -4,7 +4,8 @@
  * `npx shieldcortex audit` — comprehensive security scanner for
  * AI agent environments.
  */
-export { scanMemories } from './memory-scanner.js';
+export { discoverMemoryFiles, isShieldCortexOwnMemoryPath, queueMemoryFileScanFindings, scanMemories, scanMemoryFilesDetailed, } from './memory-scanner.js';
+export type { DetailedMemoryFileScanResult, DiscoveredMemoryFile, MemoryFileDiscoveryOptions, MemoryFileEvidence, MemoryFileQuarantineQueueItem, MemoryFileQuarantineQueueResult, MemoryFileRisk, MemoryFileScanRecord, MemoryFileScanSummary, } from './memory-scanner.js';
 export { scanMcpConfigs } from './mcp-config-scanner.js';
 export { scanEnvFiles } from './env-scanner.js';
 export { scanRulesFiles } from './rules-file-scanner.js';

package/dist/audit/index.js

@@ -4,7 +4,7 @@
  * `npx shieldcortex audit` — comprehensive security scanner for
  * AI agent environments.
  */
-export { scanMemories } from './memory-scanner.js';
+export { discoverMemoryFiles, isShieldCortexOwnMemoryPath, queueMemoryFileScanFindings, scanMemories, scanMemoryFilesDetailed, } from './memory-scanner.js';
 export { scanMcpConfigs } from './mcp-config-scanner.js';
 export { scanEnvFiles } from './env-scanner.js';
 export { scanRulesFiles } from './rules-file-scanner.js';

package/dist/audit/memory-scanner.d.ts

@@ -7,7 +7,72 @@
  *   - ~/.shieldcortex/ memory database
  *   - Cursor/Windsurf persistent memory locations
  */
-import type { ScannerResult } from './types.js';
+import type { AuditFinding, ScannerResult } from './types.js';
+export declare function isShieldCortexOwnMemoryPath(filePath: string): boolean;
+export type MemoryFileRisk = 'SAFE' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
+export interface MemoryFileEvidence {
+    snippet: string;
+    reason: string;
+}
+export interface DiscoveredMemoryFile {
+    path: string;
+    source: string;
+}
+export interface MemoryFileScanRecord {
+    id: string;
+    path: string;
+    source: string;
+    sizeBytes: number;
+    modifiedAt: string | null;
+    contentExcerpt: string;
+    auditId: number | null;
+    anomalyScore: number;
+    firewallResult: 'ALLOW' | 'QUARANTINE' | 'BLOCK';
+    risk: MemoryFileRisk;
+    reason: string;
+    threatIndicators: string[];
+    evidence: MemoryFileEvidence[];
+    findings: AuditFinding[];
+}
+export interface MemoryFileScanSummary {
+    total: number;
+    safe: number;
+    flagged: number;
+    critical: number;
+    high: number;
+    medium: number;
+}
+export interface DetailedMemoryFileScanResult {
+    scannedAt: string;
+    summary: MemoryFileScanSummary;
+    files: MemoryFileScanRecord[];
+    durationMs: number;
+}
+export interface MemoryFileQuarantineQueueItem {
+    fileId: string;
+    path: string;
+    quarantineId: number | null;
+    status: 'created' | 'updated' | 'skipped_safe' | 'skipped_reviewed';
+}
+export interface MemoryFileQuarantineQueueResult {
+    created: number;
+    updated: number;
+    skippedSafe: number;
+    skippedReviewed: number;
+    items: MemoryFileQuarantineQueueItem[];
+}
+export interface MemoryFileDiscoveryOptions {
+    homeDir?: string;
+    cwd?: string;
+    maxFiles?: number;
+    maxFileSize?: number;
+}
+export declare function queueMemoryFileScanFindings(result: DetailedMemoryFileScanResult): MemoryFileQuarantineQueueResult;
+/**
+ * Find memory-related files across known AI agent locations.
+ */
+export declare function discoverMemoryFiles(options?: MemoryFileDiscoveryOptions): DiscoveredMemoryFile[];
+export declare function scanMemoryFilesDetailed(options?: MemoryFileDiscoveryOptions): DetailedMemoryFileScanResult;
 /**
  * Run the memory scanner.
  */