@neurosec/sentry 1.0.17 → 1.0.19

package/dist/action-logger.d.ts

@@ -0,0 +1,40 @@
+import { AgentAction, AgentActionType, EnforcementDecision, FileAccessEvent, NetworkEvent, TaggedProcess } from './types';
+import { AuditLogger } from './audit';
+export declare class ActionLogger {
+    private config;
+    private auditLogger;
+    private pending;
+    private flushTimer;
+    private processedCount;
+    constructor(auditLogger: AuditLogger, hostId: string);
+    start(): void;
+    stop(): void;
+    logAction(params: {
+        pid: number;
+        frameworkId: string;
+        type: AgentActionType;
+        intent: string;
+        context: string;
+        reasoningTrace?: string[];
+        input: string;
+        output: string;
+        durationMs: number;
+        success: boolean;
+        errorMessage?: string | null;
+        dataClassifications?: string[];
+        decision: AgentAction['decision'];
+        decisionReason: string;
+    }): void;
+    logFromDecision(pid: number, frameworkId: string, decision: EnforcementDecision): void;
+    logFileAccess(pid: number, frameworkId: string, event: FileAccessEvent, process: TaggedProcess): void;
+    logNetworkAccess(pid: number, frameworkId: string, event: NetworkEvent): void;
+    getRecentActions(limit?: number): AgentAction[];
+    getProcessedCount(): number;
+    private flush;
+    private detectSensitiveData;
+    private computeRiskScore;
+    private getRiskFactors;
+    private decisionTypeToActionType;
+    private classifyPath;
+}
+//# sourceMappingURL=action-logger.d.ts.map

package/dist/action-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-logger.d.ts","sourceRoot":"","sources":["../src/action-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAWtC,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,cAAc,CAAK;gBAEf,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;IAgBpD,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI;IAUZ,SAAS,CAAC,MAAM,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;QAClC,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,IAAI;IAiER,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAiBtF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI;IAkBrG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI;IAmB7E,gBAAgB,CAAC,KAAK,SAAM,GAAG,WAAW,EAAE;IAI5C,iBAAiB,IAAI,MAAM;IAM3B,OAAO,CAAC,KAAK;IA4Bb,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,wBAAwB;IAWhC,OAAO,CAAC,YAAY;CAoBrB"}

package/dist/action-logger.js

@@ -0,0 +1,252 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionLogger = void 0;
+const crypto_1 = require("crypto");
+const logger_1 = require("./logger");
+class ActionLogger {
+    constructor(auditLogger, hostId) {
+        this.pending = [];
+        this.flushTimer = null;
+        this.processedCount = 0;
+        this.auditLogger = auditLogger;
+        this.config = {
+            hostId,
+            batchSize: 50,
+            flushIntervalMs: 10000,
+            sensitivePatterns: [
+                /api[-_]?key/i, /secret/i, /password/i, /token/i, /credential/i,
+                /auth[-_]?header/i, /bearer/i, /sk-[a-zA-Z0-9]{20,}/i,
+                /-----BEGIN (RSA |EC )?PRIVATE KEY-----/,
+                /social_security/i, /ssn/i, /passport/i, /credit_card/i, /cvv/i,
+            ],
+            maxActionInputLength: 10000,
+        };
+    }
+    start() {
+        this.flushTimer = setInterval(() => this.flush(), this.config.flushIntervalMs);
+        logger_1.logger.info('Action logger started', {
+            batchSize: this.config.batchSize,
+            intervalMs: this.config.flushIntervalMs,
+        });
+    }
+    stop() {
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
+        this.flush();
+    }
+    // ── AEGIS: Log agent actions with intent & reasoning context ─────────────
+    logAction(params) {
+        const sensitiveData = this.detectSensitiveData(params.input, params.output);
+        const riskScore = this.computeRiskScore(params.type, sensitiveData, params.intent, params.context);
+        const action = {
+            id: (0, crypto_1.randomUUID)(),
+            pid: params.pid,
+            frameworkId: params.frameworkId,
+            hostId: this.config.hostId,
+            type: params.type,
+            timestamp: Date.now(),
+            intent: params.intent,
+            context: params.context,
+            reasoningTrace: params.reasoningTrace ?? [],
+            input: params.input.slice(0, this.config.maxActionInputLength),
+            output: params.output.slice(0, this.config.maxActionInputLength),
+            durationMs: params.durationMs,
+            success: params.success,
+            errorMessage: params.errorMessage ?? null,
+            dataClassifications: params.dataClassifications ?? [],
+            sensitiveDataDetected: sensitiveData,
+            riskScore,
+            riskFactors: this.getRiskFactors(riskScore),
+            decision: params.decision,
+            decisionReason: params.decisionReason,
+        };
+        this.pending.push(action);
+        this.processedCount++;
+        if (this.pending.length >= this.config.batchSize) {
+            this.flush();
+        }
+        // Log high-risk actions immediately to audit log
+        if (riskScore >= 7) {
+            const auditAction = riskScore >= 8 ? 'deny' : 'allow';
+            this.auditLogger.log({
+                id: action.id,
+                timestamp: action.timestamp,
+                type: 'process',
+                action: auditAction,
+                frameworkId: action.frameworkId,
+                frameworkName: null,
+                pid: action.pid,
+                reason: `High-risk action: ${action.type} (score: ${riskScore})`,
+                detail: {
+                    actionType: action.type,
+                    intent: action.intent,
+                    riskScore,
+                    riskFactors: action.riskFactors,
+                    sensitiveData: action.sensitiveDataDetected,
+                },
+                hostname: this.config.hostId,
+            });
+        }
+    }
+    // ── AEGIS: Log from enforcement decisions ────────────────────────────────
+    logFromDecision(pid, frameworkId, decision) {
+        this.logAction({
+            pid,
+            frameworkId,
+            type: this.decisionTypeToActionType(decision.type),
+            intent: decision.reason,
+            context: JSON.stringify(decision.detail),
+            input: '',
+            output: '',
+            durationMs: 0,
+            success: decision.action === 'allow',
+            errorMessage: decision.action !== 'allow' ? decision.reason : null,
+            decision: decision.action,
+            decisionReason: decision.reason,
+        });
+    }
+    logFileAccess(pid, frameworkId, event, process) {
+        this.logAction({
+            pid,
+            frameworkId,
+            type: event.operation === 'read' ? 'file_read' : 'file_write',
+            intent: `File ${event.operation} on ${event.targetPath}`,
+            context: `Process: ${process.command.slice(0, 200)}`,
+            input: event.targetPath,
+            output: '',
+            durationMs: 0,
+            success: event.decision === 'allow',
+            errorMessage: event.decision !== 'allow' ? 'Access denied by policy' : null,
+            dataClassifications: this.classifyPath(event.targetPath),
+            decision: event.decision,
+            decisionReason: event.decision === 'allow' ? 'Policy allowed' : 'Policy denied',
+        });
+    }
+    logNetworkAccess(pid, frameworkId, event) {
+        this.logAction({
+            pid,
+            frameworkId,
+            type: 'network_egress',
+            intent: `Network ${event.direction} to ${event.hostname ?? event.destIp}:${event.destPort}`,
+            context: `Destination: ${event.destIp}:${event.destPort}`,
+            input: `${event.hostname ?? event.destIp}:${event.destPort}`,
+            output: '',
+            durationMs: 0,
+            success: event.decision === 'allow',
+            errorMessage: event.decision !== 'allow' ? 'Connection denied by policy' : null,
+            decision: event.decision,
+            decisionReason: event.decision === 'allow' ? 'Policy allowed' : 'Policy denied',
+        });
+    }
+    // ── Query / stats ────────────────────────────────────────────────────────
+    getRecentActions(limit = 100) {
+        return this.pending.slice(-limit);
+    }
+    getProcessedCount() {
+        return this.processedCount;
+    }
+    // ── Internal ─────────────────────────────────────────────────────────────
+    flush() {
+        if (this.pending.length === 0)
+            return;
+        const batch = this.pending.splice(0, this.config.batchSize);
+        // Write to audit log as summary
+        const highRisk = batch.filter(a => a.riskScore >= 6);
+        for (const action of highRisk) {
+            this.auditLogger.log({
+                id: action.id,
+                timestamp: action.timestamp,
+                type: 'process',
+                action: action.decision === 'monitor' ? 'allow' : action.decision,
+                frameworkId: action.frameworkId,
+                frameworkName: null,
+                pid: action.pid,
+                reason: `AEGIS action: ${action.type} — ${action.intent}`,
+                detail: {
+                    actionType: action.type,
+                    riskScore: action.riskScore,
+                    riskFactors: action.riskFactors,
+                    sensitiveData: action.sensitiveDataDetected,
+                    dataClassifications: action.dataClassifications,
+                    durationMs: action.durationMs,
+                },
+                hostname: this.config.hostId,
+            });
+        }
+    }
+    detectSensitiveData(input, output) {
+        const combined = `${input} ${output}`;
+        return this.config.sensitivePatterns.some(p => p.test(combined));
+    }
+    computeRiskScore(type, sensitiveData, intent, context) {
+        let score = 0;
+        // High-risk action types
+        if (['file_delete', 'syscall', 'child_spawn'].includes(type))
+            score += 4;
+        if (['file_write', 'network_egress', 'skill_invoke', 'api_call'].includes(type))
+            score += 2;
+        if (['tool_call', 'network_ingress'].includes(type))
+            score += 1;
+        // Sensitive data increases risk
+        if (sensitiveData)
+            score += 3;
+        // Intent analysis
+        const highRiskIntent = /delete|remove|destroy|wipe|overwrite|chmod|chown|sudo|exec/i;
+        const moderateRiskIntent = /write|modify|update|deploy|push|publish|expose/i;
+        if (highRiskIntent.test(intent))
+            score += 3;
+        else if (moderateRiskIntent.test(intent))
+            score += 1;
+        // Context analysis
+        if (/production|prod|live/i.test(context))
+            score += 1;
+        return Math.min(score, 10);
+    }
+    getRiskFactors(score) {
+        const factors = [];
+        if (score >= 8)
+            factors.push('critical_risk');
+        if (score >= 6)
+            factors.push('high_risk');
+        if (score >= 4)
+            factors.push('elevated_risk');
+        if (score < 4)
+            factors.push('normal');
+        return factors;
+    }
+    decisionTypeToActionType(decisionType) {
+        switch (decisionType) {
+            case 'file_access': return 'file_read';
+            case 'network': return 'network_egress';
+            case 'syscall': return 'syscall';
+            case 'skill': return 'skill_invoke';
+            case 'process': return 'child_spawn';
+            default: return 'api_call';
+        }
+    }
+    classifyPath(filePath) {
+        const classifications = [];
+        if (/\.ssh\/|\.aws\/|\.kube\/|\.gcloud\//i.test(filePath)) {
+            classifications.push('infrastructure_credentials');
+        }
+        if (/\.git\/|\.svn\//i.test(filePath))
+            classifications.push('source_code');
+        if (/etc\/passwd|etc\/shadow|etc\/sudoers/i.test(filePath)) {
+            classifications.push('system_config');
+        }
+        if (/token|secret|key|credential/i.test(filePath)) {
+            classifications.push('secrets');
+        }
+        if (/\.pem$|\.key$|\.crt$|cert/i.test(filePath)) {
+            classifications.push('certificates');
+        }
+        if (/database|db\/|\.sql$|\.db$/i.test(filePath)) {
+            classifications.push('database');
+        }
+        return classifications;
+    }
+}
+exports.ActionLogger = ActionLogger;
+//# sourceMappingURL=action-logger.js.map

package/dist/action-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-logger.js","sourceRoot":"","sources":["../src/action-logger.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAGpC,qCAAkC;AAUlC,MAAa,YAAY;IAOvB,YAAY,WAAwB,EAAE,MAAc;QAJ5C,YAAO,GAAkB,EAAE,CAAC;QAC5B,eAAU,GAA0C,IAAI,CAAC;QACzD,mBAAc,GAAG,CAAC,CAAC;QAGzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM;YACN,SAAS,EAAE,EAAE;YACb,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE;gBACjB,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa;gBAC/D,kBAAkB,EAAE,SAAS,EAAE,sBAAsB;gBACrD,wCAAwC;gBACxC,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM;aAChE;YACD,oBAAoB,EAAE,KAAK;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/E,eAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,4EAA4E;IAE5E,SAAS,CAAC,MAeT;QACC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CACrC,MAAM,CAAC,IAAI,EACX,aAAa,EACb,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CACf,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;YAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;YAChE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE;YACrD,qBAAqB,EAAE,aAAa;YACpC,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,WAAW,GAAoC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACvF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,IAAI;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,qBAAqB,MAAM,CAAC,IAAI,YAAY,SAAS,GAAG;gBAChE,MAAM,EAAE;oBACN,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,SAAS;oBACT,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,qBAAqB;iBAC5C;gBACD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,eAAe,CAAC,GAAW,EAAE,WAAmB,EAAE,QAA6B;QAC7E,IAAI,CAAC,SAAS,CAAC;YACb,GAAG;YACH,WAAW;YACX,IAAI,EAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,OAAO;YACpC,YAAY,EAAE,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClE,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,cAAc,EAAE,QAAQ,CAAC,MAAM;SAChC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,GAAW,EAAE,WAAmB,EAAE,KAAsB,EAAE,OAAsB;QAC5F,IAAI,CAAC,SAAS,CAAC;YACb,GAAG;YACH,WAAW;YACX,IAAI,EAAE,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;YAC7D,MAAM,EAAE,QAAQ,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,UAAU,EAAE;YACxD,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACpD,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO;YACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;YAC3E,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;YACxD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe;SAChF,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,GAAW,EAAE,WAAmB,EAAE,KAAmB;QACpE,IAAI,CAAC,SAAS,CAAC;YACb,GAAG;YACH,WAAW;YACX,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,WAAW,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE;YAC3F,OAAO,EAAE,gBAAgB,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE;YACzD,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE;YAC5D,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO;YACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;YAC/E,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe;SAChF,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E,gBAAgB,CAAC,KAAK,GAAG,GAAG;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,4EAA4E;IAEpE,KAAK;QACX,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5D,gCAAgC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBACnB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAA2C;gBACpG,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,IAAI;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,iBAAiB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE;gBACzD,MAAM,EAAE;oBACN,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,aAAa,EAAE,MAAM,CAAC,qBAAqB;oBAC3C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;gBACD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,KAAa,EAAE,MAAc;QACvD,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,gBAAgB,CACtB,IAAqB,EACrB,aAAsB,EACtB,MAAc,EACd,OAAe;QAEf,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,yBAAyB;QACzB,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAC5F,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEhE,gCAAgC;QAChC,IAAI,aAAa;YAAE,KAAK,IAAI,CAAC,CAAC;QAE9B,kBAAkB;QAClB,MAAM,cAAc,GAAG,6DAA6D,CAAC;QACrF,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;QAC7E,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;aACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAErD,mBAAmB;QACnB,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEtD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,wBAAwB,CAAC,YAAoB;QACnD,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,aAAa,CAAC,CAAC,OAAO,WAAW,CAAC;YACvC,KAAK,SAAS,CAAC,CAAC,OAAO,gBAAgB,CAAC;YACxC,KAAK,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC;YACjC,KAAK,OAAO,CAAC,CAAC,OAAO,cAAc,CAAC;YACpC,KAAK,SAAS,CAAC,CAAC,OAAO,aAAa,CAAC;YACrC,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,eAAe,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AA9RD,oCA8RC"}

package/dist/agent-registry.d.ts

@@ -0,0 +1,24 @@
+import { AgentIdentity, AgentDocumentation, TaggedProcess, DecisionConstraint } from './types';
+export declare class AgentRegistry {
+    private state;
+    private stateDir;
+    private dirty;
+    constructor(stateDir: string);
+    init(): Promise<void>;
+    registerOrUpdate(process: TaggedProcess, hostId: string): AgentIdentity;
+    decommission(frameworkId: string, pid: number): void;
+    quarantine(frameworkId: string, pid: number, reason: string): void;
+    updateDocumentation(frameworkId: string, pid: number, docs: Partial<AgentDocumentation>): void;
+    updateIdentity(frameworkId: string, pid: number, updates: Partial<AgentIdentity>): void;
+    setConstraint(constraint: DecisionConstraint): void;
+    getConstraint(frameworkId: string): DecisionConstraint | undefined;
+    getMaxDecisionLevel(frameworkId: string): DecisionConstraint['maxDecisionLevel'];
+    getActiveIdentities(): AgentIdentity[];
+    getIdentity(frameworkId: string, pid: number): AgentIdentity | undefined;
+    getIdentityById(id: string): AgentIdentity | undefined;
+    getAllIdentities(): AgentIdentity[];
+    getAgentOnAPage(frameworkId: string, pid: number): AgentIdentity | null;
+    private loadState;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=agent-registry.d.ts.map

package/dist/agent-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-registry.d.ts","sourceRoot":"","sources":["../src/agent-registry.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EACnB,MAAM,SAAS,CAAC;AAUjB,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAGX;IACF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAS;gBAEV,QAAQ,EAAE,MAAM;IAItB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;IAkDvE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAWpD,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAYlE,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAS9F,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAWvF,aAAa,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAKnD,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIlE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,CAAC;IAMhF,mBAAmB,IAAI,aAAa,EAAE;IAKtC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIxE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAItD,gBAAgB,IAAI,aAAa,EAAE;IAKnC,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;YAMzD,SAAS;IAmBjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAe7B"}

package/dist/agent-registry.js

@@ -0,0 +1,176 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentRegistry = void 0;
+const crypto_1 = require("crypto");
+const logger_1 = require("./logger");
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+class AgentRegistry {
+    constructor(stateDir) {
+        this.state = {
+            identities: new Map(),
+            constraints: new Map(),
+        };
+        this.dirty = false;
+        this.stateDir = path_1.default.join(stateDir, 'agent-registry');
+    }
+    async init() {
+        await promises_1.default.mkdir(this.stateDir, { recursive: true }).catch(() => { });
+        await this.loadState();
+        logger_1.logger.info('Agent registry initialized', { count: this.state.identities.size });
+    }
+    // ── Lifecycle: register / update / decommission ──────────────────────────
+    registerOrUpdate(process, hostId) {
+        const key = `${process.frameworkId}:${process.pid}`;
+        const existing = this.state.identities.get(key);
+        if (existing) {
+            existing.lastSeenAt = Date.now();
+            existing.pid = process.pid;
+            this.dirty = true;
+            return existing;
+        }
+        const identity = {
+            id: (0, crypto_1.randomUUID)(),
+            frameworkId: process.frameworkId,
+            frameworkName: process.frameworkName,
+            pid: process.pid,
+            ppid: process.ppid,
+            hostId,
+            command: process.command,
+            owner: '',
+            ownerEmail: '',
+            purpose: '',
+            riskLevel: 'medium',
+            status: 'active',
+            firstDiscoveredAt: Date.now(),
+            lastSeenAt: Date.now(),
+            decommissionedAt: null,
+            allowedTools: [],
+            allowedDataClassifications: [],
+            allowedDomains: [],
+            maxDecisionScope: 'act_autonomously',
+            documentation: {
+                description: '',
+                businessOwner: '',
+                technicalContact: '',
+                approvedUseCases: [],
+                prohibitedUseCases: [],
+                dataAccessRationale: '',
+                escalationContact: '',
+                reviewDate: '',
+                complianceFrameworks: [],
+            },
+        };
+        this.state.identities.set(key, identity);
+        this.dirty = true;
+        logger_1.logger.info('Agent registered', { framework: process.frameworkId, pid: process.pid });
+        return identity;
+    }
+    decommission(frameworkId, pid) {
+        const key = `${frameworkId}:${pid}`;
+        const identity = this.state.identities.get(key);
+        if (identity) {
+            identity.status = 'decommissioned';
+            identity.decommissionedAt = Date.now();
+            this.dirty = true;
+            logger_1.logger.info('Agent decommissioned', { framework: frameworkId, pid });
+        }
+    }
+    quarantine(frameworkId, pid, reason) {
+        const key = `${frameworkId}:${pid}`;
+        const identity = this.state.identities.get(key);
+        if (identity) {
+            identity.status = 'quarantined';
+            this.dirty = true;
+            logger_1.logger.warn('Agent quarantined', { framework: frameworkId, pid, reason });
+        }
+    }
+    // ── Documentation: Agent-on-a-Page ───────────────────────────────────────
+    updateDocumentation(frameworkId, pid, docs) {
+        const key = `${frameworkId}:${pid}`;
+        const identity = this.state.identities.get(key);
+        if (identity) {
+            Object.assign(identity.documentation, docs);
+            this.dirty = true;
+        }
+    }
+    updateIdentity(frameworkId, pid, updates) {
+        const key = `${frameworkId}:${pid}`;
+        const identity = this.state.identities.get(key);
+        if (identity) {
+            Object.assign(identity, updates);
+            this.dirty = true;
+        }
+    }
+    // ── Constraints: AEGIS least-agency (Zero Trust Domain) ──────────────────
+    setConstraint(constraint) {
+        this.state.constraints.set(constraint.frameworkId, constraint);
+        this.dirty = true;
+    }
+    getConstraint(frameworkId) {
+        return this.state.constraints.get(frameworkId);
+    }
+    getMaxDecisionLevel(frameworkId) {
+        return this.state.constraints.get(frameworkId)?.maxDecisionLevel ?? 'act_autonomously';
+    }
+    // ── Queries ──────────────────────────────────────────────────────────────
+    getActiveIdentities() {
+        return [...this.state.identities.values()]
+            .filter(i => i.status === 'active' || i.status === 'idle');
+    }
+    getIdentity(frameworkId, pid) {
+        return this.state.identities.get(`${frameworkId}:${pid}`);
+    }
+    getIdentityById(id) {
+        return [...this.state.identities.values()].find(i => i.id === id);
+    }
+    getAllIdentities() {
+        return [...this.state.identities.values()];
+    }
+    // AEGIS Agent-on-a-Page: return full documentation for governance review
+    getAgentOnAPage(frameworkId, pid) {
+        return this.getIdentity(frameworkId, pid) ?? null;
+    }
+    // ── Persistence ──────────────────────────────────────────────────────────
+    async loadState() {
+        try {
+            const data = await promises_1.default.readFile(path_1.default.join(this.stateDir, 'registry.json'), 'utf8');
+            const parsed = JSON.parse(data);
+            if (parsed.identities) {
+                for (const [k, v] of Object.entries(parsed.identities)) {
+                    this.state.identities.set(k, v);
+                }
+            }
+            if (parsed.constraints) {
+                for (const [k, v] of Object.entries(parsed.constraints)) {
+                    this.state.constraints.set(k, v);
+                }
+            }
+        }
+        catch {
+            // fresh start
+        }
+    }
+    async flush() {
+        if (!this.dirty)
+            return;
+        try {
+            const obj = {
+                identities: Object.fromEntries(this.state.identities),
+                constraints: Object.fromEntries(this.state.constraints),
+            };
+            const tmp = path_1.default.join(this.stateDir, `registry.tmp.${Date.now()}`);
+            await promises_1.default.writeFile(tmp, JSON.stringify(obj, null, 2), 'utf8');
+            await promises_1.default.rename(tmp, path_1.default.join(this.stateDir, 'registry.json'));
+            this.dirty = false;
+        }
+        catch (err) {
+            logger_1.logger.error('Failed to flush agent registry', { err: err.message });
+        }
+    }
+}
+exports.AgentRegistry = AgentRegistry;
+//# sourceMappingURL=agent-registry.js.map

package/dist/agent-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-registry.js","sourceRoot":"","sources":["../src/agent-registry.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAoC;AAOpC,qCAAkC;AAClC,2DAA6B;AAC7B,gDAAwB;AAOxB,MAAa,aAAa;IAQxB,YAAY,QAAgB;QAPpB,UAAK,GAAkB;YAC7B,UAAU,EAAE,IAAI,GAAG,EAAE;YACrB,WAAW,EAAE,IAAI,GAAG,EAAE;SACvB,CAAC;QAEM,UAAK,GAAG,KAAK,CAAC;QAGpB,IAAI,CAAC,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,kBAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,eAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,4EAA4E;IAE5E,gBAAgB,CAAC,OAAsB,EAAE,MAAc;QACrD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEhD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,QAAQ;YAChB,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE;YAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,EAAE;YAChB,0BAA0B,EAAE,EAAE;YAC9B,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,kBAAkB;YACpC,aAAa,EAAE;gBACb,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,EAAE;gBACjB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,kBAAkB,EAAE,EAAE;gBACtB,mBAAmB,EAAE,EAAE;gBACvB,iBAAiB,EAAE,EAAE;gBACrB,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,EAAE;aACzB;SACF,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,eAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,YAAY,CAAC,WAAmB,EAAE,GAAW;QAC3C,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC;YACnC,QAAQ,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,eAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,UAAU,CAAC,WAAmB,EAAE,GAAW,EAAE,MAAc;QACzD,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC;YAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,eAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,mBAAmB,CAAC,WAAmB,EAAE,GAAW,EAAE,IAAiC;QACrF,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,cAAc,CAAC,WAAmB,EAAE,GAAW,EAAE,OAA+B;QAC9E,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,aAAa,CAAC,UAA8B;QAC1C,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,aAAa,CAAC,WAAmB;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,mBAAmB,CAAC,WAAmB;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,gBAAgB,IAAI,kBAAkB,CAAC;IACzF,CAAC;IAED,4EAA4E;IAE5E,mBAAmB;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,WAAW,CAAC,WAAmB,EAAE,GAAW;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe,CAAC,EAAU;QACxB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,yEAAyE;IACzE,eAAe,CAAC,WAAmB,EAAE,GAAW;QAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBACvD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAkB,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAuB,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG;gBACV,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBACrD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;aACxD,CAAC;YACF,MAAM,GAAG,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnE,MAAM,kBAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,kBAAE,CAAC,MAAM,CAAC,GAAG,EAAE,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF;AA1LD,sCA0LC"}

package/dist/anomaly-detector.d.ts

@@ -0,0 +1,26 @@
+import { AnomalyAlert, AgentAction, TaggedProcess } from './types';
+import { AuditLogger } from './audit';
+export declare class AnomalyDetector {
+    private config;
+    private auditLogger;
+    private baselines;
+    private actionBuffer;
+    private alerts;
+    private checkTimer;
+    constructor(auditLogger: AuditLogger, hostId: string);
+    start(): void;
+    stop(): void;
+    ingestAction(action: AgentAction): void;
+    private establishBaseline;
+    private detectDeviations;
+    private checkFrequencyDeviation;
+    private createAlert;
+    private getRecommendation;
+    private runCheck;
+    getOpenAlerts(): AnomalyAlert[];
+    getAllAlerts(): AnomalyAlert[];
+    resolveAlert(alertId: string, resolvedBy: string): boolean;
+    acknowledgeAlert(alertId: string): boolean;
+    ingestProcesses(processes: TaggedProcess[]): void;
+}
+//# sourceMappingURL=anomaly-detector.d.ts.map

package/dist/anomaly-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-detector.d.ts","sourceRoot":"","sources":["../src/anomaly-detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAoB,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAUtC,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,YAAY,CAAyC;IAC7D,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,UAAU,CAA+C;gBAErD,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;IAUpD,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI;IASZ,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAgBvC,OAAO,CAAC,iBAAiB;IAqEzB,OAAO,CAAC,gBAAgB;IAsFxB,OAAO,CAAC,uBAAuB;IAwB/B,OAAO,CAAC,WAAW;IAuCnB,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,QAAQ;IA+ChB,aAAa,IAAI,YAAY,EAAE;IAI/B,YAAY,IAAI,YAAY,EAAE;IAI9B,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAW1D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAS1C,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI;CAUlD"}