@neurosec/sentry 1.0.0

package/dist/sandbox/linux-sandbox.js

@@ -0,0 +1,186 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinuxSandbox = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const logger_1 = require("../logger");
+const CGROUP_ROOT = '/sys/fs/cgroup';
+const SENTRY_CGROUP_NAME = 'neuroshield';
+class LinuxSandbox {
+    constructor() {
+        this.cgroupV2 = this.detectCgroupVersion();
+    }
+    detectCgroupVersion() {
+        try {
+            const info = (0, child_process_1.execSync)('stat -fc %T /sys/fs/cgroup/', {
+                encoding: 'utf8',
+                timeout: 5000,
+            }).trim();
+            return info === 'cgroup2fs';
+        }
+        catch {
+            return false;
+        }
+    }
+    async applySandbox(pid, profile, defaults) {
+        const cgroupPath = path_1.default.join(CGROUP_ROOT, SENTRY_CGROUP_NAME, `sentry-${pid}`);
+        try {
+            await promises_1.default.mkdir(cgroupPath, { recursive: true });
+            if (this.cgroupV2) {
+                await this.applyCgroupV2(cgroupPath, pid, profile, defaults);
+            }
+            else {
+                await this.applyCgroupV1(cgroupPath, pid, profile, defaults);
+            }
+            const applied = await this.addPidToCgroup(cgroupPath, pid);
+            if (applied) {
+                logger_1.logger.info('Linux sandbox configured', { pid, cgroupPath, profile: profile.name });
+            }
+            return applied;
+        }
+        catch (err) {
+            logger_1.logger.error('Linux sandbox failed', { pid, err: err.message });
+            return false;
+        }
+    }
+    async applyCgroupV2(cgroupPath, pid, profile, defaults) {
+        const cpuMax = profile.cpuMax || defaults.cpuMax;
+        const memoryMax = profile.memoryMax || defaults.memoryMax;
+        const pidMax = profile.pidMax || defaults.pidMax;
+        await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'cpu.max'), `${cpuMax}\n`);
+        await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'memory.max'), this.parseMemoryBytes(memoryMax).toString());
+        try {
+            await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'pids.max'), pidMax.toString());
+        }
+        catch {
+            // pids controller may not be enabled
+        }
+        const ioFile = path_1.default.join(cgroupPath, 'io.max');
+        try {
+            await promises_1.default.writeFile(ioFile, '8:0 rbps=104857600 wbps=52428800\n');
+        }
+        catch {
+            // io controller may not be available
+        }
+    }
+    async applyCgroupV1(cgroupPath, pid, profile, defaults) {
+        const memoryMax = profile.memoryMax || defaults.memoryMax;
+        try {
+            await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'memory.limit_in_bytes'), this.parseMemoryBytes(memoryMax).toString());
+        }
+        catch {
+            // memory controller may not be mounted
+        }
+        try {
+            const cpuCfsQuota = this.parseCpuQuota(profile.cpuMax || defaults.cpuMax);
+            await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'cpu.cfs_quota_us'), cpuCfsQuota.toString());
+        }
+        catch {
+            // cpu controller may not be mounted
+        }
+        try {
+            await promises_1.default.writeFile(path_1.default.join(cgroupPath, 'pids.max'), (profile.pidMax || defaults.pidMax).toString());
+        }
+        catch {
+            // pids controller may not be mounted
+        }
+    }
+    async addPidToCgroup(cgroupPath, pid) {
+        const procsFile = path_1.default.join(cgroupPath, 'cgroup.procs');
+        try {
+            const current = await promises_1.default.readFile(procsFile, 'utf8');
+            if (!current.split('\n').map(l => l.trim()).includes(pid.toString())) {
+                await promises_1.default.writeFile(procsFile, `${pid}\n`);
+            }
+            return true;
+        }
+        catch {
+            // Process may have exited or we lack permission
+            return false;
+        }
+    }
+    async removeSandbox(pid) {
+        const cgroupPath = path_1.default.join(CGROUP_ROOT, SENTRY_CGROUP_NAME, `sentry-${pid}`);
+        try {
+            const procsFile = path_1.default.join(cgroupPath, 'cgroup.procs');
+            const content = await promises_1.default.readFile(procsFile, 'utf8');
+            const remainingPids = content.split('\n').map(l => l.trim()).filter(Boolean);
+            for (const p of remainingPids) {
+                try {
+                    await promises_1.default.writeFile(path_1.default.join(CGROUP_ROOT, 'cgroup.procs'), `${p}\n`);
+                }
+                catch {
+                    // migrate back to root
+                }
+            }
+            await promises_1.default.rmdir(cgroupPath);
+            logger_1.logger.info('Linux sandbox removed', { pid, cgroupPath });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async isSandboxed(pid) {
+        try {
+            const content = await promises_1.default.readFile(`/proc/${pid}/cgroup`, 'utf8');
+            return content.includes(SENTRY_CGROUP_NAME);
+        }
+        catch {
+            return false;
+        }
+    }
+    async getSandboxStats(pid) {
+        const cgroupPath = path_1.default.join(CGROUP_ROOT, SENTRY_CGROUP_NAME, `sentry-${pid}`);
+        try {
+            const stats = {};
+            if (this.cgroupV2) {
+                const memoryCurrent = await promises_1.default.readFile(path_1.default.join(cgroupPath, 'memory.current'), 'utf8');
+                stats.memoryCurrentBytes = parseInt(memoryCurrent.trim(), 10);
+                try {
+                    const cpuStat = await promises_1.default.readFile(path_1.default.join(cgroupPath, 'cpu.stat'), 'utf8');
+                    const usageUs = cpuStat.match(/usage_usec\s+(\d+)/);
+                    if (usageUs)
+                        stats.cpuUsageUsec = parseInt(usageUs[1], 10);
+                }
+                catch { /* ignore */ }
+            }
+            else {
+                try {
+                    const memUsage = await promises_1.default.readFile(path_1.default.join(cgroupPath, 'memory.usage_in_bytes'), 'utf8');
+                    stats.memoryCurrentBytes = parseInt(memUsage.trim(), 10);
+                }
+                catch { /* ignore */ }
+            }
+            return stats;
+        }
+        catch {
+            return null;
+        }
+    }
+    parseMemoryBytes(value) {
+        const match = value.match(/^(\d+)(GB|MB|KB|B)?$/i);
+        if (!match)
+            return 512 * 1024 * 1024; // 512MB default
+        const num = parseInt(match[1], 10);
+        const unit = (match[2] || 'B').toUpperCase();
+        switch (unit) {
+            case 'GB': return num * 1024 * 1024 * 1024;
+            case 'MB': return num * 1024 * 1024;
+            case 'KB': return num * 1024;
+            default: return num;
+        }
+    }
+    parseCpuQuota(value) {
+        const num = parseFloat(value);
+        if (isNaN(num))
+            return 50000;
+        return Math.round(num * 100000);
+    }
+}
+exports.LinuxSandbox = LinuxSandbox;
+//# sourceMappingURL=linux-sandbox.js.map

package/dist/sandbox/linux-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/linux-sandbox.ts"],"names":[],"mappings":";;;;;;AAAA,2DAA6B;AAC7B,gDAAwB;AACxB,iDAAoD;AAGpD,sCAAmC;AAEnC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEzC,MAAa,YAAY;IAGvB;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7C,CAAC;IAEO,mBAAmB;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,6BAA6B,EAAE;gBACnD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,KAAK,WAAW,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,OAAuB,EACvB,QAA+D;QAE/D,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QAE/E,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEhD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,OAAO,EAAE,CAAC;gBACZ,eAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,UAAkB,EAClB,GAAW,EACX,OAAuB,EACvB,QAA+D;QAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAEjD,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC;QACpE,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAErG,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,SAAS,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,UAAkB,EAClB,GAAW,EACX,OAAuB,EACvB,QAA+D;QAE/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,SAAS,CAChB,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,EAC9C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAC5C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1E,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxG,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,UAAkB,EAAE,GAAW;QAC1D,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACrE,MAAM,kBAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7E,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,kBAAE,CAAC,SAAS,CAAC,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,MAAM,kBAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3B,eAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,KAAK,GAAoC,EAAE,CAAC;YAElD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,aAAa,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;gBACzF,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAE9D,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;oBAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACpD,IAAI,OAAO;wBAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC;oBAC3F,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,gBAAgB;QAEtD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;YAC3C,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;YACpC,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,CAAC;YAC7B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AArMD,oCAqMC"}

package/dist/sandbox/macos-sandbox.d.ts

@@ -0,0 +1,17 @@
+import { SandboxProfile } from '../types';
+import { SandboxBackend } from './index';
+export declare class MacOSSandbox implements SandboxBackend {
+    applySandbox(pid: number, profile: SandboxProfile, defaults: {
+        cpuMax: string;
+        memoryMax: string;
+        pidMax: number;
+    }): Promise<boolean>;
+    private applyResourceLimits;
+    private deploySandboxProfile;
+    private generateSandboxProfile;
+    removeSandbox(pid: number): Promise<boolean>;
+    isSandboxed(pid: number): Promise<boolean>;
+    getSandboxStats(pid: number): Promise<Record<string, string | number> | null>;
+    private parseMemoryBytes;
+}
+//# sourceMappingURL=macos-sandbox.d.ts.map

package/dist/sandbox/macos-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-sandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKzC,qBAAa,YAAa,YAAW,cAAc;IAC3C,YAAY,CAChB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,OAAO,CAAC;YAYL,mBAAmB;YAgBnB,oBAAoB;IAalC,OAAO,CAAC,sBAAsB;IAgDxB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU5C,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU1C,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;IAoBnF,OAAO,CAAC,gBAAgB;CAazB"}

package/dist/sandbox/macos-sandbox.js

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MacOSSandbox = void 0;
+const child_process_1 = require("child_process");
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const logger_1 = require("../logger");
+const SANDBOX_PROFILES_DIR = '/var/lib/neuroshield/sentry/sandbox-profiles';
+class MacOSSandbox {
+    async applySandbox(pid, profile, defaults) {
+        try {
+            await this.applyResourceLimits(pid, profile, defaults);
+            await this.deploySandboxProfile(pid, profile);
+            logger_1.logger.info('macOS sandbox applied', { pid, profile: profile.name });
+            return true;
+        }
+        catch (err) {
+            logger_1.logger.error('macOS sandbox failed', { pid, err: err.message });
+            return false;
+        }
+    }
+    async applyResourceLimits(pid, profile, defaults) {
+        const memBytes = this.parseMemoryBytes(profile.memoryMax || defaults.memoryMax);
+        // Use pure Node.js alternatives since we can't rely on launchctl for non-child processes
+        // On macOS we log the desired limits — actual enforcement requires SIP-less setup
+        logger_1.logger.info('macOS resource limits requested (requires sandbox-exec or Seatbelt)', {
+            pid,
+            memoryMax: memBytes,
+            cpuMax: profile.cpuMax || defaults.cpuMax,
+        });
+    }
+    async deploySandboxProfile(pid, profile) {
+        await promises_1.default.mkdir(SANDBOX_PROFILES_DIR, { recursive: true });
+        const sbContent = this.generateSandboxProfile(pid, profile);
+        const profilePath = path_1.default.join(SANDBOX_PROFILES_DIR, `sentry-${pid}.sb`);
+        await promises_1.default.writeFile(profilePath, sbContent, 'utf8');
+        logger_1.logger.debug('Sandbox profile written', { path: profilePath });
+        // Log how to apply it — runtime application requires sandbox-exec(1)
+        logger_1.logger.info(`Apply with: sandbox-exec -f ${profilePath} -p <pid>`);
+    }
+    generateSandboxProfile(pid, profile) {
+        const lines = [
+            `(version 1)`,
+            `(deny default)`,
+            `(allow sysctl-read)`,
+            `(allow ipc-posix-sem* ipc-posix-shm*)`,
+        ];
+        for (const rule of profile.fsRules) {
+            switch (rule.permissions) {
+                case 'rw':
+                    lines.push(`(allow file-read* file-write* (subpath "${rule.path.replace('/**', '')}"))`);
+                    break;
+                case 'rwx':
+                    lines.push(`(allow file-read* file-write* file-exec* (subpath "${rule.path.replace('/**', '')}"))`);
+                    break;
+                case 'rx':
+                    lines.push(`(allow file-read* file-exec* (subpath "${rule.path.replace('/**', '')}"))`);
+                    break;
+                case 'r':
+                    lines.push(`(allow file-read* (subpath "${rule.path.replace('/**', '')}"))`);
+                    break;
+                case 'none':
+                    lines.push(`(deny file-read* file-write* file-exec* (subpath "${rule.path.replace('/**', '')}"))`);
+                    break;
+            }
+        }
+        for (const rule of profile.networkRules) {
+            if (rule.action === 'allow') {
+                if (rule.host) {
+                    lines.push(`(allow network* (remote ip "${rule.host}"))`);
+                }
+                else {
+                    lines.push(`(allow network*)`);
+                }
+            }
+            else if (rule.action === 'deny') {
+                if (rule.host) {
+                    lines.push(`(deny network* (remote ip "${rule.host}"))`);
+                }
+                else {
+                    lines.push(`(deny network*)`);
+                }
+            }
+        }
+        lines.push(''); // trailing newline
+        return lines.join('\n');
+    }
+    async removeSandbox(pid) {
+        const profilePath = path_1.default.join(SANDBOX_PROFILES_DIR, `sentry-${pid}.sb`);
+        try {
+            await promises_1.default.unlink(profilePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async isSandboxed(pid) {
+        const profilePath = path_1.default.join(SANDBOX_PROFILES_DIR, `sentry-${pid}.sb`);
+        try {
+            await promises_1.default.access(profilePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async getSandboxStats(pid) {
+        try {
+            const result = (0, child_process_1.execSync)(`ps -o rss=,pcpu= -p ${pid}`, {
+                encoding: 'utf8',
+                timeout: 3000,
+            }).trim();
+            const parts = result.split(/\s+/);
+            if (parts.length >= 2) {
+                return {
+                    memoryRssKb: parseInt(parts[0], 10),
+                    cpuPercent: parseFloat(parts[1]),
+                };
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    parseMemoryBytes(value) {
+        const match = value.match(/^(\d+)(GB|MB|KB|B)?$/i);
+        if (!match)
+            return 512 * 1024 * 1024;
+        const num = parseInt(match[1], 10);
+        const unit = (match[2] || 'B').toUpperCase();
+        switch (unit) {
+            case 'GB': return num * 1024 * 1024 * 1024;
+            case 'MB': return num * 1024 * 1024;
+            case 'KB': return num * 1024;
+            default: return num;
+        }
+    }
+}
+exports.MacOSSandbox = MacOSSandbox;
+//# sourceMappingURL=macos-sandbox.js.map

package/dist/sandbox/macos-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-sandbox.js","sourceRoot":"","sources":["../../src/sandbox/macos-sandbox.ts"],"names":[],"mappings":";;;;;;AAAA,iDAAyC;AACzC,2DAA6B;AAC7B,gDAAwB;AAGxB,sCAAmC;AAEnC,MAAM,oBAAoB,GAAG,8CAA8C,CAAC;AAE5E,MAAa,YAAY;IACvB,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,OAAuB,EACvB,QAA+D;QAE/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9C,eAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,GAAW,EACX,OAAuB,EACvB,QAA+D;QAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEhF,yFAAyF;QACzF,kFAAkF;QAClF,eAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;YACjF,GAAG;YACH,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;SAC1C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,OAAuB;QACrE,MAAM,kBAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC;QAExE,MAAM,kBAAE,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,eAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/D,qEAAqE;QACrE,eAAM,CAAC,IAAI,CAAC,+BAA+B,WAAW,WAAW,CAAC,CAAC;IACrE,CAAC;IAEO,sBAAsB,CAAC,GAAW,EAAE,OAAuB;QACjE,MAAM,KAAK,GAAa;YACtB,aAAa;YACb,gBAAgB;YAChB,qBAAqB;YACrB,uCAAuC;SACxC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACnC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzB,KAAK,IAAI;oBACP,KAAK,CAAC,IAAI,CAAC,2CAA2C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBACzF,MAAM;gBACR,KAAK,KAAK;oBACR,KAAK,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBACpG,MAAM;gBACR,KAAK,IAAI;oBACP,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBACxF,MAAM;gBACR,KAAK,GAAG;oBACN,KAAK,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC7E,MAAM;gBACR,KAAK,MAAM;oBACT,KAAK,CAAC,IAAI,CAAC,qDAAqD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBACnG,MAAM;YACV,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,KAAK,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;gBAC5D,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,KAAK,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;gBAC3D,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,uBAAuB,GAAG,EAAE,EAAE;gBACpD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,IAAI,EAAE,CAAC;YAEV,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO;oBACL,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;iBACjC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;QAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;YAC3C,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;YACpC,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,CAAC;YAC7B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAnJD,oCAmJC"}

package/dist/setup.d.ts

@@ -0,0 +1,14 @@
+export interface SetupOptions {
+    neurosecUrl?: string;
+    orgId?: string;
+    token?: string;
+    mode?: string;
+    configPath?: string;
+    nonInteractive?: boolean;
+}
+export declare function runSetup(options: SetupOptions): Promise<{
+    configPath: string;
+    tokenPath: string;
+}>;
+export declare function cliSetupNonInteractive(options: Record<string, string>): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAoGA,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AA0BD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmHxG;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3F"}

package/dist/setup.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetup = runSetup;
+exports.cliSetupNonInteractive = cliSetupNonInteractive;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const readline_1 = __importDefault(require("readline"));
+const os_1 = __importDefault(require("os"));
+const DEFAULT_NEUROSEC_URL = 'https://api.neurosec.ai';
+const CONFIG_TEMPLATE = (opts) => `# NeuroShield Sentry Daemon Configuration
+# Generated by \`neuroshield-sentry setup\` at ${new Date().toISOString()}
+
+sentry:
+  host_id: "${opts.hostId}"
+  version: "1.0.0"
+  health_port: 9190
+  api_port: 9191
+  state_dir: ${opts.platform === 'darwin' ? '/usr/local/var/lib/neuroshield/sentry' : '/var/lib/neuroshield/sentry'}
+  pid_file_path: ${opts.platform === 'darwin' ? '/usr/local/var/run/neuroshield-sentry.pid' : '/var/run/neuroshield-sentry.pid'}
+
+neurosec:
+  endpoint: "${opts.neurosecUrl}"
+  org_id: "${opts.orgId}"
+  token_path: ${opts.platform === 'darwin' ? '/usr/local/etc/neuroshield/sentry.token' : '/etc/neuroshield/sentry.token'}
+  sync_interval_ms: 30000
+  heartbeat_interval_ms: 300000
+
+enforcement:
+  mode: "${opts.mode}"
+  sandbox_enabled: ${opts.platform === 'linux' ? 'true' : 'false'}
+  syscall_filter_enabled: ${opts.platform === 'linux' ? 'true' : 'false'}
+  network_filter_enabled: true
+  filesystem_filter_enabled: true
+
+sandbox_defaults:
+  cpu_max: "0.5"
+  memory_max: "512MB"
+  pid_max: 100
+
+network:
+  allow_hosts:
+    - "api.openai.com:443"
+    - "api.anthropic.com:443"
+    - "${new URL(opts.neurosecUrl).hostname}:443"
+  block_hosts:
+    - "*.pastebin.com"
+    - "*.ngrok.io"
+    - "*.requestbin.net"
+    - "*.webhook.site"
+  allow_private: false
+  dns_monitor_enabled: true
+
+skill_authz:
+  enabled: true
+  allow_unknown: false
+  require_approval:
+    - "shell_exec"
+    - "bash"
+    - "terminal"
+    - "run_command"
+
+audit:
+  log_path: ${opts.platform === 'darwin' ? '/usr/local/var/log/neuroshield/sentry.log' : '/var/log/neuroshield/sentry.log'}
+  retention_days: 90
+  max_size_mb: 500
+
+discovery:
+  interval_ms: 30000
+  source_paths:
+    - /workspace
+    - /app
+    - /home
+    - /tmp
+`;
+function getPlatformConfigPaths(plat) {
+    if (plat === 'darwin') {
+        return {
+            configDir: '/usr/local/etc/neuroshield',
+            configPath: '/usr/local/etc/neuroshield/sentry.yaml',
+            tokenPath: '/usr/local/etc/neuroshield/sentry.token',
+            stateDir: '/usr/local/var/lib/neuroshield/sentry',
+            logDir: '/usr/local/var/log/neuroshield',
+        };
+    }
+    return {
+        configDir: '/etc/neuroshield',
+        configPath: '/etc/neuroshield/sentry.yaml',
+        tokenPath: '/etc/neuroshield/sentry.token',
+        stateDir: '/var/lib/neuroshield/sentry',
+        logDir: '/var/log/neuroshield',
+    };
+}
+function prompt(question, defaultValue) {
+    const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise(resolve => {
+        const hint = defaultValue ? ` [${defaultValue}]` : '';
+        rl.question(`${question}${hint}: `, answer => {
+            rl.close();
+            resolve(answer.trim() || defaultValue || '');
+        });
+    });
+}
+function hostname() {
+    try {
+        return os_1.default.hostname();
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function generateMachineToken() {
+    const random = require('crypto').randomBytes(32).toString('hex');
+    return `nst_${random}`;
+}
+async function runSetup(options) {
+    const platform = os_1.default.platform();
+    const paths = getPlatformConfigPaths(platform);
+    const configPath = options.configPath || paths.configPath;
+    if (!options.nonInteractive) {
+        console.log('');
+        console.log('╔══════════════════════════════════════════════════╗');
+        console.log('║     NeuroShield Sentry — Setup Wizard            ║');
+        console.log('╚══════════════════════════════════════════════════╝');
+        console.log('');
+        console.log(`This will configure the Sentry daemon for this host.`);
+        console.log(`Config will be written to: ${configPath}`);
+        console.log('');
+    }
+    const neurosecUrl = options.neurosecUrl || await prompt('  NeuroSec API URL', DEFAULT_NEUROSEC_URL);
+    const orgId = options.orgId || await prompt('  NeuroSec Organization ID', '');
+    const mode = options.mode || await prompt('  Enforcement mode (monitor / enforce / quarantine)', 'monitor');
+    const useExistingToken = options.token === undefined && !options.nonInteractive;
+    let token = options.token || '';
+    if (!token && useExistingToken) {
+        const existing = await prompt('  Sentry token (or press Enter to auto-generate)', '');
+        token = existing || generateMachineToken();
+    }
+    else if (!token) {
+        token = generateMachineToken();
+    }
+    const hostId = `${hostname()}-sentry`;
+    if (!options.nonInteractive) {
+        console.log('');
+        console.log('  Configuring...');
+    }
+    const configDir = path_1.default.dirname(configPath);
+    const pathsToCreate = [
+        configDir,
+        paths.stateDir,
+        paths.logDir,
+        path_1.default.dirname(paths.tokenPath),
+    ];
+    for (const dir of pathsToCreate) {
+        try {
+            fs_1.default.mkdirSync(dir, { recursive: true });
+        }
+        catch {
+            // best-effort for dirs that may need root
+        }
+    }
+    const configContent = CONFIG_TEMPLATE({
+        hostId,
+        neurosecUrl,
+        orgId,
+        token,
+        mode,
+        platform,
+    });
+    fs_1.default.writeFileSync(configPath, configContent, 'utf8');
+    console.log(`  ✓ Config written: ${configPath}`);
+    if (token) {
+        try {
+            fs_1.default.writeFileSync(paths.tokenPath, token, 'utf8');
+            fs_1.default.chmodSync(paths.tokenPath, 0o600);
+            console.log(`  ✓ Token written: ${paths.tokenPath}`);
+        }
+        catch (err) {
+            console.log(`  ⚠ Could not write token to ${paths.tokenPath} (need root?)`);
+            console.log(`    Store token manually: echo '${token}' > ${paths.tokenPath}`);
+            console.log(`    chmod 600 ${paths.tokenPath}`);
+        }
+    }
+    if (!options.nonInteractive) {
+        console.log('');
+        console.log('  ─── Setup Complete ───');
+        console.log('');
+        console.log('  Next steps:');
+        console.log('    1. Install the service:');
+        console.log(`       sudo neuroshield-sentry install`);
+        console.log('');
+        console.log('    2. Or start manually:');
+        console.log(`       sudo neuroshield-sentryd ${configPath}`);
+        console.log('');
+        console.log('    3. View status:');
+        console.log('       neuroshield-sentry status');
+        console.log('');
+        console.log('    4. View real-time decisions:');
+        console.log('       neuroshield-sentry logs');
+        console.log('');
+        if (!token || token === '') {
+            console.log('  ⚠  No token set! Edit the config to add your NeuroSec sentry token.');
+            console.log('');
+        }
+    }
+    return { configPath, tokenPath: paths.tokenPath };
+}
+async function cliSetupNonInteractive(options) {
+    await runSetup({
+        neurosecUrl: options.url || options['neurosec-url'] || DEFAULT_NEUROSEC_URL,
+        orgId: options.org || options['org-id'] || '',
+        token: options.token || '',
+        mode: options.mode || 'monitor',
+        configPath: options.config || options['config-path'],
+        nonInteractive: true,
+    });
+}
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":";;;;;AAqIA,4BAmHC;AAED,wDASC;AAnQD,4CAAoB;AACpB,gDAAwB;AACxB,wDAAgC;AAChC,4CAAoB;AAGpB,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAEvD,MAAM,eAAe,GAAG,CAAC,IAOxB,EAAE,EAAE,CAAC;iDAC2C,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;;;cAG3D,IAAI,CAAC,MAAM;;;;eAIV,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,6BAA6B;mBAChG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,iCAAiC;;;eAGhH,IAAI,CAAC,WAAW;aAClB,IAAI,CAAC,KAAK;gBACP,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,+BAA+B;;;;;WAK7G,IAAI,CAAC,IAAI;qBACC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;4BACrC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;;;;;;;;;;;;;SAa/D,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ;;;;;;;;;;;;;;;;;;;cAmB7B,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,iCAAiC;;;;;;;;;;;CAWzH,CAAC;AAEF,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,SAAS,EAAE,4BAA4B;YACvC,UAAU,EAAE,wCAAwC;YACpD,SAAS,EAAE,yCAAyC;YACpD,QAAQ,EAAE,uCAAuC;YACjD,MAAM,EAAE,gCAAgC;SACzC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,kBAAkB;QAC7B,UAAU,EAAE,8BAA8B;QAC1C,SAAS,EAAE,+BAA+B;QAC1C,QAAQ,EAAE,6BAA6B;QACvC,MAAM,EAAE,sBAAsB;KAC/B,CAAC;AACJ,CAAC;AAWD,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,kBAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,EAAE;YAC3C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,CAAC;QACH,OAAO,YAAE,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,OAAO,MAAM,EAAE,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,QAAQ,GAAG,YAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,MAAM,CACrD,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,MAAM,CACzC,4BAA4B,EAC5B,EAAE,CACH,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,MAAM,CACvC,qDAAqD,EACrD,SAAS,CACV,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;IAChF,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAEhC,IAAI,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAC3B,kDAAkD,EAClD,EAAE,CACH,CAAC;QACF,KAAK,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IAC7C,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,QAAQ,EAAE,SAAS,CAAC;IAEtC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG;QACpB,SAAS;QACT,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,MAAM;QACZ,cAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;KAC9B,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC;QACpC,MAAM;QACN,WAAW;QACX,KAAK;QACL,KAAK;QACL,IAAI;QACJ,QAAQ;KACT,CAAC,CAAC;IAEH,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;IAEjD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,YAAE,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACjD,YAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,SAAS,eAAe,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,OAA+B;IAC1E,MAAM,QAAQ,CAAC;QACb,WAAW,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,oBAAoB;QAC3E,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;QAC/B,UAAU,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;QACpD,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/skill-authz/skill-evaluator.d.ts

@@ -0,0 +1,20 @@
+import { SkillAuthzRequest, SkillAuthzDecision } from '../types';
+import { SentryConfig } from '../config';
+import { AuditLogger } from '../audit';
+export declare class SkillEvaluator {
+    private config;
+    private pendingApprovals;
+    private cache;
+    private auditLogger;
+    constructor(config: SentryConfig, auditLogger?: AuditLogger);
+    evaluate(request: SkillAuthzRequest): SkillAuthzDecision;
+    approve(invocationId: string): boolean;
+    deny(invocationId: string): boolean;
+    getPendingApprovals(): Array<{
+        invocationId: string;
+        skillName: string;
+        frameworkId: string;
+    }>;
+    private computeRiskScore;
+}
+//# sourceMappingURL=skill-evaluator.d.ts.map

package/dist/skill-authz/skill-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-evaluator.d.ts","sourceRoot":"","sources":["../../src/skill-authz/skill-evaluator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAc,MAAM,UAAU,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAUvC,qBAAa,cAAc;IAMvB,OAAO,CAAC,MAAM;IALhB,OAAO,CAAC,gBAAgB,CAA2C;IACnE,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,WAAW,CAAc;gBAGvB,MAAM,EAAE,YAAY,EAC5B,WAAW,CAAC,EAAE,WAAW;IAK3B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,kBAAkB;IAuExD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAatC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAWnC,mBAAmB,IAAI,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAc9F,OAAO,CAAC,gBAAgB;CA6CzB"}