@panguard-ai/panguard 0.3.3 → 0.3.5

package/dist/cli/commands/serve.js

@@ -11,7 +11,7 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { c, banner } from '@panguard-ai/core';
 import { PANGUARD_VERSION } from '../../index.js';
-import { AuthDB, createAuthHandlers, sendExpirationWarningEmail, initErrorTracking, captureRequestError, generateOpenApiSpec, generateSwaggerHtml, ManagerProxy, } from '@panguard-ai/panguard-auth';
+import { AuthDB, createAuthHandlers, sendExpirationWarningEmail, initErrorTracking, captureRequestError, generateOpenApiSpec, generateSwaggerHtml, ManagerProxy, authenticateRequest, requireAdmin, } from '@panguard-ai/panguard-auth';
 import { ManagerServer, DEFAULT_MANAGER_CONFIG } from '@panguard-ai/manager';
 export function serveCommand() {
     return new Command('serve')
@@ -31,9 +31,6 @@ export function serveCommand() {
         const errors = [];
         const warnings = [];
         // Critical in production
-        if (isProd && !process.env['JWT_SECRET']) {
-            errors.push('JWT_SECRET not set in production — refusing to start with fallback key');
-        }
         if (isProd && !process.env['PANGUARD_BASE_URL']) {
             errors.push('PANGUARD_BASE_URL not set in production — OAuth and email links will break');
         }
@@ -50,15 +47,18 @@ export function serveCommand() {
         if (!process.env['RESEND_API_KEY'] && !process.env['SMTP_HOST']) {
             warnings.push('No email config (RESEND_API_KEY or SMTP_HOST) — password reset and waitlist emails disabled');
         }
-        if (!isProd && !process.env['JWT_SECRET']) {
-            warnings.push('JWT_SECRET not set — using fallback key (OK for dev, NOT for production)');
-        }
         if (!process.env['SENTRY_DSN']) {
             warnings.push('SENTRY_DSN not set — error tracking disabled');
         }
-        if (!process.env['MANAGER_AUTH_TOKEN']) {
+        if (isProd && !process.env['MANAGER_AUTH_TOKEN']) {
+            errors.push('MANAGER_AUTH_TOKEN not set in production — Manager API would allow unauthenticated access');
+        }
+        if (!isProd && !process.env['MANAGER_AUTH_TOKEN']) {
             warnings.push('MANAGER_AUTH_TOKEN not set — Manager API allows unauthenticated access (OK for dev)');
         }
+        if (!process.env['TC_API_KEY']) {
+            warnings.push('TC_API_KEY not set — Threat Cloud write API disabled in production, open in dev');
+        }
         if (errors.length > 0) {
             console.error(`  ${c.critical('FATAL — Missing required environment variables:')}`);
             for (const e of errors) {
@@ -79,6 +79,93 @@ export function serveCommand() {
         await initErrorTracking();
         // Initialize database
         const db = new AuthDB(options.db);
+        // Initialize Threat Cloud database (optional — graceful if unavailable)
+        let threatDb = null;
+        try {
+            const tcMod = '@panguard-ai/threat-cloud';
+            const tc = await import(/* webpackIgnore: true */ tcMod);
+            const threatDbPath = join(dirname(options.db), 'threat-cloud.db');
+            threatDb = new tc.ThreatCloudDB(threatDbPath);
+            console.log(`  ${c.safe('Threat Cloud DB')} initialized at ${c.dim(threatDbPath)}`);
+            // Auto-seed rules on first startup if rules table is empty
+            const stats = threatDb.getStats();
+            if (stats.totalRules === 0) {
+                console.log(`  ${c.sage('Seeding rules...')} (first startup detected)`);
+                const seeded = await seedRulesFromBundled(threatDb);
+                console.log(`  ${c.safe(`Seeded ${seeded} rules`)} into Threat Cloud DB`);
+            }
+            else {
+                console.log(`  ${c.dim(`Threat Cloud: ${stats.totalRules} rules, ${stats.totalThreats} threats`)}`);
+            }
+            console.log('');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`  [ERROR] Threat Cloud initialization failed: ${msg}`);
+            if (err instanceof Error && err.stack) {
+                console.error(`  ${err.stack}`);
+            }
+            console.log(`  ${c.dim('Threat Cloud API routes disabled due to error above')}`);
+            console.log('');
+        }
+        // Initialize LLM Reviewer for ATR proposals (optional — needs ANTHROPIC_API_KEY)
+        let llmReviewer = null;
+        if (threatDb && process.env['ANTHROPIC_API_KEY']) {
+            try {
+                const tcMod = '@panguard-ai/threat-cloud';
+                const tc = await import(/* webpackIgnore: true */ tcMod);
+                llmReviewer = new tc.LLMReviewer(process.env['ANTHROPIC_API_KEY'], threatDb);
+                console.log(`  ${c.safe('LLM Reviewer')} enabled for ATR proposal review`);
+            }
+            catch {
+                console.log(`  ${c.dim('LLM Reviewer not available')}`);
+            }
+        }
+        // Promotion cron: every 15 minutes, promote confirmed + LLM-approved proposals to rules
+        let promotionTimer = null;
+        if (threatDb) {
+            promotionTimer = setInterval(() => {
+                try {
+                    const promoted = threatDb.promoteConfirmedProposals();
+                    if (promoted > 0) {
+                        console.log(`  [Promotion] ${promoted} proposal(s) promoted to rules`);
+                    }
+                }
+                catch (err) {
+                    console.error(`  [Promotion] Error: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, 15 * 60 * 1000);
+        }
+        // Periodic database backup (every 6 hours)
+        let backupTimer = null;
+        if (threatDb) {
+            try {
+                const tcMod2 = '@panguard-ai/threat-cloud';
+                const tc2 = await import(/* webpackIgnore: true */ tcMod2);
+                const backupDir = join(dirname(options.db), 'backups');
+                const threatBackup = new tc2.BackupManager(join(dirname(options.db), 'threat-cloud.db'), backupDir, 7);
+                const authBackup = new tc2.BackupManager(options.db, backupDir, 7);
+                const runBackups = () => {
+                    try {
+                        const r1 = threatBackup.backup();
+                        const r2 = authBackup.backup();
+                        console.log(`  [Backup] threat-cloud.db (${tc2.BackupManager.formatSize(r1.sizeBytes)}), auth.db (${tc2.BackupManager.formatSize(r2.sizeBytes)})`);
+                    }
+                    catch (err) {
+                        console.error(`  [Backup] Failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                };
+                // Initial backup on startup
+                runBackups();
+                // Every 6 hours
+                backupTimer = setInterval(runBackups, 6 * 60 * 60 * 1000);
+                if (backupTimer.unref)
+                    backupTimer.unref();
+            }
+            catch {
+                console.log(`  ${c.dim('Backup manager not available — auto-backups disabled')}`);
+            }
+        }
         // Build config from environment
         // Prefer Resend API when RESEND_API_KEY is set; fall back to raw SMTP
         const emailConfig = process.env['RESEND_API_KEY']
@@ -144,7 +231,7 @@ export function serveCommand() {
         ];
         const adminDir = adminDirs.find((d) => existsSync(d));
         const server = createServer((req, res) => {
-            void handleRequest(req, res, handlers, db, adminDir, managerProxy);
+            void handleRequest(req, res, handlers, db, adminDir, managerProxy, threatDb, llmReviewer);
         });
         // Build Manager config from environment / 從環境變數建構 Manager 設定
         const managerPort = parseInt(options.managerPort, 10);
@@ -174,6 +261,11 @@ export function serveCommand() {
             console.log(`    ${c.dim('/openapi.json')}    OpenAPI 3.0 Spec`);
             console.log(`    ${c.dim('/health')}         Health check`);
             console.log(`    ${c.dim('/api/manager/*')}  Manager API (port ${managerPort})`);
+            if (threatDb) {
+                console.log(`    ${c.dim('/api/threats')}     Threat Cloud API (POST)`);
+                console.log(`    ${c.dim('/api/rules')}       Rule Distribution (GET/POST)`);
+                console.log(`    ${c.dim('/api/stats')}       Threat Statistics (GET)`);
+            }
             console.log('');
             console.log(`  Services:`);
             console.log(`    Email:   ${emailConfig ? ('apiKey' in emailConfig ? c.safe('Resend API') : c.safe('SMTP')) : c.caution('Not configured')}`);
@@ -183,10 +275,13 @@ export function serveCommand() {
             console.log(`    Manager: ${c.safe(`port ${managerPort}`)}${process.env['MANAGER_AUTH_TOKEN'] ? '' : c.dim(' (no auth)')}`);
             console.log('');
             // Start Manager server after auth server is listening / 在 Auth 伺服器啟動後啟動 Manager 伺服器
-            managerServer.start().then(() => {
+            managerServer
+                .start()
+                .then(() => {
                 console.log(`  ${c.safe('Manager server started')} on ${c.bold(`http://${host}:${managerPort}`)}`);
                 console.log('');
-            }).catch((err) => {
+            })
+                .catch((err) => {
                 const message = err instanceof Error ? err.message : String(err);
                 console.log(`  ${c.caution('Manager server failed to start:')} ${message}`);
                 console.log(`  ${c.dim('Auth server continues running without Manager')}`);
@@ -221,9 +316,15 @@ export function serveCommand() {
         const shutdown = () => {
             console.log('\n  Shutting down...');
             clearInterval(planCheckTimer);
+            if (backupTimer)
+                clearInterval(backupTimer);
+            if (promotionTimer)
+                clearInterval(promotionTimer);
             managerServer.stop().catch(() => { });
             server.close(() => {
                 db.close();
+                if (threatDb)
+                    threatDb.close();
                 process.exit(0);
             });
         };
@@ -231,7 +332,7 @@ export function serveCommand() {
         process.on('SIGTERM', shutdown);
     });
 }
-async function handleRequest(req, res, handlers, _db, adminDir, managerProxy) {
+async function handleRequest(req, res, handlers, _db, adminDir, managerProxy, threatDb, llmReviewer) {
     const url = req.url ?? '/';
     const pathname = url.split('?')[0] ?? '/';
     // Security headers
@@ -275,43 +376,461 @@ async function handleRequest(req, res, handlers, _db, adminDir, managerProxy) {
             res.end(html);
             return;
         }
-        // Health check (with DB probe + service status)
+        // Health check (minimal public response — detailed status behind /api/admin/health)
         if (pathname === '/health') {
-            const mem = process.memoryUsage();
-            const services = {
-                email: !!(process.env['RESEND_API_KEY'] || process.env['SMTP_HOST']),
-                oauth: !!process.env['GOOGLE_CLIENT_ID'],
-                billing: !!process.env['LEMON_SQUEEZY_API_KEY'],
-                errorTracking: !!process.env['SENTRY_DSN'],
-            };
             try {
                 _db.healthCheck();
                 sendJson(res, 200, {
                     ok: true,
                     data: {
                         status: 'healthy',
-                        version: process.env['npm_package_version'] ?? '0.0.0',
                         uptime: Math.round(process.uptime()),
                         db: 'connected',
-                        memory: {
-                            rss: Math.round(mem.rss / 1024 / 1024),
-                            heapUsed: Math.round(mem.heapUsed / 1024 / 1024),
-                        },
-                        services,
+                        threatCloud: threatDb ? 'connected' : 'unavailable',
                     },
                 });
             }
             catch {
                 sendJson(res, 503, {
                     ok: false,
-                    data: {
-                        status: 'unhealthy',
-                        uptime: Math.round(process.uptime()),
-                        db: 'disconnected',
-                        services,
+                    data: { status: 'unhealthy', db: 'disconnected' },
+                });
+            }
+            return;
+        }
+        // Detailed health (admin-only) — includes memory, services, threat stats
+        if (pathname === '/api/admin/health' && req.method === 'GET') {
+            const mem = process.memoryUsage();
+            const services = {
+                email: !!(process.env['RESEND_API_KEY'] || process.env['SMTP_HOST']),
+                oauth: !!process.env['GOOGLE_CLIENT_ID'],
+                billing: !!process.env['LEMON_SQUEEZY_API_KEY'],
+                errorTracking: !!process.env['SENTRY_DSN'],
+                threatCloud: !!threatDb,
+                tcApiKey: !!process.env['TC_API_KEY'],
+            };
+            let threatStats = null;
+            if (threatDb) {
+                try {
+                    const s = threatDb.getStats();
+                    threatStats = { rules: s.totalRules, threats: s.totalThreats };
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+            sendJson(res, 200, {
+                ok: true,
+                data: {
+                    status: 'healthy',
+                    version: process.env['npm_package_version'] ?? '0.0.0',
+                    uptime: Math.round(process.uptime()),
+                    db: 'connected',
+                    threatStats,
+                    memory: {
+                        rss: Math.round(mem.rss / 1024 / 1024),
+                        heapUsed: Math.round(mem.heapUsed / 1024 / 1024),
                     },
+                    services,
+                },
+            });
+            return;
+        }
+        // ── Threat Cloud API Routes ────────────────────────────────────
+        // Security: rate limiting, auth, input validation
+        // Rate limit for Threat Cloud endpoints (per-IP, shared state)
+        if (threatDb &&
+            pathname.startsWith('/api/') &&
+            [
+                '/api/threats',
+                '/api/rules',
+                '/api/stats',
+                '/api/atr-proposals',
+                '/api/atr-feedback',
+                '/api/skill-threats',
+                '/api/atr-rules',
+                '/api/yara-rules',
+                '/api/feeds/ip-blocklist',
+                '/api/feeds/domain-blocklist',
+            ].some((p) => pathname === p)) {
+            const clientIP = req.socket.remoteAddress ?? 'unknown';
+            if (!checkTCRateLimit(clientIP)) {
+                sendJson(res, 429, { ok: false, error: 'Rate limit exceeded. Try again later.' });
+                return;
+            }
+        }
+        // POST /api/threats - Upload anonymized threat data
+        if (pathname === '/api/threats' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let data;
+            try {
+                data = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            if (!data['attackSourceIP'] ||
+                !data['attackType'] ||
+                !data['mitreTechnique'] ||
+                !data['sigmaRuleMatched'] ||
+                !data['timestamp'] ||
+                !data['region']) {
+                sendJson(res, 400, { ok: false, error: 'Missing required fields' });
+                return;
+            }
+            // Anonymize IP (zero last octet)
+            const ip = String(data['attackSourceIP']);
+            if (ip.includes('.')) {
+                const parts = ip.split('.');
+                if (parts.length === 4) {
+                    parts[3] = '0';
+                    data['attackSourceIP'] = parts.join('.');
+                }
+            }
+            threatDb.insertThreat(data);
+            sendJson(res, 201, { ok: true, data: { message: 'Threat data received' } });
+            return;
+        }
+        // GET /api/rules - Fetch rules (optional ?since= filter, paginated)
+        if (pathname === '/api/rules' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const since = urlObj.searchParams.get('since');
+            // Validate since parameter format (ISO 8601)
+            if (since && !/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2})?/.test(since)) {
+                sendJson(res, 400, { ok: false, error: 'Invalid since parameter: must be ISO 8601' });
+                return;
+            }
+            const rawLimit = parseInt(urlObj.searchParams.get('limit') ?? '1000', 10);
+            const limit = isNaN(rawLimit) || rawLimit < 1 ? 1000 : Math.min(rawLimit, 5000);
+            const rules = since ? threatDb.getRulesSince(since) : threatDb.getAllRules(limit);
+            sendJson(res, 200, { ok: true, data: rules });
+            return;
+        }
+        // POST /api/rules - Publish a new community rule
+        if (pathname === '/api/rules' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let rule;
+            try {
+                rule = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            if (!rule['ruleId'] || !rule['ruleContent'] || !rule['source']) {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: 'Missing required fields: ruleId, ruleContent, source',
+                });
+                return;
+            }
+            // Field-level size limits
+            if (String(rule['ruleContent']).length > 65_536) {
+                sendJson(res, 400, { ok: false, error: 'ruleContent exceeds maximum size of 64KB' });
+                return;
+            }
+            if (String(rule['ruleId']).length > 256) {
+                sendJson(res, 400, { ok: false, error: 'ruleId exceeds maximum length of 256' });
+                return;
+            }
+            rule['publishedAt'] = rule['publishedAt'] || new Date().toISOString();
+            threatDb.upsertRule(rule);
+            sendJson(res, 201, { ok: true, data: { message: 'Rule published', ruleId: rule['ruleId'] } });
+            return;
+        }
+        // GET /api/stats - Threat statistics
+        if (pathname === '/api/stats' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const stats = threatDb.getStats();
+            sendJson(res, 200, { ok: true, data: stats });
+            return;
+        }
+        // POST /api/atr-proposals - Submit ATR rule proposal
+        if (pathname === '/api/atr-proposals' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let proposal;
+            try {
+                proposal = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            if (!proposal['patternHash'] ||
+                !proposal['ruleContent'] ||
+                !proposal['llmProvider'] ||
+                !proposal['llmModel'] ||
+                !proposal['selfReviewVerdict']) {
+                sendJson(res, 400, { ok: false, error: 'Missing required fields' });
+                return;
+            }
+            // Validate and sanitize client ID
+            const rawClientId = req.headers['x-panguard-client-id'];
+            const clientId = typeof rawClientId === 'string' && /^[a-zA-Z0-9_-]{1,64}$/.test(rawClientId)
+                ? rawClientId
+                : null;
+            proposal['clientId'] = clientId;
+            // Check if this pattern already has a proposal - if so, increment confirmation
+            const pHash = String(proposal['patternHash']);
+            const existing = threatDb
+                .getATRProposals()
+                .find((p) => p['pattern_hash'] === pHash);
+            if (existing) {
+                threatDb.confirmATRProposal(pHash);
+                sendJson(res, 200, {
+                    ok: true,
+                    data: { message: 'Confirmation recorded', patternHash: pHash },
+                });
+            }
+            else {
+                threatDb.insertATRProposal(proposal);
+                // Fire-and-forget LLM review on first submission
+                if (llmReviewer?.isAvailable()) {
+                    void llmReviewer
+                        .reviewProposal(pHash, String(proposal['ruleContent']))
+                        .catch((err) => {
+                        console.error(`LLM review error for ${pHash}:`, err);
+                    });
+                }
+                sendJson(res, 201, {
+                    ok: true,
+                    data: { message: 'Proposal submitted', patternHash: pHash },
+                });
+            }
+            return;
+        }
+        // GET /api/atr-proposals - List proposals (admin-only)
+        if (pathname === '/api/atr-proposals' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCAdminAuth(req, res, _db))
+                return;
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const status = urlObj.searchParams.get('status') ?? undefined;
+            const proposals = threatDb.getATRProposals(status);
+            sendJson(res, 200, { ok: true, data: proposals });
+            return;
+        }
+        // POST /api/atr-feedback - Report ATR rule match feedback
+        if (pathname === '/api/atr-feedback' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let feedback;
+            try {
+                feedback = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            if (!feedback['ruleId'] || typeof feedback['isTruePositive'] !== 'boolean') {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: 'Missing or invalid fields: ruleId (string), isTruePositive (boolean)',
                 });
+                return;
+            }
+            const rawCid = req.headers['x-panguard-client-id'];
+            const cid = typeof rawCid === 'string' && /^[a-zA-Z0-9_-]{1,64}$/.test(rawCid) ? rawCid : null;
+            threatDb.insertATRFeedback(String(feedback['ruleId']), feedback['isTruePositive'], cid);
+            sendJson(res, 201, { ok: true, data: { message: 'Feedback recorded' } });
+            return;
+        }
+        // POST /api/skill-threats - Submit skill audit result
+        if (pathname === '/api/skill-threats' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let submission;
+            try {
+                submission = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            const VALID_RISK_LEVELS = new Set(['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']);
+            if (!submission['skillHash'] || !submission['skillName']) {
+                sendJson(res, 400, { ok: false, error: 'Missing required fields: skillHash, skillName' });
+                return;
+            }
+            const riskScore = submission['riskScore'];
+            if (typeof riskScore !== 'number' ||
+                !isFinite(riskScore) ||
+                riskScore < 0 ||
+                riskScore > 100) {
+                sendJson(res, 400, { ok: false, error: 'riskScore must be a number between 0 and 100' });
+                return;
+            }
+            if (!VALID_RISK_LEVELS.has(String(submission['riskLevel']))) {
+                sendJson(res, 400, {
+                    ok: false,
+                    error: 'riskLevel must be one of: LOW, MEDIUM, HIGH, CRITICAL',
+                });
+                return;
+            }
+            const rawCid2 = req.headers['x-panguard-client-id'];
+            submission['clientId'] =
+                typeof rawCid2 === 'string' && /^[a-zA-Z0-9_-]{1,64}$/.test(rawCid2) ? rawCid2 : null;
+            threatDb.insertSkillThreat(submission);
+            sendJson(res, 201, { ok: true, data: { message: 'Skill threat recorded' } });
+            return;
+        }
+        // GET /api/skill-threats - List skill threats (admin-only)
+        if (pathname === '/api/skill-threats' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCAdminAuth(req, res, _db))
+                return;
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const rawLimit = parseInt(urlObj.searchParams.get('limit') ?? '50', 10);
+            const limit = isNaN(rawLimit) || rawLimit < 1 ? 50 : Math.min(rawLimit, 500);
+            const threats = threatDb.getSkillThreats(limit);
+            sendJson(res, 200, { ok: true, data: threats });
+            return;
+        }
+        // GET /api/atr-rules - Fetch confirmed ATR rules (for Guard sync)
+        if (pathname === '/api/atr-rules' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const since = urlObj.searchParams.get('since') ?? undefined;
+            const rules = threatDb.getConfirmedATRRules(since);
+            sendJson(res, 200, { ok: true, data: rules });
+            return;
+        }
+        // GET /api/yara-rules - Fetch YARA rules (for Guard sync)
+        if (pathname === '/api/yara-rules' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const since = urlObj.searchParams.get('since') ?? undefined;
+            const rules = threatDb.getRulesBySource('yara', since);
+            sendJson(res, 200, { ok: true, data: rules });
+            return;
+        }
+        // GET /api/feeds/ip-blocklist - IP blocklist feed (plain text)
+        if (pathname === '/api/feeds/ip-blocklist' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const minReputation = Number(urlObj.searchParams.get('minReputation') ?? '70');
+            const ips = threatDb.getIPBlocklist(minReputation);
+            res.setHeader('Content-Type', 'text/plain');
+            res.writeHead(200);
+            res.end(ips.join('\n'));
+            return;
+        }
+        // GET /api/feeds/domain-blocklist - Domain blocklist feed (plain text)
+        if (pathname === '/api/feeds/domain-blocklist' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            const urlObj = new URL(url, `http://${req.headers.host ?? 'localhost'}`);
+            const minReputation = Number(urlObj.searchParams.get('minReputation') ?? '70');
+            const domains = threatDb.getDomainBlocklist(minReputation);
+            res.setHeader('Content-Type', 'text/plain');
+            res.writeHead(200);
+            res.end(domains.join('\n'));
+            return;
+        }
+        // POST /api/skill-whitelist - Report safe skill (audit passed)
+        if (pathname === '/api/skill-whitelist' && req.method === 'POST') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
+            }
+            if (!requireTCWriteAuth(req, res))
+                return;
+            if (!requireJsonContentType(req, res))
+                return;
+            const body = await readRequestBody(req);
+            let data;
+            try {
+                data = JSON.parse(body);
+            }
+            catch {
+                sendJson(res, 400, { ok: false, error: 'Invalid JSON body' });
+                return;
+            }
+            const skills = 'skills' in data && Array.isArray(data['skills'])
+                ? data['skills']
+                : [data];
+            let count = 0;
+            for (const skill of skills) {
+                const name = skill['skillName'];
+                if (!name || typeof name !== 'string')
+                    continue;
+                threatDb.reportSafeSkill(name, typeof skill['fingerprintHash'] === 'string' ? skill['fingerprintHash'] : undefined);
+                count++;
+            }
+            sendJson(res, 201, { ok: true, data: { message: `${count} skill(s) reported`, count } });
+            return;
+        }
+        // GET /api/skill-whitelist - Fetch community whitelist
+        if (pathname === '/api/skill-whitelist' && req.method === 'GET') {
+            if (!threatDb) {
+                sendJson(res, 503, { ok: false, error: 'Threat Cloud not available' });
+                return;
             }
+            const whitelist = threatDb.getSkillWhitelist();
+            sendJson(res, 200, { ok: true, data: whitelist });
             return;
         }
         // Auth API routes
@@ -545,7 +1064,6 @@ async function handleRequest(req, res, handlers, _db, adminDir, managerProxy) {
                         smtp: !!process.env['SMTP_HOST'],
                     },
                     security: {
-                        jwtSecret: !!process.env['JWT_SECRET'],
                         totpEnabled: true,
                     },
                     threatCloud: {
@@ -765,4 +1283,220 @@ function sendJson(res, status, data) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(data));
 }
+// ── Threat Cloud Security Helpers ──────────────────────────────
+/** Timing-safe string comparison to prevent side-channel attacks */
+function timingSafeCompare(a, b) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { timingSafeEqual } = require('node:crypto');
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length) {
+        // Compare against self to maintain constant time
+        timingSafeEqual(ab, ab);
+        return false;
+    }
+    return timingSafeEqual(ab, bb);
+}
+/**
+ * Require TC_API_KEY auth for write endpoints.
+ * In production: BLOCK if TC_API_KEY not set (refuse unauthenticated writes).
+ * In dev: allow passthrough with warning.
+ */
+function requireTCWriteAuth(req, res) {
+    const tcApiKey = process.env['TC_API_KEY'];
+    if (!tcApiKey) {
+        if (process.env['NODE_ENV'] === 'production') {
+            sendJson(res, 503, {
+                ok: false,
+                error: 'Threat Cloud write API not configured (TC_API_KEY missing)',
+            });
+            return false;
+        }
+        return true; // dev passthrough
+    }
+    const authHeader = req.headers.authorization ?? '';
+    const token = authHeader.replace('Bearer ', '');
+    if (!timingSafeCompare(token, tcApiKey)) {
+        sendJson(res, 401, { ok: false, error: 'Invalid API key' });
+        return false;
+    }
+    return true;
+}
+/**
+ * Require admin session auth for admin-only GET endpoints.
+ * Verifies the Bearer token is a valid session with admin role.
+ */
+function requireTCAdminAuth(req, res, db) {
+    const user = authenticateRequest(req, db);
+    if (!user) {
+        sendJson(res, 401, { ok: false, error: 'Authentication required' });
+        return false;
+    }
+    if (!requireAdmin(user)) {
+        sendJson(res, 403, { ok: false, error: 'Admin access required' });
+        return false;
+    }
+    return true;
+}
+/** Validate Content-Type is application/json for POST requests */
+function requireJsonContentType(req, res) {
+    const ct = req.headers['content-type'] ?? '';
+    if (!ct.includes('application/json')) {
+        sendJson(res, 400, { ok: false, error: 'Content-Type must be application/json' });
+        return false;
+    }
+    return true;
+}
+/** Per-IP rate limiter for Threat Cloud endpoints (120 req/min) */
+const tcRateLimits = new Map();
+function checkTCRateLimit(ip) {
+    const now = Date.now();
+    const entry = tcRateLimits.get(ip);
+    if (!entry || now > entry.resetAt) {
+        tcRateLimits.set(ip, { count: 1, resetAt: now + 60_000 });
+        return true;
+    }
+    entry.count++;
+    return entry.count <= 120;
+}
+/** Read request body with 1MB size limit */
+function readRequestBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        const MAX_BODY = 1_048_576; // 1MB
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY) {
+                req.destroy();
+                reject(new Error('Request body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        req.on('error', reject);
+    });
+}
+/**
+ * Seed rules from bundled config/ directory into Threat Cloud DB.
+ * Reads Sigma YAML, YARA, and ATR YAML files.
+ * Returns count of rules seeded.
+ */
+async function seedRulesFromBundled(threatDb) {
+    const { readdirSync, readFileSync: readFs, statSync } = await import('node:fs');
+    const { join: joinPath, basename, relative } = await import('node:path');
+    let seeded = 0;
+    const now = new Date().toISOString();
+    // Resolve config directory (Docker: /app/config, monorepo: ../../config)
+    const configDirs = [
+        join(process.cwd(), 'config'),
+        join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', 'config'),
+    ];
+    const configDir = configDirs.find((d) => {
+        try {
+            return statSync(d).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!configDir) {
+        console.log(`  ${c.dim('  No config/ directory found — skipping rule seeding')}`);
+        console.log(`  ${c.dim(`  Searched: ${configDirs.join(', ')}`)}`);
+        return 0;
+    }
+    console.log(`  ${c.dim(`  Using config directory: ${configDir}`)}`);
+    /** Recursively collect files matching extensions */
+    function collectFiles(dir, extensions) {
+        const results = [];
+        try {
+            for (const entry of readdirSync(dir, { withFileTypes: true })) {
+                const fullPath = joinPath(dir, entry.name);
+                if (entry.isDirectory()) {
+                    results.push(...collectFiles(fullPath, extensions));
+                }
+                else if (extensions.some((ext) => entry.name.endsWith(ext))) {
+                    results.push(fullPath);
+                }
+            }
+        }
+        catch (err) {
+            console.error(`  [WARN] Cannot read directory ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return results;
+    }
+    // 1. Sigma rules (.yml, .yaml)
+    const sigmaDir = joinPath(configDir, 'sigma-rules');
+    try {
+        const sigmaFiles = collectFiles(sigmaDir, ['.yml', '.yaml']);
+        for (const file of sigmaFiles) {
+            const content = readFs(file, 'utf-8');
+            const ruleId = `sigma:${relative(sigmaDir, file).replace(/\//g, ':')}`;
+            threatDb.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'sigma' });
+            seeded++;
+        }
+        console.log(`  ${c.dim(`  Sigma: ${sigmaFiles.length} files processed`)}`);
+    }
+    catch (err) {
+        console.error(`  [WARN] Sigma rule seeding failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // 2. YARA rules (.yar, .yara)
+    const yaraDir = joinPath(configDir, 'yara-rules');
+    try {
+        const yaraFiles = collectFiles(yaraDir, ['.yar', '.yara']);
+        for (const file of yaraFiles) {
+            const content = readFs(file, 'utf-8');
+            // Split multi-rule YARA files
+            const ruleMatches = content.match(/rule\s+\w+/g);
+            if (ruleMatches && ruleMatches.length > 1) {
+                // Multi-rule file: store each rule name as sub-ID
+                for (const match of ruleMatches) {
+                    const ruleName = match.replace('rule ', '');
+                    const ruleId = `yara:${basename(file, '.yar').replace('.yara', '')}:${ruleName}`;
+                    threatDb.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'yara' });
+                    seeded++;
+                }
+            }
+            else {
+                const ruleId = `yara:${relative(yaraDir, file).replace(/\//g, ':')}`;
+                threatDb.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'yara' });
+                seeded++;
+            }
+        }
+        console.log(`  ${c.dim(`  YARA: ${yaraFiles.length} files processed`)}`);
+    }
+    catch (err) {
+        console.error(`  [WARN] YARA rule seeding failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // 3. ATR rules (.yaml, .yml) from atr package
+    const atrDirs = [
+        joinPath(process.cwd(), 'node_modules', 'agent-threat-rules', 'rules'),
+        joinPath(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..', '..', 'packages', 'atr', 'rules'),
+    ];
+    const atrDir = atrDirs.find((d) => {
+        try {
+            return statSync(d).isDirectory();
+        }
+        catch {
+            return false;
+        }
+    });
+    if (atrDir) {
+        try {
+            const atrFiles = collectFiles(atrDir, ['.yaml', '.yml']);
+            for (const file of atrFiles) {
+                const content = readFs(file, 'utf-8');
+                const ruleId = `atr:${relative(atrDir, file).replace(/\//g, ':')}`;
+                threatDb.upsertRule({ ruleId, ruleContent: content, publishedAt: now, source: 'atr' });
+                seeded++;
+            }
+            console.log(`  ${c.dim(`  ATR: ${atrFiles.length} files processed`)}`);
+        }
+        catch (err) {
+            console.error(`  [WARN] ATR rule seeding failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return seeded;
+}
 //# sourceMappingURL=serve.js.map