@clawops/cli 1.6.0 → 1.7.1

package/dist/harden-BDVYW567.js

@@ -0,0 +1,748 @@
+#!/usr/bin/env node
+import {
+  acquireSession,
+  drainPool
+} from "./chunk-LCKD7L7X.js";
+import "./chunk-GJEF6UQA.js";
+import "./chunk-KGXPLI7W.js";
+
+// src/harden/types.ts
+var SENTINEL_DIR = "/etc/clawops/hardening";
+
+// src/harden/runner.ts
+async function runHardening(conn, opts) {
+  const { session, release } = await acquireSession({
+    host: conn.host,
+    port: conn.port,
+    user: conn.user,
+    privateKeyPath: conn.privateKeyPath,
+    knownHostsPath: conn.knownHostsPath,
+    signal: opts.signal
+  });
+  const exec = (command, execOpts) => session.exec(command, execOpts?.signal ?? opts.signal);
+  const results = [];
+  try {
+    for (const mod of opts.modules) {
+      if (opts.signal?.aborted) break;
+      const start = Date.now();
+      let checkResult;
+      let applyResult;
+      let error;
+      try {
+        checkResult = await mod.check(exec);
+        if (!opts.dryRun && checkResult.status !== "applied") {
+          applyResult = await mod.apply(exec);
+        }
+      } catch (err) {
+        error = err instanceof Error ? err.message : String(err);
+        checkResult ??= { status: "drifted", detail: error };
+      }
+      const result = {
+        module: mod,
+        checkResult,
+        applyResult,
+        durationMs: Date.now() - start,
+        error
+      };
+      results.push(result);
+      opts.onProgress?.(result);
+    }
+  } finally {
+    release();
+    drainPool();
+  }
+  return results;
+}
+async function withRemoteExec(conn, signal, fn) {
+  const { session, release } = await acquireSession({
+    host: conn.host,
+    port: conn.port,
+    user: conn.user,
+    privateKeyPath: conn.privateKeyPath,
+    knownHostsPath: conn.knownHostsPath,
+    signal
+  });
+  try {
+    return await fn((cmd, opts) => session.exec(cmd, opts?.signal ?? signal));
+  } finally {
+    release();
+  }
+}
+function formatHardenSummary(results) {
+  const rows = results.map((r) => {
+    const icon = r.error ? "\u2717" : r.applyResult?.changed ? "\u2713" : r.checkResult.status === "applied" ? "\xB7" : "\u26A0";
+    const action = r.error ? "error" : r.applyResult?.changed ? "applied" : r.checkResult.status === "applied" ? "already ok" : "skipped (dry-run)";
+    const detail = r.error ?? r.applyResult?.detail ?? r.checkResult.detail;
+    return `  ${icon}  ${r.module.label.padEnd(30)} ${action.padEnd(16)} ${detail}`;
+  });
+  const changed = results.filter((r) => r.applyResult?.changed).length;
+  const errors = results.filter((r) => r.error).length;
+  const already = results.filter(
+    (r) => !r.error && !r.applyResult?.changed && r.checkResult.status === "applied"
+  ).length;
+  const summary = `
+  ${changed} applied  ${already} already ok  ${errors} errors`;
+  return rows.join("\n") + "\n" + summary + "\n";
+}
+function resolveModules(catalog, options, provider) {
+  const providerFiltered = catalog.filter(
+    (m) => m.providers === "all" || m.providers.includes(provider)
+  );
+  if (!options?.trim()) {
+    return providerFiltered.filter((m) => m.defaultOn);
+  }
+  const ids = new Set(options.split(",").map((s) => s.trim()).filter(Boolean));
+  return providerFiltered.filter((m) => ids.has(m.id));
+}
+
+// src/harden/modules/ssh.ts
+var SENTINEL = `${SENTINEL_DIR}/ssh.applied`;
+var SSHD_SETTINGS = [
+  "PermitRootLogin no",
+  "PasswordAuthentication no",
+  "MaxAuthTries 3",
+  "LoginGraceTime 30"
+];
+var sshModule = {
+  id: "ssh",
+  label: "SSH hardening",
+  defaultOn: true,
+  providers: "all",
+  async check(exec) {
+    const { stdout, code } = await exec(`test -f ${SENTINEL} && echo yes || echo no`);
+    if (code === 0 && stdout.trim() === "yes") {
+      return { status: "applied", detail: "sshd_config hardened (sentinel present)" };
+    }
+    const { stdout: cfg } = await exec(
+      `sshd -T 2>/dev/null | grep -E '^(permitrootlogin|passwordauthentication|maxauthtries|logingracetime)' || true`
+    );
+    const lines = cfg.toLowerCase();
+    const allApplied = lines.includes("permitrootlogin no") && lines.includes("passwordauthentication no") && lines.includes("maxauthtries 3") && lines.includes("logingracetime 30");
+    if (allApplied) {
+      return { status: "applied", detail: "sshd settings already hardened" };
+    }
+    return { status: "missing", detail: "sshd_config has insecure defaults" };
+  },
+  async apply(exec) {
+    const { stdout: authKeys } = await exec(
+      `cat /home/clawops/.ssh/authorized_keys 2>/dev/null || true`
+    );
+    if (!authKeys.trim()) {
+      throw new Error(
+        "SSH hardening aborted: /home/clawops/.ssh/authorized_keys is empty. Applying PasswordAuthentication=no without a key would lock out access."
+      );
+    }
+    const settings = SSHD_SETTINGS.map((s) => {
+      const [key] = s.split(" ");
+      return `sed -i "/^${key}/Id" /etc/ssh/sshd_config && echo "${s}" >> /etc/ssh/sshd_config`;
+    }).join(" && ");
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      settings,
+      "sshd -t",
+      // validate config before restarting
+      "systemctl restart sshd || systemctl restart ssh",
+      `touch ${SENTINEL}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`SSH hardening failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "sshd_config hardened and sshd restarted" };
+  }
+};
+
+// src/harden/modules/ufw.ts
+var SENTINEL2 = `${SENTINEL_DIR}/ufw.applied`;
+var GATEWAY_PORT = 18789;
+function makeUfwModule(sshPort = 22) {
+  return {
+    id: "ufw",
+    label: "UFW firewall",
+    defaultOn: true,
+    providers: "all",
+    async check(exec) {
+      const { stdout: sentinel } = await exec(`test -f ${SENTINEL2} && echo yes || echo no`);
+      if (sentinel.trim() === "yes") {
+        return { status: "applied", detail: "UFW configured (sentinel present)" };
+      }
+      const { stdout } = await exec(`ufw status 2>/dev/null || echo 'not installed'`);
+      if (stdout.includes("Status: active")) {
+        return { status: "applied", detail: "UFW already active" };
+      }
+      if (stdout.includes("not installed")) {
+        return { status: "missing", detail: "UFW not installed" };
+      }
+      return { status: "missing", detail: "UFW installed but not active" };
+    },
+    async apply(exec) {
+      const script = [
+        `mkdir -p ${SENTINEL_DIR}`,
+        "apt-get install -y -q ufw",
+        "ufw --force reset",
+        "ufw default deny incoming",
+        "ufw default allow outgoing",
+        `ufw allow ${sshPort}/tcp comment "clawops SSH"`,
+        `ufw allow ${GATEWAY_PORT}/tcp comment "OpenClaw gateway"`,
+        "ufw --force enable",
+        `touch ${SENTINEL2}`
+      ].join(" && ");
+      const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+      if (code !== 0) {
+        throw new Error(`UFW setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
+      }
+      return { changed: true, detail: `UFW enabled: deny-all in, allow ${sshPort}/tcp + ${GATEWAY_PORT}/tcp` };
+    }
+  };
+}
+var ufwModule = makeUfwModule();
+
+// src/harden/modules/fail2ban.ts
+var SENTINEL3 = `${SENTINEL_DIR}/fail2ban.applied`;
+var JAIL_CONF = `[sshd]
+enabled  = true
+port     = ssh
+maxretry = 5
+bantime  = 600
+findtime = 600
+`;
+var fail2banModule = {
+  id: "fail2ban",
+  label: "Fail2ban (SSH jail)",
+  defaultOn: true,
+  providers: "all",
+  async check(exec) {
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL3} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+      return { status: "applied", detail: "fail2ban configured (sentinel present)" };
+    }
+    const { stdout: active } = await exec(
+      `systemctl is-active fail2ban 2>/dev/null || echo inactive`
+    );
+    if (active.trim() === "active") {
+      return { status: "applied", detail: "fail2ban already running" };
+    }
+    const { stdout: installed } = await exec(
+      `dpkg -l fail2ban 2>/dev/null | grep -c '^ii' || echo 0`
+    );
+    if (parseInt(installed.trim(), 10) > 0) {
+      return { status: "drifted", detail: "fail2ban installed but not running" };
+    }
+    return { status: "missing", detail: "fail2ban not installed" };
+  },
+  async apply(exec) {
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      "apt-get install -y -q fail2ban",
+      `printf '%s' ${shellQuote(JAIL_CONF)} > /etc/fail2ban/jail.local`,
+      "systemctl enable --now fail2ban",
+      "systemctl restart fail2ban",
+      `touch ${SENTINEL3}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`fail2ban setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "fail2ban installed with SSH jail (maxretry=5, bantime=600s)" };
+  }
+};
+function shellQuote(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+
+// src/harden/modules/unattended-upgrades.ts
+var SENTINEL4 = `${SENTINEL_DIR}/unattended-upgrades.applied`;
+var AUTO_UPGRADES_CONF = `APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";
+`;
+var unattendedUpgradesModule = {
+  id: "unattended-upgrades",
+  label: "Automatic security updates",
+  defaultOn: true,
+  providers: "all",
+  async check(exec) {
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL4} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+      return { status: "applied", detail: "unattended-upgrades configured (sentinel present)" };
+    }
+    const { stdout } = await exec(
+      `test -f /etc/apt/apt.conf.d/20auto-upgrades && cat /etc/apt/apt.conf.d/20auto-upgrades || echo ''`
+    );
+    if (stdout.includes('Unattended-Upgrade "1"')) {
+      return { status: "applied", detail: "unattended-upgrades already enabled" };
+    }
+    return { status: "missing", detail: "unattended-upgrades not configured" };
+  },
+  async apply(exec) {
+    const confEscaped = AUTO_UPGRADES_CONF.replace(/'/g, "'\\''");
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      "apt-get install -y -q unattended-upgrades",
+      `printf '%s' '${confEscaped}' > /etc/apt/apt.conf.d/20auto-upgrades`,
+      "systemctl enable --now unattended-upgrades",
+      `touch ${SENTINEL4}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`unattended-upgrades setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "unattended-upgrades enabled for security updates" };
+  }
+};
+
+// src/harden/modules/docker-socket.ts
+var SENTINEL5 = `${SENTINEL_DIR}/docker-socket.applied`;
+var dockerSocketModule = {
+  id: "docker-socket",
+  label: "Docker socket permissions",
+  defaultOn: true,
+  providers: "all",
+  async check(exec) {
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL5} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+    }
+    const { stdout, code } = await exec(
+      `stat -c '%U %G %a' /var/run/docker.sock 2>/dev/null || echo 'not found'`
+    );
+    const trimmed = stdout.trim();
+    if (trimmed === "not found" || code !== 0) {
+      return { status: "skipped", detail: "Docker socket not present (Docker not running?)" };
+    }
+    const [owner, group, perms] = trimmed.split(" ");
+    if (owner === "root" && group === "docker" && perms === "660") {
+      return { status: "applied", detail: "docker.sock is root:docker 660" };
+    }
+    return {
+      status: "drifted",
+      detail: `docker.sock is ${owner}:${group} ${perms} (expected root:docker 660)`
+    };
+  },
+  async apply(exec) {
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      "chown root:docker /var/run/docker.sock",
+      "chmod 660 /var/run/docker.sock",
+      `touch ${SENTINEL5}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`docker socket fix failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "docker.sock set to root:docker 660" };
+  }
+};
+
+// src/harden/modules/auditd.ts
+var SENTINEL6 = `${SENTINEL_DIR}/auditd.applied`;
+var AUDIT_RULES = `-a always,exit -F arch=b64 -S execve -F euid=0 -k privileged
+-a always,exit -F arch=b64 -S open,openat -F dir=/etc/ssh -F perm=wa -k sshd_config
+-a always,exit -F arch=b64 -S open,openat -F dir=/etc/clawops -F perm=wa -k clawops_config
+-e 2
+`;
+var auditdModule = {
+  id: "auditd",
+  label: "auditd (kernel audit logging)",
+  defaultOn: false,
+  providers: "all",
+  async check(exec) {
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL6} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+      return { status: "applied", detail: "auditd configured (sentinel present)" };
+    }
+    const { stdout: active } = await exec(
+      `systemctl is-active auditd 2>/dev/null || echo inactive`
+    );
+    if (active.trim() === "active") {
+      return { status: "applied", detail: "auditd already running" };
+    }
+    return { status: "missing", detail: "auditd not installed or not running" };
+  },
+  async apply(exec) {
+    const rulesEscaped = AUDIT_RULES.replace(/'/g, "'\\''");
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      "apt-get install -y -q auditd",
+      `printf '%s' '${rulesEscaped}' > /etc/audit/rules.d/clawops.rules`,
+      "augenrules --load || auditctl -R /etc/audit/rules.d/clawops.rules",
+      "systemctl enable --now auditd",
+      `touch ${SENTINEL6}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`auditd setup failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "auditd installed with CIS-aligned rules" };
+  }
+};
+
+// src/harden/modules/lynis.ts
+import path from "path";
+import os from "os";
+import { mkdirSync, writeFileSync } from "fs";
+var SENTINEL7 = `${SENTINEL_DIR}/lynis.applied`;
+var lynisModule = {
+  id: "lynis",
+  label: "CIS Level 1 report (lynis)",
+  defaultOn: false,
+  providers: "all",
+  async check(exec) {
+    const { stdout: installed } = await exec(`which lynis 2>/dev/null || echo ''`);
+    if (!installed.trim()) {
+      return { status: "missing", detail: "lynis not installed (will install on apply)" };
+    }
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL7} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+      return { status: "applied", detail: "lynis audit has been run (sentinel present)" };
+    }
+    return { status: "missing", detail: "lynis installed but audit not yet run" };
+  },
+  async apply(exec, stackName) {
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      "apt-get install -y -q lynis",
+      // Run non-interactively; pipe stdout + stderr to a tmp file
+      "lynis audit system --no-colors --quick 2>&1 | tee /tmp/lynis-report.txt || true",
+      `touch ${SENTINEL7}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`lynis run failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    const { stdout: report } = await exec('cat /tmp/lynis-report.txt 2>/dev/null || echo ""');
+    const scoreMatch = report.match(/Hardening index\s*:\s*(\d+)/i);
+    const score = scoreMatch ? scoreMatch[1] : "unknown";
+    const suggestions = report.split("\n").filter((l) => l.includes("Suggestion") || l.includes("[suggestion]")).slice(0, 5).map((l) => l.trim());
+    const reportsDir = path.join(os.homedir(), ".clawops", "reports");
+    mkdirSync(reportsDir, { recursive: true });
+    const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const name = stackName ?? "stack";
+    const reportPath = path.join(reportsDir, `${name}-lynis-${date}.txt`);
+    writeFileSync(reportPath, report, "utf-8");
+    const detail = `Hardening index: ${score}/100. Full report: ${reportPath}` + (suggestions.length ? `
+Top suggestions:
+  ${suggestions.join("\n  ")}` : "");
+    return { changed: true, detail };
+  }
+};
+
+// src/harden/modules/sysctl.ts
+var SENTINEL8 = `${SENTINEL_DIR}/sysctl.applied`;
+var SYSCTL_CONF = `# clawops kernel hardening
+net.ipv4.ip_forward = 0
+net.ipv6.conf.all.forwarding = 0
+net.ipv4.tcp_syncookies = 1
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.rp_filter = 1
+`;
+var sysctlModule = {
+  id: "sysctl",
+  label: "Kernel sysctl hardening",
+  defaultOn: false,
+  providers: "all",
+  async check(exec) {
+    const { stdout: sentinel } = await exec(`test -f ${SENTINEL8} && echo yes || echo no`);
+    if (sentinel.trim() === "yes") {
+      return { status: "applied", detail: "sysctl hardening applied (sentinel present)" };
+    }
+    const { stdout } = await exec(
+      `test -f /etc/sysctl.d/99-clawops-hardening.conf && echo yes || echo no`
+    );
+    if (stdout.trim() === "yes") {
+      return { status: "applied", detail: "clawops sysctl config already present" };
+    }
+    return { status: "missing", detail: "hardened sysctl settings not configured" };
+  },
+  async apply(exec) {
+    const confEscaped = SYSCTL_CONF.replace(/'/g, "'\\''");
+    const script = [
+      `mkdir -p ${SENTINEL_DIR}`,
+      `printf '%s' '${confEscaped}' > /etc/sysctl.d/99-clawops-hardening.conf`,
+      "sysctl --system",
+      `touch ${SENTINEL8}`
+    ].join(" && ");
+    const { code, stderr } = await exec(`sudo sh -c '${script.replace(/'/g, "'\\''")}'`);
+    if (code !== 0) {
+      throw new Error(`sysctl hardening failed (exit ${code}): ${stderr.slice(0, 200)}`);
+    }
+    return { changed: true, detail: "kernel hardening applied (ip_forward=0, syncookies=1, no redirects)" };
+  }
+};
+
+// src/harden/modules/aws-sg-audit.ts
+var EXPECTED_OPEN_PORTS = /* @__PURE__ */ new Set([22, 18789]);
+var awsSgAuditModule = {
+  id: "aws-sg-audit",
+  label: "AWS SG audit (check-only)",
+  defaultOn: true,
+  providers: ["aws"],
+  async check(_exec) {
+    try {
+      const { EC2Client, DescribeSecurityGroupsCommand } = await import("@aws-sdk/client-ec2");
+      const client = new EC2Client({});
+      const resp = await client.send(new DescribeSecurityGroupsCommand({
+        Filters: [{ Name: "tag:Name", Values: ["clawops"] }]
+      }));
+      const groups = resp.SecurityGroups ?? [];
+      const openRules = [];
+      for (const sg of groups) {
+        for (const rule of sg.IpPermissions ?? []) {
+          const fromPort = rule.FromPort ?? 0;
+          const toPort = rule.ToPort ?? 65535;
+          for (const range of rule.IpRanges ?? []) {
+            if (range.CidrIp === "0.0.0.0/0" && !EXPECTED_OPEN_PORTS.has(fromPort)) {
+              openRules.push(`port ${fromPort}\u2013${toPort} open to 0.0.0.0/0 in ${sg.GroupId}`);
+            }
+          }
+        }
+      }
+      if (openRules.length === 0) {
+        return { status: "applied", detail: "No unexpected open ingress rules found" };
+      }
+      return {
+        status: "drifted",
+        detail: `Open ingress rules detected: ${openRules.join("; ")}`
+      };
+    } catch (err) {
+      return {
+        status: "skipped",
+        detail: `AWS SDK unavailable: ${err.message}`
+      };
+    }
+  },
+  // SG audit is check-only — apply() surfaces the finding but makes no changes.
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "SG audit is check-only. Review and tighten rules manually or re-run clawops up."
+    };
+  }
+};
+
+// src/harden/modules/aws-ssm-check.ts
+var SSM_POLICY_ARN = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore";
+var awsSsmCheckModule = {
+  id: "aws-ssm-check",
+  label: "AWS SSM access (check-only)",
+  defaultOn: true,
+  providers: ["aws"],
+  async check(_exec) {
+    try {
+      const { EC2Client, DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
+      const { IAMClient, ListAttachedRolePoliciesCommand } = await import("@aws-sdk/client-iam");
+      const ec2 = new EC2Client({});
+      const resp = await ec2.send(new DescribeInstancesCommand({
+        Filters: [{ Name: "tag:Name", Values: ["clawops"] }, { Name: "instance-state-name", Values: ["running"] }]
+      }));
+      const instance = resp.Reservations?.[0]?.Instances?.[0];
+      if (!instance) {
+        return { status: "skipped", detail: "No running clawops instance found in this region" };
+      }
+      const profileArn = instance.IamInstanceProfile?.Arn;
+      if (!profileArn) {
+        return { status: "drifted", detail: "Instance has no IAM instance profile attached" };
+      }
+      const roleName = profileArn.split("/").pop() ?? "";
+      const iam = new IAMClient({});
+      const policies = await iam.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName }));
+      const hasSSM = (policies.AttachedPolicies ?? []).some(
+        (p) => p.PolicyArn === SSM_POLICY_ARN
+      );
+      if (hasSSM) {
+        return { status: "applied", detail: `${roleName} has AmazonSSMManagedInstanceCore` };
+      }
+      return {
+        status: "drifted",
+        detail: `${roleName} missing AmazonSSMManagedInstanceCore \u2014 SSM shell access unavailable`
+      };
+    } catch (err) {
+      return {
+        status: "skipped",
+        detail: `AWS SDK unavailable: ${err.message}`
+      };
+    }
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "SSM check is read-only. Attach AmazonSSMManagedInstanceCore to the instance role to remediate."
+    };
+  }
+};
+
+// src/harden/modules/aws-flow-logs.ts
+var LOG_GROUP = "/clawops/vpc-flow-logs";
+var awsFlowLogsModule = {
+  id: "aws-flow-logs",
+  label: "AWS VPC Flow Logs (opt-in, billed)",
+  defaultOn: false,
+  providers: ["aws"],
+  async check(_exec) {
+    try {
+      const { EC2Client, DescribeFlowLogsCommand } = await import("@aws-sdk/client-ec2");
+      const { EC2Client: EC2, DescribeVpcsCommand } = await import("@aws-sdk/client-ec2");
+      const ec2 = new EC2({});
+      const vpcs = await ec2.send(new DescribeVpcsCommand({
+        Filters: [{ Name: "tag:Name", Values: ["clawops"] }]
+      }));
+      const vpcId = vpcs.Vpcs?.[0]?.VpcId;
+      if (!vpcId) {
+        return { status: "skipped", detail: "No clawops VPC found" };
+      }
+      const flowClient = new EC2Client({});
+      const logs = await flowClient.send(new DescribeFlowLogsCommand({
+        Filter: [{ Name: "resource-id", Values: [vpcId] }]
+      }));
+      if ((logs.FlowLogs ?? []).length > 0) {
+        return { status: "applied", detail: `VPC Flow Logs active on ${vpcId}` };
+      }
+      return { status: "missing", detail: `VPC Flow Logs not enabled on ${vpcId}` };
+    } catch (err) {
+      return { status: "skipped", detail: `AWS SDK unavailable: ${err.message}` };
+    }
+  },
+  async apply(_exec) {
+    try {
+      const {
+        EC2Client,
+        DescribeVpcsCommand,
+        CreateFlowLogsCommand
+      } = await import("@aws-sdk/client-ec2");
+      const {
+        CloudWatchLogsClient,
+        CreateLogGroupCommand
+      } = await import("@aws-sdk/client-cloudwatch-logs");
+      const { IAMClient, CreateRoleCommand, AttachRolePolicyCommand } = await import("@aws-sdk/client-iam");
+      const ec2 = new EC2Client({});
+      const vpcs = await ec2.send(new DescribeVpcsCommand({
+        Filters: [{ Name: "tag:Name", Values: ["clawops"] }]
+      }));
+      const vpcId = vpcs.Vpcs?.[0]?.VpcId;
+      if (!vpcId) throw new Error("No clawops VPC found");
+      const cwl = new CloudWatchLogsClient({});
+      try {
+        await cwl.send(new CreateLogGroupCommand({ logGroupName: LOG_GROUP }));
+      } catch (e) {
+        if (e.name !== "ResourceAlreadyExistsException") throw e;
+      }
+      const iam = new IAMClient({});
+      const roleName = "clawops-flow-logs-role";
+      let roleArn;
+      try {
+        const role = await iam.send(new CreateRoleCommand({
+          RoleName: roleName,
+          AssumeRolePolicyDocument: JSON.stringify({
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Principal: { Service: "vpc-flow-logs.amazonaws.com" }, Action: "sts:AssumeRole" }]
+          })
+        }));
+        roleArn = role.Role.Arn;
+        await iam.send(new AttachRolePolicyCommand({
+          RoleName: roleName,
+          PolicyArn: "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
+        }));
+      } catch (e) {
+        if (e.name !== "EntityAlreadyExists") throw e;
+        const { IAMClient: IAM2, GetRoleCommand } = await import("@aws-sdk/client-iam");
+        const existing = await new IAM2({}).send(new GetRoleCommand({ RoleName: roleName }));
+        roleArn = existing.Role.Arn;
+      }
+      await ec2.send(new CreateFlowLogsCommand({
+        ResourceIds: [vpcId],
+        ResourceType: "VPC",
+        TrafficType: "ALL",
+        LogDestinationType: "cloud-watch-logs",
+        LogGroupName: LOG_GROUP,
+        DeliverLogsPermissionArn: roleArn
+      }));
+      return { changed: true, detail: `VPC Flow Logs enabled \u2192 CloudWatch ${LOG_GROUP}` };
+    } catch (err) {
+      throw new Error(`VPC Flow Logs setup failed: ${err.message}`);
+    }
+  }
+};
+
+// src/harden/modules/aws-guardduty.ts
+var awsGuardDutyModule = {
+  id: "aws-guardduty",
+  label: "AWS GuardDuty (opt-in, ~$4/mo)",
+  defaultOn: false,
+  providers: ["aws"],
+  async check(_exec) {
+    try {
+      const { GuardDutyClient, ListDetectorsCommand } = await import("@aws-sdk/client-guardduty");
+      const client = new GuardDutyClient({});
+      const resp = await client.send(new ListDetectorsCommand({}));
+      const detectors = resp.DetectorIds ?? [];
+      if (detectors.length === 0) {
+        return { status: "missing", detail: "GuardDuty not enabled in this region" };
+      }
+      const { GetDetectorCommand } = await import("@aws-sdk/client-guardduty");
+      for (const id of detectors) {
+        const det = await client.send(new GetDetectorCommand({ DetectorId: id }));
+        if (det.Status === "ENABLED") {
+          return { status: "applied", detail: `GuardDuty enabled (detector: ${id})` };
+        }
+      }
+      return { status: "drifted", detail: "GuardDuty detector exists but is not ENABLED" };
+    } catch (err) {
+      return { status: "skipped", detail: `AWS SDK unavailable: ${err.message}` };
+    }
+  },
+  async apply(_exec) {
+    try {
+      const { GuardDutyClient, CreateDetectorCommand } = await import("@aws-sdk/client-guardduty");
+      const client = new GuardDutyClient({});
+      const resp = await client.send(new CreateDetectorCommand({ Enable: true }));
+      return {
+        changed: true,
+        detail: `GuardDuty enabled (detector: ${resp.DetectorId}). Note: billed ~$4/mo per account.`
+      };
+    } catch (err) {
+      throw new Error(`GuardDuty enable failed: ${err.message}`);
+    }
+  }
+};
+
+// src/harden/index.ts
+var MODULE_CATALOG = [
+  // ON by default — common
+  sshModule,
+  ufwModule,
+  fail2banModule,
+  unattendedUpgradesModule,
+  dockerSocketModule,
+  // OFF by default — common
+  auditdModule,
+  lynisModule,
+  sysctlModule,
+  // AWS-specific
+  awsSgAuditModule,
+  awsSsmCheckModule,
+  awsFlowLogsModule,
+  awsGuardDutyModule
+];
+export {
+  MODULE_CATALOG,
+  SENTINEL_DIR,
+  auditdModule,
+  awsFlowLogsModule,
+  awsGuardDutyModule,
+  awsSgAuditModule,
+  awsSsmCheckModule,
+  dockerSocketModule,
+  fail2banModule,
+  formatHardenSummary,
+  lynisModule,
+  makeUfwModule,
+  resolveModules,
+  runHardening,
+  sshModule,
+  sysctlModule,
+  ufwModule,
+  unattendedUpgradesModule,
+  withRemoteExec
+};