feat(security): plugin architecture + Aikido Safe Chain install-gate + Patches-style /security

package.json

@@ -51,10 +51,10 @@
       "better-sqlite3"
     ],
     "overrides": {
-      "postcss": "8.5.15",
-      "ip-address": "10.2.0",
-      "vite": "8.0.13",
-      "esbuild": "0.28.0",
+      "postcss": "^8.5.15",
+      "ip-address": "^10.2.0",
+      "vite": "^8.0.13",
+      "esbuild": ">=0.28.0",
       "qs": ">=6.15.2"
     }
   },

src/app/api/projects/[id]/escalate/route.ts

@@ -9,6 +9,7 @@ import { join } from 'path'
 import { execFile, exec } from 'child_process'
 import { promisify } from 'util'
 import { logger } from '@/lib/logger'
+import { decideDevServerGuard, isHexopsSelf, isTracked } from '@/lib/process-manager'
 
 const execFileAsync = promisify(execFile)
 const execAsync = promisify(exec)
@@ -58,6 +59,17 @@ export async function POST(
       return NextResponse.json({ error: 'Project not found' }, { status: 404 })
     }
 
+    // #109: an escalation rewrites overrides and reinstalls. Refuse if the target
+    // is hexops itself — churning node_modules would kill the server serving this
+    // request mid-install. (Orchestrated stop/restart for other projects: TODO.)
+    const guard = decideDevServerGuard({ isSelf: isHexopsSelf(project), isTracked: isTracked(id) })
+    if (guard.action === 'block-self') {
+      return NextResponse.json(
+        { error: guard.reason, devServerGuard: { action: guard.action, reason: guard.reason } },
+        { status: 409 },
+      )
+    }
+
     const body: EscalateRequestBody = await request.json()
     const { package: pkg, action, reason, overrideVersion, targetVersion, expiresAt, emergency } = body
 

src/app/api/projects/[id]/override-remove/route.ts

@@ -7,6 +7,7 @@ import { promisify } from 'util';
 import { detectPackageManager } from '@/lib/patch-scanner';
 import { invalidateProjectCache } from '@/lib/patch-storage';
 import { AUTO_APPLY_ENABLED } from '@/lib/auto-apply-flag';
+import { runWithDevServerGuard, decideDevServerGuard, isHexopsSelf, isTracked } from '@/lib/process-manager';
 
 const execAsync = promisify(exec);
 
@@ -34,6 +35,15 @@ export async function POST(
       return NextResponse.json({ error: 'Project not found' }, { status: 404 });
     }
 
+    // #109: refuse to churn node_modules out from under hexops's own dev server.
+    const guard = decideDevServerGuard({ isSelf: isHexopsSelf(project), isTracked: isTracked(id) });
+    if (guard.action === 'block-self') {
+      return NextResponse.json(
+        { success: false, error: guard.reason, devServerGuard: { action: guard.action, reason: guard.reason } },
+        { status: 409 },
+      );
+    }
+
     const pkgJsonPath = join(project.path, 'package.json');
     if (!existsSync(pkgJsonPath)) {
       return NextResponse.json({ error: 'package.json not found' }, { status: 400 });
@@ -92,18 +102,30 @@ export async function POST(
       ? 'yarn install'
       : 'npm install --legacy-peer-deps';
 
-    let installOutput = '';
-    try {
-      const result = await execAsync(installCmd, { cwd: project.path, timeout: 120000 });
-      installOutput = (result.stdout || '') + (result.stderr || '');
-    } catch (err) {
-      const e = err as { stdout?: string; stderr?: string };
-      installOutput = (e.stdout || '') + (e.stderr || '');
-    }
+    // #109: stop a running dev server, reinstall, then restart it.
+    const guardOutcome = await runWithDevServerGuard(project, async () => {
+      try {
+        const result = await execAsync(installCmd, { cwd: project.path, timeout: 120000 });
+        return (result.stdout || '') + (result.stderr || '');
+      } catch (err) {
+        const e = err as { stdout?: string; stderr?: string };
+        return (e.stdout || '') + (e.stderr || '');
+      }
+    }, { clearBuildDir: true });
 
     invalidateProjectCache(id);
 
-    return NextResponse.json({ success: true, removed: pkgName, output: installOutput });
+    return NextResponse.json({
+      success: true,
+      removed: pkgName,
+      output: guardOutcome.result ?? '',
+      devServerGuard: {
+        action: guardOutcome.decision,
+        stopped: guardOutcome.stopped,
+        restarted: guardOutcome.restarted,
+        ...(guardOutcome.restartError ? { restartError: guardOutcome.restartError } : {}),
+      },
+    });
   } catch (error) {
     console.error('Error removing override:', error);
     return NextResponse.json({ error: 'Failed to remove override' }, { status: 500 });

src/app/api/projects/[id]/plugins/[pluginId]/route.ts

@@ -0,0 +1,58 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getProjects, getCategories, saveConfig } from '@/lib/config';
+import { getPlugin } from '@/lib/security/plugins';
+import { setProjectPluginConfig } from '@/lib/security/plugins/config';
+import { AUTO_APPLY_ENABLED } from '@/lib/auto-apply-flag';
+
+interface ToggleRequest {
+  enabled: boolean;
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string; pluginId: string }> }
+) {
+  if (!AUTO_APPLY_ENABLED) {
+    return NextResponse.json(
+      { success: false, error: 'Auto-apply is disabled in HexOps. Re-enable AUTO_APPLY_ENABLED to apply updates.' },
+      { status: 409 },
+    );
+  }
+
+  const { id, pluginId } = await params;
+
+  const plugin = getPlugin(pluginId);
+  if (!plugin) {
+    return NextResponse.json({ error: `Unknown plugin: ${pluginId}` }, { status: 404 });
+  }
+
+  const projects = getProjects();
+  const projectIndex = projects.findIndex(p => p.id === id);
+  if (projectIndex === -1) {
+    return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+  }
+
+  const body = (await request.json().catch(() => null)) as ToggleRequest | null;
+  if (!body || typeof body.enabled !== 'boolean') {
+    return NextResponse.json({ error: 'Body must be { enabled: boolean }' }, { status: 400 });
+  }
+
+  // Mutate via the existing setProjectPluginConfig helper (T3). Writer captures
+  // the index update + saves the whole config (mirrors the holds-route pattern).
+  await setProjectPluginConfig(
+    projects[projectIndex],
+    pluginId,
+    { enabled: body.enabled },
+    (next) => {
+      projects[projectIndex] = next;
+      saveConfig({ projects, categories: getCategories() });
+    },
+  );
+
+  return NextResponse.json({
+    success: true,
+    project: id,
+    pluginId,
+    enabled: body.enabled,
+  });
+}

src/app/api/projects/[id]/security-scan/route.ts

@@ -1,18 +1,29 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getProject } from '@/lib/config';
-import { scanProject } from '@/lib/security/runner';
+import { scanProject, scanProjectWithSources } from '@/lib/security/runner';
+import { SOURCES } from '@/lib/security/sources';
 import { logger } from '@/lib/logger';
 
 export async function POST(
-  _req: NextRequest,
+  req: NextRequest,
   { params }: { params: Promise<{ id: string }> },
 ) {
   const { id } = await params;
   const project = getProject(id);
   if (!project) return NextResponse.json({ error: 'Project not found' }, { status: 404 });
 
   try {
-    const result = await scanProject(project);
+    const url = new URL(req.url);
+    const filter = url.searchParams.get('sources');
+    const subset = filter
+      ? SOURCES.filter(s => filter.split(',').map(x => x.trim()).includes(s.id))
+      : SOURCES;
+    if (subset.length === 0) {
+      return NextResponse.json({ error: `No sources matched: ${filter}` }, { status: 400 });
+    }
+    const result = subset.length === SOURCES.length
+      ? await scanProject(project)
+      : await scanProjectWithSources(project, subset);
     return NextResponse.json(result);
   } catch (err) {
     const message = err instanceof Error ? err.message : 'Security scan failed';

src/app/api/projects/[id]/security/exceptions/[exceptionId]/revoke/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getProject } from '@/lib/config';
+import { revokeException } from '@/lib/security/exceptions';
+import { AUTO_APPLY_ENABLED } from '@/lib/auto-apply-flag';
+import { logger } from '@/lib/logger';
+
+interface RevokeBody {
+  revokeReason?: string;
+}
+
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string; exceptionId: string }> },
+) {
+  if (!AUTO_APPLY_ENABLED) {
+    return NextResponse.json(
+      { success: false, error: 'Auto-apply is disabled in HexOps.' },
+      { status: 409 },
+    );
+  }
+  const { id, exceptionId } = await params;
+  if (!getProject(id)) return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+
+  const body = (await req.json().catch(() => ({}))) as RevokeBody;
+  const exc = revokeException({
+    projectId: id,
+    exceptionId,
+    revokeReason: body.revokeReason,
+  });
+  if (!exc) return NextResponse.json({ error: 'Exception not found' }, { status: 404 });
+
+  logger.info(
+    'security',
+    'exception_revoked',
+    `Exception ${exc.id} revoked`,
+    {
+      projectId: id,
+      meta: {
+        exceptionId: exc.id,
+        parentPackage: exc.parentPackage,
+        revokeReason: body.revokeReason,
+      },
+    },
+  );
+
+  return NextResponse.json({ success: true, exception: exc });
+}

src/app/api/projects/[id]/security/exceptions/[exceptionId]/route.ts

@@ -0,0 +1,66 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getProject } from '@/lib/config';
+import { updateException, type ExceptionClassification } from '@/lib/security/exceptions';
+import { AUTO_APPLY_ENABLED } from '@/lib/auto-apply-flag';
+import { logger } from '@/lib/logger';
+
+const VALID_CLASSIFICATIONS: ExceptionClassification[] = [
+  'risk-accepted',
+  'false-positive',
+  'compensating-control',
+  'deferred',
+  'unfixable',
+  'deviation',
+];
+
+interface PatchBody {
+  classification?: ExceptionClassification;
+  reason?: string;
+  notes?: string | null;       // null = clear
+  expiresAt?: string | null;   // null = clear
+}
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string; exceptionId: string }> },
+) {
+  if (!AUTO_APPLY_ENABLED) {
+    return NextResponse.json(
+      { success: false, error: 'Auto-apply is disabled in HexOps.' },
+      { status: 409 },
+    );
+  }
+  const { id, exceptionId } = await params;
+  if (!getProject(id)) return NextResponse.json({ error: 'Project not found' }, { status: 404 });
+
+  const body = (await req.json().catch(() => null)) as PatchBody | null;
+  if (!body) return NextResponse.json({ error: 'Invalid body' }, { status: 400 });
+  if (body.classification && !VALID_CLASSIFICATIONS.includes(body.classification)) {
+    return NextResponse.json({ error: 'Invalid classification' }, { status: 400 });
+  }
+  if (body.reason !== undefined && typeof body.reason !== 'string') {
+    return NextResponse.json({ error: 'reason must be a string' }, { status: 400 });
+  }
+
+  // Translate nulls to undefined for storage layer
+  const updates: Parameters<typeof updateException>[0]['updates'] = {};
+  if (body.classification !== undefined) updates.classification = body.classification;
+  if (body.reason !== undefined) updates.reason = body.reason;
+  if ('notes' in body) updates.notes = body.notes ?? undefined;
+  if ('expiresAt' in body) updates.expiresAt = body.expiresAt ?? undefined;
+
+  const exc = updateException({ projectId: id, exceptionId, updates });
+  if (!exc) return NextResponse.json({ error: 'Exception not found' }, { status: 404 });
+
+  logger.info(
+    'security',
+    'exception_modified',
+    `Exception ${exc.id} modified`,
+    {
+      projectId: id,
+      meta: { exceptionId: exc.id, parentPackage: exc.parentPackage, changes: Object.keys(updates) },
+    },
+  );
+
+  return NextResponse.json({ success: true, exception: exc });
+}