mira-consciousness/dist/mira-memory/src/config/security-config.js

Memory & Intelligence Retention Archive - Preserving The Spark

/**
 * Security Configuration for MIRA
 * Defines security policies and best practices
 */
export const defaultSecurityConfig = {
    // Only allow specific safe commands
    allowedCommands: [
        'git', 'npm', 'node', 'python', 'python3', 'pip', 'pip3',
        'yarn', 'pnpm', 'tsc', 'eslint', 'prettier', 'jest'
    ],
    // Restrict access to sensitive directories
    restrictedPaths: [
        '/etc', '/sys', '/proc', '/root',
        'C:\\Windows\\System32', 'C:\\Program Files',
        '~/.ssh', '~/.aws', '~/.gnupg'
    ],
    // Only allow connections to trusted hosts
    allowedHosts: [
        'registry.npmjs.org',
        'github.com',
        'api.github.com',
        'pypi.org',
        'files.pythonhosted.org'
    ],
    // Patterns for sensitive data detection
    sensitivePatterns: [
        /(?:api[_-]?key|apikey)\s*[:=]\s*["'][\w-]{20,}["']/gi,
        /(?:secret|token)\s*[:=]\s*["'][\w-]{20,}["']/gi,
        /(?:password|passwd|pwd)\s*[:=]\s*["'][^"']+["']/gi,
        /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/,
        /(?:AWS|aws)_?(?:SECRET|secret)_?(?:ACCESS|access)_?(?:KEY|key)/,
        /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/ // GitHub tokens
    ],
    // 100MB max file size
    maxFileSizeBytes: 100 * 1024 * 1024,
    // 30 second timeout for commands
    commandTimeoutMs: 30000
};
/**
 * Validate if a command is allowed to execute
 */
export function isCommandAllowed(command, config = defaultSecurityConfig) {
    const baseCommand = command.split(' ')[0].toLowerCase();
    return config.allowedCommands.includes(baseCommand);
}
/**
 * Check if a path is restricted
 */
export function isPathRestricted(filePath, config = defaultSecurityConfig) {
    const normalizedPath = filePath.toLowerCase();
    return config.restrictedPaths.some(restricted => normalizedPath.includes(restricted.toLowerCase()));
}
/**
 * Sanitize command arguments to prevent injection
 */
export function sanitizeCommandArgs(args) {
    return args.map(arg => {
        // Remove potentially dangerous characters
        return arg
            .replace(/[;&|`$]/g, '') // Remove shell metacharacters
            .replace(/\.\./g, '') // Prevent directory traversal
            .trim();
    });
}
/**
 * Create safe environment variables for subprocess
 */
export function getSafeEnvironment() {
    const safeEnv = {
        ...process.env,
        // Remove potentially dangerous environment variables
        LD_PRELOAD: undefined,
        LD_LIBRARY_PATH: undefined,
        DYLD_INSERT_LIBRARIES: undefined,
        DYLD_LIBRARY_PATH: undefined,
        // Set safe defaults
        NODE_ENV: process.env.NODE_ENV || 'production',
        PATH: process.env.PATH || '/usr/bin:/bin',
    };
    // Remove any environment variables that might contain secrets
    Object.keys(safeEnv).forEach(key => {
        if (key.match(/(?:SECRET|PASSWORD|TOKEN|KEY|CREDENTIAL)/i)) {
            delete safeEnv[key];
        }
    });
    return safeEnv;
}
//# sourceMappingURL=security-config.js.map