@panguard-ai/core 0.1.0

package/dist/monitor/network-monitor.js

@@ -0,0 +1,336 @@
+/**
+ * Network connection monitoring via polling
+ * 透過輪詢進行網路連線監控
+ *
+ * Periodically polls active network connections and emits events
+ * for newly established or closed connections.
+ * 定期輪詢活躍網路連線，並為新建立或關閉的連線發出事件。
+ *
+ * @module @panguard-ai/core/monitor/network-monitor
+ */
+import { EventEmitter } from 'node:events';
+import { execFile } from 'node:child_process';
+import { platform } from 'node:os';
+import { promisify } from 'node:util';
+import { createLogger } from '../utils/index.js';
+import { normalizeNetworkEvent } from './event-normalizer.js';
+const execFileAsync = promisify(execFile);
+const logger = createLogger('network-monitor');
+/**
+ * Generate a unique key for a connection to track state changes
+ * 為連線產生唯一金鑰以追蹤狀態變更
+ *
+ * @param conn - Active connection / 活躍連線
+ * @returns Connection key string / 連線金鑰字串
+ */
+function connectionKey(conn) {
+    return `${conn.localAddress}:${conn.localPort}-${conn.remoteAddress}:${conn.remotePort}`;
+}
+/**
+ * NetworkMonitor - monitors active network connections by polling OS tools
+ * NetworkMonitor - 透過輪詢作業系統工具監控活躍網路連線
+ *
+ * Events emitted:
+ * - 'new_connection': SecurityEvent - when a new connection is detected / 當偵測到新連線時
+ * - 'closed_connection': SecurityEvent - when a connection is closed / 當連線關閉時
+ * - 'error': Error - when polling encounters an error / 當輪詢遇到錯誤時
+ *
+ * @example
+ * ```typescript
+ * const monitor = new NetworkMonitor(30000);
+ * monitor.on('new_connection', (event) => console.log('New:', event));
+ * monitor.on('closed_connection', (event) => console.log('Closed:', event));
+ * monitor.start();
+ * ```
+ */
+export class NetworkMonitor extends EventEmitter {
+    /** Whether the monitor is currently running / 監控器是否正在執行 */
+    running = false;
+    /** Polling timer / 輪詢計時器 */
+    timer;
+    /** Previous connection snapshot for diff detection / 用於差異偵測的先前連線快照 */
+    previousConnections = new Map();
+    /** Polling interval in milliseconds / 輪詢間隔（毫秒） */
+    pollInterval;
+    /**
+     * Create a new NetworkMonitor instance
+     * 建立新的 NetworkMonitor 實例
+     *
+     * @param pollInterval - Polling interval in ms (default 30000) / 輪詢間隔毫秒數（預設 30000）
+     */
+    constructor(pollInterval = 30000) {
+        super();
+        this.pollInterval = pollInterval;
+    }
+    /**
+     * Start polling for network connections
+     * 開始輪詢網路連線
+     */
+    start() {
+        if (this.running) {
+            logger.warn('NetworkMonitor is already running');
+            return;
+        }
+        this.running = true;
+        logger.info(`NetworkMonitor started (poll interval: ${this.pollInterval}ms)`);
+        // Run an initial poll immediately / 立即執行首次輪詢
+        void this.pollConnections();
+        this.timer = setInterval(() => {
+            void this.pollConnections();
+        }, this.pollInterval);
+    }
+    /**
+     * Stop polling and clean up
+     * 停止輪詢並清理
+     */
+    stop() {
+        if (!this.running) {
+            logger.warn('NetworkMonitor is not running');
+            return;
+        }
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+        this.running = false;
+        this.previousConnections.clear();
+        logger.info('NetworkMonitor stopped');
+    }
+    /**
+     * Check if the monitor is currently running
+     * 檢查監控器是否正在執行
+     *
+     * @returns True if running / 如果正在執行則為 true
+     */
+    isRunning() {
+        return this.running;
+    }
+    /**
+     * Poll current connections and emit events for changes
+     * 輪詢目前連線並為變更發出事件
+     */
+    async pollConnections() {
+        try {
+            const currentList = await this.getCurrentConnections();
+            const currentMap = new Map();
+            for (const conn of currentList) {
+                const key = connectionKey(conn);
+                currentMap.set(key, conn);
+                // Emit event for new connections not in previous snapshot
+                // 為不在先前快照中的新連線發出事件
+                if (!this.previousConnections.has(key)) {
+                    const event = normalizeNetworkEvent({
+                        localAddr: conn.localAddress,
+                        localPort: conn.localPort,
+                        remoteAddr: conn.remoteAddress,
+                        remotePort: conn.remotePort,
+                        state: conn.state,
+                        process: conn.process || undefined,
+                    });
+                    this.emit('new_connection', event);
+                }
+            }
+            // Emit event for connections that no longer exist
+            // 為不再存在的連線發出事件
+            for (const [key, conn] of this.previousConnections) {
+                if (!currentMap.has(key)) {
+                    const event = normalizeNetworkEvent({
+                        localAddr: conn.localAddress,
+                        localPort: conn.localPort,
+                        remoteAddr: conn.remoteAddress,
+                        remotePort: conn.remotePort,
+                        state: 'CLOSED',
+                        process: conn.process || undefined,
+                    });
+                    this.emit('closed_connection', event);
+                }
+            }
+            this.previousConnections = currentMap;
+        }
+        catch (err) {
+            logger.error('Failed to poll connections', { error: String(err) });
+            this.emit('error', err instanceof Error ? err : new Error(String(err)));
+        }
+    }
+    /**
+     * Get current active network connections from the OS
+     * 從作業系統取得目前活躍的網路連線
+     *
+     * Uses platform-specific tools:
+     * 使用平台特定工具：
+     * - macOS: `lsof -i -P -n`
+     * - Linux: `ss -tnp`
+     * - Windows: `netstat -an`
+     *
+     * @returns Array of active connections / 活躍連線陣列
+     */
+    async getCurrentConnections() {
+        const os = platform();
+        try {
+            if (os === 'darwin') {
+                return await this.parseLsof();
+            }
+            else if (os === 'linux') {
+                return await this.parseSs();
+            }
+            else if (os === 'win32') {
+                return await this.parseNetstat();
+            }
+            else {
+                logger.warn(`Unsupported platform for network monitoring: ${os}`);
+                return [];
+            }
+        }
+        catch (err) {
+            logger.error('Failed to get current connections', { error: String(err) });
+            return [];
+        }
+    }
+    /**
+     * Parse macOS lsof output into ActiveConnection array
+     * 將 macOS lsof 輸出解析為 ActiveConnection 陣列
+     *
+     * @returns Parsed connections / 解析後的連線
+     */
+    async parseLsof() {
+        const { stdout } = await execFileAsync('lsof', ['-i', '-P', '-n'], {
+            timeout: 10000,
+        });
+        const connections = [];
+        const lines = stdout.split('\n');
+        // Skip header line / 跳過標頭行
+        for (let i = 1; i < lines.length; i++) {
+            const line = lines[i];
+            if (!line || line.trim().length === 0)
+                continue;
+            // lsof output columns: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
+            const parts = line.split(/\s+/);
+            if (parts.length < 9)
+                continue;
+            const processName = parts[0] ?? '';
+            const pid = parseInt(parts[1] ?? '', 10);
+            const name = parts[parts.length - 1] ?? '';
+            // Parse connection string like "192.168.1.1:443->10.0.0.1:12345"
+            // 解析連線字串如 "192.168.1.1:443->10.0.0.1:12345"
+            const arrowMatch = name.match(/^(.+):(\d+)->(.+):(\d+)$/);
+            if (arrowMatch) {
+                connections.push({
+                    localAddress: arrowMatch[1] ?? '',
+                    localPort: parseInt(arrowMatch[2] ?? '0', 10),
+                    remoteAddress: arrowMatch[3] ?? '',
+                    remotePort: parseInt(arrowMatch[4] ?? '0', 10),
+                    state: 'ESTABLISHED',
+                    process: processName,
+                    pid: isNaN(pid) ? undefined : pid,
+                });
+                continue;
+            }
+            // Parse listening socket like "*:8080" or "127.0.0.1:3000"
+            // 解析監聽 socket 如 "*:8080" 或 "127.0.0.1:3000"
+            const listenMatch = name.match(/^(.+):(\d+)$/);
+            if (listenMatch) {
+                const stateCol = parts[parts.length - 2];
+                connections.push({
+                    localAddress: listenMatch[1] ?? '',
+                    localPort: parseInt(listenMatch[2] ?? '0', 10),
+                    remoteAddress: '',
+                    remotePort: 0,
+                    state: stateCol === '(LISTEN)' ? 'LISTEN' : 'UNKNOWN',
+                    process: processName,
+                    pid: isNaN(pid) ? undefined : pid,
+                });
+            }
+        }
+        return connections;
+    }
+    /**
+     * Parse Linux ss output into ActiveConnection array
+     * 將 Linux ss 輸出解析為 ActiveConnection 陣列
+     *
+     * @returns Parsed connections / 解析後的連線
+     */
+    async parseSs() {
+        const { stdout } = await execFileAsync('ss', ['-tnp'], {
+            timeout: 10000,
+        });
+        const connections = [];
+        const lines = stdout.split('\n');
+        // Skip header line / 跳過標頭行
+        for (let i = 1; i < lines.length; i++) {
+            const line = lines[i];
+            if (!line || line.trim().length === 0)
+                continue;
+            // ss output: State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
+            const parts = line.split(/\s+/);
+            if (parts.length < 5)
+                continue;
+            const state = parts[0] ?? '';
+            const localParts = (parts[3] ?? '').split(':');
+            const remoteParts = (parts[4] ?? '').split(':');
+            const localAddr = localParts.slice(0, -1).join(':') || '0.0.0.0';
+            const localPort = parseInt(localParts[localParts.length - 1] ?? '0', 10);
+            const remoteAddr = remoteParts.slice(0, -1).join(':') || '0.0.0.0';
+            const remotePort = parseInt(remoteParts[remoteParts.length - 1] ?? '0', 10);
+            // Extract process name from the "users:(("name",pid=PID,...))" field
+            // 從 "users:(("name",pid=PID,...))" 欄位中擷取程序名稱
+            let processName = '';
+            let pid;
+            const processField = parts[5] ?? '';
+            const processMatch = processField.match(/\(\("(.+?)",pid=(\d+)/);
+            if (processMatch) {
+                processName = processMatch[1] ?? '';
+                pid = parseInt(processMatch[2] ?? '0', 10);
+            }
+            connections.push({
+                localAddress: localAddr,
+                localPort,
+                remoteAddress: remoteAddr,
+                remotePort,
+                state: state.toUpperCase(),
+                process: processName,
+                pid: pid !== undefined && !isNaN(pid) ? pid : undefined,
+            });
+        }
+        return connections;
+    }
+    /**
+     * Parse Windows netstat output into ActiveConnection array
+     * 將 Windows netstat 輸出解析為 ActiveConnection 陣列
+     *
+     * @returns Parsed connections / 解析後的連線
+     */
+    async parseNetstat() {
+        const { stdout } = await execFileAsync('netstat', ['-an'], {
+            timeout: 10000,
+        });
+        const connections = [];
+        const lines = stdout.split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || (!trimmed.startsWith('TCP') && !trimmed.startsWith('UDP')))
+                continue;
+            // netstat -an output: Proto Local Address Foreign Address State
+            const parts = trimmed.split(/\s+/);
+            if (parts.length < 4)
+                continue;
+            const localParts = (parts[1] ?? '').split(':');
+            const remoteParts = (parts[2] ?? '').split(':');
+            const state = parts[3] ?? '';
+            const localAddr = localParts.slice(0, -1).join(':') || '0.0.0.0';
+            const localPort = parseInt(localParts[localParts.length - 1] ?? '0', 10);
+            const remoteAddr = remoteParts.slice(0, -1).join(':') || '0.0.0.0';
+            const remotePort = parseInt(remoteParts[remoteParts.length - 1] ?? '0', 10);
+            connections.push({
+                localAddress: localAddr,
+                localPort,
+                remoteAddress: remoteAddr,
+                remotePort,
+                state: state.toUpperCase() || 'UNKNOWN',
+                process: '',
+                pid: undefined,
+            });
+        }
+        return connections;
+    }
+}
+//# sourceMappingURL=network-monitor.js.map

package/dist/monitor/network-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-monitor.js","sourceRoot":"","sources":["../../src/monitor/network-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAsB;IAC3C,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC9C,2DAA2D;IACnD,OAAO,GAAG,KAAK,CAAC;IACxB,4BAA4B;IACpB,KAAK,CAAkC;IAC/C,sEAAsE;IAC9D,mBAAmB,GAAkC,IAAI,GAAG,EAAE,CAAC;IACvE,kDAAkD;IAC1C,YAAY,CAAS;IAE7B;;;;;OAKG;IACH,YAAY,YAAY,GAAG,KAAK;QAC9B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC;QAE9E,6CAA6C;QAC7C,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAE5B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;YAEvD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAE1B,0DAA0D;gBAC1D,mBAAmB;gBACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC;wBAClC,SAAS,EAAE,IAAI,CAAC,YAAY;wBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,UAAU,EAAE,IAAI,CAAC,aAAa;wBAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;qBACnC,CAAC,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,eAAe;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC;wBAClC,SAAS,EAAE,IAAI,CAAC,YAAY;wBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,UAAU,EAAE,IAAI,CAAC,aAAa;wBAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;qBACnC,CAAC,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,qBAAqB;QACzB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QAEtB,IAAI,CAAC;YACH,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpB,OAAO,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,CAAC;iBAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,CAAC;iBAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,CAAC,CAAC;gBAClE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS;QACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACjE,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,WAAW,GAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjC,2BAA2B;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEhD,0EAA0E;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAE/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAE3C,iEAAiE;YACjE,4CAA4C;YAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC1D,IAAI,UAAU,EAAE,CAAC;gBACf,WAAW,CAAC,IAAI,CAAC;oBACf,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE;oBACjC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;oBAC7C,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE;oBAClC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;oBAC9C,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,WAAW;oBACpB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;iBAClC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,2DAA2D;YAC3D,4CAA4C;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAC/C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,WAAW,CAAC,IAAI,CAAC;oBACf,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;oBAClC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;oBAC9C,aAAa,EAAE,EAAE;oBACjB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBACrD,OAAO,EAAE,WAAW;oBACpB,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,OAAO;QACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;YACrD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,WAAW,GAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjC,2BAA2B;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEhD,8EAA8E;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEhD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAE5E,qEAAqE;YACrE,6CAA6C;YAC7C,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,GAAuB,CAAC;YAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,YAAY,EAAE,CAAC;gBACjB,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpC,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,WAAW,CAAC,IAAI,CAAC;gBACf,YAAY,EAAE,SAAS;gBACvB,SAAS;gBACT,aAAa,EAAE,UAAU;gBACzB,UAAU;gBACV,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC1B,OAAO,EAAE,WAAW;gBACpB,GAAG,EAAE,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACxD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY;QACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE;YACzD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,WAAW,GAAuB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAErF,gEAAgE;YAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAE/B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE7B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAE5E,WAAW,CAAC,IAAI,CAAC;gBACf,YAAY,EAAE,SAAS;gBACvB,SAAS;gBACT,aAAa,EAAE,UAAU;gBACzB,UAAU;gBACV,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS;gBACvC,OAAO,EAAE,EAAE;gBACX,GAAG,EAAE,SAAS;aACf,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/monitor/process-monitor.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Process monitoring via polling
+ * 透過輪詢進行程序監控
+ *
+ * Periodically polls the system process list and emits events
+ * for newly started or stopped processes.
+ * 定期輪詢系統程序列表，並為新啟動或停止的程序發出事件。
+ *
+ * @module @panguard-ai/core/monitor/process-monitor
+ */
+import { EventEmitter } from 'node:events';
+/**
+ * Full process list entry
+ * 完整程序列表條目
+ */
+export interface ProcessListEntry {
+    /** Process ID / 程序 ID */
+    pid: number;
+    /** Process name / 程序名稱 */
+    name: string;
+    /** User running the process / 執行程序的使用者 */
+    user?: string;
+    /** Full command line / 完整命令列 */
+    command?: string;
+}
+/**
+ * ProcessMonitor - monitors system processes by polling the process list
+ * ProcessMonitor - 透過輪詢程序列表監控系統程序
+ *
+ * Events emitted:
+ * - 'process_started': SecurityEvent - when a new process is detected / 當偵測到新程序時
+ * - 'process_stopped': SecurityEvent - when a process disappears / 當程序消失時
+ * - 'error': Error - when polling encounters an error / 當輪詢遇到錯誤時
+ *
+ * @example
+ * ```typescript
+ * const monitor = new ProcessMonitor(15000);
+ * monitor.on('process_started', (event) => console.log('Started:', event));
+ * monitor.on('process_stopped', (event) => console.log('Stopped:', event));
+ * monitor.start();
+ * ```
+ */
+export declare class ProcessMonitor extends EventEmitter {
+    /** Whether the monitor is currently running / 監控器是否正在執行 */
+    private running;
+    /** Polling timer / 輪詢計時器 */
+    private timer?;
+    /** Previous process snapshot for diff detection / 用於差異偵測的先前程序快照 */
+    private previousProcesses;
+    /** Polling interval in milliseconds / 輪詢間隔（毫秒） */
+    private pollInterval;
+    /**
+     * Create a new ProcessMonitor instance
+     * 建立新的 ProcessMonitor 實例
+     *
+     * @param pollInterval - Polling interval in ms (default 15000) / 輪詢間隔毫秒數（預設 15000）
+     */
+    constructor(pollInterval?: number);
+    /**
+     * Start polling for process changes
+     * 開始輪詢程序變更
+     */
+    start(): void;
+    /**
+     * Stop polling and clean up
+     * 停止輪詢並清理
+     */
+    stop(): void;
+    /**
+     * Check if the monitor is currently running
+     * 檢查監控器是否正在執行
+     *
+     * @returns True if running / 如果正在執行則為 true
+     */
+    isRunning(): boolean;
+    /**
+     * Poll the process list and emit events for changes
+     * 輪詢程序列表並為變更發出事件
+     */
+    private pollProcesses;
+    /**
+     * Get the current system process list
+     * 取得目前系統程序列表
+     *
+     * Uses platform-specific tools:
+     * 使用平台特定工具：
+     * - macOS/Linux: `ps -eo pid,user,comm,args`
+     * - Windows: `tasklist /FO CSV`
+     *
+     * @returns Array of process entries / 程序條目陣列
+     */
+    getProcessList(): Promise<ProcessListEntry[]>;
+    /**
+     * Parse Unix ps output into ProcessListEntry array
+     * 將 Unix ps 輸出解析為 ProcessListEntry 陣列
+     *
+     * @returns Parsed process entries / 解析後的程序條目
+     */
+    private parsePs;
+    /**
+     * Parse Windows tasklist CSV output into ProcessListEntry array
+     * 將 Windows tasklist CSV 輸出解析為 ProcessListEntry 陣列
+     *
+     * @returns Parsed process entries / 解析後的程序條目
+     */
+    private parseTasklist;
+}
+//# sourceMappingURL=process-monitor.d.ts.map

package/dist/monitor/process-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-monitor.d.ts","sourceRoot":"","sources":["../../src/monitor/process-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwB3C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,cAAe,SAAQ,YAAY;IAC9C,2DAA2D;IAC3D,OAAO,CAAC,OAAO,CAAS;IACxB,4BAA4B;IAC5B,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,mEAAmE;IACnE,OAAO,CAAC,iBAAiB,CAAuC;IAChE,kDAAkD;IAClD,OAAO,CAAC,YAAY,CAAS;IAE7B;;;;;OAKG;gBACS,YAAY,SAAQ;IAKhC;;;OAGG;IACH,KAAK,IAAI,IAAI;IAiBb;;;OAGG;IACH,IAAI,IAAI,IAAI;IAgBZ;;;;;OAKG;IACH,SAAS,IAAI,OAAO;IAIpB;;;OAGG;YACW,aAAa;IAmD3B;;;;;;;;;;OAUG;IACG,cAAc,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAkBnD;;;;;OAKG;YACW,OAAO;IAqCrB;;;;;OAKG;YACW,aAAa;CA+B5B"}