@astrofoundry/pi-astro 0.19.3 → 0.19.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.19.3",
+  "version": "0.19.4",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/security/SKILL.md

@@ -15,7 +15,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | `attention` | JSON: `bouncer` (count, oldest pull age), `wazuh_agents` (active/total, list), `recent_high_alerts` (24 h, level ≥ 10), `health_issues` |
 | `agents` | `agent_control -l` |
 | `alerts <days> [ip]` | summary: `count`, `uniqueIps`, `repeatIps`, `daily`, `topIps` (10), `scenarios`, `latest` (20 compact alerts: `at`, `ip`, `scenario`, `events`, `decisions`, `country`, `as`); with `ip`, `latest` holds every alert of that address |
-| `decisions` | `count` and compact active decisions (`value`, `scope`, `type`, `duration`, `scenario`, `origin`) |
+| `decisions` | `count` and one row per active decision (`value`, `scope`, `type`, `duration`, `scenario`, `origin`, `alertId`, `country`) |
 | `bouncers` | bouncers JSON (`name`, `last_pull`, `revoked`) |
 | `metrics` | `cscli metrics -o json` |
 | `wazuh-alerts <days> <minLevel>` | summary: count, groups by rule and agent, latest 20 (log line truncated to 200 chars) |

package/specialists/security/run.ts

@@ -92,7 +92,7 @@ interface CrowdsecAlert {
     scenario?: string;
     events_count?: number;
     source?: { ip?: string; range?: string; as_number?: string; as_name?: string; cn?: string };
-    decisions?: { type?: string; duration?: string; value?: string }[];
+    decisions?: CrowdsecDecision[];
 }
 
 interface CompactAlert {
@@ -188,17 +188,32 @@ interface CrowdsecDecision {
     origin?: string;
 }
 
-/** Keeps the fields an operator needs from `cscli decisions list -o json`. */
-export function compactDecisions(text: string): { count: number; decisions: CrowdsecDecision[] } {
-    const decisions = parseJsonArray<CrowdsecDecision>(text, "decisions").map(({ id, value, scope, type, duration, scenario, origin }) => ({
-        id,
-        value,
-        scope,
-        type,
-        duration,
-        scenario,
-        origin,
-    }));
+interface CompactDecision extends CrowdsecDecision {
+    alertId?: number;
+    country?: string;
+}
+
+/**
+ * `cscli decisions list -o json` returns alerts, each with its active decisions
+ * (the table's ALERT ID, COUNTRY, and AS columns are alert fields). Flattens to one row per decision.
+ */
+export function compactDecisions(text: string): { count: number; decisions: CompactDecision[] } {
+    const decisions: CompactDecision[] = [];
+    for (const alert of parseJsonArray<CrowdsecAlert & { decisions?: CrowdsecDecision[] }>(text, "decisions")) {
+        for (const d of alert.decisions ?? []) {
+            decisions.push({
+                id: d.id,
+                value: d.value,
+                scope: d.scope,
+                type: d.type,
+                duration: d.duration,
+                scenario: d.scenario ?? alert.scenario,
+                origin: d.origin,
+                alertId: alert.id,
+                country: alert.source?.cn,
+            });
+        }
+    }
     return { count: decisions.length, decisions };
 }
 

package/specialists/wrappers.test.ts

@@ -244,9 +244,18 @@ describe("security wrapper", () => {
         expect(summary.latest[0]).toMatchObject({ id: 3, ip: "203.0.113.9", decisions: ["ban 4h"], country: "US" });
         expect(summariseAlerts(text, 7, "45.79.207.181").latest.map((a) => a.id)).toEqual([2, 1]);
         expect(summariseAlerts("null", 7)).toMatchObject({ count: 0, uniqueIps: 0 });
-        expect(compactDecisions(JSON.stringify([{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec", extra: 1 }]))).toEqual({
+        const decisionsText = JSON.stringify([
+            {
+                id: 364,
+                scenario: "37pla/frontdoor-sni-scanning",
+                source: { ip: "203.0.113.9", cn: "US" },
+                decisions: [{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", origin: "crowdsec", simulated: false }],
+            },
+            { id: 365, scenario: "x", source: {}, decisions: [] },
+        ]);
+        expect(compactDecisions(decisionsText)).toEqual({
             count: 1,
-            decisions: [{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "x", origin: "crowdsec" }],
+            decisions: [{ id: 9, value: "203.0.113.9", scope: "Ip", type: "ban", duration: "3h59m", scenario: "37pla/frontdoor-sni-scanning", origin: "crowdsec", alertId: 364, country: "US" }],
         });
         expect(() => summariseAlerts("not json", 7)).toThrow(/no JSON/);
     });