chore: include complete dc refactor implementation and audits

internal/security/policy.go

@@ -0,0 +1,98 @@
+package security
+
+import (
+	"errors"
+	"sync"
+	"time"
+)
+
+const (
+	RiskLow    = 1
+	RiskMedium = 2
+	RiskHigh   = 3
+)
+
+type DevicePolicy struct {
+	Mode string
+}
+
+type PolicySnapshot struct {
+	Version    uint64
+	GlobalRisk int
+	Devices    map[string]DevicePolicy
+	CreatedAt  time.Time
+}
+
+type Snapshot struct {
+	mu   sync.RWMutex
+	data PolicySnapshot
+}
+
+func New(globalRisk int, devices map[string]DevicePolicy, version uint64) *Snapshot {
+	if globalRisk < RiskLow || globalRisk > RiskHigh {
+		globalRisk = RiskMedium
+	}
+	cp := make(map[string]DevicePolicy, len(devices))
+	for k, v := range devices {
+		cp[k] = v
+	}
+	return &Snapshot{data: PolicySnapshot{
+		Version: version, GlobalRisk: globalRisk, Devices: cp, CreatedAt: time.Now(),
+	}}
+}
+
+func (s *Snapshot) Current() PolicySnapshot {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	cp := make(map[string]DevicePolicy, len(s.data.Devices))
+	for k, v := range s.data.Devices {
+		cp[k] = v
+	}
+	snap := s.data
+	snap.Devices = cp
+	return snap
+}
+
+func (s *Snapshot) Publish(globalRisk int, devices map[string]DevicePolicy, version uint64) error {
+	if globalRisk < RiskLow || globalRisk > RiskHigh {
+		return errors.New("invalid global risk")
+	}
+	cp := make(map[string]DevicePolicy, len(devices))
+	for k, v := range devices {
+		cp[k] = v
+	}
+	s.mu.Lock()
+	if version < s.data.Version {
+		s.mu.Unlock()
+		return errors.New("policy version regression")
+	}
+	s.data = PolicySnapshot{
+		Version: version, GlobalRisk: globalRisk, Devices: cp, CreatedAt: time.Now(),
+	}
+	s.mu.Unlock()
+	return nil
+}
+
+func (s *Snapshot) EffectiveRisk(device string) int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if p, ok := s.data.Devices[device]; ok {
+		if risk := ModeRisk(p.Mode); risk != 0 {
+			return risk
+		}
+	}
+	return s.data.GlobalRisk
+}
+
+func ModeRisk(mode string) int {
+	switch mode {
+	case "low":
+		return RiskLow
+	case "medium":
+		return RiskMedium
+	case "high":
+		return RiskHigh
+	default:
+		return 0
+	}
+}

internal/security/policy_test.go

@@ -0,0 +1,35 @@
+package security
+
+import "testing"
+
+func TestSnapshotEffectiveRiskAndPublish(t *testing.T) {
+	s := New(RiskMedium, map[string]DevicePolicy{"hwsg": {Mode: "high"}}, 7)
+	if got := s.EffectiveRisk("hwsg"); got != RiskHigh {
+		t.Fatalf("hwsg risk=%d, want %d", got, RiskHigh)
+	}
+	if got := s.EffectiveRisk("n3450"); got != RiskMedium {
+		t.Fatalf("default risk=%d, want %d", got, RiskMedium)
+	}
+	if err := s.Publish(RiskLow, map[string]DevicePolicy{"n3450": {Mode: "medium"}}, 8); err != nil {
+		t.Fatal(err)
+	}
+	cur := s.Current()
+	if cur.Version != 8 {
+		t.Fatalf("version=%d, want 8", cur.Version)
+	}
+	if got := s.EffectiveRisk("hwsg"); got != RiskLow {
+		t.Fatalf("old node risk=%d, want %d", got, RiskLow)
+	}
+	if got := s.EffectiveRisk("n3450"); got != RiskMedium {
+		t.Fatalf("override risk=%d, want %d", got, RiskMedium)
+	}
+}
+
+func TestModeRiskRejectsUnknown(t *testing.T) {
+	if got := ModeRisk("inherit"); got != 0 {
+		t.Fatalf("inherit risk=%d, want 0", got)
+	}
+	if got := ModeRisk("root"); got != 0 {
+		t.Fatalf("unknown risk=%d, want 0", got)
+	}
+}

internal/security/registry.go

@@ -0,0 +1,52 @@
+package security
+
+type ToolSpec struct {
+	Name         string
+	RequiredRisk int
+	Category     string
+	ReadOnly     bool
+}
+
+var registry = map[string]ToolSpec{
+	"read_file":               {Name: "read_file", RequiredRisk: RiskLow, Category: "file", ReadOnly: true},
+	"read_multiple_files":     {Name: "read_multiple_files", RequiredRisk: RiskLow, Category: "file", ReadOnly: true},
+	"list_directory":          {Name: "list_directory", RequiredRisk: RiskLow, Category: "file", ReadOnly: true},
+	"get_file_info":           {Name: "get_file_info", RequiredRisk: RiskLow, Category: "file", ReadOnly: true},
+	"start_search":            {Name: "start_search", RequiredRisk: RiskLow, Category: "search", ReadOnly: true},
+	"get_more_search_results": {Name: "get_more_search_results", RequiredRisk: RiskLow, Category: "search", ReadOnly: true},
+	"list_processes":          {Name: "list_processes", RequiredRisk: RiskLow, Category: "process", ReadOnly: true},
+	"list_sessions":           {Name: "list_sessions", RequiredRisk: RiskLow, Category: "process", ReadOnly: true},
+	"read_process_output":     {Name: "read_process_output", RequiredRisk: RiskLow, Category: "process", ReadOnly: true},
+	"edit_block":              {Name: "edit_block", RequiredRisk: RiskMedium, Category: "file", ReadOnly: false},
+	"write_file":              {Name: "write_file", RequiredRisk: RiskMedium, Category: "file", ReadOnly: false},
+	"create_directory":        {Name: "create_directory", RequiredRisk: RiskMedium, Category: "file", ReadOnly: false},
+	"move_file":               {Name: "move_file", RequiredRisk: RiskMedium, Category: "file", ReadOnly: false},
+	"exec_command":            {Name: "exec_command", RequiredRisk: RiskHigh, Category: "process", ReadOnly: false},
+	"start_process":           {Name: "start_process", RequiredRisk: RiskHigh, Category: "process", ReadOnly: false},
+	"interact_with_process":   {Name: "interact_with_process", RequiredRisk: RiskHigh, Category: "process", ReadOnly: false},
+	"kill_process":            {Name: "kill_process", RequiredRisk: RiskHigh, Category: "process", ReadOnly: false},
+	"force_terminate":         {Name: "force_terminate", RequiredRisk: RiskHigh, Category: "process", ReadOnly: false},
+	"mcp_call":                {Name: "mcp_call", RequiredRisk: RiskMedium, Category: "mcp", ReadOnly: false},
+}
+
+var actionTools = map[string]string{
+	"read": "read_file", "probe": "read_file", "write": "write_file",
+	"mcp": "mcp_call", "exec": "exec_command",
+}
+
+func Lookup(name string) (ToolSpec, bool) {
+	v, ok := registry[name]
+	return v, ok
+}
+
+func RequiredRiskForAction(action string) (int, bool) {
+	name, ok := actionTools[action]
+	if !ok {
+		return 0, false
+	}
+	spec, ok := registry[name]
+	if !ok {
+		return 0, false
+	}
+	return spec.RequiredRisk, true
+}