@astrofoundry/pi-astro 0.19.0 → 0.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/security/SKILL.md

@@ -14,8 +14,8 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | `status` | unit states and running containers |
 | `attention` | JSON: `bouncer` (count, oldest pull age), `wazuh_agents` (active/total, list), `recent_high_alerts` (24 h, level ≥ 10), `health_issues` |
 | `agents` | `agent_control -l` |
-| `alerts <days> [ip]` | CrowdSec alerts JSON (`source.ip`, `scenario`, `created_at`, `decisions`) |
-| `decisions` | active decisions JSON (`value`, `duration`, `scenario`, `origin`) |
+| `alerts <days> [ip]` | summary: `count`, `uniqueIps`, `repeatIps`, `daily`, `topIps` (10), `scenarios`, `latest` (20 compact alerts: `at`, `ip`, `scenario`, `events`, `decisions`, `country`, `as`); with `ip`, `latest` holds every alert of that address |
+| `decisions` | `count` and compact active decisions (`value`, `scope`, `type`, `duration`, `scenario`, `origin`) |
 | `bouncers` | bouncers JSON (`name`, `last_pull`, `revoked`) |
 | `metrics` | `cscli metrics -o json` |
 | `wazuh-alerts <days> <minLevel>` | summary: count, groups by rule and agent, latest 20 (log line truncated to 200 chars) |

package/specialists/security/run.ts

@@ -21,8 +21,8 @@ export const OBS_COMMANDS: Readonly<Record<string, { args: [number, number]; hel
     status: { args: [0, 0], help: "unit states and running containers" },
     attention: { args: [0, 0], help: "security-attention status: bouncer freshness, Wazuh agents, recent high alerts (JSON)" },
     agents: { args: [0, 0], help: "Wazuh agent_control -l" },
-    alerts: { args: [1, 2], help: "alerts <days> [ip]         CrowdSec alerts since N days, optionally one source IP (JSON)" },
-    decisions: { args: [0, 0], help: "active CrowdSec decisions (JSON)" },
+    alerts: { args: [1, 2], help: "alerts <days> [ip]         CrowdSec alerts since N days: counts, daily, top IPs, scenarios, latest 20; with ip: every alert of that IP" },
+    decisions: { args: [0, 0], help: "active CrowdSec decisions, compact (JSON)" },
     bouncers: { args: [0, 0], help: "registered CrowdSec bouncers with last pull (JSON)" },
     metrics: { args: [0, 0], help: "cscli metrics (JSON)" },
     "wazuh-alerts": { args: [1, 1], help: "wazuh-alerts <days> <minLevel>   Wazuh alerts since N days at or above a level, summarised" },
@@ -86,6 +86,122 @@ export function buildObsRemote(args: string[]): string {
     return [name, ...rest].join(" ");
 }
 
+interface CrowdsecAlert {
+    id?: number;
+    created_at?: string;
+    scenario?: string;
+    events_count?: number;
+    source?: { ip?: string; range?: string; as_number?: string; as_name?: string; cn?: string };
+    decisions?: { type?: string; duration?: string; value?: string }[];
+}
+
+interface CompactAlert {
+    id?: number;
+    at: string;
+    ip: string;
+    scenario: string;
+    events: number;
+    decisions: string[];
+    country?: string;
+    as?: string;
+}
+
+export interface AlertSummary {
+    days: number;
+    ip?: string;
+    count: number;
+    uniqueIps: number;
+    repeatIps: number;
+    daily: { date: string; alerts: number; ips: number }[];
+    topIps: { ip: string; count: number; last: string; as?: string }[];
+    scenarios: { scenario: string; count: number }[];
+    latest: CompactAlert[];
+}
+
+function parseJsonArray<T>(text: string, what: string): T[] {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(text.trim().length === 0 ? "[]" : text);
+    } catch {
+        throw new ServiceError(`${what}: the guest returned no JSON`);
+    }
+    if (parsed === null) return [];
+    if (!Array.isArray(parsed)) throw new ServiceError(`${what}: expected a JSON array`);
+    return parsed as T[];
+}
+
+function compactAlert(a: CrowdsecAlert): CompactAlert {
+    return {
+        id: a.id,
+        at: a.created_at ?? "",
+        ip: a.source?.ip ?? "?",
+        scenario: a.scenario ?? "?",
+        events: a.events_count ?? 0,
+        decisions: (a.decisions ?? []).map((d) => `${d.type ?? "?"} ${d.duration ?? ""}`.trim()),
+        country: a.source?.cn,
+        as: a.source?.as_name === undefined ? undefined : `AS${a.source.as_number ?? "?"} ${a.source.as_name}`,
+    };
+}
+
+/** Compacts `cscli alerts list -o json` to counts, per-day activity, repeat sources, scenarios, and the latest alerts. */
+export function summariseAlerts(text: string, days: number, ip?: string): AlertSummary {
+    const alerts = parseJsonArray<CrowdsecAlert>(text, "alerts").filter((a) => a.source?.ip !== undefined && (ip === undefined || a.source.ip === ip));
+    const byIp = new Map<string, CrowdsecAlert[]>();
+    const byDay = new Map<string, CrowdsecAlert[]>();
+    const byScenario = new Map<string, number>();
+    for (const a of alerts) {
+        const source = a.source?.ip ?? "?";
+        byIp.set(source, [...(byIp.get(source) ?? []), a]);
+        const day = (a.created_at ?? "").slice(0, 10);
+        byDay.set(day, [...(byDay.get(day) ?? []), a]);
+        byScenario.set(a.scenario ?? "?", (byScenario.get(a.scenario ?? "?") ?? 0) + 1);
+    }
+    const sorted = [...alerts].sort((x, y) => (y.created_at ?? "").localeCompare(x.created_at ?? ""));
+    return {
+        days,
+        ip,
+        count: alerts.length,
+        uniqueIps: byIp.size,
+        repeatIps: [...byIp.values()].filter((list) => list.length > 1).length,
+        daily: [...byDay.entries()].sort().map(([date, list]) => ({ date, alerts: list.length, ips: new Set(list.map((a) => a.source?.ip)).size })),
+        topIps: [...byIp.entries()]
+            .map(([source, list]) => ({
+                ip: source,
+                count: list.length,
+                last: list.map((a) => a.created_at ?? "").sort().at(-1) ?? "",
+                as: compactAlert(list[0]).as,
+            }))
+            .sort((x, y) => y.count - x.count || x.ip.localeCompare(y.ip))
+            .slice(0, 10),
+        scenarios: [...byScenario.entries()].map(([scenario, count]) => ({ scenario, count })).sort((x, y) => y.count - x.count),
+        latest: (ip === undefined ? sorted.slice(0, 20) : sorted).map(compactAlert),
+    };
+}
+
+interface CrowdsecDecision {
+    id?: number;
+    value?: string;
+    scope?: string;
+    type?: string;
+    duration?: string;
+    scenario?: string;
+    origin?: string;
+}
+
+/** Keeps the fields an operator needs from `cscli decisions list -o json`. */
+export function compactDecisions(text: string): { count: number; decisions: CrowdsecDecision[] } {
+    const decisions = parseJsonArray<CrowdsecDecision>(text, "decisions").map(({ id, value, scope, type, duration, scenario, origin }) => ({
+        id,
+        value,
+        scope,
+        type,
+        duration,
+        scenario,
+        origin,
+    }));
+    return { count: decisions.length, decisions };
+}
+
 interface WazuhAlert {
     timestamp?: string;
     rule?: { id?: string; level?: number; description?: string };
@@ -186,12 +302,20 @@ export async function command(args: string[]): Promise<number> {
         120_000,
     );
     if (result.code !== 0) throw new ServiceError(result.stderr.trim() || `${args[0]} exited ${result.code}`);
-    if (minLevel !== null) {
-        printJson(summariseWazuh(result.stdout, Number(args[1]), minLevel));
-        return 0;
+    switch (args[0]) {
+        case "wazuh-alerts":
+            printJson(summariseWazuh(result.stdout, Number(args[1]), minLevel ?? 0));
+            return 0;
+        case "alerts":
+            printJson(summariseAlerts(result.stdout, Number(args[1]), args[2]));
+            return 0;
+        case "decisions":
+            printJson(compactDecisions(result.stdout));
+            return 0;
+        default:
+            if (result.stdout.length > 0) printRaw(result.stdout);
+            return 0;
     }
-    if (result.stdout.length > 0) printRaw(result.stdout);
-    return 0;
 }
 
 if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {

package/specialists/wrappers.test.ts

@@ -9,7 +9,7 @@ import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityComma
 import { UsageError } from "./lib/errors.ts";
 import { safeRepoPath, safeWritePath } from "./lib/repo.ts";
 import { buildPulsarRemote, parseQuery, unifiPath, command as networkCommand } from "./network/run.ts";
-import { buildObsRemote, summariseWazuh, command as securityCommand } from "./security/run.ts";
+import { buildObsRemote, compactDecisions, summariseAlerts, summariseWazuh, command as securityCommand } from "./security/run.ts";
 
 describe("arcane wrapper", () => {
     it("refuses only the wrapper's own setup paths", () => {
@@ -218,6 +218,39 @@ describe("security wrapper", () => {
         expect(summariseWazuh(text, 30, 15, now).count).toBe(1);
     });
 
+    it("compacts crowdsec alerts and decisions", () => {
+        const alert = (id: number, at: string, ip: string, scenario: string) => ({
+            id,
+            created_at: at,
+            scenario,
+            events_count: 3,
+            source: { ip, range: `${ip}/24`, as_number: "63949", as_name: "Akamai", cn: "US" },
+            decisions: [{ type: "ban", duration: "4h", value: ip }],
+        });
+        const text = JSON.stringify([
+            alert(1, "2026-09-15T10:00:00Z", "45.79.207.181", "37pla/frontdoor-sni-scanning"),
+            alert(2, "2026-09-16T10:00:00Z", "45.79.207.181", "37pla/frontdoor-sni-scanning"),
+            alert(3, "2026-09-16T11:00:00Z", "203.0.113.9", "37pla/pomerium-http-probing"),
+            { id: 4, created_at: "2026-09-16T12:00:00Z", scenario: "list", source: {} },
+        ]);
+        const summary = summariseAlerts(text, 7);
+        expect(summary).toMatchObject({ days: 7, count: 3, uniqueIps: 2, repeatIps: 1 });
+        expect(summary.daily).toEqual([
+            { date: "2026-09-15", alerts: 1, ips: 1 },
+            { date: "2026-09-16", alerts: 2, ips: 2 },
+        ]);
+        expect(summary.topIps[0]).toEqual({ ip: "45.79.207.181", count: 2, last: "2026-09-16T10:00:00Z", as: "AS63949 Akamai" });
+        expect(summary.scenarios[0]).toEqual({ scenario: "37pla/frontdoor-sni-scanning", count: 2 });
+        expect(summary.latest[0]).toMatchObject({ id: 3, ip: "203.0.113.9", decisions: ["ban 4h"], country: "US" });
+        expect(summariseAlerts(text, 7, "45.79.207.181").latest.map((a) => a.id)).toEqual([2, 1]);
+        expect(summariseAlerts("null", 7)).toMatchObject({ count: 0, uniqueIps: 0 });
+        expect(compactDecisions(JSON.stringify([{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec", extra: 1 }]))).toEqual({
+            count: 1,
+            decisions: [{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec" }],
+        });
+        expect(() => summariseAlerts("not json", 7)).toThrow(/no JSON/);
+    });
+
     it("prints help without touching config", async () => {
         const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
         expect(await securityCommand(["help"])).toBe(0);