@profullstack/threatcrush 0.2.0 → 0.2.1

package/dist/index.js

@@ -3336,10 +3336,18 @@ var require_commander = __commonJS({
 // src/core/state.ts
 function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   if (db) return db;
+  if (dbUnavailable) {
+    throw new Error("state db unavailable (previous init failed)");
+  }
   try {
-    db = new import_better_sqlite3.default(dbPath);
-  } catch {
-    db = new import_better_sqlite3.default(":memory:");
+    try {
+      db = new import_better_sqlite3.default(dbPath);
+    } catch {
+      db = new import_better_sqlite3.default(":memory:");
+    }
+  } catch (err) {
+    dbUnavailable = true;
+    throw err;
   }
   db.pragma("journal_mode = WAL");
   db.exec(`
@@ -3375,7 +3383,8 @@ function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   return db;
 }
 function insertEvent(event) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return -1;
   const stmt = database.prepare(`
     INSERT INTO events (timestamp, module, category, severity, message, source_ip, details)
     VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -3391,22 +3400,34 @@ function insertEvent(event) {
   );
   return result.lastInsertRowid;
 }
+function tryDb() {
+  if (db) return db;
+  if (dbUnavailable) return null;
+  try {
+    return initStateDB();
+  } catch {
+    return null;
+  }
+}
 function getRecentEvents(limit = 50) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return [];
   const rows = database.prepare(`
     SELECT * FROM events ORDER BY timestamp DESC LIMIT ?
   `).all(limit);
   return rows.map(rowToEvent);
 }
 function getEventCount(since) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return 0;
   if (since) {
     return database.prepare(`SELECT COUNT(*) as count FROM events WHERE timestamp >= ?`).get(since.toISOString()).count;
   }
   return database.prepare(`SELECT COUNT(*) as count FROM events`).get().count;
 }
 function getThreatCount(since) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return 0;
   const severities = "('medium','high','critical')";
   if (since) {
     return database.prepare(
@@ -3418,13 +3439,30 @@ function getThreatCount(since) {
   ).get().count;
 }
 function getTopSources(limit = 10) {
-  const database = db || initStateDB();
+  const database = tryDb();
+  if (!database) return [];
   return database.prepare(`
     SELECT source_ip as ip, COUNT(*) as count FROM events
     WHERE source_ip IS NOT NULL
     GROUP BY source_ip ORDER BY count DESC LIMIT ?
   `).all(limit);
 }
+function getModuleState(module2, key) {
+  const database = db || initStateDB();
+  const row = database.prepare(`SELECT value FROM module_state WHERE module = ? AND key = ?`).get(module2, key);
+  if (!row) return void 0;
+  try {
+    return JSON.parse(row.value);
+  } catch {
+    return row.value;
+  }
+}
+function setModuleState(module2, key, value) {
+  const database = db || initStateDB();
+  database.prepare(`
+    INSERT OR REPLACE INTO module_state (module, key, value) VALUES (?, ?, ?)
+  `).run(module2, key, JSON.stringify(value));
+}
 function rowToEvent(row) {
   return {
     id: row.id,
@@ -3443,12 +3481,13 @@ function closeDB() {
     db = null;
   }
 }
-var import_better_sqlite3, db;
+var import_better_sqlite3, db, dbUnavailable;
 var init_state = __esm({
   "src/core/state.ts"() {
     "use strict";
     import_better_sqlite3 = __toESM(require("better-sqlite3"));
     db = null;
+    dbUnavailable = false;
   }
 });
 
@@ -8220,7 +8259,7 @@ var source_default = chalk;
 
 // src/index.ts
 var import_readline = __toESM(require("readline"));
-var import_node_child_process6 = require("child_process");
+var import_node_child_process7 = require("child_process");
 var import_node_fs22 = require("fs");
 var import_node_path15 = require("path");
 var import_node_os8 = require("os");
@@ -10836,7 +10875,14 @@ async function pentestCommand(targetUrl) {
   } catch (err) {
     spinner.fail(`Failed to reach target: ${err.message}`);
     console.log(source_default.gray("  Check the URL and try again.\n"));
-    return;
+    return {
+      type: "pentest",
+      target: targetUrl,
+      findings: [],
+      severity_summary: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      summary: `Failed to reach target: ${err.message}`,
+      error: err.message
+    };
   }
   const sqliSpinner = ora({ text: "Testing SQL injection vectors...", color: "green" }).start();
   const sqliPayloads = ["' OR 1=1--", "1' UNION SELECT NULL--", "' AND '1'='1"];
@@ -11377,7 +11423,7 @@ async function sshConnect(options) {
 }
 
 // src/commands/daemon.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_fs18 = require("fs");
 var import_node_path12 = require("path");
 var import_node_fs19 = require("fs");
@@ -11581,6 +11627,7 @@ var IpcServer = class {
 // src/daemon/module-host.ts
 var import_node_fs16 = require("fs");
 var import_node_path10 = require("path");
+var import_node_url = require("url");
 var import_toml4 = __toESM(require_toml());
 init_paths();
 
@@ -11721,21 +11768,143 @@ var LogWatcher = class {
   }
 };
 
+// src/daemon/watchers/journal-watcher.ts
+var import_node_child_process4 = require("child_process");
+init_state();
+var JournalWatcher = class _JournalWatcher {
+  constructor(bus2) {
+    this.bus = bus2;
+  }
+  bus;
+  proc = null;
+  buffer = "";
+  moduleName = "user-journal";
+  active = false;
+  static isAvailable() {
+    const probe = (0, import_node_child_process4.spawnSync)("journalctl", ["--user", "-n", "0", "--no-pager"], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return probe.status === 0;
+  }
+  start() {
+    if (!_JournalWatcher.isAvailable()) return false;
+    const child = (0, import_node_child_process4.spawn)(
+      "journalctl",
+      ["--user", "-o", "json", "-f", "--since", "now"],
+      { stdio: ["ignore", "pipe", "pipe"] }
+    );
+    if (!child.stdout) return false;
+    child.stdout.setEncoding("utf-8");
+    child.stdout.on("data", (chunk) => this.onData(chunk));
+    child.on("exit", () => {
+      this.proc = null;
+      this.active = false;
+    });
+    this.proc = child;
+    this.active = true;
+    return true;
+  }
+  stop() {
+    if (this.proc) {
+      try {
+        this.proc.kill("SIGTERM");
+      } catch {
+      }
+      this.proc = null;
+    }
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  moduleNameValue() {
+    return this.moduleName;
+  }
+  onData(chunk) {
+    this.buffer += chunk;
+    let idx;
+    while ((idx = this.buffer.indexOf("\n")) >= 0) {
+      const line = this.buffer.slice(0, idx);
+      this.buffer = this.buffer.slice(idx + 1);
+      if (!line.trim()) continue;
+      this.handleLine(line);
+    }
+  }
+  handleLine(line) {
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      return;
+    }
+    const message = entry.MESSAGE;
+    if (!message) return;
+    const priority = parseInt(entry.PRIORITY ?? "6", 10);
+    const severity = priorityToSeverity(priority);
+    const ident = entry.SYSLOG_IDENTIFIER || entry._COMM || "journal";
+    const bumpedSeverity = bumpForIdent(ident, message, severity);
+    const event = {
+      timestamp: realtimeToDate(entry.__REALTIME_TIMESTAMP) || /* @__PURE__ */ new Date(),
+      module: this.moduleName,
+      category: "system",
+      severity: bumpedSeverity,
+      message: `[${ident}] ${message}`.slice(0, 500)
+    };
+    try {
+      insertEvent(event);
+    } catch {
+    }
+    this.bus.publish(event);
+  }
+};
+function priorityToSeverity(priority) {
+  if (priority <= 2) return "critical";
+  if (priority === 3) return "high";
+  if (priority === 4) return "medium";
+  if (priority === 5) return "low";
+  return "info";
+}
+function bumpForIdent(ident, message, base) {
+  if (/sudo/i.test(ident) && /authentication failure|incorrect password|FAILED/i.test(message)) {
+    return "high";
+  }
+  if (/sshd/i.test(ident) && /failed|invalid user|break-in/i.test(message)) {
+    return "high";
+  }
+  return base;
+}
+function realtimeToDate(rt) {
+  if (!rt) return null;
+  const us = parseInt(rt, 10);
+  if (!Number.isFinite(us)) return null;
+  return new Date(Math.floor(us / 1e3));
+}
+
 // src/daemon/module-host.ts
+init_state();
 var ModuleHost = class {
   constructor(bus2) {
     this.bus = bus2;
     bus2.on("event", (event) => {
       const mod = this.modules.get(event.module);
       if (mod) mod.events++;
+      for (const hosted of this.modules.values()) {
+        if (hosted.status !== "running" || !hosted.instance?.onEvent) continue;
+        void hosted.instance.onEvent(event).catch((err) => {
+          hosted.status = "error";
+          hosted.detail = `onEvent failed: ${String(err.message || err)}`;
+          this.bus.announceModule(hosted.name, "error", hosted.detail);
+        });
+      }
     });
   }
   bus;
   modules = /* @__PURE__ */ new Map();
   logWatcher = null;
+  journalWatcher = null;
   async start() {
     this.registerBuiltins();
-    this.discoverInstalled();
+    await this.discoverAndStartInstalled();
     this.logWatcher = new LogWatcher(this.bus);
     const watched = this.logWatcher.start();
     for (const modName of this.logWatcher.activeModules()) {
@@ -11746,10 +11915,30 @@ var ModuleHost = class {
         this.bus.announceModule(modName, "running", mod.detail);
       }
     }
+    this.journalWatcher = new JournalWatcher(this.bus);
+    if (this.journalWatcher.start()) {
+      const mod = this.modules.get("user-journal");
+      if (mod) {
+        mod.status = "running";
+        mod.detail = "tailing journalctl --user";
+        this.bus.announceModule("user-journal", "running", mod.detail);
+      }
+    }
   }
   async stop() {
     this.logWatcher?.stop();
+    this.journalWatcher?.stop();
     for (const mod of this.modules.values()) {
+      try {
+        if (mod.instance && mod.status === "running") {
+          await mod.instance.stop();
+        }
+      } catch (err) {
+        mod.status = "error";
+        mod.detail = `stop failed: ${String(err.message || err)}`;
+        this.bus.announceModule(mod.name, "error", mod.detail);
+        continue;
+      }
       mod.status = "loaded";
       this.bus.announceModule(mod.name, "stopped");
     }
@@ -11765,12 +11954,14 @@ var ModuleHost = class {
   registerBuiltins() {
     const builtins = [
       { name: "log-watcher", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
-      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
+      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "user-journal", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
     ];
     for (const m of builtins) this.modules.set(m.name, m);
   }
-  discoverInstalled() {
+  async discoverAndStartInstalled() {
     if (!(0, import_node_fs16.existsSync)(PATHS.moduleDir)) return;
+    const configs = loadModuleConfigs(PATHS.confD);
     const entries = (0, import_node_fs16.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
@@ -11779,16 +11970,113 @@ var ModuleHost = class {
       try {
         const manifest = import_toml4.default.parse((0, import_node_fs16.readFileSync)(manifestPath, "utf-8"));
         const name = manifest.module?.name || entry.name;
-        this.modules.set(name, {
+        const defaults = manifest.module?.config?.defaults || {};
+        const config = {
+          enabled: true,
+          ...defaults,
+          ...configs.get(name) || {}
+        };
+        const hosted = {
           name,
           version: manifest.module?.version || "0.0.0",
           source: "installed",
-          status: "loaded",
-          events: 0
+          status: config.enabled === false ? "disabled" : "loaded",
+          events: 0,
+          path: (0, import_node_path10.join)(PATHS.moduleDir, entry.name),
+          config
+        };
+        this.modules.set(name, hosted);
+        if (config.enabled === false) continue;
+        await this.startInstalled(hosted);
+      } catch (err) {
+        const name = entry.name;
+        this.modules.set(name, {
+          name,
+          version: "0.0.0",
+          source: "installed",
+          status: "error",
+          events: 0,
+          detail: `manifest load failed: ${String(err.message || err)}`,
+          path: (0, import_node_path10.join)(PATHS.moduleDir, entry.name)
         });
+      }
+    }
+  }
+  async startInstalled(hosted) {
+    const entrypoint = this.installedEntrypoint(hosted.path);
+    if (!entrypoint) {
+      hosted.status = "loaded";
+      hosted.detail = "no built entrypoint found; run npm install && npm run build in the module directory";
+      return;
+    }
+    try {
+      const imported = await import((0, import_node_url.pathToFileURL)(entrypoint).href);
+      const exported = imported.default || imported.module || imported;
+      const instance = typeof exported === "function" ? new exported() : exported;
+      if (!this.isThreatCrushModule(instance)) {
+        throw new Error("entrypoint does not export a ThreatCrush module");
+      }
+      hosted.instance = instance;
+      await instance.init(this.contextFor(hosted));
+      await instance.start();
+      hosted.status = "running";
+      hosted.detail = `started from ${entrypoint}`;
+      this.bus.announceModule(hosted.name, "running", hosted.detail);
+    } catch (err) {
+      hosted.status = "error";
+      hosted.detail = String(err.message || err);
+      this.bus.announceModule(hosted.name, "error", hosted.detail);
+    }
+  }
+  installedEntrypoint(modulePath) {
+    const packageJson = (0, import_node_path10.join)(modulePath, "package.json");
+    const candidates = [];
+    if ((0, import_node_fs16.existsSync)(packageJson)) {
+      try {
+        const pkg = JSON.parse((0, import_node_fs16.readFileSync)(packageJson, "utf-8"));
+        if (pkg.main) candidates.push((0, import_node_path10.join)(modulePath, pkg.main));
       } catch {
       }
     }
+    candidates.push((0, import_node_path10.join)(modulePath, "dist", "index.js"), (0, import_node_path10.join)(modulePath, "index.js"));
+    return candidates.find((candidate) => (0, import_node_fs16.existsSync)(candidate)) || null;
+  }
+  isThreatCrushModule(value) {
+    return Boolean(
+      value && typeof value === "object" && typeof value.init === "function" && typeof value.start === "function" && typeof value.stop === "function"
+    );
+  }
+  contextFor(hosted) {
+    return {
+      config: hosted.config || { enabled: true },
+      logger: this.loggerFor(hosted.name),
+      emit: (event) => this.bus.publish(event),
+      subscribe: (eventType, handler) => {
+        this.bus.on("event", (event) => {
+          if (event.category === eventType || event.module === eventType) handler(event);
+        });
+      },
+      alert: (alert) => {
+        this.bus.emit("alert", alert.event || {
+          timestamp: /* @__PURE__ */ new Date(),
+          module: hosted.name,
+          category: "system",
+          severity: alert.severity,
+          message: alert.title,
+          details: alert.body ? { body: alert.body } : void 0
+        });
+      },
+      getState: (key) => getModuleState(hosted.name, key),
+      setState: (key, value) => setModuleState(hosted.name, key, value)
+    };
+  }
+  loggerFor(moduleName) {
+    return {
+      debug: (msg, ...args) => console.debug(`[${moduleName}] ${msg}`, ...args),
+      info: (msg, ...args) => console.info(`[${moduleName}] ${msg}`, ...args),
+      warn: (msg, ...args) => console.warn(`[${moduleName}] ${msg}`, ...args),
+      error: (msg, ...args) => console.error(`[${moduleName}] ${msg}`, ...args)
+    };
   }
 };
 
@@ -12211,7 +12499,7 @@ async function daemonStart() {
   }
   const out = (0, import_node_fs19.openSync)(PATHS.logFile, "a");
   const err = (0, import_node_fs19.openSync)(PATHS.logFile, "a");
-  const child = (0, import_node_child_process4.spawn)(process.execPath, [DAEMON_ENTRY], {
+  const child = (0, import_node_child_process5.spawn)(process.execPath, [DAEMON_ENTRY], {
     detached: true,
     stdio: ["ignore", out, err],
     env: { ...process.env, THREATCRUSH_DAEMON: "1" }
@@ -12276,7 +12564,7 @@ async function daemonStop() {
 }
 
 // src/commands/service.ts
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_path13 = require("path");
 var UNIT_PATH = "/etc/systemd/system/threatcrushd.service";
@@ -12291,7 +12579,7 @@ function resolveBinPath() {
   const arg = process.argv[1];
   if (arg && (0, import_node_fs20.existsSync)(arg)) return arg;
   try {
-    return (0, import_node_child_process5.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
+    return (0, import_node_child_process6.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
   } catch {
     return "threatcrush";
   }
@@ -12313,8 +12601,8 @@ async function installServiceCommand() {
   (0, import_node_fs20.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
   console.log(source_default.green(`  \u2713 Installed unit file: ${UNIT_PATH}`));
   try {
-    (0, import_node_child_process5.execSync)("systemctl daemon-reload", { stdio: "inherit" });
-    (0, import_node_child_process5.execSync)("systemctl enable threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process6.execSync)("systemctl daemon-reload", { stdio: "inherit" });
+    (0, import_node_child_process6.execSync)("systemctl enable threatcrushd.service", { stdio: "inherit" });
     console.log(source_default.green("  \u2713 Service enabled on boot."));
     console.log(source_default.dim("  Start now with: systemctl start threatcrushd"));
     console.log(source_default.dim("  View logs with: journalctl -u threatcrushd -f"));
@@ -12333,22 +12621,22 @@ async function uninstallServiceCommand() {
     return;
   }
   try {
-    (0, import_node_child_process5.execSync)("systemctl stop threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process6.execSync)("systemctl stop threatcrushd.service", { stdio: "inherit" });
   } catch {
   }
   try {
-    (0, import_node_child_process5.execSync)("systemctl disable threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process6.execSync)("systemctl disable threatcrushd.service", { stdio: "inherit" });
   } catch {
   }
   try {
     if ((0, import_node_fs20.existsSync)(UNIT_PATH)) {
-      (0, import_node_child_process5.execSync)(`rm -f ${UNIT_PATH}`);
+      (0, import_node_child_process6.execSync)(`rm -f ${UNIT_PATH}`);
       console.log(source_default.green(`  \u2713 Removed unit file: ${UNIT_PATH}`));
     }
   } catch {
   }
   try {
-    (0, import_node_child_process5.execSync)("systemctl daemon-reload", { stdio: "inherit" });
+    (0, import_node_child_process6.execSync)("systemctl daemon-reload", { stdio: "inherit" });
   } catch {
   }
   console.log(source_default.green("  \u2713 threatcrushd service removed."));
@@ -12908,22 +13196,22 @@ var DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
 var INSTALL_CONFIG_PATH = (0, import_node_path15.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
 function detectPackageManager() {
   try {
-    const npmGlobal = (0, import_node_child_process6.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
+    const npmGlobal = (0, import_node_child_process7.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
     if (npmGlobal.includes(PKG_NAME)) return "npm";
   } catch {
   }
   try {
-    (0, import_node_child_process6.execSync)("pnpm --version", { stdio: "pipe" });
+    (0, import_node_child_process7.execSync)("pnpm --version", { stdio: "pipe" });
     return "pnpm";
   } catch {
   }
   try {
-    (0, import_node_child_process6.execSync)("yarn --version", { stdio: "pipe" });
+    (0, import_node_child_process7.execSync)("yarn --version", { stdio: "pipe" });
     return "yarn";
   } catch {
   }
   try {
-    (0, import_node_child_process6.execSync)("bun --version", { stdio: "pipe" });
+    (0, import_node_child_process7.execSync)("bun --version", { stdio: "pipe" });
     return "bun";
   } catch {
   }
@@ -12969,7 +13257,7 @@ function packageLooksInstalled(pm, pkgName) {
       yarn: `yarn global list --pattern ${pkgName}`,
       bun: `bun pm ls -g`
     };
-    const output = (0, import_node_child_process6.execSync)(listCommands[pm] || listCommands.npm, {
+    const output = (0, import_node_child_process7.execSync)(listCommands[pm] || listCommands.npm, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -13071,7 +13359,7 @@ program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(source_default.green(`  Tailing ${logPath}...
 `));
   console.log(source_default.gray("  Press Ctrl+C to stop\n"));
-  (0, import_node_child_process6.execSync)(`tail -f ${logPath}`, { stdio: "inherit" });
+  (0, import_node_child_process7.execSync)(`tail -f ${logPath}`, { stdio: "inherit" });
 });
 program2.command("activate").description("Activate your license key").action(async () => {
   console.log(LOGO2);
@@ -13121,7 +13409,7 @@ program2.command("update").description("Update ThreatCrush CLI and installed bun
       for (const cmd of commands2) {
         console.log(source_default.green(`  \u2192 ${cmd}
 `));
-        (0, import_node_child_process6.execSync)(cmd, { stdio: "inherit" });
+        (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
       }
       console.log(source_default.green("\n  \u2713 Modules updated successfully!\n"));
     } catch (err) {
@@ -13147,7 +13435,7 @@ program2.command("update").description("Update ThreatCrush CLI and installed bun
     for (const cmd of commands) {
       console.log(source_default.green(`  \u2192 ${cmd}
 `));
-      (0, import_node_child_process6.execSync)(cmd, { stdio: "inherit" });
+      (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
     }
     console.log(source_default.green("\n  \u2713 ThreatCrush updated successfully!\n"));
     if (installMode === "desktop") {
@@ -13191,7 +13479,7 @@ program2.command("remove").description("Uninstall ThreatCrush and the installed
     for (const cmd of commands) {
       console.log(source_default.green(`  \u2192 ${cmd}
 `));
-      (0, import_node_child_process6.execSync)(cmd, { stdio: "inherit" });
+      (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
     }
     console.log(source_default.green("\n  \u2713 ThreatCrush has been uninstalled.\n"));
     console.log(source_default.dim("  We're sorry to see you go! \u{1F44B}\n"));