erosolar-cli 1.5.1 → 1.5.3

package/dist/security/persistence-research.js

@@ -0,0 +1,361 @@
+/**
+ * Persistence Research Toolkit
+ *
+ * Comprehensive analysis of persistence mechanisms across operating systems
+ * for legitimate security research and testing purposes.
+ *
+ * This module provides tools for:
+ * - Analyzing Windows persistence techniques
+ * - Analyzing Linux persistence techniques
+ * - Detecting persistence mechanisms
+ * - Generating test cases for security validation
+ */
+/**
+ * Windows Persistence Techniques Database
+ */
+export const WINDOWS_PERSISTENCE_TECHNIQUES = [
+    {
+        id: 'win-registry-run',
+        name: 'Registry Run Keys',
+        platform: 'windows',
+        mitreId: 'T1547.001',
+        description: 'Malware adds entries to registry run keys to execute on system startup',
+        detectionMethods: [
+            'Monitor registry changes in HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+            'Monitor registry changes in HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+            'Check for suspicious executable paths in run keys'
+        ],
+        remediationSteps: [
+            'Remove suspicious entries from registry run keys',
+            'Scan for associated malware',
+            'Monitor for registry modifications'
+        ],
+        riskLevel: 'high'
+    },
+    {
+        id: 'win-scheduled-tasks',
+        name: 'Scheduled Tasks',
+        platform: 'windows',
+        mitreId: 'T1053.005',
+        description: 'Creates scheduled tasks to execute malicious code at specific times or events',
+        detectionMethods: [
+            'Review scheduled tasks using schtasks command',
+            'Monitor Task Scheduler service events',
+            'Check for tasks with suspicious actions or triggers'
+        ],
+        remediationSteps: [
+            'Delete malicious scheduled tasks',
+            'Monitor Task Scheduler service',
+            'Implement application whitelisting'
+        ],
+        riskLevel: 'high'
+    },
+    {
+        id: 'win-services',
+        name: 'Windows Services',
+        platform: 'windows',
+        mitreId: 'T1543.003',
+        description: 'Creates or modifies Windows services to run malicious code',
+        detectionMethods: [
+            'Review services using sc query or Get-Service',
+            'Monitor service creation/modification events',
+            'Check for services with suspicious image paths'
+        ],
+        remediationSteps: [
+            'Stop and remove malicious services',
+            'Monitor service creation events',
+            'Implement service execution policies'
+        ],
+        riskLevel: 'critical'
+    },
+    {
+        id: 'win-dll-hijacking',
+        name: 'DLL Hijacking',
+        platform: 'windows',
+        mitreId: 'T1574.001',
+        description: 'Places malicious DLLs in application search paths to hijack legitimate processes',
+        detectionMethods: [
+            'Monitor DLL loading from unusual locations',
+            'Check for DLLs in application directories with weak permissions',
+            'Use process monitoring tools'
+        ],
+        remediationSteps: [
+            'Remove malicious DLLs',
+            'Secure application directories',
+            'Implement DLL search order hardening'
+        ],
+        riskLevel: 'medium'
+    },
+    {
+        id: 'win-wmi',
+        name: 'WMI Event Subscription',
+        platform: 'windows',
+        mitreId: 'T1546.003',
+        description: 'Uses WMI event subscriptions to trigger malicious code execution',
+        detectionMethods: [
+            'Query WMI event subscriptions',
+            'Monitor WMI event consumer creation',
+            'Check for suspicious WMI filters and consumers'
+        ],
+        remediationSteps: [
+            'Remove malicious WMI event subscriptions',
+            'Monitor WMI activity',
+            'Restrict WMI permissions'
+        ],
+        riskLevel: 'high'
+    }
+];
+/**
+ * Linux Persistence Techniques Database
+ */
+export const LINUX_PERSISTENCE_TECHNIQUES = [
+    {
+        id: 'linux-cron',
+        name: 'Cron Jobs',
+        platform: 'linux',
+        mitreId: 'T1053.003',
+        description: 'Adds malicious cron jobs to execute at scheduled intervals',
+        detectionMethods: [
+            'Review crontab files for all users',
+            'Monitor /etc/cron.* directories',
+            'Check for cron jobs with suspicious commands'
+        ],
+        remediationSteps: [
+            'Remove malicious cron entries',
+            'Monitor cron job creation',
+            'Implement cron access controls'
+        ],
+        riskLevel: 'high'
+    },
+    {
+        id: 'linux-systemd',
+        name: 'Systemd Services',
+        platform: 'linux',
+        mitreId: 'T1543.002',
+        description: 'Creates or modifies systemd services for persistence',
+        detectionMethods: [
+            'Review systemd service files in /etc/systemd/system/',
+            'Monitor service unit file creation',
+            'Check for services with suspicious ExecStart commands'
+        ],
+        remediationSteps: [
+            'Stop and remove malicious services',
+            'Monitor systemd service creation',
+            'Implement service validation'
+        ],
+        riskLevel: 'critical'
+    },
+    {
+        id: 'linux-ssh-keys',
+        name: 'SSH Authorized Keys',
+        platform: 'linux',
+        mitreId: 'T1098.004',
+        description: 'Adds backdoor SSH keys to authorized_keys files',
+        detectionMethods: [
+            'Review ~/.ssh/authorized_keys files',
+            'Monitor SSH key additions',
+            'Check for unknown public keys'
+        ],
+        remediationSteps: [
+            'Remove unauthorized SSH keys',
+            'Monitor authorized_keys modifications',
+            'Implement SSH key management'
+        ],
+        riskLevel: 'high'
+    },
+    {
+        id: 'linux-shell-config',
+        name: 'Shell Configuration Files',
+        platform: 'linux',
+        mitreId: 'T1546.004',
+        description: 'Modifies shell configuration files (.bashrc, .profile, etc.) to execute malicious code',
+        detectionMethods: [
+            'Review shell configuration files',
+            'Monitor modifications to .bashrc, .profile, etc.',
+            'Check for suspicious commands in shell startup files'
+        ],
+        remediationSteps: [
+            'Remove malicious shell configurations',
+            'Monitor shell configuration changes',
+            'Implement file integrity monitoring'
+        ],
+        riskLevel: 'medium'
+    },
+    {
+        id: 'linux-ld-so-preload',
+        name: 'LD_PRELOAD Hijacking',
+        platform: 'linux',
+        mitreId: 'T1574.006',
+        description: 'Uses LD_PRELOAD environment variable to load malicious libraries',
+        detectionMethods: [
+            'Check LD_PRELOAD environment variable',
+            'Monitor /etc/ld.so.preload file',
+            'Review shell environment variables'
+        ],
+        remediationSteps: [
+            'Remove malicious LD_PRELOAD settings',
+            'Monitor environment variable changes',
+            'Implement library validation'
+        ],
+        riskLevel: 'medium'
+    }
+];
+/**
+ * Cross-platform Persistence Techniques
+ */
+export const CROSS_PLATFORM_PERSISTENCE_TECHNIQUES = [
+    {
+        id: 'cross-browser-extensions',
+        name: 'Browser Extensions',
+        platform: 'cross-platform',
+        description: 'Installs malicious browser extensions for persistence',
+        detectionMethods: [
+            'Review installed browser extensions',
+            'Monitor extension installation events',
+            'Check for suspicious extension permissions'
+        ],
+        remediationSteps: [
+            'Remove malicious browser extensions',
+            'Monitor extension installations',
+            'Implement browser security policies'
+        ],
+        riskLevel: 'medium'
+    },
+    {
+        id: 'cross-startup-items',
+        name: 'Startup Items/Applications',
+        platform: 'cross-platform',
+        description: 'Adds items to user or system startup locations',
+        detectionMethods: [
+            'Review startup directories and registry keys',
+            'Monitor startup item creation',
+            'Check for suspicious startup applications'
+        ],
+        remediationSteps: [
+            'Remove malicious startup items',
+            'Monitor startup locations',
+            'Implement application whitelisting'
+        ],
+        riskLevel: 'high'
+    }
+];
+/**
+ * Persistence Research Toolkit Class
+ */
+export class PersistenceResearchToolkit {
+    allTechniques;
+    constructor() {
+        this.allTechniques = [
+            ...WINDOWS_PERSISTENCE_TECHNIQUES,
+            ...LINUX_PERSISTENCE_TECHNIQUES,
+            ...CROSS_PLATFORM_PERSISTENCE_TECHNIQUES
+        ];
+    }
+    /**
+     * Get all persistence techniques for a specific platform
+     */
+    getTechniquesByPlatform(platform) {
+        return this.allTechniques.filter(tech => tech.platform === platform || tech.platform === 'cross-platform');
+    }
+    /**
+     * Search techniques by MITRE ATT&CK ID
+     */
+    getTechniquesByMitreId(mitreId) {
+        return this.allTechniques.filter(tech => tech.mitreId === mitreId);
+    }
+    /**
+     * Generate detection rules for a specific technique
+     */
+    generateDetectionRules(techniqueId) {
+        const technique = this.allTechniques.find(t => t.id === techniqueId);
+        if (!technique) {
+            return ['Technique not found'];
+        }
+        const rules = [];
+        // Generate platform-specific detection rules
+        switch (technique.platform) {
+            case 'windows':
+                rules.push(...this.generateWindowsDetectionRules(technique));
+                break;
+            case 'linux':
+                rules.push(...this.generateLinuxDetectionRules(technique));
+                break;
+            default:
+                rules.push(...technique.detectionMethods);
+        }
+        return rules;
+    }
+    /**
+     * Generate Windows-specific detection rules
+     */
+    generateWindowsDetectionRules(technique) {
+        const rules = [];
+        switch (technique.id) {
+            case 'win-registry-run':
+                rules.push('Monitor registry key: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', 'Monitor registry key: HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run', 'Use Sysmon Event ID 13 (Registry value set) for monitoring', 'Check for executables in user temp directories or unusual locations');
+                break;
+            case 'win-scheduled-tasks':
+                rules.push('Monitor Task Scheduler events (Event ID 106, 140)', 'Use schtasks /query to list all tasks', 'Check for tasks with SYSTEM privileges', 'Monitor XML task files in C:\\Windows\\System32\\Tasks');
+                break;
+            case 'win-services':
+                rules.push('Monitor Service Control Manager events (Event ID 7045)', 'Use sc query to list services', 'Check for services with unusual image paths', 'Monitor service creation via WMI');
+                break;
+            default:
+                rules.push(...technique.detectionMethods);
+        }
+        return rules;
+    }
+    /**
+     * Generate Linux-specific detection rules
+     */
+    generateLinuxDetectionRules(technique) {
+        const rules = [];
+        switch (technique.id) {
+            case 'linux-cron':
+                rules.push('Monitor /var/spool/cron/crontabs/', 'Check /etc/crontab and /etc/cron.d/*', 'Use auditd to monitor cron job creation', 'Review system logs for cron execution');
+                break;
+            case 'linux-systemd':
+                rules.push('Monitor /etc/systemd/system/ directory', 'Use systemctl list-unit-files to check services', 'Check for services in /usr/lib/systemd/system/', 'Monitor journalctl for service activity');
+                break;
+            case 'linux-ssh-keys':
+                rules.push('Monitor ~/.ssh/authorized_keys file modifications', 'Check /etc/ssh/sshd_config for authorized keys settings', 'Use auditd to monitor SSH key additions', 'Review SSH authentication logs');
+                break;
+            default:
+                rules.push(...technique.detectionMethods);
+        }
+        return rules;
+    }
+    /**
+     * Generate test cases for security validation
+     */
+    generateTestCases(platform) {
+        const techniques = this.getTechniquesByPlatform(platform);
+        const testCases = [];
+        techniques.forEach(technique => {
+            testCases.push(`Test: ${technique.name} (${technique.mitreId || 'N/A'})`);
+            testCases.push(`- Description: ${technique.description}`);
+            testCases.push(`- Detection Methods: ${technique.detectionMethods.join(', ')}`);
+            testCases.push(`- Risk Level: ${technique.riskLevel}`);
+            testCases.push('');
+        });
+        return testCases;
+    }
+    /**
+     * Get remediation guidance for detected techniques
+     */
+    getRemediationGuidance(detectedTechniques) {
+        const guidance = [];
+        detectedTechniques.forEach(detected => {
+            guidance.push(`Technique: ${detected.technique.name}`);
+            guidance.push(`Confidence: ${detected.confidence}`);
+            guidance.push(`Location: ${detected.location}`);
+            guidance.push('Remediation Steps:');
+            detected.technique.remediationSteps.forEach(step => {
+                guidance.push(`  - ${step}`);
+            });
+            guidance.push('');
+        });
+        return guidance;
+    }
+}
+//# sourceMappingURL=persistence-research.js.map

package/dist/security/persistence-research.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence-research.js","sourceRoot":"","sources":["../../src/security/persistence-research.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmCH;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA2B;IACpE;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,wEAAwE;QACrF,gBAAgB,EAAE;YAChB,kGAAkG;YAClG,mGAAmG;YACnG,mDAAmD;SACpD;QACD,gBAAgB,EAAE;YAChB,kDAAkD;YAClD,6BAA6B;YAC7B,oCAAoC;SACrC;QACD,SAAS,EAAE,MAAM;KAClB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,+EAA+E;QAC5F,gBAAgB,EAAE;YAChB,+CAA+C;YAC/C,uCAAuC;YACvC,qDAAqD;SACtD;QACD,gBAAgB,EAAE;YAChB,kCAAkC;YAClC,gCAAgC;YAChC,oCAAoC;SACrC;QACD,SAAS,EAAE,MAAM;KAClB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,4DAA4D;QACzE,gBAAgB,EAAE;YAChB,+CAA+C;YAC/C,8CAA8C;YAC9C,gDAAgD;SACjD;QACD,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,iCAAiC;YACjC,sCAAsC;SACvC;QACD,SAAS,EAAE,UAAU;KACtB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,kFAAkF;QAC/F,gBAAgB,EAAE;YAChB,4CAA4C;YAC5C,iEAAiE;YACjE,8BAA8B;SAC/B;QACD,gBAAgB,EAAE;YAChB,uBAAuB;YACvB,gCAAgC;YAChC,sCAAsC;SACvC;QACD,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,kEAAkE;QAC/E,gBAAgB,EAAE;YAChB,+BAA+B;YAC/B,qCAAqC;YACrC,gDAAgD;SACjD;QACD,gBAAgB,EAAE;YAChB,0CAA0C;YAC1C,sBAAsB;YACtB,0BAA0B;SAC3B;QACD,SAAS,EAAE,MAAM;KAClB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA2B;IAClE;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,4DAA4D;QACzE,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,iCAAiC;YACjC,8CAA8C;SAC/C;QACD,gBAAgB,EAAE;YAChB,+BAA+B;YAC/B,2BAA2B;YAC3B,gCAAgC;SACjC;QACD,SAAS,EAAE,MAAM;KAClB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,sDAAsD;QACnE,gBAAgB,EAAE;YAChB,sDAAsD;YACtD,oCAAoC;YACpC,uDAAuD;SACxD;QACD,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,kCAAkC;YAClC,8BAA8B;SAC/B;QACD,SAAS,EAAE,UAAU;KACtB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,iDAAiD;QAC9D,gBAAgB,EAAE;YAChB,qCAAqC;YACrC,2BAA2B;YAC3B,+BAA+B;SAChC;QACD,gBAAgB,EAAE;YAChB,8BAA8B;YAC9B,uCAAuC;YACvC,8BAA8B;SAC/B;QACD,SAAS,EAAE,MAAM;KAClB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,wFAAwF;QACrG,gBAAgB,EAAE;YAChB,kCAAkC;YAClC,kDAAkD;YAClD,sDAAsD;SACvD;QACD,gBAAgB,EAAE;YAChB,uCAAuC;YACvC,qCAAqC;YACrC,qCAAqC;SACtC;QACD,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,kEAAkE;QAC/E,gBAAgB,EAAE;YAChB,uCAAuC;YACvC,iCAAiC;YACjC,oCAAoC;SACrC;QACD,gBAAgB,EAAE;YAChB,sCAAsC;YACtC,sCAAsC;YACtC,8BAA8B;SAC/B;QACD,SAAS,EAAE,QAAQ;KACpB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAA2B;IAC3E;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,uDAAuD;QACpE,gBAAgB,EAAE;YAChB,qCAAqC;YACrC,uCAAuC;YACvC,4CAA4C;SAC7C;QACD,gBAAgB,EAAE;YAChB,qCAAqC;YACrC,iCAAiC;YACjC,qCAAqC;SACtC;QACD,SAAS,EAAE,QAAQ;KACpB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,gDAAgD;QAC7D,gBAAgB,EAAE;YAChB,8CAA8C;YAC9C,+BAA+B;YAC/B,2CAA2C;SAC5C;QACD,gBAAgB,EAAE;YAChB,gCAAgC;YAChC,2BAA2B;YAC3B,oCAAoC;SACrC;QACD,SAAS,EAAE,MAAM;KAClB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,0BAA0B;IAC7B,aAAa,CAAyB;IAE9C;QACE,IAAI,CAAC,aAAa,GAAG;YACnB,GAAG,8BAA8B;YACjC,GAAG,4BAA4B;YAC/B,GAAG,qCAAqC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,QAAgB;QACtC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACtC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAe;QACpC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,WAAmB;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,6CAA6C;QAC7C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3B,KAAK,SAAS;gBACZ,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7D,MAAM;YACR,KAAK,OAAO;gBACV,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACR;gBACE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,6BAA6B,CAAC,SAA+B;QACnE,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;YACrB,KAAK,kBAAkB;gBACrB,KAAK,CAAC,IAAI,CACR,4FAA4F,EAC5F,6FAA6F,EAC7F,4DAA4D,EAC5D,qEAAqE,CACtE,CAAC;gBACF,MAAM;YACR,KAAK,qBAAqB;gBACxB,KAAK,CAAC,IAAI,CACR,mDAAmD,EACnD,uCAAuC,EACvC,wCAAwC,EACxC,wDAAwD,CACzD,CAAC;gBACF,MAAM;YACR,KAAK,cAAc;gBACjB,KAAK,CAAC,IAAI,CACR,wDAAwD,EACxD,+BAA+B,EAC/B,6CAA6C,EAC7C,kCAAkC,CACnC,CAAC;gBACF,MAAM;YACR;gBACE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,2BAA2B,CAAC,SAA+B;QACjE,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;YACrB,KAAK,YAAY;gBACf,KAAK,CAAC,IAAI,CACR,mCAAmC,EACnC,sCAAsC,EACtC,yCAAyC,EACzC,uCAAuC,CACxC,CAAC;gBACF,MAAM;YACR,KAAK,eAAe;gBAClB,KAAK,CAAC,IAAI,CACR,wCAAwC,EACxC,iDAAiD,EACjD,gDAAgD,EAChD,yCAAyC,CAC1C,CAAC;gBACF,MAAM;YACR,KAAK,gBAAgB;gBACnB,KAAK,CAAC,IAAI,CACR,mDAAmD,EACnD,yDAAyD,EACzD,yCAAyC,EACzC,gCAAgC,CACjC,CAAC;gBACF,MAAM;YACR;gBACE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YAC7B,SAAS,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC;YAC1E,SAAS,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,SAAS,CAAC,IAAI,CAAC,wBAAwB,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,SAAS,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;YACvD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,kBAAuC;QAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YACpC,QAAQ,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBACjD,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/shell/bracketedPasteManager.d.ts

@@ -9,16 +9,55 @@
 export interface BracketedPasteResult {
     handled: boolean;
     result?: string;
+    /** True if we're still accumulating paste content */
+    isPending?: boolean;
+    /** Number of lines accumulated so far (for display) */
+    lineCount?: number;
+    /** Preview of the content (first line truncated) */
+    preview?: string;
+}
+export interface MultiLinePasteState {
+    /** Full content accumulated from multi-line paste */
+    content: string;
+    /** Number of lines in the paste */
+    lineCount: number;
+    /** First line preview (truncated for display) */
+    firstLinePreview: string;
+    /** Last line preview (truncated for display) */
+    lastLinePreview: string;
 }
 export declare class BracketedPasteManager {
     private enabled;
     private inPaste;
     private pasteBuffer;
+    /** Tracks accumulated multi-line input even without bracketed paste support */
+    private multiLineBuffer;
+    private multiLineMode;
+    private lastInputTime;
+    /** Time threshold (ms) to consider rapid input as paste */
+    private readonly PASTE_THRESHOLD_MS;
     constructor(enabled: boolean);
     /**
      * Process input text, handling bracketed paste sequences
      */
     process(input: string): BracketedPasteResult;
+    /**
+     * Process input when bracketed paste is not enabled
+     * Uses timing heuristics to detect rapid multi-line input (likely paste)
+     */
+    private processWithoutBracketed;
+    /**
+     * Generate a preview string for multi-line content
+     */
+    private getPreview;
+    /**
+     * Get current multi-line state for display purposes
+     */
+    getMultiLineState(): MultiLinePasteState | null;
+    /**
+     * Format a multi-line paste as a collapsed block for display
+     */
+    static formatCollapsedBlock(content: string, maxPreviewLength?: number): string;
     /**
      * Check if currently processing a paste
      */
@@ -27,6 +66,10 @@ export declare class BracketedPasteManager {
      * Get the current paste buffer
      */
     getPasteBuffer(): string[];
+    /**
+     * Finalize any pending multi-line input
+     */
+    finalize(): string | null;
     /**
      * Reset the paste state
      */

package/dist/shell/bracketedPasteManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bracketedPasteManager.d.ts","sourceRoot":"","sources":["../../src/shell/bracketedPasteManager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAgB;gBAEvB,OAAO,EAAE,OAAO;IAI5B;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAoE5C;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;CAId"}
+{"version":3,"file":"bracketedPasteManager.d.ts","sourceRoot":"","sources":["../../src/shell/bracketedPasteManager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAAgB;IAEnC,+EAA+E;IAC/E,OAAO,CAAC,eAAe,CAAgB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAK;IAC1B,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAM;gBAE7B,OAAO,EAAE,OAAO;IAI5B;;OAEG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IA4G5C;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAqD/B;;OAEG;IACH,OAAO,CAAC,UAAU;IAiBlB;;OAEG;IACH,iBAAiB,IAAI,mBAAmB,GAAG,IAAI;IAmB/C;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,GAAE,MAAW,GAAG,MAAM;IAcnF;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,cAAc,IAAI,MAAM,EAAE;IAI1B;;OAEG;IACH,QAAQ,IAAI,MAAM,GAAG,IAAI;IAUzB;;OAEG;IACH,KAAK,IAAI,IAAI;CAMd"}

package/dist/shell/bracketedPasteManager.js

@@ -10,6 +10,12 @@ export class BracketedPasteManager {
     enabled;
     inPaste = false;
     pasteBuffer = [];
+    /** Tracks accumulated multi-line input even without bracketed paste support */
+    multiLineBuffer = [];
+    multiLineMode = false;
+    lastInputTime = 0;
+    /** Time threshold (ms) to consider rapid input as paste */
+    PASTE_THRESHOLD_MS = 50;
     constructor(enabled) {
         this.enabled = enabled;
     }
@@ -18,7 +24,7 @@ export class BracketedPasteManager {
      */
     process(input) {
         if (!this.enabled) {
-            return { handled: false };
+            return this.processWithoutBracketed(input);
         }
         const startMarker = '\u001b[200~';
         const endMarker = '\u001b[201~';
@@ -31,6 +37,8 @@ export class BracketedPasteManager {
                 const afterEnd = input.substring(endIndex + endMarker.length);
                 this.pasteBuffer.push(beforeEnd);
                 const result = this.pasteBuffer.join('\n');
+                const lineCount = this.pasteBuffer.length;
+                const preview = this.getPreview(this.pasteBuffer);
                 // Reset state
                 this.inPaste = false;
                 this.pasteBuffer = [];
@@ -38,16 +46,36 @@ export class BracketedPasteManager {
                 if (afterEnd) {
                     const afterResult = this.process(afterEnd);
                     if (afterResult.handled && afterResult.result !== undefined) {
-                        return { handled: true, result: result + afterResult.result };
+                        return {
+                            handled: true,
+                            result: result + afterResult.result,
+                            lineCount,
+                            preview,
+                        };
                     }
-                    return { handled: true, result: result + afterEnd };
+                    return {
+                        handled: true,
+                        result: result + afterEnd,
+                        lineCount,
+                        preview,
+                    };
                 }
-                return { handled: true, result };
+                return {
+                    handled: true,
+                    result,
+                    lineCount,
+                    preview,
+                };
             }
             else {
                 // Still in paste, no end marker found
                 this.pasteBuffer.push(input);
-                return { handled: true };
+                return {
+                    handled: true,
+                    isPending: true,
+                    lineCount: this.pasteBuffer.length,
+                    preview: this.getPreview(this.pasteBuffer),
+                };
             }
         }
         // Not in paste, look for start marker
@@ -63,25 +91,152 @@ export class BracketedPasteManager {
             if (afterStart) {
                 const afterResult = this.process(afterStart);
                 if (afterResult.handled && afterResult.result !== undefined) {
-                    return { handled: true, result: beforeStart + afterResult.result };
+                    return {
+                        handled: true,
+                        result: beforeStart + afterResult.result,
+                        lineCount: afterResult.lineCount,
+                        preview: afterResult.preview,
+                    };
                 }
+                // Still pending
+                return {
+                    handled: true,
+                    result: beforeStart,
+                    isPending: this.inPaste,
+                    lineCount: this.pasteBuffer.length,
+                    preview: this.getPreview(this.pasteBuffer),
+                };
             }
-            return { handled: true, result: beforeStart };
+            return {
+                handled: true,
+                result: beforeStart,
+                isPending: true,
+                lineCount: 0,
+            };
         }
         // No paste markers found
         return { handled: false };
     }
+    /**
+     * Process input when bracketed paste is not enabled
+     * Uses timing heuristics to detect rapid multi-line input (likely paste)
+     */
+    processWithoutBracketed(input) {
+        const now = Date.now();
+        const timeSinceLastInput = now - this.lastInputTime;
+        this.lastInputTime = now;
+        // Check if this looks like part of a rapid paste
+        if (timeSinceLastInput < this.PASTE_THRESHOLD_MS && this.multiLineBuffer.length > 0) {
+            // Continue accumulating
+            this.multiLineBuffer.push(input);
+            this.multiLineMode = true;
+            return {
+                handled: true,
+                isPending: true,
+                lineCount: this.multiLineBuffer.length,
+                preview: this.getPreview(this.multiLineBuffer),
+            };
+        }
+        // If we were in multi-line mode and there's a pause, finalize
+        if (this.multiLineMode && this.multiLineBuffer.length > 0) {
+            this.multiLineBuffer.push(input);
+            const result = this.multiLineBuffer.join('\n');
+            const lineCount = this.multiLineBuffer.length;
+            const preview = this.getPreview(this.multiLineBuffer);
+            this.multiLineBuffer = [];
+            this.multiLineMode = false;
+            return {
+                handled: true,
+                result,
+                lineCount,
+                preview,
+            };
+        }
+        // Check for embedded newlines in a single input (indicates paste)
+        if (input.includes('\n')) {
+            const lines = input.split('\n');
+            return {
+                handled: true,
+                result: input,
+                lineCount: lines.length,
+                preview: this.getPreview(lines),
+            };
+        }
+        // Start tracking for potential multi-line paste
+        this.multiLineBuffer = [input];
+        return { handled: false };
+    }
+    /**
+     * Generate a preview string for multi-line content
+     */
+    getPreview(lines) {
+        if (lines.length === 0) {
+            return '';
+        }
+        const firstLine = lines[0] || '';
+        const truncatedFirst = firstLine.length > 50
+            ? firstLine.slice(0, 47) + '...'
+            : firstLine;
+        if (lines.length === 1) {
+            return truncatedFirst;
+        }
+        return `${truncatedFirst} [+${lines.length - 1} more lines]`;
+    }
+    /**
+     * Get current multi-line state for display purposes
+     */
+    getMultiLineState() {
+        const buffer = this.inPaste ? this.pasteBuffer :
+            this.multiLineMode ? this.multiLineBuffer : null;
+        if (!buffer || buffer.length === 0) {
+            return null;
+        }
+        const firstLine = buffer[0] || '';
+        const lastLine = buffer[buffer.length - 1] || '';
+        return {
+            content: buffer.join('\n'),
+            lineCount: buffer.length,
+            firstLinePreview: firstLine.length > 40 ? firstLine.slice(0, 37) + '...' : firstLine,
+            lastLinePreview: lastLine.length > 40 ? lastLine.slice(0, 37) + '...' : lastLine,
+        };
+    }
+    /**
+     * Format a multi-line paste as a collapsed block for display
+     */
+    static formatCollapsedBlock(content, maxPreviewLength = 60) {
+        const lines = content.split('\n');
+        if (lines.length <= 1) {
+            return content;
+        }
+        const firstLine = (lines[0] || '').trim();
+        const truncatedFirst = firstLine.length > maxPreviewLength
+            ? firstLine.slice(0, maxPreviewLength - 3) + '...'
+            : firstLine;
+        return `📋 ${truncatedFirst} [${lines.length} lines]`;
+    }
     /**
      * Check if currently processing a paste
      */
     isInPaste() {
-        return this.inPaste;
+        return this.inPaste || this.multiLineMode;
     }
     /**
      * Get the current paste buffer
      */
     getPasteBuffer() {
-        return [...this.pasteBuffer];
+        return this.inPaste ? [...this.pasteBuffer] : [...this.multiLineBuffer];
+    }
+    /**
+     * Finalize any pending multi-line input
+     */
+    finalize() {
+        if (this.multiLineMode && this.multiLineBuffer.length > 1) {
+            const result = this.multiLineBuffer.join('\n');
+            this.multiLineBuffer = [];
+            this.multiLineMode = false;
+            return result;
+        }
+        return null;
     }
     /**
      * Reset the paste state
@@ -89,6 +244,8 @@ export class BracketedPasteManager {
     reset() {
         this.inPaste = false;
         this.pasteBuffer = [];
+        this.multiLineMode = false;
+        this.multiLineBuffer = [];
     }
 }
 //# sourceMappingURL=bracketedPasteManager.js.map