@astrofoundry/pi-astro 0.18.6 → 0.19.1

package/specialists/lib/tunnel.ts

@@ -0,0 +1,76 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import { connect } from "node:net";
+import { ServiceError } from "./errors.ts";
+
+export interface TunnelOptions {
+    env: Record<string, string>;
+    /** Local port the tunnel process must start listening on. */
+    port: number;
+    readyTimeoutMs: number;
+}
+
+export interface Tunnel {
+    close(): Promise<void>;
+}
+
+function portOpen(port: number): Promise<boolean> {
+    return new Promise((resolve) => {
+        const socket = connect({ port, host: "127.0.0.1" });
+        socket.once("connect", () => {
+            socket.destroy();
+            resolve(true);
+        });
+        socket.once("error", () => {
+            socket.destroy();
+            resolve(false);
+        });
+    });
+}
+
+function sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function stop(child: ChildProcess): Promise<void> {
+    if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve();
+    return new Promise((resolve) => {
+        const hardKill = setTimeout(() => child.kill("SIGKILL"), 3000);
+        child.once("exit", () => {
+            clearTimeout(hardKill);
+            resolve();
+        });
+        child.kill("SIGTERM");
+    });
+}
+
+/**
+ * Starts a long-running process that opens a local listener (an IAP tunnel)
+ * and resolves once 127.0.0.1:port accepts connections. The caller closes it
+ * when the connection through it is done.
+ */
+export async function openTunnel(file: string, args: string[], options: TunnelOptions): Promise<Tunnel> {
+    const child = spawn(file, args, {
+        env: { PATH: "/usr/bin:/bin:/usr/sbin:/sbin", HOME: process.env.HOME ?? "", ...options.env },
+        stdio: ["ignore", "ignore", "pipe"],
+    });
+    const state = { stderr: "", ended: false, failure: "" };
+    child.stderr?.on("data", (chunk: Buffer) => {
+        state.stderr += chunk.toString("utf-8");
+    });
+    child.on("exit", (code) => {
+        state.ended = true;
+        state.failure = `exited with code ${code}`;
+    });
+    child.on("error", (err) => {
+        state.ended = true;
+        state.failure = err.message;
+    });
+    const deadline = Date.now() + options.readyTimeoutMs;
+    while (Date.now() < deadline) {
+        if (state.ended) throw new ServiceError(`${file} ${state.failure}: ${state.stderr.trim()}`);
+        if (await portOpen(options.port)) return { close: () => stop(child) };
+        await sleep(250);
+    }
+    await stop(child);
+    throw new ServiceError(`${file} did not listen on 127.0.0.1:${options.port} within ${options.readyTimeoutMs} ms: ${state.stderr.trim()}`);
+}

package/specialists/security/run.ts

@@ -0,0 +1,323 @@
+import { join } from "node:path";
+import { readConfig } from "../lib/config.ts";
+import { ServiceError, UsageError } from "../lib/errors.ts";
+import { main } from "../lib/main.ts";
+import { printJson, printRaw } from "../lib/output.ts";
+import { specialistsHome } from "../lib/paths.ts";
+import { secretPath } from "../lib/secrets.ts";
+import { sshFixed } from "../lib/ssh.ts";
+
+const SERVICE = "security";
+
+interface SecurityConfig extends Record<string, string> {
+    obsHost: string;
+    obsUser: string;
+}
+
+const SHAPE = { obsHost: "string", obsUser: "string" } as const;
+
+/** Fixed remote commands; the forced command on VM 106 accepts exactly these names. */
+export const OBS_COMMANDS: Readonly<Record<string, { args: [number, number]; help: string }>> = {
+    status: { args: [0, 0], help: "unit states and running containers" },
+    attention: { args: [0, 0], help: "security-attention status: bouncer freshness, Wazuh agents, recent high alerts (JSON)" },
+    agents: { args: [0, 0], help: "Wazuh agent_control -l" },
+    alerts: { args: [1, 2], help: "alerts <days> [ip]         CrowdSec alerts since N days: counts, daily, top IPs, scenarios, latest 20; with ip: every alert of that IP" },
+    decisions: { args: [0, 0], help: "active CrowdSec decisions, compact (JSON)" },
+    bouncers: { args: [0, 0], help: "registered CrowdSec bouncers with last pull (JSON)" },
+    metrics: { args: [0, 0], help: "cscli metrics (JSON)" },
+    "wazuh-alerts": { args: [1, 1], help: "wazuh-alerts <days> <minLevel>   Wazuh alerts since N days at or above a level, summarised" },
+    "wazuh-log": { args: [1, 1], help: "wazuh-log <lines>          tail of the Wazuh manager container log" },
+    "remote-hosts": { args: [0, 0], help: "hosts and programs under /var/log/remote" },
+    "remote-log": { args: [3, 3], help: "remote-log <host> <program> <lines>   tail of /var/log/remote/<host>/<program>.log" },
+    journal: { args: [2, 2], help: "journal <unit> <since>     e.g. journal crowdsec '1 hour ago'" },
+};
+
+export const OBS_UNITS = ["crowdsec", "rsyslog", "nftables", "docker", "security-attention", "update-home-whitelist", "ssh"];
+const SINCE = /^[A-Za-z0-9 :\-+]{1,40}$/;
+const HOSTNAME = /^[A-Za-z0-9][A-Za-z0-9.-]{0,62}$/;
+const PROGRAM = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
+const IPV4 = /^(\d{1,3})(\.\d{1,3}){3}$/;
+
+const HELP = `security specialist (Wazuh, CrowdSec, rsyslog on VM 106)
+
+  <command> [args]            fixed operations through the forced-command SSH key
+${Object.entries(OBS_COMMANDS)
+    .map(([name, c]) => `      ${name.padEnd(14)} ${c.help}`)
+    .join("\n")}
+
+Read-only. Bans, unbans, and rule changes are out of scope; describe them for the operator.`;
+
+function positiveInt(value: string | undefined, what: string, max: number): number {
+    const n = Number(value);
+    if (!Number.isInteger(n) || n < 1 || n > max) throw new UsageError(`${what} must be an integer from 1 to ${max}`);
+    return n;
+}
+
+export function buildObsRemote(args: string[]): string {
+    const [name, ...rest] = args;
+    const spec = name === undefined ? undefined : OBS_COMMANDS[name];
+    if (!spec) throw new UsageError(`unknown command: ${name ?? "(none)"}`);
+    if (rest.length < spec.args[0] || rest.length > spec.args[1]) {
+        throw new UsageError(`${name} takes ${spec.args[0]}${spec.args[1] > spec.args[0] ? ` to ${spec.args[1]}` : ""} argument(s)`);
+    }
+    switch (name) {
+        case "alerts":
+            positiveInt(rest[0], "days", 365);
+            if (rest[1] !== undefined && !IPV4.test(rest[1])) throw new UsageError("ip must be an IPv4 address");
+            break;
+        case "wazuh-alerts":
+            positiveInt(rest[0], "days", 30);
+            break;
+        case "wazuh-log":
+            positiveInt(rest[0], "lines", 2000);
+            break;
+        case "remote-log":
+            if (!HOSTNAME.test(rest[0])) throw new UsageError("host must be a hostname");
+            if (!PROGRAM.test(rest[1])) throw new UsageError("program must be a log name");
+            positiveInt(rest[2], "lines", 2000);
+            break;
+        case "journal":
+            if (!OBS_UNITS.includes(rest[0])) throw new UsageError(`unit must be one of ${OBS_UNITS.join(", ")}`);
+            if (!SINCE.test(rest[1])) throw new UsageError("since: letters, digits, spaces, colon, plus, minus only");
+            break;
+        default:
+            break;
+    }
+    return [name, ...rest].join(" ");
+}
+
+interface CrowdsecAlert {
+    id?: number;
+    created_at?: string;
+    scenario?: string;
+    events_count?: number;
+    source?: { ip?: string; range?: string; as_number?: string; as_name?: string; cn?: string };
+    decisions?: { type?: string; duration?: string; value?: string }[];
+}
+
+interface CompactAlert {
+    id?: number;
+    at: string;
+    ip: string;
+    scenario: string;
+    events: number;
+    decisions: string[];
+    country?: string;
+    as?: string;
+}
+
+export interface AlertSummary {
+    days: number;
+    ip?: string;
+    count: number;
+    uniqueIps: number;
+    repeatIps: number;
+    daily: { date: string; alerts: number; ips: number }[];
+    topIps: { ip: string; count: number; last: string; as?: string }[];
+    scenarios: { scenario: string; count: number }[];
+    latest: CompactAlert[];
+}
+
+function parseJsonArray<T>(text: string, what: string): T[] {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(text.trim().length === 0 ? "[]" : text);
+    } catch {
+        throw new ServiceError(`${what}: the guest returned no JSON`);
+    }
+    if (parsed === null) return [];
+    if (!Array.isArray(parsed)) throw new ServiceError(`${what}: expected a JSON array`);
+    return parsed as T[];
+}
+
+function compactAlert(a: CrowdsecAlert): CompactAlert {
+    return {
+        id: a.id,
+        at: a.created_at ?? "",
+        ip: a.source?.ip ?? "?",
+        scenario: a.scenario ?? "?",
+        events: a.events_count ?? 0,
+        decisions: (a.decisions ?? []).map((d) => `${d.type ?? "?"} ${d.duration ?? ""}`.trim()),
+        country: a.source?.cn,
+        as: a.source?.as_name === undefined ? undefined : `AS${a.source.as_number ?? "?"} ${a.source.as_name}`,
+    };
+}
+
+/** Compacts `cscli alerts list -o json` to counts, per-day activity, repeat sources, scenarios, and the latest alerts. */
+export function summariseAlerts(text: string, days: number, ip?: string): AlertSummary {
+    const alerts = parseJsonArray<CrowdsecAlert>(text, "alerts").filter((a) => a.source?.ip !== undefined && (ip === undefined || a.source.ip === ip));
+    const byIp = new Map<string, CrowdsecAlert[]>();
+    const byDay = new Map<string, CrowdsecAlert[]>();
+    const byScenario = new Map<string, number>();
+    for (const a of alerts) {
+        const source = a.source?.ip ?? "?";
+        byIp.set(source, [...(byIp.get(source) ?? []), a]);
+        const day = (a.created_at ?? "").slice(0, 10);
+        byDay.set(day, [...(byDay.get(day) ?? []), a]);
+        byScenario.set(a.scenario ?? "?", (byScenario.get(a.scenario ?? "?") ?? 0) + 1);
+    }
+    const sorted = [...alerts].sort((x, y) => (y.created_at ?? "").localeCompare(x.created_at ?? ""));
+    return {
+        days,
+        ip,
+        count: alerts.length,
+        uniqueIps: byIp.size,
+        repeatIps: [...byIp.values()].filter((list) => list.length > 1).length,
+        daily: [...byDay.entries()].sort().map(([date, list]) => ({ date, alerts: list.length, ips: new Set(list.map((a) => a.source?.ip)).size })),
+        topIps: [...byIp.entries()]
+            .map(([source, list]) => ({
+                ip: source,
+                count: list.length,
+                last: list.map((a) => a.created_at ?? "").sort().at(-1) ?? "",
+                as: compactAlert(list[0]).as,
+            }))
+            .sort((x, y) => y.count - x.count || x.ip.localeCompare(y.ip))
+            .slice(0, 10),
+        scenarios: [...byScenario.entries()].map(([scenario, count]) => ({ scenario, count })).sort((x, y) => y.count - x.count),
+        latest: (ip === undefined ? sorted.slice(0, 20) : sorted).map(compactAlert),
+    };
+}
+
+interface CrowdsecDecision {
+    id?: number;
+    value?: string;
+    scope?: string;
+    type?: string;
+    duration?: string;
+    scenario?: string;
+    origin?: string;
+}
+
+/** Keeps the fields an operator needs from `cscli decisions list -o json`. */
+export function compactDecisions(text: string): { count: number; decisions: CrowdsecDecision[] } {
+    const decisions = parseJsonArray<CrowdsecDecision>(text, "decisions").map(({ id, value, scope, type, duration, scenario, origin }) => ({
+        id,
+        value,
+        scope,
+        type,
+        duration,
+        scenario,
+        origin,
+    }));
+    return { count: decisions.length, decisions };
+}
+
+interface WazuhAlert {
+    timestamp?: string;
+    rule?: { id?: string; level?: number; description?: string };
+    agent?: { name?: string };
+    data?: { srcip?: string };
+    full_log?: string;
+}
+
+interface WazuhGroup {
+    rule: string;
+    level: number;
+    description: string;
+    agent: string;
+    count: number;
+    last: string;
+}
+
+export interface WazuhSummary {
+    days: number;
+    minLevel: number;
+    count: number;
+    groups: WazuhGroup[];
+    latest: { timestamp: string; agent: string; rule: string; level: number; description: string; srcip?: string; log?: string }[];
+}
+
+/** Filters newline-delimited Wazuh alerts by age and level, grouped by rule and agent. */
+export function summariseWazuh(text: string, days: number, minLevel: number, now = Date.now()): WazuhSummary {
+    const cutoff = now - days * 86_400_000;
+    const alerts: WazuhAlert[] = [];
+    for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0) continue;
+        let parsed: WazuhAlert;
+        try {
+            parsed = JSON.parse(trimmed) as WazuhAlert;
+        } catch {
+            continue;
+        }
+        const level = parsed.rule?.level ?? 0;
+        const time = parsed.timestamp === undefined ? Number.NaN : Date.parse(parsed.timestamp);
+        if (level < minLevel || Number.isNaN(time) || time < cutoff) continue;
+        alerts.push(parsed);
+    }
+    const groups = new Map<string, WazuhGroup>();
+    for (const a of alerts) {
+        const rule = a.rule?.id ?? "?";
+        const agent = a.agent?.name ?? "?";
+        const key = `${rule} ${agent}`;
+        const existing = groups.get(key);
+        const last = a.timestamp ?? "";
+        if (existing) {
+            existing.count++;
+            if (last > existing.last) existing.last = last;
+        } else {
+            groups.set(key, { rule, level: a.rule?.level ?? 0, description: a.rule?.description ?? "", agent, count: 1, last });
+        }
+    }
+    alerts.sort((x, y) => (y.timestamp ?? "").localeCompare(x.timestamp ?? ""));
+    return {
+        days,
+        minLevel,
+        count: alerts.length,
+        groups: [...groups.values()].sort((x, y) => y.level - x.level || y.count - x.count),
+        latest: alerts.slice(0, 20).map((a) => ({
+            timestamp: a.timestamp ?? "",
+            agent: a.agent?.name ?? "?",
+            rule: a.rule?.id ?? "?",
+            level: a.rule?.level ?? 0,
+            description: a.rule?.description ?? "",
+            srcip: a.data?.srcip,
+            log: a.full_log === undefined ? undefined : a.full_log.slice(0, 200),
+        })),
+    };
+}
+
+export async function command(args: string[]): Promise<number> {
+    if (args.length === 0 || args[0] === "--help" || args[0] === "help") {
+        printRaw(HELP);
+        return 0;
+    }
+    const config = readConfig<SecurityConfig>(SERVICE, SHAPE);
+    let minLevel: number | null = null;
+    let remoteArgs = args;
+    if (args[0] === "wazuh-alerts") {
+        if (args.length !== 3) throw new UsageError("wazuh-alerts <days> <minLevel>");
+        minLevel = positiveInt(args[2], "minLevel", 16);
+        remoteArgs = args.slice(0, 2);
+    }
+    const remote = buildObsRemote(remoteArgs);
+    const result = await sshFixed(
+        {
+            host: config.obsHost,
+            user: config.obsUser,
+            keyFile: secretPath(SERVICE, "SSH_KEY_OBS"),
+            knownHostsFile: join(specialistsHome(), "config", "known_hosts"),
+        },
+        remote,
+        120_000,
+    );
+    if (result.code !== 0) throw new ServiceError(result.stderr.trim() || `${args[0]} exited ${result.code}`);
+    switch (args[0]) {
+        case "wazuh-alerts":
+            printJson(summariseWazuh(result.stdout, Number(args[1]), minLevel ?? 0));
+            return 0;
+        case "alerts":
+            printJson(summariseAlerts(result.stdout, Number(args[1]), args[2]));
+            return 0;
+        case "decisions":
+            printJson(compactDecisions(result.stdout));
+            return 0;
+        default:
+            if (result.stdout.length > 0) printRaw(result.stdout);
+            return 0;
+    }
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {
+    await main(SERVICE, command);
+}

package/specialists/wrappers.test.ts

@@ -2,10 +2,14 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { refusedPrefix, safeRepoPath, command as arcaneCommand } from "./arcane/run.ts";
+import { refusedPrefix, command as arcaneCommand } from "./arcane/run.ts";
+import { parseParams, parseRecordFilters, technitiumRequest, command as dnsCommand } from "./dns/run.ts";
+import { buildVpsRemote, command as edgeCommand } from "./edge/run.ts";
 import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityCommand } from "./identity/run.ts";
 import { UsageError } from "./lib/errors.ts";
+import { safeRepoPath, safeWritePath } from "./lib/repo.ts";
 import { buildPulsarRemote, parseQuery, unifiPath, command as networkCommand } from "./network/run.ts";
+import { buildObsRemote, compactDecisions, summariseAlerts, summariseWazuh, command as securityCommand } from "./security/run.ts";
 
 describe("arcane wrapper", () => {
     it("refuses only the wrapper's own setup paths", () => {
@@ -25,6 +29,10 @@ describe("arcane wrapper", () => {
         for (const bad of ["", "/etc/passwd", "../x", "a/../../b", ".git/config", "a\0b"]) {
             expect(() => safeRepoPath(dir, bad), bad).toThrow(UsageError);
         }
+        expect(safeWritePath(dir, "00-frontdoor-vps/nginx.conf", "00-frontdoor-vps")).toBe("/repo/00-frontdoor-vps/nginx.conf");
+        expect(() => safeWritePath(dir, "00-frontdoor-vps", "00-frontdoor-vps")).toThrow(/limited to/);
+        expect(() => safeWritePath(dir, "02-pulsar-proxmox/dmz/config.yaml", "00-frontdoor-vps")).toThrow(/limited to/);
+        expect(() => safeWritePath(dir, "00-frontdoor-vps-other/x", "00-frontdoor-vps")).toThrow(/limited to/);
     });
 
     it("prints help without touching config", async () => {
@@ -99,6 +107,158 @@ describe("network wrapper", () => {
     });
 });
 
+describe("dns wrapper", () => {
+    it("maps technitium commands to documented API paths", () => {
+        expect(technitiumRequest("catalog.invalid", ["zones"])).toEqual({ path: "/api/zones/list", params: {}, write: false });
+        expect(technitiumRequest("catalog.invalid", ["zones", "*.37pla.net"])).toEqual({ path: "/api/zones/list", params: { filterName: "*.37pla.net" }, write: false });
+        expect(technitiumRequest("catalog.invalid", ["records", "37pla.net"])).toEqual({
+            path: "/api/zones/records/get",
+            params: { domain: "37pla.net", zone: "37pla.net", listZone: "true" },
+            write: false,
+        });
+        expect(technitiumRequest("catalog.invalid", ["records", "37pla.net", "kuma.37pla.net"]).params.listZone).toBe("false");
+        expect(technitiumRequest("catalog.invalid", ["resolve", "auth.37pla.net"]).params).toEqual({ server: "this-server", domain: "auth.37pla.net", type: "A" });
+        expect(technitiumRequest("catalog.invalid", ["stats", "LastDay"]).params).toEqual({ type: "LastDay" });
+        expect(technitiumRequest("catalog.invalid", ["zone-create", "lab.test"])).toEqual({
+            path: "/api/zones/create",
+            params: { zone: "lab.test", type: "Primary", catalog: "catalog.invalid" },
+            write: true,
+        });
+        expect(technitiumRequest("catalog.invalid", ["record-add", "37pla.net", "kuma.37pla.net", "A", "ipAddress=10.0.40.30", "ttl=300"])).toEqual({
+            path: "/api/zones/records/add",
+            params: { ipAddress: "10.0.40.30", ttl: "300", zone: "37pla.net", domain: "kuma.37pla.net", type: "A" },
+            write: true,
+        });
+        expect(technitiumRequest("catalog.invalid", ["record-delete", "37pla.net", "kuma.37pla.net", "A", "ipAddress=10.0.40.30"]).path).toBe("/api/zones/records/delete");
+    });
+
+    it("rejects malformed names, types, and parameters", () => {
+        expect(() => technitiumRequest("c", ["records", "bad zone"])).toThrow(/DNS name/);
+        expect(() => technitiumRequest("c", ["record-add", "z.test", "a.z.test", "a", "ipAddress=1.2.3.4"])).toThrow(/record type/);
+        expect(() => technitiumRequest("c", ["record-add", "z.test", "a.z.test", "A", "ipAddress"])).toThrow(/key=value/);
+        expect(() => technitiumRequest("c", ["record-add", "z.test", "a.z.test", "A", "token=x"])).toThrow(/parameter name/);
+        expect(() => technitiumRequest("c", ["record-add", "z.test", "a.z.test", "A", "zone=other"])).toThrow(/positional/);
+        expect(() => technitiumRequest("c", ["stats", "Forever"])).toThrow(/stats type/);
+        expect(() => technitiumRequest("c", ["zone-delete"])).toThrow(/1 argument/);
+        expect(() => technitiumRequest("c", ["settings"])).toThrow(/unknown technitium command/);
+        expect(parseParams(["comments=a=b"])).toEqual({ comments: "a=b" });
+    });
+
+    it("parses cloudflare record filters", () => {
+        const { zone, query } = parseRecordFilters(["37pla.net", "--type", "A", "--name", "kuma.37pla.net"]);
+        expect(zone).toBe("37pla.net");
+        expect(query.get("type")).toBe("A");
+        expect(query.get("name")).toBe("kuma.37pla.net");
+        expect(() => parseRecordFilters([])).toThrow(UsageError);
+        expect(() => parseRecordFilters(["37pla.net", "--proxied"])).toThrow(/unknown option/);
+        expect(() => parseRecordFilters(["37pla.net", "--type", "a"])).toThrow(/record type/);
+    });
+
+    it("prints help without touching config", async () => {
+        const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+        expect(await dnsCommand(["--help"])).toBe(0);
+        expect(String(write.mock.calls[0][0])).toContain("cloudflare record-add");
+        write.mockRestore();
+    });
+});
+
+describe("edge wrapper", () => {
+    it("maps vps commands and requires reboot confirmation", () => {
+        expect(buildVpsRemote(["status"])).toEqual({ remote: "status", stdin: false });
+        expect(buildVpsRemote(["deploy-nginx"])).toEqual({ remote: "deploy-nginx", stdin: true });
+        expect(buildVpsRemote(["journal", "wg-quick@wg0", "2 hours ago"])).toEqual({ remote: "journal wg-quick@wg0 2 hours ago", stdin: false });
+        expect(buildVpsRemote(["reboot", "--confirm"])).toEqual({ remote: "reboot", stdin: false });
+        expect(() => buildVpsRemote(["reboot"])).toThrow(/--confirm/);
+        expect(() => buildVpsRemote(["journal", "sshd", "1 hour ago"])).toThrow(/unit/);
+        expect(() => buildVpsRemote(["journal", "nginx", "x; rm -rf /"])).toThrow(/since/);
+        expect(() => buildVpsRemote(["wg", "extra"])).toThrow(/0 argument/);
+        expect(() => buildVpsRemote(["shell"])).toThrow(/unknown vps command/);
+    });
+
+    it("prints help without touching config", async () => {
+        const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+        expect(await edgeCommand([])).toBe(0);
+        expect(String(write.mock.calls[0][0])).toContain("deploy-nginx");
+        expect(String(write.mock.calls[0][0])).toContain("git write");
+        write.mockRestore();
+    });
+});
+
+describe("security wrapper", () => {
+    it("maps commands to fixed remote strings and validates arguments", () => {
+        expect(buildObsRemote(["attention"])).toBe("attention");
+        expect(buildObsRemote(["alerts", "7"])).toBe("alerts 7");
+        expect(buildObsRemote(["alerts", "7", "45.79.207.181"])).toBe("alerts 7 45.79.207.181");
+        expect(buildObsRemote(["remote-log", "frontdoor-1337", "nginx-stream", "200"])).toBe("remote-log frontdoor-1337 nginx-stream 200");
+        expect(buildObsRemote(["journal", "crowdsec", "1 hour ago"])).toBe("journal crowdsec 1 hour ago");
+        expect(() => buildObsRemote(["alerts", "0"])).toThrow(/days/);
+        expect(() => buildObsRemote(["alerts", "7", "evil.host"])).toThrow(/IPv4/);
+        expect(() => buildObsRemote(["remote-log", "../etc", "passwd", "10"])).toThrow(/host/);
+        expect(() => buildObsRemote(["remote-log", "frontdoor-1337", "nginx-stream", "5000"])).toThrow(/lines/);
+        expect(() => buildObsRemote(["journal", "sshd", "1 hour ago"])).toThrow(/unit/);
+        expect(() => buildObsRemote(["ban", "1.2.3.4"])).toThrow(/unknown command/);
+    });
+
+    it("summarises wazuh alerts by age and level", () => {
+        const now = Date.parse("2026-09-16T12:00:00Z");
+        const line = (ts: string, level: number, id: string, agent: string) =>
+            JSON.stringify({ timestamp: ts, rule: { id, level, description: `rule ${id}` }, agent: { name: agent }, data: { srcip: "1.2.3.4" }, full_log: "x".repeat(300) });
+        const text = [
+            line("2026-09-16T11:00:00.000+0000", 12, "100010", "dmz"),
+            line("2026-09-16T10:00:00.000+0000", 12, "100010", "dmz"),
+            line("2026-09-16T09:00:00.000+0000", 5, "5501", "dmz"),
+            line("2026-09-10T09:00:00.000+0000", 15, "100011", "arcane"),
+            "not json",
+        ].join("\n");
+        const summary = summariseWazuh(text, 2, 10, now);
+        expect(summary.count).toBe(2);
+        expect(summary.groups).toEqual([{ rule: "100010", level: 12, description: "rule 100010", agent: "dmz", count: 2, last: "2026-09-16T11:00:00.000+0000" }]);
+        expect(summary.latest[0].timestamp).toBe("2026-09-16T11:00:00.000+0000");
+        expect(summary.latest[0].log?.length).toBe(200);
+        expect(summariseWazuh(text, 30, 15, now).count).toBe(1);
+    });
+
+    it("compacts crowdsec alerts and decisions", () => {
+        const alert = (id: number, at: string, ip: string, scenario: string) => ({
+            id,
+            created_at: at,
+            scenario,
+            events_count: 3,
+            source: { ip, range: `${ip}/24`, as_number: "63949", as_name: "Akamai", cn: "US" },
+            decisions: [{ type: "ban", duration: "4h", value: ip }],
+        });
+        const text = JSON.stringify([
+            alert(1, "2026-09-15T10:00:00Z", "45.79.207.181", "37pla/frontdoor-sni-scanning"),
+            alert(2, "2026-09-16T10:00:00Z", "45.79.207.181", "37pla/frontdoor-sni-scanning"),
+            alert(3, "2026-09-16T11:00:00Z", "203.0.113.9", "37pla/pomerium-http-probing"),
+            { id: 4, created_at: "2026-09-16T12:00:00Z", scenario: "list", source: {} },
+        ]);
+        const summary = summariseAlerts(text, 7);
+        expect(summary).toMatchObject({ days: 7, count: 3, uniqueIps: 2, repeatIps: 1 });
+        expect(summary.daily).toEqual([
+            { date: "2026-09-15", alerts: 1, ips: 1 },
+            { date: "2026-09-16", alerts: 2, ips: 2 },
+        ]);
+        expect(summary.topIps[0]).toEqual({ ip: "45.79.207.181", count: 2, last: "2026-09-16T10:00:00Z", as: "AS63949 Akamai" });
+        expect(summary.scenarios[0]).toEqual({ scenario: "37pla/frontdoor-sni-scanning", count: 2 });
+        expect(summary.latest[0]).toMatchObject({ id: 3, ip: "203.0.113.9", decisions: ["ban 4h"], country: "US" });
+        expect(summariseAlerts(text, 7, "45.79.207.181").latest.map((a) => a.id)).toEqual([2, 1]);
+        expect(summariseAlerts("null", 7)).toMatchObject({ count: 0, uniqueIps: 0 });
+        expect(compactDecisions(JSON.stringify([{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec", extra: 1 }]))).toEqual({
+            count: 1,
+            decisions: [{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec" }],
+        });
+        expect(() => summariseAlerts("not json", 7)).toThrow(/no JSON/);
+    });
+
+    it("prints help without touching config", async () => {
+        const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+        expect(await securityCommand(["help"])).toBe(0);
+        expect(String(write.mock.calls[0][0])).toContain("remote-log <host> <program> <lines>");
+        write.mockRestore();
+    });
+});
+
 describe("wrapper config errors", () => {
     let home: string;
     const originalHome = process.env.HOME;
@@ -116,5 +276,8 @@ describe("wrapper config errors", () => {
     it("fails clearly when the config file is absent", async () => {
         await expect(arcaneCommand(["projects", "list"])).rejects.toThrow(/cannot read .*arcane\.json/);
         await expect(networkCommand(["unifi", "sites"])).rejects.toThrow(/network\.json/);
+        await expect(dnsCommand(["technitium", "primary", "zones"])).rejects.toThrow(/dns\.json/);
+        await expect(edgeCommand(["probe"])).rejects.toThrow(/edge\.json/);
+        await expect(securityCommand(["attention"])).rejects.toThrow(/security\.json/);
     });
 });