@profullstack/threatcrush 0.2.0 → 0.2.1

package/dist/daemon.js

@@ -2134,12 +2134,21 @@ bus.setMaxListeners(50);
 // src/core/state.ts
 var import_better_sqlite3 = __toESM(require("better-sqlite3"));
 var db = null;
+var dbUnavailable = false;
 function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   if (db) return db;
+  if (dbUnavailable) {
+    throw new Error("state db unavailable (previous init failed)");
+  }
   try {
-    db = new import_better_sqlite3.default(dbPath);
-  } catch {
-    db = new import_better_sqlite3.default(":memory:");
+    try {
+      db = new import_better_sqlite3.default(dbPath);
+    } catch {
+      db = new import_better_sqlite3.default(":memory:");
+    }
+  } catch (err) {
+    dbUnavailable = true;
+    throw err;
   }
   db.pragma("journal_mode = WAL");
   db.exec(`
@@ -2175,7 +2184,8 @@ function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   return db;
 }
 function insertEvent(event) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return -1;
   const stmt = database.prepare(`
     INSERT INTO events (timestamp, module, category, severity, message, source_ip, details)
     VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -2191,22 +2201,34 @@ function insertEvent(event) {
   );
   return result.lastInsertRowid;
 }
+function tryDb() {
+  if (db) return db;
+  if (dbUnavailable) return null;
+  try {
+    return initStateDB();
+  } catch {
+    return null;
+  }
+}
 function getRecentEvents(limit = 50) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return [];
   const rows = database.prepare(`
     SELECT * FROM events ORDER BY timestamp DESC LIMIT ?
   `).all(limit);
   return rows.map(rowToEvent);
 }
 function getEventCount(since) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return 0;
   if (since) {
     return database.prepare(`SELECT COUNT(*) as count FROM events WHERE timestamp >= ?`).get(since.toISOString()).count;
   }
   return database.prepare(`SELECT COUNT(*) as count FROM events`).get().count;
 }
 function getThreatCount(since) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return 0;
   const severities = "('medium','high','critical')";
   if (since) {
     return database.prepare(
@@ -2218,13 +2240,30 @@ function getThreatCount(since) {
   ).get().count;
 }
 function getTopSources(limit = 10) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return [];
   return database.prepare(`
     SELECT source_ip as ip, COUNT(*) as count FROM events
     WHERE source_ip IS NOT NULL
     GROUP BY source_ip ORDER BY count DESC LIMIT ?
   `).all(limit);
 }
+function getModuleState(module2, key) {
+  const database = db || initStateDB();
+  const row = database.prepare(`SELECT value FROM module_state WHERE module = ? AND key = ?`).get(module2, key);
+  if (!row) return void 0;
+  try {
+    return JSON.parse(row.value);
+  } catch {
+    return row.value;
+  }
+}
+function setModuleState(module2, key, value) {
+  const database = db || initStateDB();
+  database.prepare(`
+    INSERT OR REPLACE INTO module_state (module, key, value) VALUES (?, ?, ?)
+  `).run(module2, key, JSON.stringify(value));
+}
 function rowToEvent(row) {
   return {
     id: row.id,
@@ -2413,9 +2452,10 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs5 = require("fs");
-var import_node_path2 = require("path");
-var import_toml = __toESM(require_toml());
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
+var import_node_url = require("url");
+var import_toml2 = __toESM(require_toml());
 
 // src/daemon/watchers/log-watcher.ts
 var import_node_fs4 = require("fs");
@@ -2674,6 +2714,182 @@ var LogWatcher = class {
   }
 };
 
+// src/daemon/watchers/journal-watcher.ts
+var import_node_child_process = require("child_process");
+var JournalWatcher = class _JournalWatcher {
+  constructor(bus2) {
+    this.bus = bus2;
+  }
+  bus;
+  proc = null;
+  buffer = "";
+  moduleName = "user-journal";
+  active = false;
+  static isAvailable() {
+    const probe = (0, import_node_child_process.spawnSync)("journalctl", ["--user", "-n", "0", "--no-pager"], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return probe.status === 0;
+  }
+  start() {
+    if (!_JournalWatcher.isAvailable()) return false;
+    const child = (0, import_node_child_process.spawn)(
+      "journalctl",
+      ["--user", "-o", "json", "-f", "--since", "now"],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    if (!child.stdout) return false;
+    child.stdout.setEncoding("utf-8");
+    child.stdout.on("data", (chunk) => this.onData(chunk));
+    child.on("exit", () => {
+      this.proc = null;
+      this.active = false;
+    });
+    this.proc = child;
+    this.active = true;
+    return true;
+  }
+  stop() {
+    if (this.proc) {
+      try {
+        this.proc.kill("SIGTERM");
+      } catch {
+      }
+      this.proc = null;
+    }
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  moduleNameValue() {
+    return this.moduleName;
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    let idx;
+    while ((idx = this.buffer.indexOf("\n")) >= 0) {
+      const line = this.buffer.slice(0, idx);
+      this.buffer = this.buffer.slice(idx + 1);
+      if (!line.trim()) continue;
+      this.handleLine(line);
+    }
+  }
+  handleLine(line) {
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      return;
+    }
+    const message = entry.MESSAGE;
+    if (!message) return;
+    const priority = parseInt(entry.PRIORITY ?? "6", 10);
+    const severity = priorityToSeverity(priority);
+    const ident = entry.SYSLOG_IDENTIFIER || entry._COMM || "journal";
+    const bumpedSeverity = bumpForIdent(ident, message, severity);
+    const event = {
+      timestamp: realtimeToDate(entry.__REALTIME_TIMESTAMP) || /* @__PURE__ */ new Date(),
+      module: this.moduleName,
+      category: "system",
+      severity: bumpedSeverity,
+      message: `[${ident}] ${message}`.slice(0, 500)
+    };
+    try {
+      insertEvent(event);
+    } catch {
+    }
+    this.bus.publish(event);
+  }
+};
+function priorityToSeverity(priority) {
+  if (priority <= 2) return "critical";
+  if (priority === 3) return "high";
+  if (priority === 4) return "medium";
+  if (priority === 5) return "low";
+  return "info";
+}
+function bumpForIdent(ident, message, base) {
+  if (/sudo/i.test(ident) && /authentication failure|incorrect password|FAILED/i.test(message)) {
+    return "high";
+  }
+  if (/sshd/i.test(ident) && /failed|invalid user|break-in/i.test(message)) {
+    return "high";
+  }
+  return base;
+}
+function realtimeToDate(rt) {
+  if (!rt) return null;
+  const us = parseInt(rt, 10);
+  if (!Number.isFinite(us)) return null;
+  return new Date(Math.floor(us / 1e3));
+}
+
+// src/core/config.ts
+var import_node_fs5 = require("fs");
+var import_node_path2 = require("path");
+var import_toml = __toESM(require_toml());
+var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
+var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
+var DEFAULT_CONFIG = {
+  daemon: {
+    pid_file: "/var/run/threatcrush/threatcrushd.pid",
+    log_level: "info",
+    log_file: "/var/log/threatcrush/threatcrushd.log",
+    state_db: "/var/lib/threatcrush/state.db"
+  },
+  api: {
+    enabled: true,
+    bind: "127.0.0.1:9393",
+    tls: false
+  },
+  alerts: {},
+  modules: {
+    auto_update: true,
+    update_interval: "24h",
+    module_dir: "/etc/threatcrush/modules",
+    config_dir: DEFAULT_CONFDIR
+  }
+};
+function loadConfig(configPath) {
+  const path = configPath || DEFAULT_CONFIG_PATH;
+  if (!(0, import_node_fs5.existsSync)(path)) {
+    return { ...DEFAULT_CONFIG };
+  }
+  try {
+    const raw = (0, import_node_fs5.readFileSync)(path, "utf-8");
+    const parsed = import_toml.default.parse(raw);
+    return {
+      daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
+      api: { ...DEFAULT_CONFIG.api, ...parsed.api },
+      alerts: parsed.alerts || {},
+      modules: { ...DEFAULT_CONFIG.modules, ...parsed.modules },
+      license: parsed.license
+    };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+function loadModuleConfigs(confDir) {
+  const dir = confDir || DEFAULT_CONFDIR;
+  const configs = /* @__PURE__ */ new Map();
+  if (!(0, import_node_fs5.existsSync)(dir)) {
+    return configs;
+  }
+  const files = (0, import_node_fs5.readdirSync)(dir).filter((f) => f.endsWith(".conf"));
+  for (const file of files) {
+    try {
+      const raw = (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(dir, file), "utf-8");
+      const parsed = import_toml.default.parse(raw);
+      for (const [name, config] of Object.entries(parsed)) {
+        configs.set(name, config);
+      }
+    } catch {
+    }
+  }
+  return configs;
+}
+
 // src/daemon/module-host.ts
 var ModuleHost = class {
   constructor(bus2) {
@@ -2681,14 +2897,23 @@ var ModuleHost = class {
     bus2.on("event", (event) => {
       const mod = this.modules.get(event.module);
       if (mod) mod.events++;
+      for (const hosted of this.modules.values()) {
+        if (hosted.status !== "running" || !hosted.instance?.onEvent) continue;
+        void hosted.instance.onEvent(event).catch((err) => {
+          hosted.status = "error";
+          hosted.detail = `onEvent failed: ${String(err.message || err)}`;
+          this.bus.announceModule(hosted.name, "error", hosted.detail);
+        });
+      }
     });
   }
   bus;
   modules = /* @__PURE__ */ new Map();
   logWatcher = null;
+  journalWatcher = null;
   async start() {
     this.registerBuiltins();
-    this.discoverInstalled();
+    await this.discoverAndStartInstalled();
     this.logWatcher = new LogWatcher(this.bus);
     const watched = this.logWatcher.start();
     for (const modName of this.logWatcher.activeModules()) {
@@ -2699,10 +2924,30 @@ var ModuleHost = class {
         this.bus.announceModule(modName, "running", mod.detail);
       }
     }
+    this.journalWatcher = new JournalWatcher(this.bus);
+    if (this.journalWatcher.start()) {
+      const mod = this.modules.get("user-journal");
+      if (mod) {
+        mod.status = "running";
+        mod.detail = "tailing journalctl --user";
+        this.bus.announceModule("user-journal", "running", mod.detail);
+      }
+    }
   }
   async stop() {
     this.logWatcher?.stop();
+    this.journalWatcher?.stop();
     for (const mod of this.modules.values()) {
+      try {
+        if (mod.instance && mod.status === "running") {
+          await mod.instance.stop();
+        }
+      } catch (err) {
+        mod.status = "error";
+        mod.detail = `stop failed: ${String(err.message || err)}`;
+        this.bus.announceModule(mod.name, "error", mod.detail);
+        continue;
+      }
       mod.status = "loaded";
       this.bus.announceModule(mod.name, "stopped");
     }
@@ -2718,30 +2963,129 @@ var ModuleHost = class {
   registerBuiltins() {
     const builtins = [
       { name: "log-watcher", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
-      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
+      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "user-journal", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
     ];
     for (const m of builtins) this.modules.set(m.name, m);
   }
-  discoverInstalled() {
-    if (!(0, import_node_fs5.existsSync)(PATHS.moduleDir)) return;
-    const entries = (0, import_node_fs5.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+  async discoverAndStartInstalled() {
+    if (!(0, import_node_fs6.existsSync)(PATHS.moduleDir)) return;
+    const configs = loadModuleConfigs(PATHS.confD);
+    const entries = (0, import_node_fs6.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path2.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs5.existsSync)(manifestPath)) continue;
+      const manifestPath = (0, import_node_path3.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs6.existsSync)(manifestPath)) continue;
       try {
-        const manifest = import_toml.default.parse((0, import_node_fs5.readFileSync)(manifestPath, "utf-8"));
+        const manifest = import_toml2.default.parse((0, import_node_fs6.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
-        this.modules.set(name, {
+        const defaults = manifest.module?.config?.defaults || {};
+        const config = {
+          enabled: true,
+          ...defaults,
+          ...configs.get(name) || {}
+        };
+        const hosted = {
           name,
           version: manifest.module?.version || "0.0.0",
           source: "installed",
-          status: "loaded",
-          events: 0
+          status: config.enabled === false ? "disabled" : "loaded",
+          events: 0,
+          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name),
+          config
+        };
+        this.modules.set(name, hosted);
+        if (config.enabled === false) continue;
+        await this.startInstalled(hosted);
+      } catch (err) {
+        const name = entry.name;
+        this.modules.set(name, {
+          name,
+          version: "0.0.0",
+          source: "installed",
+          status: "error",
+          events: 0,
+          detail: `manifest load failed: ${String(err.message || err)}`,
+          path: (0, import_node_path3.join)(PATHS.moduleDir, entry.name)
         });
+      }
+    }
+  }
+  async startInstalled(hosted) {
+    const entrypoint = this.installedEntrypoint(hosted.path);
+    if (!entrypoint) {
+      hosted.status = "loaded";
+      hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
+      return;
+    }
+    try {
+      const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
+      const exported = imported.default || imported.module || imported;
+      const instance = typeof exported === "function" ? new exported() : exported;
+      if (!this.isThreatCrushModule(instance)) {
+        throw new Error("entrypoint does not export a ThreatCrush module");
+      }
+      hosted.instance = instance;
+      await instance.init(this.contextFor(hosted));
+      await instance.start();
+      hosted.status = "running";
+      hosted.detail = `started from ${entrypoint}`;
+      this.bus.announceModule(hosted.name, "running", hosted.detail);
+    } catch (err) {
+      hosted.status = "error";
+      hosted.detail = String(err.message || err);
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+    }
+  }
+  installedEntrypoint(modulePath) {
+    const packageJson = (0, import_node_path3.join)(modulePath, "package.json");
+    const candidates = [];
+    if ((0, import_node_fs6.existsSync)(packageJson)) {
+      try {
+        const pkg = JSON.parse((0, import_node_fs6.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path3.join)(modulePath, pkg.main));
       } catch {
       }
     }
+    candidates.push((0, import_node_path3.join)(modulePath, "dist", "index.js"), (0, import_node_path3.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs6.existsSync)(candidate)) || null;
+  }
+  isThreatCrushModule(value) {
+    return Boolean(
+      value && typeof value === "object" && typeof value.init === "function" && typeof value.start === "function" && typeof value.stop === "function"
+    );
+  }
+  contextFor(hosted) {
+    return {
+      config: hosted.config || { enabled: true },
+      logger: this.loggerFor(hosted.name),
+      emit: (event) => this.bus.publish(event),
+      subscribe: (eventType, handler) => {
+        this.bus.on("event", (event) => {
+          if (event.category === eventType || event.module === eventType) handler(event);
+        });
+      },
+      alert: (alert) => {
+        this.bus.emit("alert", alert.event || {
+          timestamp: /* @__PURE__ */ new Date(),
+          module: hosted.name,
+          category: "system",
+          severity: alert.severity,
+          message: alert.title,
+          details: alert.body ? { body: alert.body } : void 0
+        });
+      },
+      getState: (key) => getModuleState(hosted.name, key),
+      setState: (key, value) => setModuleState(hosted.name, key, value)
+    };
+  }
+  loggerFor(moduleName) {
+    return {
+      debug: (msg, ...args) => console.debug(`[${moduleName}] ${msg}`, ...args),
+      info: (msg, ...args) => console.info(`[${moduleName}] ${msg}`, ...args),
+      warn: (msg, ...args) => console.warn(`[${moduleName}] ${msg}`, ...args),
+      error: (msg, ...args) => console.error(`[${moduleName}] ${msg}`, ...args)
+    };
   }
 };
 
@@ -2863,14 +3207,14 @@ function slackChannel(webhookUrl) {
 }
 
 // src/core/cli-config.ts
-var import_node_fs6 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path4 = require("path");
 var import_node_os2 = require("os");
-var CLI_CONFIG_DIR = (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".threatcrush");
-var CLI_CONFIG_PATH = (0, import_node_path3.join)(CLI_CONFIG_DIR, "config.json");
+var CLI_CONFIG_DIR = (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".threatcrush");
+var CLI_CONFIG_PATH = (0, import_node_path4.join)(CLI_CONFIG_DIR, "config.json");
 function readCliConfig() {
   try {
-    return JSON.parse((0, import_node_fs6.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs7.readFileSync)(CLI_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -2889,8 +3233,8 @@ function authHeaders() {
 }
 
 // src/commands/scan.ts
-var import_node_fs7 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path5 = require("path");
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -3518,12 +3862,12 @@ async function runScan(targetPath) {
 function scanDirectory(basePath, currentPath, findings, onFile) {
   let entries;
   try {
-    entries = (0, import_node_fs7.readdirSync)(currentPath, { withFileTypes: true });
+    entries = (0, import_node_fs8.readdirSync)(currentPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = (0, import_node_path4.join)(currentPath, entry.name);
+    const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
       scanDirectory(basePath, fullPath, findings, onFile);
@@ -3533,7 +3877,7 @@ function scanDirectory(basePath, currentPath, findings, onFile) {
     for (const mc of MISCONFIG_FILES) {
       if (entry.name === mc.pattern || entry.name.endsWith(mc.pattern)) {
         findings.push({
-          file: (0, import_node_path4.relative)(basePath, fullPath),
+          file: (0, import_node_path5.relative)(basePath, fullPath),
           line: 0,
           type: "Sensitive File",
           severity: "high",
@@ -3542,10 +3886,10 @@ function scanDirectory(basePath, currentPath, findings, onFile) {
         });
       }
     }
-    const ext = (0, import_node_path4.extname)(entry.name).toLowerCase();
+    const ext = (0, import_node_path5.extname)(entry.name).toLowerCase();
     if (!SCAN_EXTENSIONS.has(ext) && !entry.name.startsWith(".env")) continue;
     try {
-      const stat = (0, import_node_fs7.statSync)(fullPath);
+      const stat = (0, import_node_fs8.statSync)(fullPath);
       if (stat.size > 1024 * 1024) continue;
     } catch {
       continue;
@@ -3553,7 +3897,7 @@ function scanDirectory(basePath, currentPath, findings, onFile) {
     onFile();
     let content;
     try {
-      content = (0, import_node_fs7.readFileSync)(fullPath, "utf-8");
+      content = (0, import_node_fs8.readFileSync)(fullPath, "utf-8");
     } catch {
       continue;
     }
@@ -3565,7 +3909,7 @@ function scanDirectory(basePath, currentPath, findings, onFile) {
         pattern.pattern.lastIndex = 0;
         if (pattern.pattern.test(line)) {
           findings.push({
-            file: (0, import_node_path4.relative)(basePath, fullPath),
+            file: (0, import_node_path5.relative)(basePath, fullPath),
             line: i + 1,
             type: pattern.name,
             severity: pattern.severity,
@@ -3843,52 +4187,6 @@ var RunsWorker = class {
   }
 };
 
-// src/core/config.ts
-var import_node_fs8 = require("fs");
-var import_node_path5 = require("path");
-var import_toml2 = __toESM(require_toml());
-var DEFAULT_CONFIG_PATH = "/etc/threatcrush/threatcrushd.conf";
-var DEFAULT_CONFDIR = "/etc/threatcrush/threatcrushd.conf.d";
-var DEFAULT_CONFIG = {
-  daemon: {
-    pid_file: "/var/run/threatcrush/threatcrushd.pid",
-    log_level: "info",
-    log_file: "/var/log/threatcrush/threatcrushd.log",
-    state_db: "/var/lib/threatcrush/state.db"
-  },
-  api: {
-    enabled: true,
-    bind: "127.0.0.1:9393",
-    tls: false
-  },
-  alerts: {},
-  modules: {
-    auto_update: true,
-    update_interval: "24h",
-    module_dir: "/etc/threatcrush/modules",
-    config_dir: DEFAULT_CONFDIR
-  }
-};
-function loadConfig(configPath) {
-  const path = configPath || DEFAULT_CONFIG_PATH;
-  if (!(0, import_node_fs8.existsSync)(path)) {
-    return { ...DEFAULT_CONFIG };
-  }
-  try {
-    const raw = (0, import_node_fs8.readFileSync)(path, "utf-8");
-    const parsed = import_toml2.default.parse(raw);
-    return {
-      daemon: { ...DEFAULT_CONFIG.daemon, ...parsed.daemon },
-      api: { ...DEFAULT_CONFIG.api, ...parsed.api },
-      alerts: parsed.alerts || {},
-      modules: { ...DEFAULT_CONFIG.modules, ...parsed.modules },
-      license: parsed.license
-    };
-  } catch {
-    return { ...DEFAULT_CONFIG };
-  }
-}
-
 // src/core/telemetry.ts
 var ready = false;
 var sentry = null;