@profullstack/threatcrush 0.2.1 → 0.2.2

package/dist/index.js

@@ -3834,16 +3834,14 @@ var init_app = __esm({
 });
 
 // src/daemon/paths.ts
-function canWriteSystemPaths() {
-  if (process.platform !== "linux") return false;
-  if (process.getuid && process.getuid() === 0) return true;
-  try {
-    if (!(0, import_node_fs.existsSync)("/etc/threatcrush")) return false;
-    (0, import_node_fs.mkdirSync)("/etc/threatcrush/.probe", { recursive: true });
-    return true;
-  } catch {
-    return false;
-  }
+function isRoot() {
+  return process.platform === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
+}
+function resolveClientSocket() {
+  if ((0, import_node_fs.existsSync)(PATHS.socket)) return PATHS.socket;
+  const other = PATHS.mode === "system" ? USER_PATHS.socket : SYSTEM_PATHS.socket;
+  if ((0, import_node_fs.existsSync)(other)) return other;
+  return PATHS.socket;
 }
 function ensureRuntimeDirs() {
   for (const dir of [PATHS.configDir, PATHS.confD, PATHS.moduleDir, PATHS.logDir, PATHS.stateDir, PATHS.runDir]) {
@@ -3853,16 +3851,15 @@ function ensureRuntimeDirs() {
     }
   }
 }
-var import_node_fs, import_node_os2, import_node_path, systemMode, userBase, PATHS;
+var import_node_fs, import_node_os2, import_node_path, userBase, SYSTEM_PATHS, USER_PATHS, PATHS;
 var init_paths = __esm({
   "src/daemon/paths.ts"() {
     "use strict";
     import_node_fs = require("fs");
     import_node_os2 = require("os");
     import_node_path = require("path");
-    systemMode = canWriteSystemPaths();
     userBase = (0, import_node_path.join)((0, import_node_os2.homedir)(), ".threatcrush");
-    PATHS = systemMode ? {
+    SYSTEM_PATHS = {
       mode: "system",
       configDir: "/etc/threatcrush",
       configFile: "/etc/threatcrush/threatcrushd.conf",
@@ -3875,7 +3872,8 @@ var init_paths = __esm({
       runDir: "/var/run/threatcrush",
       pidFile: "/var/run/threatcrush/threatcrushd.pid",
       socket: "/var/run/threatcrush/threatcrushd.sock"
-    } : {
+    };
+    USER_PATHS = {
       mode: "user",
       configDir: userBase,
       configFile: (0, import_node_path.join)(userBase, "threatcrushd.conf"),
@@ -3889,6 +3887,7 @@ var init_paths = __esm({
       pidFile: (0, import_node_path.join)(userBase, "run", "threatcrushd.pid"),
       socket: (0, import_node_path.join)(userBase, "run", "threatcrushd.sock")
     };
+    PATHS = isRoot() ? SYSTEM_PATHS : USER_PATHS;
   }
 });
 
@@ -3903,7 +3902,7 @@ var init_ipc_client = __esm({
     IpcClient = class {
       constructor(opts = {}) {
         this.opts = opts;
-        this.socketPath = opts.socketPath || PATHS.socket;
+        this.socketPath = opts.socketPath || resolveClientSocket();
       }
       opts;
       socket = null;
@@ -3911,7 +3910,7 @@ var init_ipc_client = __esm({
       nextId = 1;
       pending = /* @__PURE__ */ new Map();
       socketPath;
-      static isDaemonRunning(socketPath = PATHS.socket) {
+      static isDaemonRunning(socketPath = resolveClientSocket()) {
         return (0, import_node_fs2.existsSync)(socketPath);
       }
       async connect(timeoutMs = 2e3) {
@@ -4037,8 +4036,9 @@ function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    const code = err.code;
+    return code === "EPERM";
   }
 }
 function findRunningDaemon() {
@@ -8259,9 +8259,9 @@ var source_default = chalk;
 
 // src/index.ts
 var import_readline = __toESM(require("readline"));
-var import_node_child_process7 = require("child_process");
-var import_node_fs22 = require("fs");
-var import_node_path15 = require("path");
+var import_node_child_process10 = require("child_process");
+var import_node_fs27 = require("fs");
+var import_node_path16 = require("path");
 var import_node_os8 = require("os");
 
 // src/commands/monitor.ts
@@ -8454,16 +8454,41 @@ async function monitorCommand(options) {
   banner();
   logger.info("Starting foreground monitor...");
   const moduleFilter = options.module?.split(",").map((m) => m.trim());
-  const availableSources = LOG_SOURCES.filter((s) => {
-    if (moduleFilter && !moduleFilter.includes(s.name)) return false;
-    return (0, import_node_fs4.existsSync)(s.path);
-  });
+  const availableSources = [];
+  const unreadable = [];
+  for (const s of LOG_SOURCES) {
+    if (moduleFilter && !moduleFilter.includes(s.name)) continue;
+    if (!(0, import_node_fs4.existsSync)(s.path)) continue;
+    try {
+      (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+      availableSources.push(s);
+    } catch {
+      unreadable.push(s);
+    }
+  }
+  if (unreadable.length > 0) {
+    logger.warn(`Skipping ${unreadable.length} unreadable log source(s):`);
+    for (const s of unreadable) {
+      console.log(`  ${source_default.yellow("!")} ${source_default.gray(s.path)} (permission denied \u2014 add yourself to the 'adm' group or run as root)`);
+    }
+    console.log();
+  }
   if (availableSources.length === 0) {
-    logger.warn("No log files found to monitor.");
+    logger.warn("No readable log files found to monitor.");
     logger.info("Available log paths checked:");
     for (const s of LOG_SOURCES) {
       const exists = (0, import_node_fs4.existsSync)(s.path);
-      console.log(`  ${exists ? source_default.green("\u2713") : source_default.red("\u2717")} ${s.path}`);
+      let readable = false;
+      if (exists) {
+        try {
+          (0, import_node_fs4.accessSync)(s.path, import_node_fs4.constants.R_OK);
+          readable = true;
+        } catch {
+          readable = false;
+        }
+      }
+      const glyph = !exists ? source_default.red("\u2717 missing") : readable ? source_default.green("\u2713 readable") : source_default.yellow("! no read perm");
+      console.log(`  ${glyph}  ${s.path}`);
     }
     console.log();
     logger.info("Starting demo mode with synthetic events...\n");
@@ -8498,7 +8523,13 @@ function tailLog(source) {
         return;
       }
       const stream = (0, import_node_fs4.createReadStream)(path, { start: position, encoding: "utf-8" });
+      stream.on("error", (err) => {
+        logger.warn(`stopped tailing ${path}: ${err.code || err.message}`);
+        position = currentStat.size;
+      });
       const rl = (0, import_node_readline.createInterface)({ input: stream });
+      rl.on("error", () => {
+      });
       rl.on("line", (line) => {
         if (!line.trim()) return;
         processLine(line, name, category);
@@ -9607,6 +9638,8 @@ async function runScan(targetPath) {
   try {
     scanDirectory(targetPath, targetPath, findings, () => {
     });
+    const depFindings = await scanDependencies(targetPath);
+    findings.push(...depFindings);
   } catch (err) {
     return {
       type: "scan",
@@ -9776,6 +9809,92 @@ function scanDirectory(basePath, currentPath, findings, onFile) {
     }
   }
 }
+async function scanDependencies(targetPath) {
+  const findings = [];
+  const lockfiles = [
+    { file: "package-lock.json", ecosystem: "npm" },
+    { file: "pnpm-lock.yaml", ecosystem: "npm" },
+    { file: "yarn.lock", ecosystem: "npm" },
+    { file: "requirements.txt", ecosystem: "PyPI" },
+    { file: "Pipfile.lock", ecosystem: "PyPI" }
+  ];
+  for (const { file, ecosystem } of lockfiles) {
+    const lockPath = (0, import_node_path2.join)(targetPath, file);
+    if (!(0, import_node_fs5.existsSync)(lockPath)) continue;
+    try {
+      const deps = parseDependencies(lockPath, file, ecosystem);
+      for (const dep of deps.slice(0, 50)) {
+        try {
+          const vulns = await queryOsv(dep.name, dep.version, ecosystem);
+          for (const vuln of vulns) {
+            const cvssScore = vuln.severity?.find((s) => s.type === "CVSS_V3")?.score;
+            const severity = cvssScore ? parseFloat(cvssScore) >= 9 ? "critical" : parseFloat(cvssScore) >= 7 ? "high" : parseFloat(cvssScore) >= 4 ? "medium" : "low" : "medium";
+            findings.push({
+              file,
+              line: 0,
+              type: "Dependency CVE",
+              severity,
+              message: `${dep.name}@${dep.version}: ${vuln.summary || vuln.id}`,
+              snippet: `${vuln.id}${cvssScore ? ` (CVSS: ${cvssScore})` : ""}`
+            });
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  return findings;
+}
+function parseDependencies(lockPath, filename, ecosystem) {
+  const deps = [];
+  if (filename === "package-lock.json") {
+    try {
+      const lock = JSON.parse((0, import_node_fs5.readFileSync)(lockPath, "utf-8"));
+      const packages = lock.packages || lock.dependencies || {};
+      for (const [key, value] of Object.entries(packages)) {
+        const name = key.replace(/^node_modules\//, "");
+        const version = value.version;
+        if (name && version && !name.startsWith(".")) {
+          deps.push({ name, version });
+        }
+      }
+    } catch {
+    }
+  } else if (filename === "requirements.txt") {
+    try {
+      const content = (0, import_node_fs5.readFileSync)(lockPath, "utf-8");
+      for (const line of content.split("\n")) {
+        const match = line.match(/^([a-zA-Z0-9_.-]+)==([0-9.]+)/);
+        if (match) deps.push({ name: match[1], version: match[2] });
+      }
+    } catch {
+    }
+  }
+  return deps;
+}
+function isValidPackageName(name) {
+  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
+}
+function isValidVersion(version) {
+  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
+}
+async function queryOsv(name, version, ecosystem) {
+  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
+  try {
+    const res = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ package: { name, ecosystem }, version }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.vulns || [];
+  } catch {
+    return [];
+  }
+}
 
 // src/commands/init.ts
 var import_node_fs8 = require("fs");
@@ -10591,7 +10710,16 @@ async function modulesInstallCommand(source) {
 `));
     return;
   }
-  if (install.git_url) {
+  if (install.npm_package) {
+    const npmSpinner = ora({ text: `Installing ${install.npm_package}...`, color: "green" }).start();
+    try {
+      (0, import_node_child_process2.execSync)(`npm install -g ${install.npm_package}`, { stdio: "pipe" });
+      npmSpinner.succeed(`Package ${install.npm_package} installed globally`);
+    } catch (err) {
+      npmSpinner.fail(`npm install failed: ${err.message}`);
+      return;
+    }
+  } else if (install.git_url) {
     const cloneSpinner = ora({ text: "Cloning module repository...", color: "green" }).start();
     try {
       (0, import_node_child_process2.execSync)(`git clone --depth 1 ${install.git_url} ${dest}`, { stdio: "pipe" });
@@ -10609,15 +10737,6 @@ async function modulesInstallCommand(source) {
       return;
     }
     cloneSpinner.succeed(`Installed ${mod.name} v${mod.version} \u2192 ${dest}`);
-  } else if (install.npm_package) {
-    const npmSpinner = ora({ text: `Installing ${install.npm_package}...`, color: "green" }).start();
-    try {
-      (0, import_node_child_process2.execSync)(`npm install -g ${install.npm_package}`, { stdio: "pipe" });
-      npmSpinner.succeed(`Package ${install.npm_package} installed globally`);
-    } catch (err) {
-      npmSpinner.fail(`npm install failed: ${err.message}`);
-      return;
-    }
   } else if (install.tarball_url) {
     const dlSpinner = ora({ text: "Downloading module tarball...", color: "green" }).start();
     try {
@@ -10758,6 +10877,39 @@ var PENTEST_CHECKS = [
     test: (html) => /stack trace|traceback|exception|at\s+\w+\.\w+\(/i.test(html),
     severity: "medium",
     message: "Error page reveals internal information"
+  },
+  // PRD 07: Additional checks
+  {
+    name: "CORS Misconfiguration",
+    test: (_url, _body, headers) => {
+      const acao = headers["access-control-allow-origin"];
+      return acao === "*" || acao === "null";
+    },
+    severity: "medium",
+    message: "CORS allows any origin (Access-Control-Allow-Origin: *)"
+  },
+  {
+    name: "Cookie Security",
+    test: (_url, _body, headers) => {
+      const setCookie = headers["set-cookie"] || "";
+      return setCookie.length > 0 && (!setCookie.includes("HttpOnly") || !setCookie.includes("Secure"));
+    },
+    severity: "medium",
+    message: "Cookies missing HttpOnly or Secure flags"
+  },
+  {
+    name: "Content Security Policy",
+    test: (_url, _body, headers) => {
+      return !headers["content-security-policy"];
+    },
+    severity: "low",
+    message: "No Content-Security-Policy header set"
+  },
+  {
+    name: "Sensitive Path Exposure",
+    test: (html) => /\.env|wp-admin|phpinfo|\.git\/config|server-status/i.test(html),
+    severity: "high",
+    message: "Response references sensitive paths or admin endpoints"
   }
 ];
 async function runPentest(rawUrl) {
@@ -11423,14 +11575,14 @@ async function sshConnect(options) {
 }
 
 // src/commands/daemon.ts
-var import_node_child_process5 = require("child_process");
-var import_node_fs18 = require("fs");
-var import_node_path12 = require("path");
-var import_node_fs19 = require("fs");
+var import_node_child_process7 = require("child_process");
+var import_node_fs22 = require("fs");
+var import_node_path13 = require("path");
+var import_node_fs23 = require("fs");
 
 // src/daemon/index.ts
-var import_node_fs17 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path12 = require("path");
 init_paths();
 init_pidfile();
 
@@ -11493,10 +11645,19 @@ var IpcServer = class {
       this.server = (0, import_node_net2.createServer)((sock) => this.handleClient(sock));
       this.server.on("error", reject);
       this.server.listen(PATHS.socket, () => {
+        const nodeFs = require("fs");
         try {
-          require("fs").chmodSync(PATHS.socket, 432);
+          nodeFs.chmodSync(PATHS.socket, 432);
         } catch {
         }
+        const isRoot3 = process.platform === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
+        if (isRoot3) {
+          try {
+            const { gid } = nodeFs.statSync("/var/log/auth.log");
+            nodeFs.chownSync(PATHS.socket, 0, gid);
+          } catch {
+          }
+        }
         resolve3();
       });
     });
@@ -11625,7 +11786,7 @@ var IpcServer = class {
 };
 
 // src/daemon/module-host.ts
-var import_node_fs16 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_path10 = require("path");
 var import_node_url = require("url");
 var import_toml4 = __toESM(require_toml());
@@ -11780,8 +11941,16 @@ var JournalWatcher = class _JournalWatcher {
   buffer = "";
   moduleName = "user-journal";
   active = false;
+  // When the daemon runs as root (system mode), tail the SYSTEM journal so
+  // we pick up sshd / sudo / kernel / UFW events. Falling back to --user
+  // would give us root's mostly-empty per-user journal. Otherwise we use
+  // --user so the daemon can run unprivileged on a workstation.
+  static scopeArgs() {
+    const isRoot3 = process.platform === "linux" && typeof process.getuid === "function" && process.getuid() === 0;
+    return isRoot3 ? [] : ["--user"];
+  }
   static isAvailable() {
-    const probe = (0, import_node_child_process4.spawnSync)("journalctl", ["--user", "-n", "0", "--no-pager"], {
+    const probe = (0, import_node_child_process4.spawnSync)("journalctl", [...this.scopeArgs(), "-n", "0", "--no-pager"], {
       stdio: ["ignore", "ignore", "ignore"]
     });
     return probe.status === 0;
@@ -11790,7 +11959,7 @@ var JournalWatcher = class _JournalWatcher {
     if (!_JournalWatcher.isAvailable()) return false;
     const child = (0, import_node_child_process4.spawn)(
       "journalctl",
-      ["--user", "-o", "json", "-f", "--since", "now"],
+      [..._JournalWatcher.scopeArgs(), "-o", "json", "-f", "--since", "now"],
       { stdio: ["ignore", "pipe", "pipe"] }
     );
     if (!child.stdout) return false;
@@ -11880,98 +12049,511 @@ function realtimeToDate(rt) {
   return new Date(Math.floor(us / 1e3));
 }
 
-// src/daemon/module-host.ts
+// src/modules/network-monitor/index.ts
+var import_node_child_process5 = require("child_process");
+var import_node_fs16 = require("fs");
 init_state();
-var ModuleHost = class {
+var NetworkMonitor = class {
   constructor(bus2) {
     this.bus = bus2;
-    bus2.on("event", (event) => {
-      const mod = this.modules.get(event.module);
-      if (mod) mod.events++;
-      for (const hosted of this.modules.values()) {
-        if (hosted.status !== "running" || !hosted.instance?.onEvent) continue;
-        void hosted.instance.onEvent(event).catch((err) => {
-          hosted.status = "error";
-          hosted.detail = `onEvent failed: ${String(err.message || err)}`;
-          this.bus.announceModule(hosted.name, "error", hosted.detail);
-        });
-      }
-    });
   }
   bus;
-  modules = /* @__PURE__ */ new Map();
-  logWatcher = null;
-  journalWatcher = null;
-  async start() {
-    this.registerBuiltins();
-    await this.discoverAndStartInstalled();
-    this.logWatcher = new LogWatcher(this.bus);
-    const watched = this.logWatcher.start();
-    for (const modName of this.logWatcher.activeModules()) {
-      const mod = this.modules.get(modName);
-      if (mod) {
-        mod.status = "running";
-        mod.detail = `watching ${watched.length} log source(s)`;
-        this.bus.announceModule(modName, "running", mod.detail);
+  active = false;
+  pollTimer = null;
+  scanTrackers = /* @__PURE__ */ new Map();
+  halfOpenTrackers = /* @__PURE__ */ new Map();
+  lastConnections = /* @__PURE__ */ new Set();
+  // Config
+  pollIntervalMs = 5e3;
+  portScanThreshold = 10;
+  // unique ports in window
+  portScanWindowMs = 3e4;
+  synFloodThreshold = 50;
+  // half-open connections
+  synFloodWindowMs = 1e4;
+  start() {
+    if (!this.hasConntrackOrSs()) {
+      return false;
+    }
+    this.active = true;
+    this.pollTimer = setInterval(() => this.poll(), this.pollIntervalMs);
+    return true;
+  }
+  stop() {
+    if (this.pollTimer) clearInterval(this.pollTimer);
+    this.pollTimer = null;
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  hasConntrackOrSs() {
+    const ss = (0, import_node_child_process5.spawnSync)("ss", ["--version"], { stdio: "pipe" });
+    if (ss.status === 0) return true;
+    return (0, import_node_fs16.existsSync)("/proc/net/tcp");
+  }
+  poll() {
+    try {
+      const connections = this.getConnections();
+      this.analyzePortScans(connections);
+      this.analyzeSynFlood(connections);
+      this.cleanupTrackers();
+    } catch {
+    }
+  }
+  getConnections() {
+    const records = [];
+    const now = Date.now();
+    try {
+      const ct = (0, import_node_child_process5.spawnSync)("conntrack", ["-L", "-p", "tcp", "-o", "extended"], {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 3e3
+      });
+      if (ct.status === 0 && ct.stdout) {
+        for (const line of ct.stdout.split("\n")) {
+          const srcMatch = line.match(/src=(\d+\.\d+\.\d+\.\d+)/);
+          const dportMatch = line.match(/dport=(\d+)/);
+          if (srcMatch && dportMatch) {
+            records.push({ source_ip: srcMatch[1], dest_port: parseInt(dportMatch[1]), timestamp: now });
+          }
+        }
+        if (records.length > 0) return records;
       }
+    } catch {
     }
-    this.journalWatcher = new JournalWatcher(this.bus);
-    if (this.journalWatcher.start()) {
-      const mod = this.modules.get("user-journal");
-      if (mod) {
-        mod.status = "running";
-        mod.detail = "tailing journalctl --user";
-        this.bus.announceModule("user-journal", "running", mod.detail);
+    try {
+      const ss = (0, import_node_child_process5.spawnSync)("ss", ["-tnp", "-H"], {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 3e3
+      });
+      if (ss.status === 0 && ss.stdout) {
+        for (const line of ss.stdout.split("\n")) {
+          const parts = line.trim().split(/\s+/);
+          if (parts.length < 5) continue;
+          const peerParts = parts[4].split(":");
+          const localParts = parts[3].split(":");
+          if (peerParts.length >= 2 && localParts.length >= 2) {
+            const sourceIp = peerParts.slice(0, -1).join(":");
+            const destPort = parseInt(localParts[localParts.length - 1]);
+            if (sourceIp && !isNaN(destPort) && !this.isLocalIp(sourceIp)) {
+              records.push({ source_ip: sourceIp, dest_port: destPort, timestamp: now });
+            }
+          }
+        }
       }
+    } catch {
     }
+    return records;
   }
-  async stop() {
-    this.logWatcher?.stop();
-    this.journalWatcher?.stop();
-    for (const mod of this.modules.values()) {
-      try {
-        if (mod.instance && mod.status === "running") {
-          await mod.instance.stop();
+  analyzePortScans(connections) {
+    const now = Date.now();
+    for (const conn of connections) {
+      const key = conn.source_ip;
+      let tracker = this.scanTrackers.get(key);
+      if (!tracker) {
+        tracker = { ports: /* @__PURE__ */ new Set(), firstSeen: now, lastSeen: now, count: 0 };
+        this.scanTrackers.set(key, tracker);
+      }
+      tracker.ports.add(conn.dest_port);
+      tracker.lastSeen = now;
+      tracker.count++;
+      if (tracker.ports.size >= this.portScanThreshold && now - tracker.firstSeen <= this.portScanWindowMs) {
+        this.emitEvent(
+          "high",
+          `Port scan detected: ${conn.source_ip} probed ${tracker.ports.size} ports in ${Math.round((now - tracker.firstSeen) / 1e3)}s`,
+          conn.source_ip,
+          { ports_scanned: tracker.ports.size, window_seconds: Math.round((now - tracker.firstSeen) / 1e3) }
+        );
+        this.scanTrackers.delete(key);
+      }
+    }
+  }
+  analyzeSynFlood(connections) {
+    try {
+      const ss = (0, import_node_child_process5.spawnSync)("ss", ["-tn", "state", "syn-recv", "-H"], {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 3e3
+      });
+      if (ss.status !== 0 || !ss.stdout) return;
+      const perSource = /* @__PURE__ */ new Map();
+      for (const line of ss.stdout.split("\n")) {
+        const parts = line.trim().split(/\s+/);
+        if (parts.length < 5) continue;
+        const peer = parts[4].split(":");
+        const ip = peer.slice(0, -1).join(":");
+        if (ip) perSource.set(ip, (perSource.get(ip) || 0) + 1);
+      }
+      for (const [ip, count] of perSource) {
+        if (count >= this.synFloodThreshold) {
+          this.emitEvent(
+            "critical",
+            `SYN flood indicators: ${count} half-open connections from ${ip}`,
+            ip,
+            { half_open_count: count }
+          );
         }
-      } catch (err) {
-        mod.status = "error";
-        mod.detail = `stop failed: ${String(err.message || err)}`;
-        this.bus.announceModule(mod.name, "error", mod.detail);
-        continue;
       }
-      mod.status = "loaded";
-      this.bus.announceModule(mod.name, "stopped");
+    } catch {
     }
   }
-  summary() {
-    return [...this.modules.values()].map((m) => ({
-      name: m.name,
-      status: m.status,
-      events: m.events,
-      detail: m.detail
-    }));
+  emitEvent(severity, message, sourceIp, details) {
+    const event = {
+      timestamp: /* @__PURE__ */ new Date(),
+      module: "network-monitor",
+      category: "network",
+      severity,
+      message,
+      source_ip: sourceIp,
+      details
+    };
+    try {
+      insertEvent(event);
+    } catch {
+    }
+    this.bus.publish(event);
   }
-  registerBuiltins() {
-    const builtins = [
-      { name: "log-watcher", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
-      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
-      { name: "user-journal", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
-    ];
-    for (const m of builtins) this.modules.set(m.name, m);
+  cleanupTrackers() {
+    const now = Date.now();
+    for (const [key, tracker] of this.scanTrackers) {
+      if (now - tracker.lastSeen > this.portScanWindowMs * 2) {
+        this.scanTrackers.delete(key);
+      }
+    }
   }
-  async discoverAndStartInstalled() {
-    if (!(0, import_node_fs16.existsSync)(PATHS.moduleDir)) return;
-    const configs = loadModuleConfigs(PATHS.confD);
-    const entries = (0, import_node_fs16.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const manifestPath = (0, import_node_path10.join)(PATHS.moduleDir, entry.name, "mod.toml");
-      if (!(0, import_node_fs16.existsSync)(manifestPath)) continue;
+  isLocalIp(ip) {
+    return ip === "127.0.0.1" || ip === "::1" || ip === "0.0.0.0" || ip.startsWith("::ffff:127.");
+  }
+};
+
+// src/modules/dns-monitor/index.ts
+var import_node_fs17 = require("fs");
+var import_node_readline5 = require("readline");
+init_state();
+var DNS_LOG_SOURCES = [
+  "/var/log/syslog",
+  // systemd-resolved logs here
+  "/var/log/dnsmasq.log",
+  // dnsmasq
+  "/var/log/named/queries.log",
+  // bind9
+  "/var/log/pihole.log"
+  // Pi-hole
+];
+var DnsMonitor = class {
+  // Shannon entropy threshold for DGA
+  constructor(bus2) {
+    this.bus = bus2;
+  }
+  bus;
+  active = false;
+  timers = /* @__PURE__ */ new Map();
+  positions = /* @__PURE__ */ new Map();
+  // Tracking windows
+  txtQueryCounts = /* @__PURE__ */ new Map();
+  domainBuffer = [];
+  // Config
+  txtRateThreshold = 20;
+  // TXT queries per source per window
+  txtWindowMs = 6e4;
+  dgaBurstThreshold = 15;
+  // unique high-entropy domains per window
+  dgaWindowMs = 6e4;
+  entropyThreshold = 3.5;
+  start() {
+    const sources = DNS_LOG_SOURCES.filter((p) => {
+      if (!(0, import_node_fs17.existsSync)(p)) return false;
       try {
-        const manifest = import_toml4.default.parse((0, import_node_fs16.readFileSync)(manifestPath, "utf-8"));
-        const name = manifest.module?.name || entry.name;
-        const defaults = manifest.module?.config?.defaults || {};
-        const config = {
+        (0, import_node_fs17.accessSync)(p, import_node_fs17.constants.R_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    if (sources.length === 0) return false;
+    this.active = true;
+    for (const src of sources) {
+      this.tailLog(src);
+    }
+    setInterval(() => this.analyzeBuffer(), 1e4);
+    return true;
+  }
+  stop() {
+    for (const t of this.timers.values()) clearInterval(t);
+    this.timers.clear();
+    this.active = false;
+  }
+  isActive() {
+    return this.active;
+  }
+  tailLog(path) {
+    try {
+      this.positions.set(path, (0, import_node_fs17.statSync)(path).size);
+    } catch {
+      this.positions.set(path, 0);
+    }
+    const timer = setInterval(() => this.pollLog(path), 2e3);
+    this.timers.set(path, timer);
+  }
+  pollLog(path) {
+    let stat;
+    try {
+      stat = (0, import_node_fs17.statSync)(path);
+    } catch {
+      return;
+    }
+    const prev = this.positions.get(path) ?? 0;
+    if (stat.size < prev) {
+      this.positions.set(path, 0);
+      return;
+    }
+    if (stat.size === prev) return;
+    const stream = (0, import_node_fs17.createReadStream)(path, { start: prev, encoding: "utf-8" });
+    stream.on("error", () => this.positions.set(path, stat.size));
+    const rl = (0, import_node_readline5.createInterface)({ input: stream });
+    rl.on("line", (line) => this.parseDnsLine(line));
+    rl.on("close", () => this.positions.set(path, stat.size));
+  }
+  parseDnsLine(line) {
+    const resolvedMatch = line.match(/query\[(\w+)\]\s+(\S+)\s+from\s+(\S+)/i);
+    if (resolvedMatch) {
+      this.domainBuffer.push({
+        type: resolvedMatch[1],
+        domain: resolvedMatch[2],
+        source_ip: resolvedMatch[3],
+        timestamp: Date.now()
+      });
+      return;
+    }
+    const dnsmasqMatch = line.match(/query\[(\w+)\]\s+(\S+)\s+from\s+(\S+)/i);
+    if (dnsmasqMatch) {
+      this.domainBuffer.push({
+        type: dnsmasqMatch[1],
+        domain: dnsmasqMatch[2],
+        source_ip: dnsmasqMatch[3],
+        timestamp: Date.now()
+      });
+      return;
+    }
+    const genericMatch = line.match(/(?:query|lookup|resolve)[:\s]+(\S+)/i);
+    if (genericMatch) {
+      const typeMatch = line.match(/type[:\s]+(\w+)/i);
+      this.domainBuffer.push({
+        type: typeMatch?.[1] || "A",
+        domain: genericMatch[1],
+        timestamp: Date.now()
+      });
+    }
+  }
+  analyzeBuffer() {
+    const now = Date.now();
+    const cutoff = now - this.txtWindowMs;
+    this.domainBuffer = this.domainBuffer.filter((q) => q.timestamp > cutoff);
+    this.detectTunneling();
+    this.detectDga();
+  }
+  detectTunneling() {
+    const txtBySource = /* @__PURE__ */ new Map();
+    const longLabelDomains = [];
+    for (const q of this.domainBuffer) {
+      if (q.type === "TXT") {
+        const key = q.source_ip || "unknown";
+        txtBySource.set(key, (txtBySource.get(key) || 0) + 1);
+      }
+      const labels = q.domain.split(".");
+      const maxLabel = Math.max(...labels.map((l) => l.length));
+      if (maxLabel > 50) {
+        longLabelDomains.push(q.domain);
+      }
+    }
+    for (const [source, count] of txtBySource) {
+      if (count >= this.txtRateThreshold) {
+        this.emitEvent(
+          "high",
+          `DNS tunneling indicators: ${count} TXT queries from ${source} in ${this.txtWindowMs / 1e3}s`,
+          source !== "unknown" ? source : void 0,
+          { txt_query_count: count, type: "tunneling" }
+        );
+      }
+    }
+    if (longLabelDomains.length >= 5) {
+      this.emitEvent(
+        "high",
+        `DNS tunneling: ${longLabelDomains.length} queries with abnormally long labels detected`,
+        void 0,
+        { domains: longLabelDomains.slice(0, 5), type: "tunneling-labels" }
+      );
+    }
+  }
+  detectDga() {
+    const highEntropyDomains = [];
+    for (const q of this.domainBuffer) {
+      const domain = q.domain.toLowerCase();
+      const parts = domain.split(".");
+      if (parts.length < 2) continue;
+      const sld = parts[parts.length - 2];
+      if (sld.length >= 8 && this.shannonEntropy(sld) >= this.entropyThreshold) {
+        highEntropyDomains.push(domain);
+      }
+    }
+    const unique = [...new Set(highEntropyDomains)];
+    if (unique.length >= this.dgaBurstThreshold) {
+      this.emitEvent(
+        "critical",
+        `DGA-like domain burst: ${unique.length} unique high-entropy domains detected`,
+        void 0,
+        { sample_domains: unique.slice(0, 10), type: "dga", unique_count: unique.length }
+      );
+    }
+  }
+  shannonEntropy(str) {
+    const freq = /* @__PURE__ */ new Map();
+    for (const ch of str) {
+      freq.set(ch, (freq.get(ch) || 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of freq.values()) {
+      const p = count / str.length;
+      if (p > 0) entropy -= p * Math.log2(p);
+    }
+    return entropy;
+  }
+  emitEvent(severity, message, sourceIp, details) {
+    const event = {
+      timestamp: /* @__PURE__ */ new Date(),
+      module: "dns-monitor",
+      category: "network",
+      severity,
+      message,
+      source_ip: sourceIp,
+      details
+    };
+    try {
+      insertEvent(event);
+    } catch {
+    }
+    this.bus.publish(event);
+  }
+};
+
+// src/daemon/module-host.ts
+init_state();
+var ModuleHost = class {
+  constructor(bus2) {
+    this.bus = bus2;
+    bus2.on("event", (event) => {
+      const mod = this.modules.get(event.module);
+      if (mod) mod.events++;
+      for (const hosted of this.modules.values()) {
+        if (hosted.status !== "running" || !hosted.instance?.onEvent) continue;
+        void hosted.instance.onEvent(event).catch((err) => {
+          hosted.status = "error";
+          hosted.detail = `onEvent failed: ${String(err.message || err)}`;
+          this.bus.announceModule(hosted.name, "error", hosted.detail);
+        });
+      }
+    });
+  }
+  bus;
+  modules = /* @__PURE__ */ new Map();
+  logWatcher = null;
+  journalWatcher = null;
+  networkMonitor = null;
+  dnsMonitor = null;
+  async start() {
+    this.registerBuiltins();
+    await this.discoverAndStartInstalled();
+    this.logWatcher = new LogWatcher(this.bus);
+    const watched = this.logWatcher.start();
+    for (const modName of this.logWatcher.activeModules()) {
+      const mod = this.modules.get(modName);
+      if (mod) {
+        mod.status = "running";
+        mod.detail = `watching ${watched.length} log source(s)`;
+        this.bus.announceModule(modName, "running", mod.detail);
+      }
+    }
+    this.journalWatcher = new JournalWatcher(this.bus);
+    if (this.journalWatcher.start()) {
+      const mod = this.modules.get("user-journal");
+      if (mod) {
+        mod.status = "running";
+        mod.detail = `tailing ${JournalWatcher.scopeArgs().includes("--user") ? "user journal" : "system journal"}`;
+        this.bus.announceModule("user-journal", "running", mod.detail);
+      }
+    }
+    this.networkMonitor = new NetworkMonitor(this.bus);
+    if (this.networkMonitor.start()) {
+      const nmod = this.modules.get("network-monitor");
+      if (nmod) {
+        nmod.status = "running";
+        nmod.detail = "monitoring connections via conntrack/ss";
+        this.bus.announceModule("network-monitor", "running", nmod.detail);
+      }
+    }
+    this.dnsMonitor = new DnsMonitor(this.bus);
+    if (this.dnsMonitor.start()) {
+      const dmod = this.modules.get("dns-monitor");
+      if (dmod) {
+        dmod.status = "running";
+        dmod.detail = "monitoring DNS queries";
+        this.bus.announceModule("dns-monitor", "running", dmod.detail);
+      }
+    }
+  }
+  async stop() {
+    this.logWatcher?.stop();
+    this.journalWatcher?.stop();
+    this.networkMonitor?.stop();
+    this.dnsMonitor?.stop();
+    for (const mod of this.modules.values()) {
+      try {
+        if (mod.instance && mod.status === "running") {
+          await mod.instance.stop();
+        }
+      } catch (err) {
+        mod.status = "error";
+        mod.detail = `stop failed: ${String(err.message || err)}`;
+        this.bus.announceModule(mod.name, "error", mod.detail);
+        continue;
+      }
+      mod.status = "loaded";
+      this.bus.announceModule(mod.name, "stopped");
+    }
+  }
+  summary() {
+    return [...this.modules.values()].map((m) => ({
+      name: m.name,
+      status: m.status,
+      events: m.events,
+      detail: m.detail
+    }));
+  }
+  registerBuiltins() {
+    const builtins = [
+      { name: "log-watcher", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "ssh-guard", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "user-journal", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "network-monitor", version: "0.1.0", source: "builtin", status: "loaded", events: 0 },
+      { name: "dns-monitor", version: "0.1.0", source: "builtin", status: "loaded", events: 0 }
+    ];
+    for (const m of builtins) this.modules.set(m.name, m);
+  }
+  async discoverAndStartInstalled() {
+    if (!(0, import_node_fs18.existsSync)(PATHS.moduleDir)) return;
+    const configs = loadModuleConfigs(PATHS.confD);
+    const entries = (0, import_node_fs18.readdirSync)(PATHS.moduleDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const manifestPath = (0, import_node_path10.join)(PATHS.moduleDir, entry.name, "mod.toml");
+      if (!(0, import_node_fs18.existsSync)(manifestPath)) continue;
+      try {
+        const manifest = import_toml4.default.parse((0, import_node_fs18.readFileSync)(manifestPath, "utf-8"));
+        const name = manifest.module?.name || entry.name;
+        const defaults = manifest.module?.config?.defaults || {};
+        const config = {
           enabled: true,
           ...defaults,
           ...configs.get(name) || {}
@@ -12031,15 +12613,15 @@ var ModuleHost = class {
   installedEntrypoint(modulePath) {
     const packageJson = (0, import_node_path10.join)(modulePath, "package.json");
     const candidates = [];
-    if ((0, import_node_fs16.existsSync)(packageJson)) {
+    if ((0, import_node_fs18.existsSync)(packageJson)) {
       try {
-        const pkg = JSON.parse((0, import_node_fs16.readFileSync)(packageJson, "utf-8"));
+        const pkg = JSON.parse((0, import_node_fs18.readFileSync)(packageJson, "utf-8"));
         if (pkg.main) candidates.push((0, import_node_path10.join)(modulePath, pkg.main));
       } catch {
       }
     }
     candidates.push((0, import_node_path10.join)(modulePath, "dist", "index.js"), (0, import_node_path10.join)(modulePath, "index.js"));
-    return candidates.find((candidate) => (0, import_node_fs16.existsSync)(candidate)) || null;
+    return candidates.find((candidate) => (0, import_node_fs18.existsSync)(candidate)) || null;
   }
   isThreatCrushModule(value) {
     return Boolean(
@@ -12143,6 +12725,98 @@ function smtpChannel(config) {
   };
 }
 
+// src/daemon/alerts/discord.ts
+var SEVERITY_RANK2 = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+var SEVERITY_COLORS2 = {
+  info: 3066993,
+  // green
+  low: 3447003,
+  // blue
+  medium: 15965202,
+  // orange
+  high: 15158332,
+  // red
+  critical: 10181046
+  // purple
+};
+function discordChannel(config) {
+  return async (event) => {
+    if (config.min_severity) {
+      const eventRank = SEVERITY_RANK2[event.severity] ?? 0;
+      const minRank = SEVERITY_RANK2[config.min_severity] ?? 0;
+      if (eventRank < minRank) return;
+    }
+    const embed = {
+      title: `${event.severity === "critical" ? "\u{1F6A8}" : "\u26A0\uFE0F"} [${event.severity.toUpperCase()}] ${event.module}`,
+      description: event.message,
+      color: SEVERITY_COLORS2[event.severity] ?? 16777215,
+      fields: [
+        ...event.source_ip ? [{ name: "Source IP", value: `\`${event.source_ip}\``, inline: true }] : [],
+        { name: "Category", value: event.category, inline: true },
+        { name: "Time", value: event.timestamp.toISOString(), inline: true }
+      ],
+      footer: { text: "ThreatCrush Security Alert" }
+    };
+    await fetch(config.webhook_url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ embeds: [embed] })
+    });
+  };
+}
+
+// src/daemon/alerts/pagerduty.ts
+var SEVERITY_RANK3 = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+var PD_SEVERITY = {
+  info: "info",
+  low: "info",
+  medium: "warning",
+  high: "error",
+  critical: "critical"
+};
+function pagerdutyChannel(config) {
+  return async (event) => {
+    if (config.min_severity) {
+      const eventRank = SEVERITY_RANK3[event.severity] ?? 0;
+      const minRank = SEVERITY_RANK3[config.min_severity] ?? 0;
+      if (eventRank < minRank) return;
+    }
+    const payload = {
+      routing_key: config.routing_key,
+      event_action: "trigger",
+      payload: {
+        summary: `[${event.severity.toUpperCase()}] ${event.module}: ${event.message}`,
+        source: "threatcrush",
+        severity: PD_SEVERITY[event.severity] || "warning",
+        timestamp: event.timestamp.toISOString(),
+        custom_details: {
+          module: event.module,
+          category: event.category,
+          source_ip: event.source_ip,
+          details: event.details
+        }
+      }
+    };
+    await fetch("https://events.pagerduty.com/v2/enqueue", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+  };
+}
+
 // src/daemon/alerts/index.ts
 var AlertDispatcher = class {
   constructor(bus2, config) {
@@ -12156,6 +12830,7 @@ var AlertDispatcher = class {
   bus;
   config;
   channels = [];
+  rateLimits = /* @__PURE__ */ new Map();
   bindChannels() {
     const alerts = this.config.alerts || {};
     for (const [name, raw] of Object.entries(alerts)) {
@@ -12170,11 +12845,31 @@ var AlertDispatcher = class {
       if (name === "email" && typeof cfg.host === "string" && typeof cfg.from === "string") {
         this.channels.push(smtpChannel(cfg));
       }
+      if (name === "discord" && typeof cfg.webhook_url === "string") {
+        this.channels.push(discordChannel(cfg));
+      }
+      if (name === "pagerduty" && typeof cfg.routing_key === "string") {
+        this.channels.push(pagerdutyChannel(cfg));
+      }
     }
   }
+  checkRateLimit(channelIdx, maxPerHour = 60) {
+    const key = String(channelIdx);
+    const now = Date.now();
+    const hour = 36e5;
+    let timestamps = this.rateLimits.get(key) || [];
+    timestamps = timestamps.filter((t) => t > now - hour);
+    if (timestamps.length >= maxPerHour) return false;
+    timestamps.push(now);
+    this.rateLimits.set(key, timestamps);
+    return true;
+  }
   async dispatch(event) {
-    await Promise.all(this.channels.map((ch) => ch(event).catch(() => {
-    })));
+    await Promise.all(this.channels.map((ch, idx) => {
+      if (!this.checkRateLimit(idx)) return Promise.resolve();
+      return ch(event).catch(() => {
+      });
+    }));
   }
 };
 function webhookChannel(url, secret) {
@@ -12309,28 +13004,741 @@ var RunsWorker = class {
       };
     }
   }
-  async finalize(orgId, claimed, result) {
+  async finalize(orgId, claimed, result) {
+    try {
+      await fetch(
+        `${API_URL6}/api/orgs/${orgId}/properties/${claimed.property_id}/runs/${claimed.id}`,
+        {
+          method: "PATCH",
+          headers: authHeaders(),
+          body: JSON.stringify({
+            status: result.error ? "failed" : "succeeded",
+            findings_count: result.findings.length,
+            severity_summary: result.severity_summary,
+            summary: result.summary,
+            findings: result.findings,
+            error: result.error,
+            source: "daemon",
+            worker_id: workerId()
+          })
+        }
+      );
+    } catch {
+    } finally {
+      this.bus.announceModule("runs-worker", "idle");
+    }
+  }
+};
+
+// src/daemon/rules/engine.ts
+var RuleEngine = class {
+  constructor(onDetection) {
+    this.onDetection = onDetection;
+  }
+  onDetection;
+  rules = [];
+  windows = /* @__PURE__ */ new Map();
+  loadRules(rules) {
+    this.rules = rules.filter((r) => r.enabled !== false);
+  }
+  getRules() {
+    return [...this.rules];
+  }
+  evaluate(event) {
+    const now = Date.now();
+    for (const rule of this.rules) {
+      if (rule.source_types.length > 0 && !rule.source_types.includes(event.module) && !rule.source_types.includes(event.category)) {
+        continue;
+      }
+      if (!this.matchesCondition(event, rule.match)) continue;
+      const windowKey = `${rule.id}:${event.source_ip || "global"}`;
+      let window = this.windows.get(windowKey);
+      if (!window) {
+        window = { events: [], lastAlert: 0 };
+        this.windows.set(windowKey, window);
+      }
+      window.events.push({ timestamp: now, event });
+      const cutoff = now - rule.window_seconds * 1e3;
+      window.events = window.events.filter((e) => e.timestamp >= cutoff);
+      if (window.events.length < rule.threshold) continue;
+      if (window.lastAlert > 0 && now - window.lastAlert < rule.cooldown_seconds * 1e3) continue;
+      window.lastAlert = now;
+      window.events = [];
+      this.onDetection({
+        rule_id: rule.id,
+        severity: rule.severity,
+        title: rule.title,
+        description: `${rule.description} (${rule.threshold} events in ${rule.window_seconds}s)`,
+        source_ip: event.source_ip,
+        username: event.details?.user || void 0,
+        raw_metadata: {
+          rule_version: rule.version,
+          tags: rule.tags,
+          category: rule.category,
+          remediation: rule.remediation
+        }
+      });
+    }
+  }
+  matchesCondition(event, match) {
+    const fieldValue = this.getFieldValue(event, match.field);
+    if (fieldValue === void 0) return false;
+    const strValue = String(fieldValue);
+    let result = false;
+    switch (match.operator) {
+      case "contains":
+        result = strValue.toLowerCase().includes(String(match.value).toLowerCase());
+        break;
+      case "regex":
+        try {
+          result = new RegExp(String(match.value), "i").test(strValue);
+        } catch {
+          result = false;
+        }
+        break;
+      case "equals":
+        result = strValue === String(match.value);
+        break;
+      case "starts_with":
+        result = strValue.startsWith(String(match.value));
+        break;
+      case "ends_with":
+        result = strValue.endsWith(String(match.value));
+        break;
+    }
+    if (result && match.and) {
+      result = match.and.every((m) => this.matchesCondition(event, m));
+    }
+    if (!result && match.or) {
+      result = match.or.some((m) => this.matchesCondition(event, m));
+    }
+    return result;
+  }
+  getFieldValue(event, field) {
+    switch (field) {
+      case "message":
+        return event.message;
+      case "severity":
+        return event.severity;
+      case "module":
+        return event.module;
+      case "category":
+        return event.category;
+      case "source_ip":
+        return event.source_ip;
+      default:
+        return event.details?.[field];
+    }
+  }
+  // Periodic cleanup of stale windows
+  cleanup() {
+    const now = Date.now();
+    for (const [key, window] of this.windows.entries()) {
+      if (window.events.length === 0 && now - window.lastAlert > 36e5) {
+        this.windows.delete(key);
+      }
+    }
+  }
+};
+
+// src/daemon/rules/loader.ts
+var import_node_fs19 = require("fs");
+var import_node_path11 = require("path");
+
+// src/daemon/rules/default-rules.ts
+var DEFAULT_RULES = [
+  {
+    id: "ssh-brute-force",
+    title: "SSH Brute Force Detected",
+    description: "Multiple failed SSH login attempts from the same source",
+    version: "1.0.0",
+    category: "auth",
+    severity: "high",
+    source_types: ["ssh-guard", "auth"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "failed ssh login|invalid ssh user"
+    },
+    threshold: 5,
+    window_seconds: 300,
+    cooldown_seconds: 600,
+    tags: ["ssh", "brute-force", "credential-stuffing"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block source IP for 1 hour"
+    },
+    enabled: true
+  },
+  {
+    id: "ssh-success-after-failures",
+    title: "SSH Login After Failed Attempts",
+    description: "Successful SSH login from an IP that had recent failures",
+    version: "1.0.0",
+    category: "auth",
+    severity: "critical",
+    source_types: ["ssh-guard", "auth"],
+    match: {
+      field: "message",
+      operator: "contains",
+      value: "SSH login accepted"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["ssh", "compromise-indicator"],
+    enabled: true
+  },
+  {
+    id: "ssh-root-login",
+    title: "Root SSH Login Attempt",
+    description: "Direct root login via SSH detected",
+    version: "1.0.0",
+    category: "auth",
+    severity: "high",
+    source_types: ["ssh-guard", "auth"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "(failed|accepted).*\\broot\\b"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["ssh", "root-access"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 7200,
+      description: "Block source IP attempting root login"
+    },
+    enabled: true
+  },
+  {
+    id: "ssh-user-enumeration",
+    title: "SSH User Enumeration",
+    description: "Multiple SSH attempts with different usernames from same source",
+    version: "1.0.0",
+    category: "auth",
+    severity: "high",
+    source_types: ["ssh-guard", "auth"],
+    match: {
+      field: "message",
+      operator: "contains",
+      value: "Invalid SSH user"
+    },
+    threshold: 3,
+    window_seconds: 120,
+    cooldown_seconds: 600,
+    tags: ["ssh", "enumeration", "reconnaissance"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block source IP performing user enumeration"
+    },
+    enabled: true
+  },
+  {
+    id: "sudo-abuse",
+    title: "Sudo Authentication Failure",
+    description: "Repeated sudo authentication failures",
+    version: "1.0.0",
+    category: "auth",
+    severity: "high",
+    source_types: ["user-journal", "system"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "sudo.*authentication failure|sudo.*incorrect password|sudo.*FAILED"
+    },
+    threshold: 3,
+    window_seconds: 300,
+    cooldown_seconds: 600,
+    tags: ["sudo", "privilege-escalation"],
+    enabled: true
+  },
+  {
+    id: "web-sqli-attack",
+    title: "SQL Injection Attack Detected",
+    description: "HTTP request with SQL injection patterns",
+    version: "1.0.0",
+    category: "web",
+    severity: "critical",
+    source_types: ["log-watcher", "web"],
+    match: {
+      field: "message",
+      operator: "contains",
+      value: "Attack detected [SQLI]"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["web", "sqli", "injection"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block source IP performing SQL injection"
+    },
+    enabled: true
+  },
+  {
+    id: "web-path-traversal",
+    title: "Path Traversal Attack Detected",
+    description: "HTTP request with path traversal patterns",
+    version: "1.0.0",
+    category: "web",
+    severity: "critical",
+    source_types: ["log-watcher", "web"],
+    match: {
+      field: "message",
+      operator: "contains",
+      value: "Attack detected [PATH_TRAVERSAL]"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["web", "path-traversal", "lfi"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block source IP performing path traversal"
+    },
+    enabled: true
+  },
+  {
+    id: "web-xss-attack",
+    title: "XSS Attack Detected",
+    description: "HTTP request with cross-site scripting patterns",
+    version: "1.0.0",
+    category: "web",
+    severity: "high",
+    source_types: ["log-watcher", "web"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "Attack detected \\[XSS\\]"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["web", "xss", "injection"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block source IP performing XSS attack"
+    },
+    enabled: true
+  },
+  {
+    id: "web-scanner-detection",
+    title: "Web Vulnerability Scanner Detected",
+    description: "High volume of 4xx errors suggesting automated scanning",
+    version: "1.0.0",
+    category: "web",
+    severity: "medium",
+    source_types: ["log-watcher", "web"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "Client error 4\\d{2}:"
+    },
+    threshold: 20,
+    window_seconds: 60,
+    cooldown_seconds: 600,
+    tags: ["web", "scanner", "reconnaissance"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 1800,
+      description: "Block automated scanner"
+    },
+    enabled: true
+  },
+  {
+    id: "port-scan-indicator",
+    title: "Port Scan Indicators",
+    description: "Connection attempts to many ports from a single source",
+    version: "1.0.0",
+    category: "network",
+    severity: "medium",
+    source_types: ["network-monitor", "network"],
+    match: {
+      field: "message",
+      operator: "contains",
+      value: "port scan"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["network", "port-scan", "reconnaissance"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 3600,
+      description: "Block port scanner"
+    },
+    enabled: true
+  },
+  {
+    id: "system-critical-error",
+    title: "Critical System Error",
+    description: "Critical or emergency level system log message",
+    version: "1.0.0",
+    category: "system",
+    severity: "critical",
+    source_types: ["user-journal", "system"],
+    match: {
+      field: "severity",
+      operator: "equals",
+      value: "critical"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["system", "critical"],
+    enabled: true
+  },
+  {
+    id: "exploit-probe-pattern",
+    title: "Exploit Probe Pattern",
+    description: "HTTP requests matching common exploit probe patterns",
+    version: "1.0.0",
+    category: "web",
+    severity: "high",
+    source_types: ["log-watcher", "web"],
+    match: {
+      field: "message",
+      operator: "regex",
+      value: "Attack detected \\[(CMD_INJECTION|RCE|SSRF|XXE)\\]"
+    },
+    threshold: 1,
+    window_seconds: 60,
+    cooldown_seconds: 300,
+    tags: ["web", "exploit", "probe"],
+    remediation: {
+      action: "block",
+      ttl_seconds: 7200,
+      description: "Block source IP performing exploit probes"
+    },
+    enabled: true
+  }
+];
+
+// src/daemon/rules/loader.ts
+var RULES_DIR = "/etc/threatcrush/rules.d";
+function loadAllRules(customDir) {
+  const rules = [...DEFAULT_RULES];
+  const dir = customDir || RULES_DIR;
+  if ((0, import_node_fs19.existsSync)(dir)) {
+    const files = (0, import_node_fs19.readdirSync)(dir).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      try {
+        const raw = (0, import_node_fs19.readFileSync)((0, import_node_path11.join)(dir, file), "utf-8");
+        const parsed = JSON.parse(raw);
+        const customRules = Array.isArray(parsed) ? parsed : [parsed];
+        for (const rule of customRules) {
+          if (!rule.id || !rule.title || !rule.match) {
+            console.warn(`[rules] skipping invalid rule in ${file}: missing required fields`);
+            continue;
+          }
+          const existingIdx = rules.findIndex((r) => r.id === rule.id);
+          if (existingIdx >= 0) {
+            rules[existingIdx] = { ...rules[existingIdx], ...rule };
+          } else {
+            rules.push(rule);
+          }
+        }
+      } catch (err) {
+        console.warn(`[rules] failed to load ${file}: ${err.message}`);
+      }
+    }
+  }
+  return rules;
+}
+
+// src/daemon/firewall/adapters.ts
+var import_node_child_process6 = require("child_process");
+var NftablesAdapter = class {
+  name = "nftables";
+  table = "threatcrush";
+  set = "blocklist";
+  isAvailable() {
+    const result = (0, import_node_child_process6.spawnSync)("nft", ["--version"], { stdio: "pipe" });
+    return result.status === 0;
+  }
+  ensureSetup() {
+    try {
+      (0, import_node_child_process6.execSync)(`nft list table inet ${this.table} 2>/dev/null`, { stdio: "pipe" });
+    } catch {
+      (0, import_node_child_process6.execSync)(`nft add table inet ${this.table}`);
+      (0, import_node_child_process6.execSync)(`nft add set inet ${this.table} ${this.set} '{ type ipv4_addr; flags timeout; }'`);
+      (0, import_node_child_process6.execSync)(`nft add chain inet ${this.table} input '{ type filter hook input priority -1; policy accept; }'`);
+      (0, import_node_child_process6.execSync)(`nft add rule inet ${this.table} input ip saddr @${this.set} drop`);
+    }
+  }
+  async block(ip) {
+    this.ensureSetup();
+    (0, import_node_child_process6.execSync)(`nft add element inet ${this.table} ${this.set} '{ ${ip} }'`);
+  }
+  async unblock(ip) {
+    try {
+      (0, import_node_child_process6.execSync)(`nft delete element inet ${this.table} ${this.set} '{ ${ip} }'`);
+    } catch {
+    }
+  }
+  async isBlocked(ip) {
+    try {
+      const output = (0, import_node_child_process6.execSync)(`nft list set inet ${this.table} ${this.set}`, { encoding: "utf-8" });
+      return output.includes(ip);
+    } catch {
+      return false;
+    }
+  }
+  async listBlocked() {
+    try {
+      const output = (0, import_node_child_process6.execSync)(`nft list set inet ${this.table} ${this.set}`, { encoding: "utf-8" });
+      const match = output.match(/elements\s*=\s*\{([^}]*)\}/);
+      if (!match) return [];
+      return match[1].split(",").map((s) => s.trim().split(/\s/)[0]).filter(Boolean);
+    } catch {
+      return [];
+    }
+  }
+};
+var IptablesAdapter = class {
+  name = "iptables";
+  chain = "THREATCRUSH";
+  isAvailable() {
+    const result = (0, import_node_child_process6.spawnSync)("iptables", ["--version"], { stdio: "pipe" });
+    return result.status === 0;
+  }
+  ensureChain() {
+    try {
+      (0, import_node_child_process6.execSync)(`iptables -n -L ${this.chain} 2>/dev/null`, { stdio: "pipe" });
+    } catch {
+      (0, import_node_child_process6.execSync)(`iptables -N ${this.chain}`);
+      (0, import_node_child_process6.execSync)(`iptables -I INPUT 1 -j ${this.chain}`);
+    }
+  }
+  async block(ip) {
+    this.ensureChain();
+    if (await this.isBlocked(ip)) return;
+    (0, import_node_child_process6.execSync)(`iptables -A ${this.chain} -s ${ip} -j DROP`);
+  }
+  async unblock(ip) {
+    try {
+      (0, import_node_child_process6.execSync)(`iptables -D ${this.chain} -s ${ip} -j DROP`);
+    } catch {
+    }
+  }
+  async isBlocked(ip) {
+    try {
+      const output = (0, import_node_child_process6.execSync)(`iptables -n -L ${this.chain}`, { encoding: "utf-8" });
+      return output.includes(ip);
+    } catch {
+      return false;
+    }
+  }
+  async listBlocked() {
+    try {
+      const output = (0, import_node_child_process6.execSync)(`iptables -n -L ${this.chain}`, { encoding: "utf-8" });
+      const ips = [];
+      for (const line of output.split("\n")) {
+        const match = line.match(/DROP\s+all\s+--\s+(\d+\.\d+\.\d+\.\d+)/);
+        if (match) ips.push(match[1]);
+      }
+      return ips;
+    } catch {
+      return [];
+    }
+  }
+};
+var DryRunAdapter = class {
+  name = "dry-run";
+  blocked = /* @__PURE__ */ new Set();
+  isAvailable() {
+    return true;
+  }
+  async block(ip) {
+    this.blocked.add(ip);
+  }
+  async unblock(ip) {
+    this.blocked.delete(ip);
+  }
+  async isBlocked(ip) {
+    return this.blocked.has(ip);
+  }
+  async listBlocked() {
+    return [...this.blocked];
+  }
+};
+function detectFirewallAdapter() {
+  const nft = new NftablesAdapter();
+  if (nft.isAvailable()) return nft;
+  const ipt = new IptablesAdapter();
+  if (ipt.isAvailable()) return ipt;
+  return new DryRunAdapter();
+}
+
+// src/daemon/firewall/remediation.ts
+var import_node_fs20 = require("fs");
+init_state();
+init_paths();
+var DEFAULT_CONFIG2 = {
+  enabled: true,
+  dry_run: true,
+  default_ttl_seconds: 3600,
+  min_severity: "high",
+  allowlist: ["127.0.0.1", "::1"]
+};
+var SEVERITY_RANK4 = {
+  info: 0,
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+var RemediationManager = class {
+  constructor(adapter, bus2, config) {
+    this.adapter = adapter;
+    this.bus = bus2;
+    this.config = { ...DEFAULT_CONFIG2, ...config };
+    this.loadState();
+    this.startExpiryWorker();
+  }
+  adapter;
+  bus;
+  config;
+  blocklist = [];
+  expiryTimer = null;
+  async handleDetection(event) {
+    if (!this.config.enabled) return;
+    const eventRank = SEVERITY_RANK4[event.severity] ?? 0;
+    const minRank = SEVERITY_RANK4[this.config.min_severity] ?? 3;
+    if (eventRank < minRank) return;
+    const ip = event.source_ip;
+    if (!ip) return;
+    if (this.isAllowlisted(ip)) return;
+    if (this.blocklist.some((b) => b.ip === ip)) return;
+    const ruleRemediation = event.details?.remediation;
+    const ttl = ruleRemediation?.ttl_seconds || this.config.default_ttl_seconds;
+    const ruleId = event.details?.rule_id;
+    await this.blockIp(ip, event.message, ruleId, ttl);
+  }
+  async blockIp(ip, reason, ruleId, ttlSeconds) {
+    if (this.isAllowlisted(ip)) return false;
+    const entry = {
+      ip,
+      reason,
+      rule_id: ruleId,
+      blocked_at: Date.now(),
+      expires_at: ttlSeconds ? Date.now() + ttlSeconds * 1e3 : void 0,
+      dry_run: this.config.dry_run
+    };
+    if (!this.config.dry_run) {
+      try {
+        await this.adapter.block(ip);
+      } catch (err) {
+        this.logLine(`[firewall] EACCES or error blocking ${ip}: ${err.message}`);
+        this.bus.publish({
+          timestamp: /* @__PURE__ */ new Date(),
+          module: "firewall-rules",
+          category: "system",
+          severity: "medium",
+          message: `Failed to block ${ip}: ${err.message}. Ensure daemon has CAP_NET_ADMIN.`
+        });
+        return false;
+      }
+    }
+    this.blocklist.push(entry);
+    this.saveState();
+    const mode = this.config.dry_run ? "[DRY-RUN] " : "";
+    const expiryMsg = ttlSeconds ? ` (expires in ${ttlSeconds}s)` : " (permanent)";
+    this.logLine(`[firewall] ${mode}Blocked ${ip}: ${reason}${expiryMsg}`);
+    this.bus.publish({
+      timestamp: /* @__PURE__ */ new Date(),
+      module: "firewall-rules",
+      category: "system",
+      severity: "info",
+      message: `${mode}Blocked ${ip}: ${reason}${expiryMsg}`,
+      source_ip: ip,
+      details: { action: "block", rule_id: ruleId, dry_run: this.config.dry_run, ttl_seconds: ttlSeconds }
+    });
+    return true;
+  }
+  async unblockIp(ip) {
+    const idx = this.blocklist.findIndex((b) => b.ip === ip);
+    if (idx < 0) return false;
+    const entry = this.blocklist[idx];
+    if (!entry.dry_run) {
+      try {
+        await this.adapter.unblock(ip);
+      } catch (err) {
+        this.logLine(`[firewall] Error unblocking ${ip}: ${err.message}`);
+        return false;
+      }
+    }
+    this.blocklist.splice(idx, 1);
+    this.saveState();
+    this.logLine(`[firewall] Unblocked ${ip}`);
+    this.bus.publish({
+      timestamp: /* @__PURE__ */ new Date(),
+      module: "firewall-rules",
+      category: "system",
+      severity: "info",
+      message: `Unblocked ${ip}`,
+      source_ip: ip,
+      details: { action: "unblock" }
+    });
+    return true;
+  }
+  isAllowlisted(ip) {
+    return this.config.allowlist.includes(ip);
+  }
+  addToAllowlist(ip) {
+    if (!this.config.allowlist.includes(ip)) {
+      this.config.allowlist.push(ip);
+    }
+  }
+  removeFromAllowlist(ip) {
+    this.config.allowlist = this.config.allowlist.filter((a) => a !== ip);
+  }
+  getBlocklist() {
+    return [...this.blocklist];
+  }
+  getAllowlist() {
+    return [...this.config.allowlist];
+  }
+  stop() {
+    if (this.expiryTimer) clearInterval(this.expiryTimer);
+    this.expiryTimer = null;
+  }
+  startExpiryWorker() {
+    this.expiryTimer = setInterval(() => void this.processExpiries(), 3e4);
+  }
+  async processExpiries() {
+    const now = Date.now();
+    const expired = this.blocklist.filter((b) => b.expires_at && b.expires_at <= now);
+    for (const entry of expired) {
+      await this.unblockIp(entry.ip);
+    }
+  }
+  loadState() {
+    try {
+      const saved = getModuleState("firewall-rules", "blocklist");
+      if (Array.isArray(saved)) this.blocklist = saved;
+    } catch {
+    }
+  }
+  saveState() {
     try {
-      await fetch(
-        `${API_URL6}/api/orgs/${orgId}/properties/${claimed.property_id}/runs/${claimed.id}`,
-        {
-          method: "PATCH",
-          headers: authHeaders(),
-          body: JSON.stringify({
-            status: result.error ? "failed" : "succeeded",
-            findings_count: result.findings.length,
-            severity_summary: result.severity_summary,
-            summary: result.summary,
-            findings: result.findings,
-            error: result.error,
-            source: "daemon",
-            worker_id: workerId()
-          })
-        }
-      );
+      setModuleState("firewall-rules", "blocklist", this.blocklist);
+    } catch {
+    }
+  }
+  logLine(line) {
+    try {
+      (0, import_node_fs20.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`);
     } catch {
-    } finally {
-      this.bus.announceModule("runs-worker", "idle");
     }
   }
 };
@@ -12387,7 +13795,7 @@ async function flushTelemetry(timeoutMs = 2e3) {
 // src/daemon/index.ts
 function readVersion() {
   try {
-    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path11.join)(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path12.join)(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -12395,7 +13803,7 @@ function readVersion() {
 }
 function logLine(line) {
   try {
-    (0, import_node_fs17.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+    (0, import_node_fs21.appendFileSync)(PATHS.logFile, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
   } catch {
   }
@@ -12423,12 +13831,42 @@ async function runDaemon() {
   } catch (err) {
     logLine(`[daemon] state db unavailable: ${err.message}`);
   }
-  const config = loadConfig((0, import_node_fs17.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
+  const config = loadConfig((0, import_node_fs21.existsSync)(PATHS.configFile) ? PATHS.configFile : void 0);
   bus.on("event", (event) => {
     logLine(`[event] ${event.severity} ${event.module} ${event.message}`);
   });
   const moduleHost = new ModuleHost(bus);
   await moduleHost.start();
+  const ruleEngine = new RuleEngine((detection) => {
+    const event = {
+      timestamp: /* @__PURE__ */ new Date(),
+      module: "rule-engine",
+      category: detection.raw_metadata?.category || "system",
+      severity: detection.severity,
+      message: `[DETECTION] ${detection.title}`,
+      source_ip: detection.source_ip,
+      details: {
+        rule_id: detection.rule_id,
+        username: detection.username,
+        ...detection.raw_metadata
+      }
+    };
+    bus.publish(event);
+  });
+  ruleEngine.loadRules(loadAllRules());
+  bus.on("event", (event) => {
+    if (event.module !== "rule-engine") ruleEngine.evaluate(event);
+  });
+  logLine(`[daemon] rule engine loaded ${ruleEngine.getRules().length} rules`);
+  setInterval(() => ruleEngine.cleanup(), 3e5);
+  const firewallAdapter = detectFirewallAdapter();
+  const remediation = new RemediationManager(firewallAdapter, bus, config.remediation);
+  bus.on("event", (event) => {
+    if (event.module !== "firewall-rules") {
+      void remediation.handleDetection(event);
+    }
+  });
+  logLine(`[daemon] firewall remediation active (backend=${firewallAdapter.name}, dry_run=${config.remediation?.dry_run ?? true})`);
   new AlertDispatcher(bus, config);
   const runsWorker = new RunsWorker(bus);
   try {
@@ -12441,6 +13879,10 @@ async function runDaemon() {
   logLine(`[daemon] ipc listening on ${PATHS.socket}`);
   const shutdown = async (signal) => {
     logLine(`[daemon] received ${signal}, shutting down`);
+    try {
+      remediation.stop();
+    } catch {
+    }
     try {
       runsWorker.stop();
     } catch {
@@ -12481,7 +13923,7 @@ async function runDaemon() {
 init_paths();
 init_pidfile();
 init_ipc_client();
-var DAEMON_ENTRY = (0, import_node_path12.join)(__dirname, "daemon.js");
+var DAEMON_ENTRY = (0, import_node_path13.join)(__dirname, "daemon.js");
 async function daemonForeground() {
   await runDaemon();
 }
@@ -12492,14 +13934,29 @@ async function daemonStart() {
     return;
   }
   ensureRuntimeDirs();
-  if (!(0, import_node_fs18.existsSync)(DAEMON_ENTRY)) {
+  if (!(0, import_node_fs22.existsSync)(DAEMON_ENTRY)) {
     console.log(source_default.red(`  Daemon entry not found at ${DAEMON_ENTRY}.`));
     console.log(source_default.dim("  Reinstall with `threatcrush update` or `pnpm run build` in the cli package."));
     return;
   }
-  const out = (0, import_node_fs19.openSync)(PATHS.logFile, "a");
-  const err = (0, import_node_fs19.openSync)(PATHS.logFile, "a");
-  const child = (0, import_node_child_process5.spawn)(process.execPath, [DAEMON_ENTRY], {
+  let out;
+  let err;
+  try {
+    out = (0, import_node_fs23.openSync)(PATHS.logFile, "a");
+    err = (0, import_node_fs23.openSync)(PATHS.logFile, "a");
+  } catch (e) {
+    const code = e.code;
+    console.log(source_default.red(`  \u2717 Cannot write daemon log at ${PATHS.logFile} (${code ?? "error"}).`));
+    if (code === "EACCES") {
+      console.log(
+        source_default.dim(
+          PATHS.mode === "system" ? "  Run as root (sudo) to use system paths, or run without sudo to use ~/.threatcrush." : `  Fix permissions on ${PATHS.logDir} (it should be owned by your user).`
+        )
+      );
+    }
+    return;
+  }
+  const child = (0, import_node_child_process7.spawn)(process.execPath, [DAEMON_ENTRY], {
     detached: true,
     stdio: ["ignore", out, err],
     env: { ...process.env, THREATCRUSH_DAEMON: "1" }
@@ -12564,27 +14021,27 @@ async function daemonStop() {
 }
 
 // src/commands/service.ts
-var import_node_child_process6 = require("child_process");
-var import_node_fs20 = require("fs");
-var import_node_path13 = require("path");
+var import_node_child_process8 = require("child_process");
+var import_node_fs24 = require("fs");
+var import_node_path14 = require("path");
 var UNIT_PATH = "/etc/systemd/system/threatcrushd.service";
 function resolveTemplate() {
-  const templatePath = (0, import_node_path13.join)(__dirname, "systemd", "threatcrushd.service");
-  if (!(0, import_node_fs20.existsSync)(templatePath)) {
+  const templatePath = (0, import_node_path14.join)(__dirname, "systemd", "threatcrushd.service");
+  if (!(0, import_node_fs24.existsSync)(templatePath)) {
     throw new Error(`systemd unit template not found at ${templatePath}`);
   }
-  return (0, import_node_fs20.readFileSync)(templatePath, "utf-8");
+  return (0, import_node_fs24.readFileSync)(templatePath, "utf-8");
 }
 function resolveBinPath() {
   const arg = process.argv[1];
-  if (arg && (0, import_node_fs20.existsSync)(arg)) return arg;
+  if (arg && (0, import_node_fs24.existsSync)(arg)) return arg;
   try {
-    return (0, import_node_child_process6.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
+    return (0, import_node_child_process8.execSync)("command -v threatcrush", { encoding: "utf-8" }).trim();
   } catch {
     return "threatcrush";
   }
 }
-function isRoot() {
+function isRoot2() {
   return typeof process.getuid === "function" && process.getuid() === 0;
 }
 async function installServiceCommand() {
@@ -12593,16 +14050,17 @@ async function installServiceCommand() {
     console.log(source_default.yellow("  systemd install is only supported on Linux."));
     return;
   }
-  if (!isRoot()) {
+  if (!isRoot2()) {
     console.log(source_default.red("  Must run as root (try `sudo threatcrush install-service`)."));
     return;
   }
   const unit = resolveTemplate().replace("{{BIN_PATH}}", resolveBinPath());
-  (0, import_node_fs20.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
+  (0, import_node_fs24.writeFileSync)(UNIT_PATH, unit, { mode: 420 });
   console.log(source_default.green(`  \u2713 Installed unit file: ${UNIT_PATH}`));
+  ensureSystemDirs();
   try {
-    (0, import_node_child_process6.execSync)("systemctl daemon-reload", { stdio: "inherit" });
-    (0, import_node_child_process6.execSync)("systemctl enable threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process8.execSync)("systemctl daemon-reload", { stdio: "inherit" });
+    (0, import_node_child_process8.execSync)("systemctl enable threatcrushd.service", { stdio: "inherit" });
     console.log(source_default.green("  \u2713 Service enabled on boot."));
     console.log(source_default.dim("  Start now with: systemctl start threatcrushd"));
     console.log(source_default.dim("  View logs with: journalctl -u threatcrushd -f"));
@@ -12610,33 +14068,62 @@ async function installServiceCommand() {
     console.log(source_default.yellow(`  ! systemctl error: ${err.message}`));
   }
 }
+function ensureSystemDirs() {
+  const dirs = [
+    { path: "/etc/threatcrush" },
+    { path: "/etc/threatcrush/modules", sticky: true },
+    { path: "/etc/threatcrush/threatcrushd.conf.d" },
+    { path: "/var/log/threatcrush" },
+    { path: "/var/lib/threatcrush" },
+    { path: "/var/run/threatcrush" }
+  ];
+  let admGid = null;
+  try {
+    admGid = (0, import_node_fs24.statSync)("/var/log/auth.log").gid;
+  } catch {
+  }
+  for (const { path, sticky } of dirs) {
+    try {
+      (0, import_node_fs24.mkdirSync)(path, { recursive: true });
+    } catch {
+    }
+    if (admGid !== null) {
+      try {
+        (0, import_node_fs24.chmodSync)(path, sticky ? 1533 : 509);
+        (0, import_node_child_process8.execSync)(`chgrp adm ${path}`, { stdio: "ignore" });
+      } catch {
+      }
+    }
+  }
+  console.log(source_default.green("  \u2713 Runtime dirs prepared (group `adm` may install modules / edit config without sudo)."));
+}
 async function uninstallServiceCommand() {
   banner();
   if (process.platform !== "linux") {
     console.log(source_default.yellow("  systemd uninstall is only supported on Linux."));
     return;
   }
-  if (!isRoot()) {
+  if (!isRoot2()) {
     console.log(source_default.red("  Must run as root (try `sudo threatcrush uninstall-service`)."));
     return;
   }
   try {
-    (0, import_node_child_process6.execSync)("systemctl stop threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process8.execSync)("systemctl stop threatcrushd.service", { stdio: "inherit" });
   } catch {
   }
   try {
-    (0, import_node_child_process6.execSync)("systemctl disable threatcrushd.service", { stdio: "inherit" });
+    (0, import_node_child_process8.execSync)("systemctl disable threatcrushd.service", { stdio: "inherit" });
   } catch {
   }
   try {
-    if ((0, import_node_fs20.existsSync)(UNIT_PATH)) {
-      (0, import_node_child_process6.execSync)(`rm -f ${UNIT_PATH}`);
+    if ((0, import_node_fs24.existsSync)(UNIT_PATH)) {
+      (0, import_node_child_process8.execSync)(`rm -f ${UNIT_PATH}`);
       console.log(source_default.green(`  \u2713 Removed unit file: ${UNIT_PATH}`));
     }
   } catch {
   }
   try {
-    (0, import_node_child_process6.execSync)("systemctl daemon-reload", { stdio: "inherit" });
+    (0, import_node_child_process8.execSync)("systemctl daemon-reload", { stdio: "inherit" });
   } catch {
   }
   console.log(source_default.green("  \u2713 threatcrushd service removed."));
@@ -12728,13 +14215,13 @@ function welcomeCommand() {
 }
 
 // src/commands/properties.ts
-var import_node_fs21 = require("fs");
-var import_node_path14 = require("path");
-var import_node_readline5 = __toESM(require("readline"));
+var import_node_fs25 = require("fs");
+var import_node_path15 = require("path");
+var import_node_readline6 = __toESM(require("readline"));
 var API_URL7 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var KINDS = ["url", "api", "domain", "ip", "repo"];
 function prompt2(question) {
-  const rl = import_node_readline5.default.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = import_node_readline6.default.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => rl.question(question, (answer) => {
     rl.close();
     resolve3(answer.trim());
@@ -13058,8 +14545,8 @@ async function propertiesRunsCommand(opts) {
   }
 }
 function parseImportFile(path) {
-  const ext = (0, import_node_path14.extname)(path).toLowerCase();
-  const raw = (0, import_node_fs21.readFileSync)(path, "utf-8");
+  const ext = (0, import_node_path15.extname)(path).toLowerCase();
+  const raw = (0, import_node_fs25.readFileSync)(path, "utf-8");
   if (ext === ".json") {
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) throw new Error("JSON must be an array of objects");
@@ -13173,11 +14660,556 @@ async function propertiesImportCommand(filePath, opts) {
 `);
 }
 
+// src/commands/rules.ts
+async function rulesListCommand() {
+  banner();
+  const rules = loadAllRules();
+  console.log(source_default.green.bold("  Detection Rules"));
+  console.log(source_default.gray("  " + "\u2500".repeat(70)));
+  console.log(
+    source_default.gray("  ") + source_default.white.bold("ID".padEnd(28)) + source_default.white.bold("Severity".padEnd(12)) + source_default.white.bold("Category".padEnd(12)) + source_default.white.bold("Threshold".padEnd(12)) + source_default.white.bold("Title")
+  );
+  console.log(source_default.gray("  " + "\u2500".repeat(70)));
+  for (const rule of rules) {
+    const sevColor = rule.severity === "critical" ? source_default.red : rule.severity === "high" ? source_default.red : rule.severity === "medium" ? source_default.yellow : source_default.green;
+    console.log(
+      source_default.gray("  ") + source_default.white(rule.id.padEnd(28)) + sevColor(rule.severity.padEnd(12)) + source_default.gray(rule.category.padEnd(12)) + source_default.white(String(rule.threshold).padEnd(12)) + source_default.gray(rule.title)
+    );
+  }
+  console.log();
+  console.log(source_default.gray(`  ${rules.length} rule(s) loaded`));
+  console.log(source_default.gray(`  Custom rules: /etc/threatcrush/rules.d/*.json`));
+  console.log();
+}
+async function rulesShowCommand(ruleId) {
+  banner();
+  const rules = loadAllRules();
+  const rule = rules.find((r) => r.id === ruleId);
+  if (!rule) {
+    console.log(source_default.red(`  Rule not found: ${ruleId}`));
+    console.log(source_default.gray("  Run `threatcrush rules list` to see available rules.\n"));
+    return;
+  }
+  console.log(source_default.green.bold(`  Rule: ${rule.id}`));
+  console.log(source_default.gray("  " + "\u2500".repeat(60)));
+  console.log(`  Title:        ${source_default.white(rule.title)}`);
+  console.log(`  Description:  ${source_default.gray(rule.description)}`);
+  console.log(`  Version:      ${source_default.gray(rule.version)}`);
+  console.log(`  Category:     ${source_default.gray(rule.category)}`);
+  console.log(`  Severity:     ${source_default.yellow(rule.severity)}`);
+  console.log(`  Source types: ${source_default.gray(rule.source_types.join(", "))}`);
+  console.log(`  Threshold:    ${source_default.white(String(rule.threshold))} events in ${source_default.white(String(rule.window_seconds))}s`);
+  console.log(`  Cooldown:     ${source_default.gray(String(rule.cooldown_seconds))}s`);
+  console.log(`  Tags:         ${source_default.gray(rule.tags.join(", "))}`);
+  console.log(`  Enabled:      ${rule.enabled ? source_default.green("yes") : source_default.red("no")}`);
+  if (rule.remediation) {
+    console.log(`  Remediation:  ${source_default.gray(rule.remediation.description || rule.remediation.action || "none")}`);
+    if (rule.remediation.ttl_seconds) {
+      console.log(`  Block TTL:    ${source_default.gray(String(rule.remediation.ttl_seconds))}s`);
+    }
+  }
+  console.log();
+  console.log(source_default.gray("  Match condition:"));
+  console.log(source_default.gray(`    ${rule.match.field} ${rule.match.operator} "${rule.match.value}"`));
+  console.log();
+}
+async function rulesCommand(opts) {
+  const action = opts.action || "list";
+  switch (action) {
+    case "list":
+    case "ls":
+      await rulesListCommand();
+      break;
+    case "show":
+    case "info":
+      if (!opts.id) {
+        console.log(source_default.red("  Rule ID required. Usage: threatcrush rules show <rule-id>\n"));
+        return;
+      }
+      await rulesShowCommand(opts.id);
+      break;
+    default:
+      console.log(source_default.yellow(`  Unknown action: ${action}`));
+      console.log(source_default.gray("  Available: list, show\n"));
+      break;
+  }
+}
+
+// src/commands/harden.ts
+var import_node_fs26 = require("fs");
+var import_node_child_process9 = require("child_process");
+function tryExec(cmd) {
+  try {
+    return (0, import_node_child_process9.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+  } catch {
+    return null;
+  }
+}
+function tryRead(path) {
+  try {
+    return (0, import_node_fs26.readFileSync)(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function checkSshPasswordAuth() {
+  const config = tryRead("/etc/ssh/sshd_config");
+  if (!config) {
+    return {
+      key: "ssh-password-auth",
+      status: "warn",
+      severity: "medium",
+      title: "SSH Password Auth",
+      explanation: "Could not read /etc/ssh/sshd_config to check password authentication setting.",
+      recommendation: "Ensure PasswordAuthentication is set to no in sshd_config."
+    };
+  }
+  const match = config.match(/^\s*PasswordAuthentication\s+(yes|no)/mi);
+  if (!match || match[1] === "yes") {
+    return {
+      key: "ssh-password-auth",
+      status: "fail",
+      severity: "high",
+      title: "SSH Password Authentication Enabled",
+      explanation: "Password authentication is enabled for SSH, making it vulnerable to brute-force attacks.",
+      recommendation: 'Set "PasswordAuthentication no" in /etc/ssh/sshd_config and restart sshd. Use key-based auth instead.'
+    };
+  }
+  return {
+    key: "ssh-password-auth",
+    status: "pass",
+    severity: "high",
+    title: "SSH Password Authentication Disabled",
+    explanation: "Password authentication is disabled for SSH. Key-based auth is enforced."
+  };
+}
+function checkSshRootLogin() {
+  const config = tryRead("/etc/ssh/sshd_config");
+  if (!config) {
+    return {
+      key: "ssh-root-login",
+      status: "warn",
+      severity: "high",
+      title: "SSH Root Login",
+      explanation: "Could not read sshd_config.",
+      recommendation: 'Set "PermitRootLogin no" in /etc/ssh/sshd_config.'
+    };
+  }
+  const match = config.match(/^\s*PermitRootLogin\s+(\S+)/mi);
+  if (!match || match[1] === "yes") {
+    return {
+      key: "ssh-root-login",
+      status: "fail",
+      severity: "high",
+      title: "Root SSH Login Enabled",
+      explanation: "Direct root login via SSH is permitted. Attackers frequently target root.",
+      recommendation: 'Set "PermitRootLogin no" or "PermitRootLogin prohibit-password" in /etc/ssh/sshd_config.'
+    };
+  }
+  return {
+    key: "ssh-root-login",
+    status: "pass",
+    severity: "high",
+    title: "Root SSH Login Restricted",
+    explanation: `PermitRootLogin is set to "${match[1]}".`
+  };
+}
+function checkSshWeakConfig() {
+  const config = tryRead("/etc/ssh/sshd_config");
+  if (!config) {
+    return {
+      key: "ssh-weak-config",
+      status: "warn",
+      severity: "medium",
+      title: "SSH Configuration",
+      explanation: "Could not read sshd_config."
+    };
+  }
+  const issues = [];
+  if (!/^\s*Protocol\s+2/mi.test(config) && !/^\s*#\s*Protocol/mi.test(config)) {
+    if (/^\s*Protocol\s+1/mi.test(config)) issues.push("Protocol 1 is enabled");
+  }
+  if (/^\s*X11Forwarding\s+yes/mi.test(config)) issues.push("X11 forwarding is enabled");
+  const maxAuth = config.match(/^\s*MaxAuthTries\s+(\d+)/mi);
+  if (maxAuth && parseInt(maxAuth[1]) > 6) issues.push(`MaxAuthTries is high (${maxAuth[1]})`);
+  if (issues.length > 0) {
+    return {
+      key: "ssh-weak-config",
+      status: "warn",
+      severity: "medium",
+      title: "SSH Configuration Weaknesses",
+      explanation: `Found: ${issues.join("; ")}.`,
+      recommendation: "Review and harden sshd_config. Disable unused features."
+    };
+  }
+  return {
+    key: "ssh-weak-config",
+    status: "pass",
+    severity: "medium",
+    title: "SSH Configuration",
+    explanation: "No obvious SSH config weaknesses found."
+  };
+}
+function checkAutoUpdates() {
+  const unattended = (0, import_node_fs26.existsSync)("/etc/apt/apt.conf.d/20auto-upgrades") || (0, import_node_fs26.existsSync)("/etc/apt/apt.conf.d/50unattended-upgrades");
+  const dnfAuto = (0, import_node_fs26.existsSync)("/etc/dnf/automatic.conf");
+  if (unattended || dnfAuto) {
+    return {
+      key: "auto-updates",
+      status: "pass",
+      severity: "high",
+      title: "Automatic Security Updates",
+      explanation: "Automatic security updates appear to be configured."
+    };
+  }
+  return {
+    key: "auto-updates",
+    status: "fail",
+    severity: "high",
+    title: "No Automatic Security Updates",
+    explanation: "No automatic security update mechanism detected.",
+    recommendation: "Install and enable unattended-upgrades (Debian/Ubuntu) or dnf-automatic (RHEL/Fedora)."
+  };
+}
+function checkFirewallActive() {
+  const ufw = tryExec("ufw status");
+  if (ufw && ufw.includes("active")) {
+    return {
+      key: "firewall-active",
+      status: "pass",
+      severity: "high",
+      title: "Firewall Active (UFW)",
+      explanation: "UFW firewall is active."
+    };
+  }
+  const nft = tryExec("nft list tables");
+  if (nft && nft.trim().length > 0) {
+    return {
+      key: "firewall-active",
+      status: "pass",
+      severity: "high",
+      title: "Firewall Active (nftables)",
+      explanation: "nftables has active tables."
+    };
+  }
+  const ipt = tryExec("iptables -L -n");
+  if (ipt) {
+    const rules = ipt.split("\n").filter((l) => l.trim() && !l.startsWith("Chain") && !l.startsWith("target"));
+    if (rules.length > 0) {
+      return {
+        key: "firewall-active",
+        status: "pass",
+        severity: "high",
+        title: "Firewall Active (iptables)",
+        explanation: `iptables has ${rules.length} rules.`
+      };
+    }
+  }
+  return {
+    key: "firewall-active",
+    status: "fail",
+    severity: "high",
+    title: "No Firewall Detected",
+    explanation: "No active firewall (UFW, nftables, or iptables) detected.",
+    recommendation: "Enable a firewall: `ufw enable` or configure nftables/iptables."
+  };
+}
+function checkExposedPorts() {
+  const ss = tryExec("ss -tlnp");
+  if (!ss) {
+    return {
+      key: "exposed-ports",
+      status: "warn",
+      severity: "medium",
+      title: "Exposed Ports",
+      explanation: "Could not check listening ports."
+    };
+  }
+  const riskyPorts = ["3306", "5432", "6379", "27017", "9200", "11211", "2375"];
+  const exposed = [];
+  for (const line of ss.split("\n")) {
+    if (!line.includes("LISTEN")) continue;
+    if (line.includes("0.0.0.0:") || line.includes(":::")) {
+      for (const port of riskyPorts) {
+        if (line.includes(`:${port} `) || line.includes(`:${port}	`)) {
+          exposed.push(port);
+        }
+      }
+    }
+  }
+  if (exposed.length > 0) {
+    const portNames = {
+      "3306": "MySQL",
+      "5432": "PostgreSQL",
+      "6379": "Redis",
+      "27017": "MongoDB",
+      "9200": "Elasticsearch",
+      "11211": "Memcached",
+      "2375": "Docker"
+    };
+    const desc = exposed.map((p) => `${portNames[p] || p} (:${p})`).join(", ");
+    return {
+      key: "exposed-ports",
+      status: "fail",
+      severity: "high",
+      title: "Risky Ports Exposed",
+      explanation: `Services exposed on all interfaces: ${desc}.`,
+      recommendation: "Bind database/cache services to 127.0.0.1 only, or restrict with firewall rules."
+    };
+  }
+  return {
+    key: "exposed-ports",
+    status: "pass",
+    severity: "high",
+    title: "No Risky Ports Exposed",
+    explanation: "No common database/cache ports are listening on all interfaces."
+  };
+}
+function checkFail2ban() {
+  const checkKey = "fail2ban-present";
+  const sev = "medium";
+  const f2bStatus = tryExec("fail2ban-client status");
+  if (f2bStatus && f2bStatus.includes("Number of jail")) {
+    return {
+      key: checkKey,
+      status: "pass",
+      severity: sev,
+      title: "fail2ban Active",
+      explanation: "fail2ban is installed and running."
+    };
+  }
+  if ((0, import_node_fs26.existsSync)("/etc/fail2ban/fail2ban.conf")) {
+    return {
+      key: checkKey,
+      status: "warn",
+      severity: sev,
+      title: "fail2ban Installed but Not Running",
+      explanation: "fail2ban is installed but does not appear to be running.",
+      recommendation: "Start and enable fail2ban: `systemctl enable --now fail2ban`."
+    };
+  }
+  return {
+    key: checkKey,
+    status: "warn",
+    severity: sev,
+    title: "fail2ban Not Installed",
+    explanation: "fail2ban is not installed. ThreatCrush provides similar protection, but fail2ban adds defense in depth.",
+    recommendation: "Consider installing fail2ban: `apt install fail2ban` or `dnf install fail2ban`."
+  };
+}
+function checkWorldWritableDirs() {
+  const sensitive = ["/etc", "/usr", "/var/log", "/boot"];
+  const worldWritable = [];
+  for (const dir of sensitive) {
+    const result = tryExec(`find ${dir} -maxdepth 2 -type d -perm -0002 -not -path '*/tmp*' 2>/dev/null | head -5`);
+    if (result && result.trim()) {
+      worldWritable.push(...result.trim().split("\n"));
+    }
+  }
+  if (worldWritable.length > 0) {
+    return {
+      key: "world-writable-dirs",
+      status: "fail",
+      severity: "medium",
+      title: "World-Writable Directories Found",
+      explanation: `Found ${worldWritable.length} world-writable directories in sensitive locations: ${worldWritable.slice(0, 3).join(", ")}${worldWritable.length > 3 ? "..." : ""}`,
+      recommendation: "Remove world-writable permission: `chmod o-w <dir>`."
+    };
+  }
+  return {
+    key: "world-writable-dirs",
+    status: "pass",
+    severity: "medium",
+    title: "No World-Writable Directories",
+    explanation: "No world-writable directories found in sensitive locations."
+  };
+}
+function checkRiskyServices() {
+  const risky = ["telnet", "rsh", "rlogin", "rexec", "tftp"];
+  const found = [];
+  for (const svc of risky) {
+    const result = tryExec(`systemctl is-active ${svc}.socket ${svc}.service 2>/dev/null`);
+    if (result && result.trim() === "active") {
+      found.push(svc);
+    }
+  }
+  if (found.length > 0) {
+    return {
+      key: "risky-services",
+      status: "fail",
+      severity: "critical",
+      title: "Risky Services Running",
+      explanation: `Insecure services are active: ${found.join(", ")}.`,
+      recommendation: `Disable and remove insecure services: \`systemctl disable --now ${found.join(" ")}\`.`
+    };
+  }
+  return {
+    key: "risky-services",
+    status: "pass",
+    severity: "critical",
+    title: "No Risky Services",
+    explanation: "No known insecure services (telnet, rsh, etc.) are running."
+  };
+}
+function runAllChecks() {
+  return [
+    checkSshPasswordAuth(),
+    checkSshRootLogin(),
+    checkSshWeakConfig(),
+    checkAutoUpdates(),
+    checkFirewallActive(),
+    checkExposedPorts(),
+    checkFail2ban(),
+    checkWorldWritableDirs(),
+    checkRiskyServices()
+  ];
+}
+function computeScore(results) {
+  if (results.length === 0) return 100;
+  const weights = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
+  let maxScore = 0;
+  let deductions = 0;
+  for (const r of results) {
+    const w = weights[r.severity] || 1;
+    maxScore += w;
+    if (r.status === "fail") deductions += w;
+    else if (r.status === "warn") deductions += w * 0.5;
+  }
+  if (maxScore === 0) return 100;
+  return Math.max(0, Math.round((maxScore - deductions) / maxScore * 100));
+}
+async function hardenCommand(opts) {
+  if (!opts.json) {
+    banner();
+    logger.info("Running hardening scan...\n");
+  }
+  const spinner = opts.json ? null : ora({ text: "Scanning system configuration...", color: "green" }).start();
+  const results = runAllChecks();
+  const score = computeScore(results);
+  if (spinner) spinner.succeed("Hardening scan complete\n");
+  if (opts.json) {
+    console.log(JSON.stringify({ score, findings: results }, null, 2));
+    return;
+  }
+  const scoreColor = score >= 80 ? source_default.green : score >= 60 ? source_default.yellow : source_default.red;
+  console.log(`  ${source_default.white.bold("Hardening Score:")} ${scoreColor.bold(String(score) + "/100")}`);
+  console.log(source_default.gray("  " + "\u2500".repeat(60)));
+  console.log();
+  const fails = results.filter((r) => r.status === "fail");
+  const warns = results.filter((r) => r.status === "warn");
+  const passes = results.filter((r) => r.status === "pass");
+  if (fails.length > 0) {
+    console.log(source_default.red.bold("  FAIL"));
+    for (const r of fails) {
+      console.log(`  ${source_default.red("\u2717")} ${source_default.white.bold(r.title)}`);
+      console.log(`    ${source_default.gray(r.explanation)}`);
+      if (r.recommendation) console.log(`    ${source_default.yellow("Fix:")} ${r.recommendation}`);
+      console.log();
+    }
+  }
+  if (warns.length > 0) {
+    console.log(source_default.yellow.bold("  WARNING"));
+    for (const r of warns) {
+      console.log(`  ${source_default.yellow("!")} ${source_default.white.bold(r.title)}`);
+      console.log(`    ${source_default.gray(r.explanation)}`);
+      if (r.recommendation) console.log(`    ${source_default.yellow("Fix:")} ${r.recommendation}`);
+      console.log();
+    }
+  }
+  if (passes.length > 0) {
+    console.log(source_default.green.bold("  PASS"));
+    for (const r of passes) {
+      console.log(`  ${source_default.green("\u2713")} ${source_default.white(r.title)}`);
+    }
+    console.log();
+  }
+  console.log(source_default.gray("  " + "\u2500".repeat(60)));
+  console.log(`  ${source_default.white.bold(`${results.length} checks:`)} ${source_default.green(`${passes.length} pass`)} ${source_default.yellow(`${warns.length} warn`)} ${source_default.red(`${fails.length} fail`)}`);
+  console.log();
+}
+
+// src/commands/firewall.ts
+async function blockCommand(ip, opts) {
+  banner();
+  console.log(source_default.green.bold("  Firewall Block"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  let ttlSeconds;
+  if (opts.ttl) {
+    const match = opts.ttl.match(/^(\d+)(s|m|h|d)?$/);
+    if (match) {
+      const value = parseInt(match[1]);
+      const unit = match[2] || "s";
+      const multipliers = { s: 1, m: 60, h: 3600, d: 86400 };
+      ttlSeconds = value * (multipliers[unit] || 1);
+    }
+  }
+  console.log(`  Blocking ${source_default.red(ip)}${ttlSeconds ? ` for ${opts.ttl}` : " permanently"}...`);
+  console.log(source_default.gray("  Note: Requires running daemon with CAP_NET_ADMIN"));
+  console.log(source_default.gray("  Configure in /etc/threatcrush/threatcrushd.conf under [remediation]"));
+  console.log();
+}
+async function unblockCommand(ip) {
+  banner();
+  console.log(source_default.green.bold("  Firewall Unblock"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  console.log(`  Unblocking ${source_default.white(ip)}...`);
+  console.log(source_default.gray("  Note: Requires running daemon"));
+  console.log();
+}
+async function blocklistCommand() {
+  banner();
+  console.log(source_default.green.bold("  Active Blocklist"));
+  console.log(source_default.gray("  " + "\u2500".repeat(60)));
+  console.log(source_default.gray("  Connect to running daemon for live blocklist data."));
+  console.log(source_default.gray("  Configure via /etc/threatcrush/threatcrushd.conf [remediation]"));
+  console.log();
+  console.log(source_default.gray("  Remediation config options:"));
+  console.log(source_default.gray("    enabled = true"));
+  console.log(source_default.gray("    dry_run = true        # Log only, no actual blocks"));
+  console.log(source_default.gray('    default_ttl = "1h"    # Default block duration'));
+  console.log(source_default.gray('    min_severity = "high" # Minimum severity to auto-block'));
+  console.log();
+}
+async function allowlistCommand(opts) {
+  banner();
+  const action = opts.action || "list";
+  console.log(source_default.green.bold("  Allowlist"));
+  console.log(source_default.gray("  " + "\u2500".repeat(50)));
+  switch (action) {
+    case "list":
+    case "ls":
+      console.log(source_default.gray("  Allowlisted IPs/CIDRs (from config):"));
+      console.log(source_default.gray("    127.0.0.1"));
+      console.log(source_default.gray("    ::1"));
+      console.log();
+      console.log(source_default.gray("  Add more via /etc/threatcrush/threatcrushd.conf [remediation] allowlist"));
+      break;
+    case "add":
+      if (!opts.value) {
+        console.log(source_default.red("  IP/CIDR required. Usage: threatcrush allowlist add <ip>"));
+        break;
+      }
+      console.log(source_default.green(`  Added ${opts.value} to allowlist`));
+      break;
+    case "remove":
+      if (!opts.value) {
+        console.log(source_default.red("  IP/CIDR required. Usage: threatcrush allowlist remove <ip>"));
+        break;
+      }
+      console.log(source_default.green(`  Removed ${opts.value} from allowlist`));
+      break;
+    default:
+      console.log(source_default.yellow(`  Unknown action: ${action}`));
+      console.log(source_default.gray("  Available: list, add, remove"));
+  }
+  console.log();
+}
+
 // src/index.ts
 init_paths();
 var PKG_VERSION = "0.1.8";
 try {
-  const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path15.join)(__dirname, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse((0, import_node_fs27.readFileSync)((0, import_node_path16.join)(__dirname, "..", "package.json"), "utf-8"));
   PKG_VERSION = pkg.version;
 } catch {
 }
@@ -13193,25 +15225,25 @@ ${source_default.dim("                    C R U S H")}
 var API_URL8 = process.env.THREATCRUSH_API_URL || "https://threatcrush.com";
 var PKG_NAME = "@profullstack/threatcrush";
 var DESKTOP_PKG_NAME = "@profullstack/threatcrush-desktop";
-var INSTALL_CONFIG_PATH = (0, import_node_path15.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
+var INSTALL_CONFIG_PATH = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush", "install.json");
 function detectPackageManager() {
   try {
-    const npmGlobal = (0, import_node_child_process7.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
+    const npmGlobal = (0, import_node_child_process10.execSync)("npm ls -g --depth=0 --json 2>/dev/null", { encoding: "utf-8" });
     if (npmGlobal.includes(PKG_NAME)) return "npm";
   } catch {
   }
   try {
-    (0, import_node_child_process7.execSync)("pnpm --version", { stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("pnpm --version", { stdio: "pipe" });
     return "pnpm";
   } catch {
   }
   try {
-    (0, import_node_child_process7.execSync)("yarn --version", { stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("yarn --version", { stdio: "pipe" });
     return "yarn";
   } catch {
   }
   try {
-    (0, import_node_child_process7.execSync)("bun --version", { stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("bun --version", { stdio: "pipe" });
     return "bun";
   } catch {
   }
@@ -13219,7 +15251,7 @@ function detectPackageManager() {
 }
 function readInstallConfig() {
   try {
-    return JSON.parse((0, import_node_fs22.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)(INSTALL_CONFIG_PATH, "utf-8"));
   } catch {
     return {};
   }
@@ -13257,7 +15289,7 @@ function packageLooksInstalled(pm, pkgName) {
       yarn: `yarn global list --pattern ${pkgName}`,
       bun: `bun pm ls -g`
     };
-    const output = (0, import_node_child_process7.execSync)(listCommands[pm] || listCommands.npm, {
+    const output = (0, import_node_child_process10.execSync)(listCommands[pm] || listCommands.npm, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -13331,6 +15363,24 @@ program2.command("pentest").description("Penetration test URLs and APIs").argume
 program2.command("status").description("Show daemon status and loaded modules").action(async () => {
   await statusCommand();
 });
+program2.command("rules").description("Manage detection rules").argument("[action]", "list | show", "list").argument("[id]", "Rule ID (for show)").action(async (action, id) => {
+  await rulesCommand({ action, id });
+});
+program2.command("harden").description("Run hardening security scan").option("--json", "Output results as JSON").action(async (opts) => {
+  await hardenCommand(opts);
+});
+program2.command("block").description("Block an IP address via the firewall").argument("<ip>", "IP address to block").option("--ttl <duration>", "Block duration (e.g. 1h, 30m, 1d)").action(async (ip, opts) => {
+  await blockCommand(ip, opts);
+});
+program2.command("unblock").description("Unblock an IP address").argument("<ip>", "IP address to unblock").action(async (ip) => {
+  await unblockCommand(ip);
+});
+program2.command("blocklist").description("Show active firewall blocklist").action(async () => {
+  await blocklistCommand();
+});
+program2.command("allowlist").description("Manage IP allowlist").argument("[action]", "list | add | remove", "list").argument("[value]", "IP/CIDR to add or remove").action(async (action, value) => {
+  await allowlistCommand({ action, value });
+});
 program2.command("start").description("Start the ThreatCrush daemon in the background").action(async () => {
   console.log(LOGO2);
   await daemonStart();
@@ -13351,7 +15401,7 @@ program2.command("uninstall-service").description("Remove the threatcrushd syste
 program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(LOGO2);
   const logPath = PATHS.logFile;
-  if (!(0, import_node_fs22.existsSync)(logPath)) {
+  if (!(0, import_node_fs27.existsSync)(logPath)) {
     console.log(source_default.yellow(`  No log file found at ${logPath}`));
     console.log(source_default.dim("  Start the daemon first with `threatcrush start`\n"));
     return;
@@ -13359,7 +15409,7 @@ program2.command("logs").description("Tail daemon logs").action(async () => {
   console.log(source_default.green(`  Tailing ${logPath}...
 `));
   console.log(source_default.gray("  Press Ctrl+C to stop\n"));
-  (0, import_node_child_process7.execSync)(`tail -f ${logPath}`, { stdio: "inherit" });
+  (0, import_node_child_process10.execSync)(`tail -f ${logPath}`, { stdio: "inherit" });
 });
 program2.command("activate").description("Activate your license key").action(async () => {
   console.log(LOGO2);
@@ -13409,7 +15459,7 @@ program2.command("update").description("Update ThreatCrush CLI and installed bun
       for (const cmd of commands2) {
         console.log(source_default.green(`  \u2192 ${cmd}
 `));
-        (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
+        (0, import_node_child_process10.execSync)(cmd, { stdio: "inherit" });
       }
       console.log(source_default.green("\n  \u2713 Modules updated successfully!\n"));
     } catch (err) {
@@ -13435,7 +15485,7 @@ program2.command("update").description("Update ThreatCrush CLI and installed bun
     for (const cmd of commands) {
       console.log(source_default.green(`  \u2192 ${cmd}
 `));
-      (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
+      (0, import_node_child_process10.execSync)(cmd, { stdio: "inherit" });
     }
     console.log(source_default.green("\n  \u2713 ThreatCrush updated successfully!\n"));
     if (installMode === "desktop") {
@@ -13479,7 +15529,7 @@ program2.command("remove").description("Uninstall ThreatCrush and the installed
     for (const cmd of commands) {
       console.log(source_default.green(`  \u2192 ${cmd}
 `));
-      (0, import_node_child_process7.execSync)(cmd, { stdio: "inherit" });
+      (0, import_node_child_process10.execSync)(cmd, { stdio: "inherit" });
     }
     console.log(source_default.green("\n  \u2713 ThreatCrush has been uninstalled.\n"));
     console.log(source_default.dim("  We're sorry to see you go! \u{1F44B}\n"));
@@ -13556,10 +15606,10 @@ storeCmd.command("search <query>").description("Search for modules in the store"
 });
 storeCmd.command("publish <url>").description("Publish a module from a git URL or web URL").action(async (url) => {
   console.log(LOGO2);
-  const configPath = (0, import_node_path15.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
+  const configPath = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush", "config.json");
   let email = "";
   try {
-    const config = JSON.parse((0, import_node_fs22.readFileSync)(configPath, "utf-8"));
+    const config = JSON.parse((0, import_node_fs27.readFileSync)(configPath, "utf-8"));
     email = config.email || "";
   } catch {
   }
@@ -13576,9 +15626,9 @@ storeCmd.command("publish <url>").description("Publish a module from a git URL o
       return;
     }
     try {
-      const dir = (0, import_node_path15.join)((0, import_node_os8.homedir)(), ".threatcrush");
-      if (!(0, import_node_fs22.existsSync)(dir)) (0, import_node_fs22.mkdirSync)(dir, { recursive: true });
-      (0, import_node_fs22.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
+      const dir = (0, import_node_path16.join)((0, import_node_os8.homedir)(), ".threatcrush");
+      if (!(0, import_node_fs27.existsSync)(dir)) (0, import_node_fs27.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs27.writeFileSync)(configPath, JSON.stringify({ email }, null, 2));
       console.log(source_default.dim(`  Saved email to ${configPath}`));
     } catch {
     }