erosolar-cli 2.1.242 → 2.1.244

package/dist/core/agentOrchestrator.js

@@ -1,5 +1,8 @@
 import { TASK_FULLY_COMPLETE } from './constants.js';
 import { TaskCompletionDetector } from './taskCompletionDetector.js';
+import { planAttackChain, selectNextTechnique, executeTechniqueInChain, techniqueRegistry, parseNaturalLanguageIntent, validateAuthorizationContext, getRLState, listActiveChains, } from '../tools/tao/index.js';
+import { getInfrastructureStack, generateDeploymentScript, generateTeardownScript, generateOpsecChecklist, } from './infrastructureTemplates.js';
+import { getAgencyContacts, getApplicableLegalFrameworks, } from './governmentProcedures.js';
 /**
  * Single-pass orchestration: drive the agent to finish as much as possible
  * in one go, with strong bias toward real actions over planning.
@@ -872,5 +875,882 @@ Please provide context so I can help appropriately.`,
         }
         return { isHarmful: false, response: '' };
     }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // ATTACK CHAIN EXECUTION
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Detect if a request should trigger attack chain execution.
+     * Uses natural language parsing to identify security operation intents.
+     */
+    shouldExecuteAttackChain(request, mode = 'auto') {
+        if (mode === 'disabled') {
+            return { shouldExecute: false, intent: null };
+        }
+        if (mode === 'forced') {
+            const intent = parseNaturalLanguageIntent(request);
+            return { shouldExecute: true, intent };
+        }
+        // Auto mode: parse intent and check for security operations
+        const intent = parseNaturalLanguageIntent(request);
+        const securityActions = ['recon', 'scan', 'enumerate', 'exploit', 'extract', 'test', 'monitor'];
+        const isSecurityOp = securityActions.includes(intent.action);
+        const hasTargets = intent.targets.length > 0;
+        return {
+            shouldExecute: isSecurityOp && hasTargets,
+            intent: isSecurityOp ? intent : null,
+        };
+    }
+    /**
+     * Validate authorization context for attack chain execution.
+     * Ensures proper authorization before executing security techniques.
+     */
+    validateAttackAuthorization(intent, authContext) {
+        // Use the TAO authorization validator
+        const validation = validateAuthorizationContext(intent);
+        // Additional checks for protected targets
+        const protectedTargets = [
+            'google.com', 'microsoft.com', 'apple.com', 'amazon.com',
+            'facebook.com', 'twitter.com', 'github.com',
+        ];
+        const targetingProtected = intent.targets.some(t => protectedTargets.some(pt => t.toLowerCase().includes(pt)));
+        if (targetingProtected && !validation.valid) {
+            return {
+                authorized: false,
+                reason: 'Targeting protected production systems without explicit authorization',
+                warnings: [
+                    'Protected targets detected. Provide CTF/lab context or authorization scope.',
+                    ...validation.warnings,
+                ],
+            };
+        }
+        // Check for explicit authorization context
+        if (authContext) {
+            const authorizedContexts = ['ctf', 'lab', 'pentest', 'bug-bounty', 'authorized'];
+            const hasExplicitAuth = authorizedContexts.some(ctx => authContext.toLowerCase().includes(ctx));
+            if (hasExplicitAuth) {
+                return {
+                    authorized: true,
+                    reason: `Explicit authorization: ${authContext}`,
+                    warnings: validation.warnings,
+                };
+            }
+        }
+        return {
+            authorized: validation.valid,
+            reason: validation.type,
+            warnings: validation.warnings,
+        };
+    }
+    /**
+     * Execute an attack chain with TAO techniques.
+     * Returns results including all executed techniques and artifacts.
+     */
+    async executeAttackChain(request, options = {}) {
+        const intent = parseNaturalLanguageIntent(request);
+        const targets = options.targets ?? intent.targets;
+        // Normalize depth - map 'comprehensive' to 'deep'
+        const rawDepth = options.depth ?? intent.depth;
+        const depth = rawDepth === 'comprehensive' ? 'deep' : rawDepth;
+        const stealth = options.stealth ?? intent.constraints.includes('stealth');
+        // Validate authorization
+        const auth = this.validateAttackAuthorization(intent, options.authContext);
+        if (!auth.authorized) {
+            throw new Error(`Attack chain execution not authorized: ${auth.reason}`);
+        }
+        const executedTechniques = [];
+        const phasesCompleted = new Set();
+        const startTime = Date.now();
+        // Execute chain for each target
+        for (const target of targets) {
+            const chain = planAttackChain(intent, `Attack chain: ${target}`);
+            while (chain.state === 'planning' || chain.state === 'executing') {
+                const action = selectNextTechnique(chain);
+                if (!action)
+                    break;
+                const technique = techniqueRegistry.get(action.id);
+                if (!technique)
+                    continue;
+                const params = {
+                    target,
+                    depth,
+                    stealth,
+                    timeout: depth === 'deep' ? 60000 : depth === 'standard' ? 30000 : 10000,
+                    context: {
+                        chainId: chain.id,
+                        phase: technique.phase,
+                        previousArtifacts: executedTechniques
+                            .filter(t => t.success)
+                            .flatMap(t => t.artifacts),
+                    },
+                };
+                try {
+                    const { result } = await executeTechniqueInChain(chain, action, params);
+                    executedTechniques.push({
+                        id: technique.id,
+                        name: technique.name,
+                        phase: technique.phase,
+                        success: result.success,
+                        duration: result.duration,
+                        artifacts: result.artifacts,
+                    });
+                    if (result.success) {
+                        phasesCompleted.add(technique.phase);
+                    }
+                    options.onProgress?.(chain, technique.id, result);
+                }
+                catch (err) {
+                    // Log but continue chain execution
+                    executedTechniques.push({
+                        id: technique.id,
+                        name: technique.name,
+                        phase: technique.phase,
+                        success: false,
+                        duration: 0,
+                        artifacts: [{ type: 'error', data: String(err) }],
+                    });
+                }
+            }
+        }
+        const successCount = executedTechniques.filter(t => t.success).length;
+        return {
+            chain: planAttackChain(intent, request), // Return final chain state
+            techniques: executedTechniques,
+            totalDuration: Date.now() - startTime,
+            successRate: executedTechniques.length > 0
+                ? successCount / executedTechniques.length
+                : 0,
+            phasesCompleted: Array.from(phasesCompleted),
+        };
+    }
+    /**
+     * Run orchestration with optional attack chain integration.
+     * When attack chain mode is enabled, security operations are executed
+     * directly through TAO techniques rather than relying on LLM tool calls.
+     */
+    async runWithAttackChain(request, options = {}) {
+        const attackChainMode = options.attackChainMode ?? 'auto';
+        // Check if we should execute attack chain
+        const { shouldExecute, intent } = this.shouldExecuteAttackChain(request, attackChainMode);
+        if (!shouldExecute || !intent) {
+            // Fall back to normal orchestration
+            return this.runToCompletion(request, options);
+        }
+        // Validate authorization
+        const auth = this.validateAttackAuthorization(intent, options.authorizationContext);
+        if (!auth.authorized) {
+            return {
+                finalResponse: `Cannot execute security operation: ${auth.reason}\n\n${auth.warnings.join('\n')}`,
+                toolsUsed: [],
+                planOnly: false,
+                tookAction: false,
+                completion: {
+                    isComplete: true,
+                    confidence: 1.0,
+                    signals: {
+                        hasExplicitCompletionStatement: true,
+                        hasIncompleteWorkIndicators: false,
+                        hasPendingActionIndicators: false,
+                        hasErrorIndicators: false,
+                        hasFollowUpQuestions: false,
+                        toolsUsedInLastResponse: 0,
+                        lastToolWasReadOnly: false,
+                        consecutiveResponsesWithoutTools: 0,
+                        hasRecentFileWrites: false,
+                        hasRecentCommits: false,
+                        todoItemsPending: 0,
+                        todoItemsCompleted: 0,
+                        mentionsFutureWork: false,
+                        completionConfidence: 1.0,
+                    },
+                    reason: 'Authorization required',
+                    shouldVerify: false,
+                },
+                exitReason: 'attack-chain-aborted',
+                statusSummary: `Authorization required: ${auth.reason}`,
+                limitations: auth.warnings,
+                recommendations: [
+                    'Provide explicit authorization context (CTF, lab, pentest scope)',
+                    'Use --auth-context flag to specify authorization',
+                ],
+            };
+        }
+        // Execute attack chain
+        try {
+            // Normalize depth for attack chain
+            const attackRawDepth = options.attackDepth ?? intent.depth;
+            const attackDepth = attackRawDepth === 'comprehensive' ? 'deep' : attackRawDepth;
+            const chainResult = await this.executeAttackChain(request, {
+                targets: options.attackTargets ?? intent.targets,
+                depth: attackDepth,
+                stealth: options.stealthMode ?? intent.constraints.includes('stealth'),
+                authContext: options.authorizationContext,
+                onProgress: options.onAttackChainProgress,
+            });
+            // Build response summary
+            const summary = this.buildAttackChainSummary(chainResult);
+            return {
+                finalResponse: summary,
+                toolsUsed: chainResult.techniques.map(t => t.id),
+                planOnly: false,
+                tookAction: true,
+                completion: {
+                    isComplete: true,
+                    confidence: chainResult.successRate,
+                    signals: {
+                        hasExplicitCompletionStatement: true,
+                        hasIncompleteWorkIndicators: false,
+                        hasPendingActionIndicators: false,
+                        hasErrorIndicators: chainResult.successRate < 0.5,
+                        hasFollowUpQuestions: false,
+                        toolsUsedInLastResponse: chainResult.techniques.length,
+                        lastToolWasReadOnly: false,
+                        consecutiveResponsesWithoutTools: 0,
+                        hasRecentFileWrites: false,
+                        hasRecentCommits: false,
+                        todoItemsPending: 0,
+                        todoItemsCompleted: chainResult.techniques.length,
+                        mentionsFutureWork: false,
+                        completionConfidence: chainResult.successRate,
+                    },
+                    reason: 'Attack chain completed',
+                    shouldVerify: chainResult.successRate < 1.0,
+                },
+                exitReason: 'attack-chain-complete',
+                statusSummary: `Attack chain: ${chainResult.techniques.length} techniques, ${Math.round(chainResult.successRate * 100)}% success`,
+                limitations: [],
+                recommendations: chainResult.successRate < 1.0
+                    ? ['Review failed techniques and adjust approach']
+                    : [],
+                attackChainResult: chainResult,
+            };
+        }
+        catch (err) {
+            return {
+                finalResponse: `Attack chain execution failed: ${String(err)}`,
+                toolsUsed: [],
+                planOnly: false,
+                tookAction: false,
+                completion: {
+                    isComplete: true,
+                    confidence: 0,
+                    signals: {
+                        hasExplicitCompletionStatement: true,
+                        hasIncompleteWorkIndicators: false,
+                        hasPendingActionIndicators: false,
+                        hasErrorIndicators: true,
+                        hasFollowUpQuestions: false,
+                        toolsUsedInLastResponse: 0,
+                        lastToolWasReadOnly: false,
+                        consecutiveResponsesWithoutTools: 0,
+                        hasRecentFileWrites: false,
+                        hasRecentCommits: false,
+                        todoItemsPending: 0,
+                        todoItemsCompleted: 0,
+                        mentionsFutureWork: false,
+                        completionConfidence: 0,
+                    },
+                    reason: `Error: ${String(err)}`,
+                    shouldVerify: false,
+                },
+                exitReason: 'attack-chain-aborted',
+                statusSummary: `Attack chain failed: ${String(err)}`,
+                limitations: [String(err)],
+                recommendations: ['Check target connectivity', 'Verify authorization context'],
+            };
+        }
+    }
+    /**
+     * Build a human-readable summary of attack chain execution.
+     */
+    buildAttackChainSummary(result) {
+        const lines = [];
+        lines.push('## Attack Chain Execution Summary\n');
+        // Overall stats
+        lines.push(`**Duration:** ${Math.round(result.totalDuration / 1000)}s`);
+        lines.push(`**Success Rate:** ${Math.round(result.successRate * 100)}%`);
+        lines.push(`**Phases Completed:** ${result.phasesCompleted.join(', ')}\n`);
+        // Technique breakdown
+        lines.push('### Techniques Executed\n');
+        const byPhase = new Map();
+        for (const tech of result.techniques) {
+            const list = byPhase.get(tech.phase) || [];
+            list.push(tech);
+            byPhase.set(tech.phase, list);
+        }
+        for (const [phase, techniques] of byPhase) {
+            lines.push(`#### ${phase}`);
+            for (const tech of techniques) {
+                const status = tech.success ? '✓' : '✗';
+                lines.push(`- ${status} **${tech.name}** (${Math.round(tech.duration / 1000)}s)`);
+                if (tech.artifacts.length > 0) {
+                    lines.push(`  - Artifacts: ${tech.artifacts.length} collected`);
+                }
+            }
+            lines.push('');
+        }
+        // Artifacts summary
+        const allArtifacts = result.techniques.flatMap(t => t.artifacts);
+        if (allArtifacts.length > 0) {
+            lines.push('### Collected Artifacts\n');
+            const artifactsByType = new Map();
+            for (const artifact of allArtifacts) {
+                artifactsByType.set(artifact.type, (artifactsByType.get(artifact.type) || 0) + 1);
+            }
+            for (const [type, count] of artifactsByType) {
+                lines.push(`- **${type}:** ${count}`);
+            }
+        }
+        return lines.join('\n');
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // UNIFIED ORCHESTRATION - FULL STACK INTEGRATION
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /** Goal-to-technique mapping for goal-oriented execution */
+    goalTechniques = {
+        reconnaissance: [
+            'dns_enum', 'whois_recon', 'asn_lookup', 'subdomain_enum', 'dns_zone_transfer',
+            'ssl_analysis', 'ct_search', 'web_fingerprint', 'tech_fingerprint',
+            'cloud_detect', 's3_enum', 'gcs_enum', 'azure_enum', 'email_security',
+            'port_scan', 'service_enum', 'api_discovery', 'git_analysis',
+        ],
+        access: [
+            'credential_spray', 'exploit_attempt', 'cloud_metadata', 'container_escape',
+        ],
+        persistence: [
+            'persistence', 'sched_persist', 'ssh_persist', 'c2_beacon',
+        ],
+        privilege: [
+            'privesc', 'credential_harvest', 'memory_dump', 'cloud_creds',
+        ],
+        lateral: [
+            'lateral_move', 'network_discovery', 'smb_enum', 'ssh_enum',
+        ],
+        collection: [
+            'file_discovery', 'data_discovery', 'process_enum', 'cloud_enum',
+            'credential_harvest', 'git_analysis', 'api_surface_map',
+        ],
+        exfiltration: [
+            'data_staging', 'exfil', 'c2_beacon',
+        ],
+        impact: [
+            'service_disruption', 'resource_exhaustion', 'cleanup',
+        ],
+        stealth: [
+            'cleanup', 'process_enum', 'network_discovery',
+        ],
+        all: [], // Dynamically populated
+    };
+    /**
+     * Unified orchestration entry point.
+     * Routes to appropriate execution strategy based on mode and options.
+     *
+     * This is the primary method for full-stack unified orchestration that
+     * combines LLM-driven orchestration with direct TAO technique execution,
+     * infrastructure deployment, and goal-oriented APT simulation.
+     */
+    async runUnified(request, options = {}) {
+        const mode = options.unifiedMode || this.detectMode(request, options);
+        switch (mode) {
+            case 'attack-chain':
+                return this.runWithAttackChain(request, options);
+            case 'apt-simulation':
+                return this.runAPTSimulation(request, options);
+            case 'infrastructure':
+                return this.runInfrastructureMode(request, options);
+            case 'red-team':
+                return this.runRedTeamMode(request, options);
+            case 'intel-collection':
+                return this.runIntelCollectionMode(request, options);
+            case 'compliance':
+                return this.runComplianceMode(request, options);
+            case 'standard':
+            default:
+                // Check for goal-oriented execution
+                if (options.goal || options.goals) {
+                    return this.runGoalOriented(request, options);
+                }
+                return this.runToCompletion(request, options);
+        }
+    }
+    /**
+     * Auto-detect the appropriate orchestration mode from request content.
+     */
+    detectMode(request, options) {
+        const lower = request.toLowerCase();
+        // Check for explicit goals first
+        if (options.goal || options.goals) {
+            return 'attack-chain';
+        }
+        // Infrastructure keywords
+        if (lower.includes('infrastructure') || lower.includes('deploy') ||
+            lower.includes('c2 server') || lower.includes('redirector')) {
+            return 'infrastructure';
+        }
+        // Compliance keywords
+        if (lower.includes('compliance') || lower.includes('audit') ||
+            lower.includes('legal') || lower.includes('framework')) {
+            return 'compliance';
+        }
+        // Intel collection keywords
+        if (lower.includes('intelligence') || lower.includes('osint') ||
+            lower.includes('gather') || lower.includes('collect')) {
+            return 'intel-collection';
+        }
+        // Red team keywords
+        if (lower.includes('red team') || lower.includes('adversary') ||
+            lower.includes('full simulation')) {
+            return 'red-team';
+        }
+        // APT simulation keywords
+        if (lower.includes('apt') || lower.includes('kill chain') ||
+            lower.includes('kill-chain') || lower.includes('attack chain')) {
+            return 'apt-simulation';
+        }
+        // Security operation keywords (attack chain)
+        const securityKeywords = ['scan', 'recon', 'enumerate', 'exploit', 'pentest', 'hack'];
+        if (securityKeywords.some(kw => lower.includes(kw))) {
+            return 'attack-chain';
+        }
+        return 'standard';
+    }
+    /**
+     * Run full APT simulation with all kill-chain phases.
+     */
+    async runAPTSimulation(request, options) {
+        const startTime = Date.now();
+        const intent = parseNaturalLanguageIntent(request);
+        const targets = options.attackTargets ?? intent.targets;
+        const depth = this.normalizeDepth(options.attackDepth ?? intent.depth);
+        const stealth = options.stealthMode ?? intent.constraints.includes('stealth');
+        // Validate authorization
+        const auth = this.validateAttackAuthorization(intent, options.authorizationContext);
+        if (!auth.authorized) {
+            return this.buildAuthorizationError(auth);
+        }
+        const realExecutions = [];
+        const completedPhases = new Set();
+        const allArtifacts = [];
+        // APT Kill Chain Phases
+        const killChainPhases = [
+            'reconnaissance',
+            'weaponization',
+            'delivery',
+            'exploitation',
+            'installation',
+            'command-control',
+            'actions-on-objectives',
+        ];
+        // Execute techniques for each target
+        for (const target of targets) {
+            const chain = planAttackChain(intent, `APT Simulation: ${target}`);
+            for (const phase of killChainPhases) {
+                const phaseTechniques = techniqueRegistry.getByPhase(phase);
+                const techniqueLimit = depth === 'quick' ? 2 : depth === 'standard' ? 4 : phaseTechniques.length;
+                for (const technique of phaseTechniques.slice(0, techniqueLimit)) {
+                    if (stealth && technique.stealthRating < 0.3)
+                        continue;
+                    options.onTechniqueStart?.(technique.id, target);
+                    try {
+                        const result = await technique.execute({
+                            target,
+                            depth,
+                            stealth,
+                            timeout: depth === 'deep' ? 60000 : 30000,
+                            context: { chainId: chain.id, phase },
+                        });
+                        const execResult = {
+                            techniqueId: technique.id,
+                            techniqueName: technique.name,
+                            phase,
+                            success: result.success,
+                            duration: result.duration,
+                            artifacts: result.artifacts,
+                            detectionRisk: result.detectionRisk,
+                            nextTechniques: result.nextTechniques,
+                        };
+                        realExecutions.push(execResult);
+                        allArtifacts.push(...result.artifacts);
+                        options.onTechniqueComplete?.(execResult);
+                        if (result.success) {
+                            completedPhases.add(phase);
+                        }
+                        // Stealth abort if detection risk too high
+                        if (stealth && result.detectionRisk > 0.7)
+                            break;
+                    }
+                    catch {
+                        realExecutions.push({
+                            techniqueId: technique.id,
+                            techniqueName: technique.name,
+                            phase,
+                            success: false,
+                            duration: 0,
+                            artifacts: [],
+                            detectionRisk: 0.5,
+                            nextTechniques: [],
+                        });
+                    }
+                }
+            }
+        }
+        const metrics = this.computeMetrics(realExecutions, startTime);
+        return {
+            finalResponse: this.buildExecutionSummary(realExecutions, metrics, 'APT Simulation'),
+            toolsUsed: realExecutions.map(r => `tao:${r.techniqueId}`),
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis(metrics),
+            exitReason: metrics.successfulTechniques > 0 ? 'attack-chain-complete' : 'attack-chain-aborted',
+            statusSummary: `APT: ${metrics.successfulTechniques}/${metrics.totalTechniquesExecuted} techniques`,
+            limitations: [],
+            recommendations: this.buildRecommendations(realExecutions),
+            realExecutions,
+            realMetrics: metrics,
+            attackChains: listActiveChains(),
+            attackChainPhases: Array.from(completedPhases),
+            collectedArtifacts: allArtifacts,
+        };
+    }
+    /**
+     * Run infrastructure deployment mode.
+     */
+    async runInfrastructureMode(request, options) {
+        const region = options.region || 'us';
+        const stack = getInfrastructureStack(region);
+        if (!stack) {
+            return {
+                finalResponse: `No infrastructure stack available for region: ${region}`,
+                toolsUsed: [],
+                planOnly: false,
+                tookAction: false,
+                completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 0, successfulTechniques: 0, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+                exitReason: 'incomplete',
+                statusSummary: 'No infrastructure stack',
+                limitations: [`Region '${region}' not supported`],
+                recommendations: ['Use us or ukraine region'],
+            };
+        }
+        const deployScript = generateDeploymentScript(stack);
+        const teardownScript = generateTeardownScript(stack);
+        const opsecList = generateOpsecChecklist(stack);
+        options.onInfrastructure?.(stack);
+        return {
+            finalResponse: `## Infrastructure Stack: ${stack.name}\n\n` +
+                `**Region:** ${stack.region}\n` +
+                `**Components:** ${stack.components.length}\n` +
+                `**Persistence Mechanisms:** ${stack.persistence.length}\n` +
+                `**Monthly Cost:** $${stack.costEstimate.monthly}\n\n` +
+                `### Components\n${stack.components.map(c => `- ${c.name} (${c.type})`).join('\n')}\n\n` +
+                `### Deployment Script Generated\n### Teardown Script Generated\n### OPSEC Checklist Generated`,
+            toolsUsed: ['infrastructure-deploy', 'script-generator'],
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 1, successfulTechniques: 1, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+            exitReason: 'complete',
+            statusSummary: `Infrastructure: ${stack.components.length} components`,
+            limitations: [],
+            recommendations: ['Review OPSEC checklist before deployment'],
+            infrastructureStack: stack,
+            deploymentScript: deployScript,
+            teardownScript: teardownScript,
+            opsecChecklist: opsecList,
+        };
+    }
+    /**
+     * Run combined red team mode.
+     */
+    async runRedTeamMode(request, options) {
+        // Red team combines infrastructure + APT simulation
+        const infraResult = await this.runInfrastructureMode(request, options);
+        const aptResult = await this.runAPTSimulation(request, {
+            ...options,
+            attackDepth: 'deep',
+            stealthMode: true,
+        });
+        return {
+            ...aptResult,
+            finalResponse: `## Red Team Operation\n\n${infraResult.finalResponse}\n\n---\n\n${aptResult.finalResponse}`,
+            toolsUsed: [...infraResult.toolsUsed, ...aptResult.toolsUsed],
+            infrastructureStack: infraResult.infrastructureStack,
+            deploymentScript: infraResult.deploymentScript,
+            teardownScript: infraResult.teardownScript,
+            opsecChecklist: infraResult.opsecChecklist,
+            statusSummary: `Red Team: ${aptResult.realMetrics?.successfulTechniques || 0} techniques + ${infraResult.infrastructureStack?.components.length || 0} infra components`,
+        };
+    }
+    /**
+     * Run intelligence collection mode.
+     */
+    async runIntelCollectionMode(request, options) {
+        return this.runGoalOriented(request, {
+            ...options,
+            goals: ['reconnaissance', 'collection'],
+            collectIntel: true,
+            minimizeFootprint: true,
+        });
+    }
+    /**
+     * Run compliance mode with legal frameworks.
+     */
+    async runComplianceMode(request, options) {
+        const agencyTypes = options.agencyTypes || ['federal-le', 'regulatory'];
+        const contacts = agencyTypes.flatMap(at => getAgencyContacts(at));
+        const frameworks = getApplicableLegalFrameworks(agencyTypes);
+        const response = `## Compliance Analysis\n\n` +
+            `### Applicable Legal Frameworks\n` +
+            frameworks.map(f => `- **${f.name}** (${f.jurisdiction})\n  Requirements: ${f.requirements.length}`).join('\n') +
+            `\n\n### Agency Contacts\n` +
+            contacts.map(c => `- **${c.agency}** - ${c.division}\n  Contact: ${c.contact.email}`).join('\n');
+        return {
+            finalResponse: response,
+            toolsUsed: ['compliance-check'],
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 1, successfulTechniques: 1, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+            exitReason: 'complete',
+            statusSummary: `Compliance: ${frameworks.length} frameworks`,
+            limitations: [],
+            recommendations: frameworks.flatMap(f => f.requirements.map(r => r.requirement)),
+        };
+    }
+    /**
+     * Run goal-oriented APT execution.
+     */
+    async runGoalOriented(request, options) {
+        const startTime = Date.now();
+        const goals = options.goals || (options.goal ? [options.goal] : ['reconnaissance']);
+        const targets = options.attackTargets || [];
+        const depth = this.normalizeDepth(options.attackDepth ?? 'standard');
+        const stealth = options.stealthMode ?? options.minimizeFootprint ?? false;
+        // Build technique list from goals
+        let techniques = [];
+        for (const goal of goals) {
+            if (goal === 'all') {
+                techniques = techniqueRegistry.list().map(t => t.id);
+                break;
+            }
+            techniques.push(...(this.goalTechniques[goal] || []));
+        }
+        techniques = [...new Set(techniques)];
+        const realExecutions = [];
+        const achievedGoals = [];
+        const allArtifacts = [];
+        // Execute techniques
+        for (const target of targets) {
+            for (const techniqueId of techniques) {
+                const technique = techniqueRegistry.get(techniqueId);
+                if (!technique)
+                    continue;
+                if (stealth && technique.stealthRating < 0.3)
+                    continue;
+                options.onTechniqueStart?.(techniqueId, target);
+                try {
+                    const result = await technique.execute({
+                        target,
+                        depth,
+                        stealth,
+                        timeout: 60000,
+                        context: {},
+                    });
+                    const execResult = {
+                        techniqueId: technique.id,
+                        techniqueName: technique.name,
+                        phase: technique.phase,
+                        success: result.success,
+                        duration: result.duration,
+                        artifacts: result.artifacts,
+                        detectionRisk: result.detectionRisk,
+                        nextTechniques: result.nextTechniques,
+                    };
+                    realExecutions.push(execResult);
+                    allArtifacts.push(...result.artifacts);
+                    options.onTechniqueComplete?.(execResult);
+                    // Check goal achievement
+                    for (const goal of goals) {
+                        if (!achievedGoals.includes(goal)) {
+                            const goalTechs = this.goalTechniques[goal] || [];
+                            if (goalTechs.includes(techniqueId) && result.success) {
+                                achievedGoals.push(goal);
+                                options.onGoalAchieved?.(goal, result.artifacts);
+                            }
+                        }
+                    }
+                    if (stealth && result.detectionRisk > 0.7)
+                        break;
+                }
+                catch {
+                    realExecutions.push({
+                        techniqueId: technique.id,
+                        techniqueName: technique.name,
+                        phase: technique.phase,
+                        success: false,
+                        duration: 0,
+                        artifacts: [],
+                        detectionRisk: 0.5,
+                        nextTechniques: [],
+                    });
+                }
+            }
+            // Maintain persistence if requested
+            if (options.maintainAccess) {
+                for (const persistTech of ['persistence', 'sched_persist', 'ssh_persist']) {
+                    const technique = techniqueRegistry.get(persistTech);
+                    if (technique) {
+                        try {
+                            await technique.execute({ target, depth, stealth, timeout: 30000, context: {} });
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+            }
+        }
+        const metrics = this.computeMetrics(realExecutions, startTime);
+        return {
+            finalResponse: this.buildExecutionSummary(realExecutions, metrics, `Goal-Oriented: ${goals.join(', ')}`),
+            toolsUsed: realExecutions.map(r => r.techniqueId),
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis(metrics),
+            exitReason: metrics.successfulTechniques > 0 ? 'attack-chain-complete' : 'attack-chain-aborted',
+            statusSummary: `Goals: ${achievedGoals.length}/${goals.length} achieved`,
+            limitations: [],
+            recommendations: this.buildRecommendations(realExecutions),
+            realExecutions,
+            realMetrics: metrics,
+            attackChains: listActiveChains(),
+            achievedGoals,
+            collectedArtifacts: allArtifacts,
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // HELPER METHODS
+    // ═══════════════════════════════════════════════════════════════════════════════
+    normalizeDepth(depth) {
+        if (depth === 'quick' || depth === 'standard' || depth === 'deep') {
+            return depth;
+        }
+        return 'standard';
+    }
+    computeMetrics(executions, startTime) {
+        const successful = executions.filter(e => e.success).length;
+        const rlState = getRLState();
+        return {
+            totalTechniquesExecuted: executions.length,
+            successfulTechniques: successful,
+            failedTechniques: executions.length - successful,
+            totalDuration: Date.now() - startTime,
+            averageDetectionRisk: executions.length > 0
+                ? executions.reduce((s, e) => s + e.detectionRisk, 0) / executions.length
+                : 0,
+            phasesCompleted: [...new Set(executions.filter(e => e.success).map(e => e.phase))],
+            artifactsCollected: executions.reduce((s, e) => s + e.artifacts.length, 0),
+            rlRewardAverage: rlState.avgReward,
+        };
+    }
+    buildCompletionAnalysis(metrics) {
+        const confidence = metrics.totalTechniquesExecuted > 0
+            ? metrics.successfulTechniques / metrics.totalTechniquesExecuted
+            : 0;
+        return {
+            isComplete: true,
+            confidence,
+            signals: {
+                hasExplicitCompletionStatement: true,
+                hasIncompleteWorkIndicators: false,
+                hasPendingActionIndicators: false,
+                hasErrorIndicators: metrics.failedTechniques > metrics.successfulTechniques,
+                hasFollowUpQuestions: false,
+                toolsUsedInLastResponse: metrics.totalTechniquesExecuted,
+                lastToolWasReadOnly: false,
+                consecutiveResponsesWithoutTools: 0,
+                hasRecentFileWrites: false,
+                hasRecentCommits: false,
+                todoItemsPending: 0,
+                todoItemsCompleted: metrics.successfulTechniques,
+                mentionsFutureWork: false,
+                completionConfidence: confidence,
+            },
+            reason: 'Unified execution complete',
+            shouldVerify: confidence < 0.8,
+        };
+    }
+    buildAuthorizationError(auth) {
+        return {
+            finalResponse: `## Authorization Required\n\n${auth.reason}\n\n### Warnings\n${auth.warnings.map(w => `- ${w}`).join('\n')}`,
+            toolsUsed: [],
+            planOnly: false,
+            tookAction: false,
+            completion: {
+                isComplete: true,
+                confidence: 1.0,
+                signals: {
+                    hasExplicitCompletionStatement: true,
+                    hasIncompleteWorkIndicators: false,
+                    hasPendingActionIndicators: false,
+                    hasErrorIndicators: false,
+                    hasFollowUpQuestions: true,
+                    toolsUsedInLastResponse: 0,
+                    lastToolWasReadOnly: false,
+                    consecutiveResponsesWithoutTools: 0,
+                    hasRecentFileWrites: false,
+                    hasRecentCommits: false,
+                    todoItemsPending: 0,
+                    todoItemsCompleted: 0,
+                    mentionsFutureWork: false,
+                    completionConfidence: 1.0,
+                },
+                reason: 'Authorization required',
+                shouldVerify: false,
+            },
+            exitReason: 'attack-chain-aborted',
+            statusSummary: `Authorization required: ${auth.reason}`,
+            limitations: auth.warnings,
+            recommendations: [
+                'Provide CTF/lab context',
+                'Specify pentest authorization',
+                'Use --auth-context flag',
+            ],
+        };
+    }
+    buildExecutionSummary(executions, metrics, title) {
+        const lines = [];
+        lines.push(`## ${title} Execution Summary\n`);
+        lines.push(`**Total Techniques:** ${metrics.totalTechniquesExecuted}`);
+        lines.push(`**Successful:** ${metrics.successfulTechniques}`);
+        lines.push(`**Failed:** ${metrics.failedTechniques}`);
+        lines.push(`**Duration:** ${(metrics.totalDuration / 1000).toFixed(1)}s`);
+        lines.push(`**Detection Risk:** ${(metrics.averageDetectionRisk * 100).toFixed(1)}%`);
+        lines.push(`**Artifacts:** ${metrics.artifactsCollected}`);
+        lines.push(`**Phases:** ${metrics.phasesCompleted.join(', ') || 'none'}`);
+        lines.push('');
+        lines.push(`### Technique Results\n`);
+        for (const exec of executions) {
+            const status = exec.success ? '✓' : '✗';
+            lines.push(`**${status} ${exec.techniqueName}** (${exec.phase})`);
+            lines.push(`- Duration: ${exec.duration}ms`);
+            lines.push(`- Risk: ${(exec.detectionRisk * 100).toFixed(0)}%`);
+            if (exec.artifacts.length > 0) {
+                lines.push(`- Artifacts: ${exec.artifacts.length}`);
+            }
+            lines.push('');
+        }
+        return lines.join('\n');
+    }
+    buildRecommendations(executions) {
+        const recommendations = [];
+        const failed = executions.filter(e => !e.success);
+        if (failed.length > 0) {
+            recommendations.push(`Review ${failed.length} failed technique(s)`);
+        }
+        const highRisk = executions.filter(e => e.detectionRisk > 0.7);
+        if (highRisk.length > 0) {
+            recommendations.push(`${highRisk.length} technique(s) have high detection risk`);
+        }
+        const nextTechniques = [...new Set(executions.flatMap(e => e.nextTechniques))];
+        if (nextTechniques.length > 0) {
+            recommendations.push(`Consider: ${nextTechniques.slice(0, 5).join(', ')}`);
+        }
+        return recommendations;
+    }
 }
 //# sourceMappingURL=agentOrchestrator.js.map