@harbinger-ai/harbinger 0.1.0

package/lib/bounty/actions.js

@@ -0,0 +1,119 @@
+'use server';
+
+import { auth } from '../auth/index.js';
+
+async function requireAuth() {
+  const session = await auth();
+  if (!session?.user?.id) throw new Error('Unauthorized');
+  return session.user;
+}
+
+// ── Programs ─────────────────────────────────────────────────────────────────
+
+export async function getPrograms() {
+  await requireAuth();
+  const { getPrograms: dbGet } = await import('./programs.js');
+  return dbGet();
+}
+
+export async function createProgram(data) {
+  await requireAuth();
+  const { createProgram: dbCreate } = await import('./programs.js');
+  return dbCreate(data);
+}
+
+export async function updateProgram(id, data) {
+  await requireAuth();
+  const { updateProgram: dbUpdate } = await import('./programs.js');
+  dbUpdate(id, data);
+  return { success: true };
+}
+
+export async function deleteProgram(id) {
+  await requireAuth();
+  const { deleteProgram: dbDelete } = await import('./programs.js');
+  dbDelete(id);
+  return { success: true };
+}
+
+// ── Targets ──────────────────────────────────────────────────────────────────
+
+export async function getTargets(programId) {
+  await requireAuth();
+  const { getTargets: dbGet } = await import('./targets.js');
+  return dbGet(programId);
+}
+
+export async function createTarget(data) {
+  await requireAuth();
+  const { createTarget: dbCreate } = await import('./targets.js');
+  return dbCreate(data);
+}
+
+export async function updateTarget(id, data) {
+  await requireAuth();
+  const { updateTarget: dbUpdate } = await import('./targets.js');
+  dbUpdate(id, data);
+  return { success: true };
+}
+
+export async function deleteTarget(id) {
+  await requireAuth();
+  const { deleteTarget: dbDelete } = await import('./targets.js');
+  dbDelete(id);
+  return { success: true };
+}
+
+// ── Findings ─────────────────────────────────────────────────────────────────
+
+export async function getFindings(filters) {
+  await requireAuth();
+  const { getFindings: dbGet } = await import('./findings.js');
+  return dbGet(filters);
+}
+
+export async function createFinding(data) {
+  await requireAuth();
+  const { createFinding: dbCreate } = await import('./findings.js');
+  return dbCreate(data);
+}
+
+export async function updateFinding(id, data) {
+  await requireAuth();
+  const { updateFinding: dbUpdate } = await import('./findings.js');
+  dbUpdate(id, data);
+  return { success: true };
+}
+
+export async function deleteFinding(id) {
+  await requireAuth();
+  const { deleteFinding: dbDelete } = await import('./findings.js');
+  dbDelete(id);
+  return { success: true };
+}
+
+export async function getFindingCounts() {
+  await requireAuth();
+  const { getFindingCounts: dbCounts } = await import('./findings.js');
+  return dbCounts();
+}
+
+// ── Target Sync ─────────────────────────────────────────────────────────────
+
+export async function syncTargetsFromPlatform(platform, options = {}) {
+  await requireAuth();
+  const { syncPlatform } = await import('./sync-targets.js');
+  return syncPlatform(platform, options);
+}
+
+export async function syncAllTargets(options = {}) {
+  await requireAuth();
+  const { syncAllPlatforms } = await import('./sync-targets.js');
+  return syncAllPlatforms(options);
+}
+
+export async function getSyncStatus() {
+  await requireAuth();
+  const { getSyncStatus: getStatus } = await import('./sync-targets.js');
+  return getStatus();
+}

package/lib/bounty/findings.js

@@ -0,0 +1,64 @@
+import { randomUUID } from 'crypto';
+import { eq, and, desc, sql } from 'drizzle-orm';
+import { getDb } from '../db/index.js';
+import { findings } from '../db/schema.js';
+
+export function createFinding({ targetId, title, severity = 'info', type, description, stepsToReproduce, impact, agentId, toolId, rawOutput }) {
+  const db = getDb();
+  const now = Date.now();
+  const id = randomUUID();
+  db.insert(findings).values({ id, targetId, title, severity, type, status: 'new', description, stepsToReproduce, impact, agentId, toolId, rawOutput, createdAt: now, updatedAt: now }).run();
+  return { id, title, severity };
+}
+
+export function getFindings(filters = {}) {
+  const db = getDb();
+  const conditions = [];
+  if (filters.targetId) conditions.push(eq(findings.targetId, filters.targetId));
+  if (filters.severity) conditions.push(eq(findings.severity, filters.severity));
+  if (filters.status) conditions.push(eq(findings.status, filters.status));
+  let query = db.select().from(findings);
+  if (conditions.length > 0) query = query.where(and(...conditions));
+  return query.orderBy(desc(findings.createdAt)).all();
+}
+
+export function getFindingById(id) {
+  const db = getDb();
+  return db.select().from(findings).where(eq(findings.id, id)).get();
+}
+
+export function updateFinding(id, data) {
+  const db = getDb();
+  db.update(findings).set({ ...data, updatedAt: Date.now() }).where(eq(findings.id, id)).run();
+}
+
+export function deleteFinding(id) {
+  const db = getDb();
+  db.delete(findings).where(eq(findings.id, id)).run();
+}
+
+export function getFindingCounts() {
+  const db = getDb();
+  const [row] = db.select({
+    total: sql`count(*)`,
+    critical: sql`sum(case when severity='critical' then 1 else 0 end)`,
+    high: sql`sum(case when severity='high' then 1 else 0 end)`,
+    medium: sql`sum(case when severity='medium' then 1 else 0 end)`,
+    low: sql`sum(case when severity='low' then 1 else 0 end)`,
+    info: sql`sum(case when severity='info' then 1 else 0 end)`,
+    confirmed: sql`sum(case when status='confirmed' then 1 else 0 end)`,
+    reported: sql`sum(case when status='reported' then 1 else 0 end)`,
+    totalBounty: sql`coalesce(sum(bounty_amount), 0)`,
+  }).from(findings).all();
+  return {
+    total: Number(row.total) || 0,
+    critical: Number(row.critical) || 0,
+    high: Number(row.high) || 0,
+    medium: Number(row.medium) || 0,
+    low: Number(row.low) || 0,
+    info: Number(row.info) || 0,
+    confirmed: Number(row.confirmed) || 0,
+    reported: Number(row.reported) || 0,
+    totalBounty: Number(row.totalBounty) || 0,
+  };
+}

package/lib/bounty/programs.js

@@ -0,0 +1,34 @@
+import { randomUUID } from 'crypto';
+import { eq, desc } from 'drizzle-orm';
+import { getDb } from '../db/index.js';
+import { programs, targets } from '../db/schema.js';
+
+export function createProgram({ name, platform = 'custom', url, scopeUrl, minBounty, maxBounty, notes }) {
+  const db = getDb();
+  const now = Date.now();
+  const id = randomUUID();
+  db.insert(programs).values({ id, name, platform, url, scopeUrl, minBounty, maxBounty, notes, status: 'active', createdAt: now, updatedAt: now }).run();
+  return { id, name, platform };
+}
+
+export function getPrograms() {
+  const db = getDb();
+  return db.select().from(programs).orderBy(desc(programs.updatedAt)).all();
+}
+
+export function getProgramById(id) {
+  const db = getDb();
+  return db.select().from(programs).where(eq(programs.id, id)).get();
+}
+
+export function updateProgram(id, data) {
+  const db = getDb();
+  db.update(programs).set({ ...data, updatedAt: Date.now() }).where(eq(programs.id, id)).run();
+}
+
+export function deleteProgram(id) {
+  const db = getDb();
+  // Cascade: delete targets belonging to this program first
+  db.delete(targets).where(eq(targets.programId, id)).run();
+  db.delete(programs).where(eq(programs.id, id)).run();
+}

package/lib/bounty/sync-targets.js

@@ -0,0 +1,267 @@
+import { randomUUID } from 'crypto';
+import { eq, and, isNotNull, sql, inArray } from 'drizzle-orm';
+import { getDb } from '../db/index.js';
+import { programs, targets } from '../db/schema.js';
+
+const BASE_URL = 'https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data';
+
+const PLATFORM_CONFIGS = {
+  hackerone: {
+    url: `${BASE_URL}/hackerone_data.json`,
+    parseProgramName: (p) => p.name,
+    parseProgramHandle: (p) => p.handle,
+    parseProgramUrl: (p) => `https://hackerone.com/${p.handle}`,
+    parseMaxBounty: (p) => {
+      const amounts = (p.targets?.in_scope || []).map(t => t.max_severity_bounty || 0);
+      return amounts.length > 0 ? Math.max(...amounts) : null;
+    },
+    parseTargets: (p) => (p.targets?.in_scope || []).map(t => ({
+      type: mapAssetType(t.asset_type),
+      value: t.asset_identifier,
+    })),
+  },
+  bugcrowd: {
+    url: `${BASE_URL}/bugcrowd_data.json`,
+    parseProgramName: (p) => p.name,
+    parseProgramHandle: (p) => p.code || slugify(p.name),
+    parseProgramUrl: (p) => p.url || `https://bugcrowd.com/${p.code}`,
+    parseMaxBounty: (p) => p.max_payout || null,
+    parseTargets: (p) => (p.targets?.in_scope || p.target_groups || []).flatMap(g => {
+      if (g.targets) return g.targets.map(t => ({ type: mapAssetType(t.type || t.category), value: t.name || t.uri }));
+      return [{ type: mapAssetType(g.type || g.category), value: g.name || g.uri }];
+    }),
+  },
+  intigriti: {
+    url: `${BASE_URL}/intigriti_data.json`,
+    parseProgramName: (p) => p.name,
+    parseProgramHandle: (p) => p.company_handle || p.handle || slugify(p.name),
+    parseProgramUrl: (p) => p.url || `https://app.intigriti.com/programs/${p.company_handle}`,
+    parseMaxBounty: (p) => p.max_bounty || null,
+    parseTargets: (p) => (p.targets?.in_scope || []).map(t => ({
+      type: mapAssetType(t.type),
+      value: t.endpoint || t.description,
+    })),
+  },
+  yeswehack: {
+    url: `${BASE_URL}/yeswehack_data.json`,
+    parseProgramName: (p) => p.title || p.name,
+    parseProgramHandle: (p) => p.slug || slugify(p.title || p.name || ''),
+    parseProgramUrl: (p) => p.url || `https://yeswehack.com/programs/${p.slug}`,
+    parseMaxBounty: (p) => p.max_bounty || null,
+    parseTargets: (p) => (p.targets || p.scopes || []).map(t => ({
+      type: mapAssetType(t.type || t.scope_type),
+      value: t.target || t.scope,
+    })),
+  },
+  federacy: {
+    url: `${BASE_URL}/federacy_data.json`,
+    parseProgramName: (p) => p.name,
+    parseProgramHandle: (p) => p.slug || slugify(p.name),
+    parseProgramUrl: (p) => p.url || `https://federacy.com/programs/${p.slug}`,
+    parseMaxBounty: (p) => p.max_bounty || null,
+    parseTargets: (p) => (p.targets || p.scope || []).map(t => ({
+      type: mapAssetType(typeof t === 'string' ? 'url' : t.type),
+      value: typeof t === 'string' ? t : t.target || t.url,
+    })),
+  },
+};
+
+function slugify(str) {
+  return (str || '').toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-|-$/g, '');
+}
+
+// Map platform asset type strings to our target types.
+// Uses exact matches for short strings to avoid false positives (e.g. 'ip' matching 'script').
+const ASSET_TYPE_MAP = {
+  'url': 'domain', 'website': 'domain', 'domain': 'domain', 'web': 'domain',
+  'wildcard': 'wildcard',
+  'ip_address': 'ip', 'ip': 'ip',
+  'cidr': 'cidr',
+  'api': 'api', 'endpoint': 'api',
+  'mobile': 'mobile', 'android': 'mobile', 'ios': 'mobile',
+  'other': 'domain',
+};
+
+function mapAssetType(raw) {
+  if (!raw) return 'domain';
+  const lower = ('' + raw).toLowerCase().trim();
+  // Exact match first
+  if (ASSET_TYPE_MAP[lower]) return ASSET_TYPE_MAP[lower];
+  // Substring matches for compound types like "Android App"
+  if (lower.includes('wildcard') || lower.includes('*.')) return 'wildcard';
+  if (lower.includes('android') || lower.includes('ios') || lower.includes('mobile')) return 'mobile';
+  if (lower.includes('cidr')) return 'cidr';
+  if (lower.includes('api')) return 'api';
+  return 'domain';
+}
+
+async function fetchPlatformData(platform) {
+  const config = PLATFORM_CONFIGS[platform];
+  if (!config) throw new Error(`Unknown platform: ${platform}`);
+
+  const response = await fetch(config.url);
+  if (!response.ok) throw new Error(`Failed to fetch ${platform} data: ${response.status}`);
+  return response.json();
+}
+
+/**
+ * Sync targets from a specific platform's bounty-targets-data.
+ * Pre-fetches existing programs/targets to avoid N+1 queries.
+ */
+export async function syncPlatform(platform, options = {}) {
+  const config = PLATFORM_CONFIGS[platform];
+  if (!config) throw new Error(`Unknown platform: ${platform}`);
+
+  const db = getDb();
+  const now = Date.now();
+  const stats = { programsAdded: 0, programsUpdated: 0, targetsAdded: 0, targetsSkipped: 0, errors: [] };
+  const maxPrograms = options.maxPrograms || 0;
+
+  let data;
+  try {
+    data = await fetchPlatformData(platform);
+  } catch (err) {
+    stats.errors.push(`Fetch failed: ${err.message}`);
+    return stats;
+  }
+
+  if (!Array.isArray(data)) {
+    stats.errors.push(`Expected array, got ${typeof data}`);
+    return stats;
+  }
+
+  const programsToSync = maxPrograms > 0 ? data.slice(0, maxPrograms) : data;
+
+  // Bulk-prefetch existing programs for this platform (avoids N+1)
+  const existingPrograms = db.select().from(programs)
+    .where(eq(programs.platform, platform)).all();
+  const programByHandle = new Map(existingPrograms.map(p => [p.syncHandle, p]));
+
+  // Bulk-prefetch existing target keys for all programs on this platform
+  const programIds = existingPrograms.map(p => p.id);
+  const existingTargetRows = programIds.length > 0
+    ? db.select({ programId: targets.programId, type: targets.type, value: targets.value })
+        .from(targets)
+        .where(inArray(targets.programId, programIds))
+        .all()
+    : [];
+  const existingTargetKeys = new Set(existingTargetRows.map(t => `${t.programId}:${t.type}:${t.value}`));
+
+  for (const entry of programsToSync) {
+    try {
+      const handle = config.parseProgramHandle(entry);
+      const name = config.parseProgramName(entry);
+      if (!handle || !name) continue;
+
+      let program = programByHandle.get(handle);
+
+      if (program) {
+        db.update(programs).set({
+          name,
+          url: config.parseProgramUrl(entry),
+          maxBounty: config.parseMaxBounty(entry),
+          lastSyncedAt: now,
+          updatedAt: now,
+        }).where(eq(programs.id, program.id)).run();
+        stats.programsUpdated++;
+      } else {
+        const programId = randomUUID();
+        db.insert(programs).values({
+          id: programId,
+          name,
+          platform,
+          url: config.parseProgramUrl(entry),
+          maxBounty: config.parseMaxBounty(entry),
+          syncHandle: handle,
+          lastSyncedAt: now,
+          status: 'active',
+          createdAt: now,
+          updatedAt: now,
+        }).run();
+        program = { id: programId };
+        programByHandle.set(handle, program);
+        stats.programsAdded++;
+      }
+
+      // Sync targets
+      const parsedTargets = config.parseTargets(entry);
+      for (const t of parsedTargets) {
+        if (!t.value) continue;
+        const key = `${program.id}:${t.type}:${t.value}`;
+        if (existingTargetKeys.has(key)) {
+          stats.targetsSkipped++;
+          continue;
+        }
+        db.insert(targets).values({
+          id: randomUUID(),
+          programId: program.id,
+          type: t.type,
+          value: t.value,
+          status: 'in_scope',
+          syncSource: platform,
+          syncProgramHandle: handle,
+          createdAt: now,
+          updatedAt: now,
+        }).run();
+        existingTargetKeys.add(key); // prevent duplicates within this sync
+        stats.targetsAdded++;
+      }
+    } catch (err) {
+      stats.errors.push(`${config.parseProgramName(entry) || 'unknown'}: ${err.message}`);
+    }
+  }
+
+  return stats;
+}
+
+/**
+ * Sync all platforms in parallel. Returns combined stats per platform.
+ */
+export async function syncAllPlatforms(options = {}) {
+  const platforms = options.platforms || Object.keys(PLATFORM_CONFIGS);
+  const entries = await Promise.allSettled(
+    platforms.map(p => syncPlatform(p, options).then(stats => [p, stats]))
+  );
+  const results = {};
+  for (const entry of entries) {
+    if (entry.status === 'fulfilled') {
+      const [p, stats] = entry.value;
+      results[p] = stats;
+    } else {
+      // Extract platform name from error if possible
+      results[entry.reason?.message || 'unknown'] = { programsAdded: 0, programsUpdated: 0, targetsAdded: 0, targetsSkipped: 0, errors: [entry.reason?.message || 'Unknown error'] };
+    }
+  }
+  return results;
+}
+
+/**
+ * Get sync status summary using SQL aggregation.
+ */
+export function getSyncStatus() {
+  const db = getDb();
+  const rows = db.select({
+    platform: programs.platform,
+    count: sql`count(*)`,
+    lastSync: sql`max(last_synced_at)`,
+  }).from(programs)
+    .where(isNotNull(programs.syncHandle))
+    .groupBy(programs.platform)
+    .all();
+
+  const platformCounts = {};
+  let totalSyncedPrograms = 0;
+  let lastSyncedAt = 0;
+  for (const r of rows) {
+    platformCounts[r.platform] = Number(r.count);
+    totalSyncedPrograms += Number(r.count);
+    lastSyncedAt = Math.max(lastSyncedAt, Number(r.lastSync) || 0);
+  }
+
+  return {
+    totalSyncedPrograms,
+    platformCounts,
+    lastSyncedAt: lastSyncedAt || null,
+    availablePlatforms: Object.keys(PLATFORM_CONFIGS),
+  };
+}

package/lib/bounty/targets.js

@@ -0,0 +1,33 @@
+import { randomUUID } from 'crypto';
+import { eq, desc } from 'drizzle-orm';
+import { getDb } from '../db/index.js';
+import { targets } from '../db/schema.js';
+
+export function createTarget({ programId, type = 'domain', value, status = 'in_scope', notes }) {
+  const db = getDb();
+  const now = Date.now();
+  const id = randomUUID();
+  db.insert(targets).values({ id, programId, type, value, status, notes, createdAt: now, updatedAt: now }).run();
+  return { id, value, type };
+}
+
+export function getTargets(programId) {
+  const db = getDb();
+  if (programId) return db.select().from(targets).where(eq(targets.programId, programId)).orderBy(desc(targets.updatedAt)).all();
+  return db.select().from(targets).orderBy(desc(targets.updatedAt)).all();
+}
+
+export function getTargetById(id) {
+  const db = getDb();
+  return db.select().from(targets).where(eq(targets.id, id)).get();
+}
+
+export function updateTarget(id, data) {
+  const db = getDb();
+  db.update(targets).set({ ...data, updatedAt: Date.now() }).where(eq(targets.id, id)).run();
+}
+
+export function deleteTarget(id) {
+  const db = getDb();
+  db.delete(targets).where(eq(targets.id, id)).run();
+}

package/lib/channels/base.js

@@ -0,0 +1,56 @@
+/**
+ * Base channel adapter interface.
+ * Every chat channel (Telegram, Slack, web, etc.) implements this contract.
+ */
+class ChannelAdapter {
+  /**
+   * Handle an incoming webhook request from this channel.
+   * Returns normalized message data or null if no action needed.
+   *
+   * @param {Request} request - Incoming HTTP request
+   * @returns {Promise<{ threadId: string, text: string, attachments: Array, metadata: object } | null>}
+   *
+   * Attachments array (may be empty) — only non-text content that the LLM needs to see:
+   *   { category: "image", mimeType: "image/png", data: Buffer }  — send to LLM as vision
+   *   { category: "document", mimeType: "application/pdf", data: Buffer } — future: extract/attach
+   *
+   * The adapter downloads authenticated files and normalizes them.
+   * Voice/audio messages are fully resolved by the adapter — transcribed to text
+   * and included in the `text` field. They are NOT passed as attachments.
+   */
+  async receive(request) {
+    throw new Error('Not implemented');
+  }
+
+  /**
+   * Called when message is received — adapter shows acknowledgment.
+   * Telegram: thumbs up reaction. Slack: emoji reaction. Web: no-op.
+   */
+  async acknowledge(metadata) {}
+
+  /**
+   * Called while AI is processing — adapter shows activity.
+   * Telegram: typing indicator. Slack: typing indicator. Web: no-op (streaming handles this).
+   * Returns a stop function.
+   */
+  startProcessingIndicator(metadata) {
+    return () => {};
+  }
+
+  /**
+   * Send a complete (non-streaming) response back to the channel.
+   */
+  async sendResponse(threadId, text, metadata) {
+    throw new Error('Not implemented');
+  }
+
+  /**
+   * Whether this channel supports real streaming (e.g., web chat via Vercel AI SDK).
+   * If true, the AI layer provides a stream instead of a complete response.
+   */
+  get supportsStreaming() {
+    return false;
+  }
+}
+
+export { ChannelAdapter };

package/lib/channels/index.js

@@ -0,0 +1,15 @@
+import { TelegramAdapter } from './telegram.js';
+
+let _telegramAdapter = null;
+
+/**
+ * Get the Telegram channel adapter (lazy singleton).
+ * @param {string} botToken - Telegram bot token
+ * @returns {TelegramAdapter}
+ */
+export function getTelegramAdapter(botToken) {
+  if (!_telegramAdapter || _telegramAdapter.botToken !== botToken) {
+    _telegramAdapter = new TelegramAdapter(botToken);
+  }
+  return _telegramAdapter;
+}