zeuslock-dlp-cli 0.2.0

package/src/commands/hook.js

@@ -0,0 +1,221 @@
+import { execFile } from "node:child_process";
+import { chmod, mkdir, stat, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { Command } from "commander";
+
+import {
+  analyzeDlpBatch,
+  formatDlpSummary,
+  parseFailOn,
+  summarizeDlpResponses
+} from "../lib/dlp-scan.js";
+
+const execFileAsync = promisify(execFile);
+const BATCH_SIZE = 5;
+const GIT_MAX_BUFFER = 16 * 1024 * 1024;
+
+export function createHookCommand({
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("hook")
+    .description("Install and run Git DLP hooks");
+
+  command.addCommand(createHookInstallCommand({ stdout, env }));
+  command.addCommand(createHookRunCommand({ stdout, env }));
+
+  return command;
+}
+
+function createHookInstallCommand({ stdout, env }) {
+  return new Command("install")
+    .description("Install a Git pre-commit hook that runs ZeusLock DLP scan")
+    .option("--repo <path>", "Git repository path", process.cwd())
+    .option("--fail-on <decision>", "block commit on alert or block", "alert")
+    .option("--force", "replace an existing pre-commit hook")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const failOn = parseFailOn(options.failOn);
+      if (failOn === "never") {
+        throw new Error("--fail-on never is not supported for hook install.");
+      }
+
+      const repoRoot = await gitText(["rev-parse", "--show-toplevel"], options.repo, env);
+      const gitHookPath = await gitText(["rev-parse", "--git-path", "hooks/pre-commit"], repoRoot, env);
+      const hookPath = path.resolve(repoRoot, gitHookPath);
+      const exists = await pathExists(hookPath);
+      if (exists && !options.force) {
+        throw new Error(`Pre-commit hook already exists at ${hookPath}. Re-run with --force to replace it.`);
+      }
+
+      await mkdir(path.dirname(hookPath), { recursive: true });
+      await writeFile(hookPath, buildHookScript(failOn), "utf8");
+      await chmod(hookPath, 0o755);
+
+      const output = {
+        installed: true,
+        repo: repoRoot,
+        hook: hookPath,
+        failOn,
+        replaced: exists
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Installed ZeusLock pre-commit hook at ${hookPath}\n`);
+      stdout.write(`Commit block threshold: ${failOn}\n`);
+    });
+}
+
+function createHookRunCommand({ stdout, env }) {
+  return new Command("run")
+    .description("Run ZeusLock DLP scan against staged Git files")
+    .option("--repo <path>", "Git repository path", process.cwd())
+    .option("--api-key <key>", "organization API key; defaults to saved key or ZEUSLOCK_API_KEY")
+    .option("--fail-on <decision>", "exit nonzero on alert, block, or never", "alert")
+    .option("--user-email <email>", "user email label sent to backend")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const failOn = parseFailOn(options.failOn);
+      const repoRoot = await gitText(["rev-parse", "--show-toplevel"], options.repo, env);
+      const stagedFiles = await listStagedFiles(repoRoot, env);
+
+      if (!stagedFiles.length) {
+        const output = {
+          scanned: { files: 0, text: false },
+          decision: "allow",
+          failed: false,
+          failOn,
+          responses: []
+        };
+        stdout.write(options.json ? `${JSON.stringify(output)}\n` : "No staged files to scan.\n");
+        return;
+      }
+
+      const files = [];
+      for (const file of stagedFiles) {
+        files.push({
+          filename: file,
+          contentType: "application/octet-stream",
+          data: await gitBuffer(["show", `:${file}`], repoRoot, env)
+        });
+      }
+
+      const responses = [];
+      for (const batch of chunk(files, BATCH_SIZE)) {
+        responses.push(await analyzeDlpBatch({
+          files: batch,
+          metadata: {
+            source: "git_pre_commit",
+            platform: "git",
+            hostname: os.hostname(),
+            path: "/git/pre-commit",
+            method: "PRE_COMMIT",
+            userEmail: options.userEmail || null
+          },
+          apiKey: options.apiKey,
+          env
+        }));
+      }
+
+      const summary = summarizeDlpResponses(responses, {
+        failOn,
+        includeSensitive: false
+      });
+      const output = {
+        ...summary,
+        repo: repoRoot,
+        scanned: {
+          files: files.length,
+          text: false
+        }
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+      } else {
+        stdout.write(formatDlpSummary(summary, { scannedFiles: files.length }));
+        if (summary.failed) {
+          stdout.write("Commit blocked by ZeusLock DLP policy.\n");
+        }
+      }
+
+      if (summary.failed) {
+        process.exitCode = 1;
+      }
+    });
+}
+
+function buildHookScript(failOn) {
+  return `#!/bin/sh
+# Generated by ZeusLock CLI. Reinstall with: zeuslock hook install --force
+if ! command -v zeuslock >/dev/null 2>&1; then
+  echo "ZeusLock pre-commit hook failed: zeuslock command not found in PATH" >&2
+  exit 1
+fi
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+exec zeuslock hook run --repo "$REPO_ROOT" --fail-on ${failOn}
+`;
+}
+
+async function listStagedFiles(repoRoot, env) {
+  const output = await gitBuffer([
+    "diff",
+    "--cached",
+    "--name-only",
+    "--diff-filter=ACMR",
+    "-z"
+  ], repoRoot, env);
+  return output
+    .toString("utf8")
+    .split("\0")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+async function gitText(args, cwd, env) {
+  const output = await gitBuffer(args, cwd, env);
+  return output.toString("utf8").trim();
+}
+
+async function gitBuffer(args, cwd, env) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd: path.resolve(cwd),
+      env,
+      encoding: "buffer",
+      maxBuffer: GIT_MAX_BUFFER
+    });
+    return stdout;
+  } catch (error) {
+    const stderr = Buffer.isBuffer(error?.stderr)
+      ? error.stderr.toString("utf8").trim()
+      : String(error?.stderr || "").trim();
+    throw new Error(stderr || error?.message || "Git command failed");
+  }
+}
+
+async function pathExists(filePath) {
+  try {
+    await stat(filePath);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+
+function chunk(items, size) {
+  const batches = [];
+  for (let i = 0; i < items.length; i += size) {
+    batches.push(items.slice(i, i + size));
+  }
+  return batches;
+}

package/src/commands/incidents.js

@@ -0,0 +1,436 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+
+const LIST_DAYS = [7, 30, 90];
+const STATS_DAYS = [1, 7, 30, 365];
+const SEVERITIES = ["critical", "warning"];
+const EXPORT_FORMATS = ["csv", "json"];
+const BUSINESS_PLANS = new Set(["business", "enterprise"]);
+
+export function createIncidentsCommand({
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("incidents")
+    .description("Review and export ZeusLock security incidents");
+
+  command.addCommand(createListCommand({ stdout, env }));
+  command.addCommand(createStatsCommand({ stdout, env }));
+  command.addCommand(createExportCommand({ stdout, env }));
+
+  return command;
+}
+
+function createListCommand({ stdout, env }) {
+  return new Command("list")
+    .description("List recent incidents")
+    .option("--days <days>", "incident history window: 7, 30, or 90", "30")
+    .option("--severity <level>", "severity filter: critical or warning")
+    .option("--search <text>", "search user email, URL, or finding type")
+    .option("--jailbreak", "show only jailbreak-attempt incidents")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const days = parseAllowedInt(options.days, LIST_DAYS, "--days");
+      const severity = parseOptionalChoice(options.severity, SEVERITIES, "--severity");
+
+      if (days === 90) {
+        await requireBusinessPlan({
+          env,
+          message: "90-day history is only available on Business and Enterprise plans."
+        });
+      }
+
+      const data = await requestAuthenticatedJson(`/api/incidents?days=${days}`, { env });
+      const incidents = applyIncidentFilters(normalizeIncidents(data), {
+        severity,
+        search: options.search,
+        jailbreak: Boolean(options.jailbreak)
+      });
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(incidents)}\n`);
+        return;
+      }
+
+      if (incidents.length === 0) {
+        stdout.write("No incidents found\n");
+        return;
+      }
+
+      stdout.write(formatIncidentTable(incidents));
+    });
+}
+
+function createStatsCommand({ stdout, env }) {
+  return new Command("stats")
+    .description("Show incident statistics")
+    .option("--days <days>", "stats window: 1, 7, 30, or 365", "30")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const days = parseAllowedInt(options.days, STATS_DAYS, "--days");
+
+      if (days === 365) {
+        await requireBusinessPlan({
+          env,
+          message: "Yearly history is only available on Business and Enterprise plans."
+        });
+      }
+
+      const stats = await requestAuthenticatedJson(`/api/stats?days=${days}`, { env });
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(stats)}\n`);
+        return;
+      }
+
+      stdout.write(formatStats(stats, days));
+    });
+}
+
+function createExportCommand({ stdout, env }) {
+  return new Command("export")
+    .description("Export dashboard-filtered incidents")
+    .option("--days <days>", "incident history window: 7, 30, or 90", "30")
+    .option("--severity <level>", "severity filter: critical or warning")
+    .option("--search <text>", "search user email, URL, or finding type")
+    .option("--jailbreak", "export only jailbreak-attempt incidents")
+    .option("--format <format>", "export format: csv or json", "csv")
+    .option("--output <path>", "write export to this path instead of a timestamped file")
+    .option("--json", "print machine-readable result metadata")
+    .action(async (options) => {
+      const days = parseAllowedInt(options.days, LIST_DAYS, "--days");
+      const severity = parseOptionalChoice(options.severity, SEVERITIES, "--severity");
+      const format = parseOptionalChoice(options.format, EXPORT_FORMATS, "--format") || "csv";
+
+      await requireBusinessPlan({
+        env,
+        message: "Incident export is only available on Business and Enterprise plans."
+      });
+
+      const data = await requestAuthenticatedJson(`/api/incidents?days=${days}`, { env });
+      const incidents = applyIncidentFilters(normalizeIncidents(data), {
+        severity,
+        search: options.search,
+        jailbreak: Boolean(options.jailbreak)
+      });
+
+      const content = format === "json"
+        ? `${JSON.stringify(incidents, null, 2)}\n`
+        : formatIncidentsCsv(incidents);
+      const outputPath = path.resolve(options.output || `incidents-${Date.now()}.${format}`);
+
+      if (incidents.length === 0) {
+        if (options.json) {
+          stdout.write(`${JSON.stringify({
+            exported: false,
+            format,
+            output: null,
+            totalCount: 0,
+            filters: buildIncidentFilterMetadata({ days, severity, search: options.search, jailbreak: Boolean(options.jailbreak) })
+          })}\n`);
+          return;
+        }
+        stdout.write("No incidents to export\n");
+        return;
+      }
+
+      await writeFile(outputPath, content, "utf8");
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify({
+          exported: true,
+          format,
+          output: outputPath,
+          totalCount: incidents.length,
+          filters: buildIncidentFilterMetadata({ days, severity, search: options.search, jailbreak: Boolean(options.jailbreak) })
+        })}\n`);
+        return;
+      }
+
+      stdout.write(`Exported ${incidents.length} incidents to ${outputPath}\n`);
+    });
+}
+
+function parseAllowedInt(value, allowed, optionName) {
+  const number = Number(value);
+  if (!Number.isInteger(number) || !allowed.includes(number)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return number;
+}
+
+function parseOptionalChoice(value, allowed, optionName) {
+  if (value === undefined || value === null || value === "") {
+    return null;
+  }
+  const normalized = String(value).trim().toLowerCase();
+  if (!allowed.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return normalized;
+}
+
+async function requireBusinessPlan({ env, message }) {
+  const org = await requestAuthenticatedJson("/api/org", { env });
+  const plan = String(org?.plan || "free").toLowerCase();
+  if (!BUSINESS_PLANS.has(plan)) {
+    throw new Error(message);
+  }
+  return org;
+}
+
+function buildIncidentFilterMetadata({ days, severity = null, search = "", jailbreak = false }) {
+  return {
+    days,
+    severity,
+    search: search || null,
+    jailbreak
+  };
+}
+
+function normalizeIncidents(data) {
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (Array.isArray(data?.incidents)) {
+    return data.incidents;
+  }
+  return [];
+}
+
+function applyIncidentFilters(incidents, { severity = null, search = "", jailbreak = false } = {}) {
+  let filtered = incidents.filter(isDashboardVisibleIncident);
+
+  if (jailbreak) {
+    filtered = filtered.filter(isJailbreakIncident);
+  }
+
+  if (severity) {
+    filtered = filtered.filter((incident) => {
+      const riskLevel = String(incident.risk_level || incident.severity || "").toLowerCase();
+      if (severity === "warning") {
+        return ["high", "medium", "low"].includes(riskLevel);
+      }
+      return riskLevel === severity;
+    });
+  }
+
+  const query = String(search || "").trim().toLowerCase();
+  if (query) {
+    filtered = filtered.filter((incident) =>
+      String(incident.user_email || "").toLowerCase().includes(query) ||
+      String(incident.url || "").toLowerCase().includes(query) ||
+      getFindingTypes(incident).some((type) => type.toLowerCase().includes(query))
+    );
+  }
+
+  return filtered;
+}
+
+function isDashboardVisibleIncident(incident) {
+  const hasFindings = Array.isArray(incident.findings) && incident.findings.length > 0;
+  const isBlocked = incident.blocked === true;
+  const hasAction = incident.action && incident.action !== "allowed";
+  return hasFindings || isBlocked || hasAction;
+}
+
+function isJailbreakIncident(incident) {
+  return getFindingTypes(incident).includes("jailbreak_attempt");
+}
+
+function getFindingTypes(incident) {
+  return Array.isArray(incident.findings)
+    ? incident.findings.map((finding) => String(finding?.type || "")).filter(Boolean)
+    : [];
+}
+
+function formatIncidentTable(incidents) {
+  const rows = incidents.map((incident) => ({
+    date: formatDate(incident.created_at),
+    severity: incident.risk_level || incident.severity || "-",
+    type: formatFindingTypes(incident),
+    user: incident.user_email || "-",
+    platform: formatPlatform(incident),
+    decision: formatDecision(incident),
+    source: incident.url || incident.source || "-"
+  }));
+
+  return formatTable(rows, [
+    { key: "date", label: "Date", maxWidth: 24 },
+    { key: "severity", label: "Severity", maxWidth: 10 },
+    { key: "type", label: "Type", maxWidth: 32 },
+    { key: "user", label: "User", maxWidth: 32 },
+    { key: "platform", label: "AI Platform", maxWidth: 12 },
+    { key: "decision", label: "Decision", maxWidth: 10 },
+    { key: "source", label: "Source", maxWidth: 50 }
+  ]);
+}
+
+function formatFindingTypes(incident) {
+  const types = getFindingTypes(incident);
+  if (types.length === 0) {
+    return "Unknown";
+  }
+  if (types.length <= 2) {
+    return types.join(", ");
+  }
+  return `${types.slice(0, 2).join(", ")} +${types.length - 2}`;
+}
+
+function formatPlatform(incident) {
+  const platform = incident.platform || inferPlatformFromUrl(incident.url);
+  return platform || "-";
+}
+
+function inferPlatformFromUrl(urlValue) {
+  const url = String(urlValue || "").toLowerCase();
+  if (!url) return "";
+  if (url.includes("chatgpt") || url.includes("openai.com")) return "chatgpt";
+  if (url.includes("claude")) return "claude";
+  if (url.includes("gemini")) return "gemini";
+  if (url.includes("copilot")) return "copilot";
+  if (url.includes("grok")) return "grok";
+  return "";
+}
+
+function formatDecision(incident) {
+  const action = String(incident.action || "").toLowerCase();
+  if (incident.blocked === true || action === "blocked" || action === "block") {
+    return "block";
+  }
+  if (action === "alerted" || action === "alert") {
+    return "alert";
+  }
+  return action || "-";
+}
+
+function formatStats(stats, days) {
+  const lines = [];
+  lines.push(`Incidents stats (${days} days)`);
+  lines.push(`Total incidents: ${stats?.total_incidents ?? 0}`);
+  lines.push(`Prompts captured: ${stats?.prompts_captured ?? 0}`);
+  lines.push(`Active agents: ${stats?.active_agents ?? 0}`);
+  lines.push("");
+
+  lines.push("Severity:");
+  appendKeyValueLines(lines, stats?.by_risk_level, ["critical", "high", "medium", "low"]);
+  lines.push("");
+
+  lines.push("Detected data types:");
+  appendKeyValueLines(lines, stats?.by_type);
+  lines.push("");
+
+  lines.push("Timeline:");
+  const timeline = Array.isArray(stats?.daily_incidents) ? stats.daily_incidents : [];
+  if (timeline.length === 0) {
+    lines.push("  No timeline data");
+  } else {
+    for (const point of timeline) {
+      lines.push(`  ${point.date}: ${point.count ?? 0}`);
+    }
+  }
+  lines.push("");
+
+  lines.push("AI platform usage:");
+  const platforms = Array.isArray(stats?.ai_usage?.platforms) ? stats.ai_usage.platforms : [];
+  if (platforms.length === 0) {
+    lines.push("  No AI platform incidents");
+  } else {
+    for (const platform of platforms) {
+      const label = platform.name || platform.platform || "Unknown";
+      const percentage = platform.percentage === undefined ? "" : ` (${platform.percentage}%)`;
+      lines.push(`  ${label}: ${platform.count ?? 0}${percentage}`);
+    }
+  }
+
+  return `${lines.join("\n")}\n`;
+}
+
+function appendKeyValueLines(lines, values, preferredOrder = null) {
+  const source = values && typeof values === "object" ? values : {};
+  const keys = preferredOrder || Object.keys(source);
+  if (keys.length === 0) {
+    lines.push("  None");
+    return;
+  }
+  for (const key of keys) {
+    lines.push(`  ${key}: ${source[key] ?? 0}`);
+  }
+}
+
+function formatIncidentsCsv(incidents) {
+  const columns = [
+    ["incident_id", (incident) => incident.incident_id || incident.id || ""],
+    ["created_at", (incident) => incident.created_at || ""],
+    ["risk_level", (incident) => incident.risk_level || incident.severity || ""],
+    ["type", (incident) => formatFindingTypes(incident)],
+    ["user_email", (incident) => incident.user_email || ""],
+    ["platform", (incident) => formatPlatform(incident)],
+    ["decision", (incident) => formatDecision(incident)],
+    ["source", (incident) => incident.source || ""],
+    ["url", (incident) => incident.url || ""],
+    ["blocked", (incident) => incident.blocked === undefined ? "" : String(Boolean(incident.blocked))],
+    ["status", (incident) => incident.status || ""],
+    ["file_name", (incident) => incident.file_name || ""]
+  ];
+
+  const header = columns.map(([name]) => escapeCsv(name)).join(",");
+  const rows = incidents.map((incident) =>
+    columns.map(([, getter]) => escapeCsv(getter(incident))).join(",")
+  );
+  return `${[header, ...rows].join("\n")}\n`;
+}
+
+function formatTable(rows, columns) {
+  const widths = columns.map((column) => {
+    const contentWidth = rows.reduce((max, row) => {
+      return Math.max(max, String(row[column.key] ?? "").length);
+    }, column.label.length);
+    return Math.min(contentWidth, column.maxWidth || contentWidth);
+  });
+
+  const renderRow = (row) => columns.map((column, index) => {
+    const value = truncate(String(row[column.key] ?? ""), widths[index]);
+    return value.padEnd(widths[index]);
+  }).join("  ");
+
+  const header = renderRow(Object.fromEntries(columns.map((column) => [column.key, column.label])));
+  const separator = widths.map((width) => "-".repeat(width)).join("  ");
+  const body = rows.map(renderRow).join("\n");
+  return `${header}\n${separator}\n${body}\n`;
+}
+
+function truncate(value, width) {
+  if (value.length <= width) {
+    return value;
+  }
+  if (width <= 3) {
+    return value.slice(0, width);
+  }
+  return `${value.slice(0, width - 3)}...`;
+}
+
+function formatDate(value) {
+  if (!value) {
+    return "-";
+  }
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return String(value);
+  }
+  return date.toISOString();
+}
+
+function escapeCsv(value) {
+  if (value === null || value === undefined) {
+    return "";
+  }
+  const text = String(value);
+  if (/[",\n\r]/.test(text)) {
+    return `"${text.replaceAll("\"", "\"\"")}"`;
+  }
+  return text;
+}