erosolar-cli 2.1.243 → 2.1.244

package/dist/tools/unifiedInvestigationTools.js

@@ -0,0 +1,851 @@
+/**
+ * Unified Tech Fraud Investigation Tools
+ *
+ * CLI tool suite for investigating tech company fraud across:
+ * - Apple iMessage (via existing iMessageVerificationTools)
+ * - Google Gmail (hidden threads, draft manipulation, unauthorized access)
+ * - Google Chrome (unauthorized launches, session hijacking, history manipulation)
+ * - Cross-platform correlation
+ *
+ * Tools:
+ * - Investigation: Manage investigations
+ * - GmailInvestigate: Gmail manipulation detection
+ * - ChromeInvestigate: Chrome browser control detection
+ * - CorrelateEvidence: Cross-vector correlation
+ * - FraudReport: Generate unified reports
+ */
+import * as path from 'node:path';
+import { UnifiedFraudOrchestrator, GOOGLE_GMAIL_CLAIMS, GOOGLE_CHROME_CLAIMS, } from '../core/unifiedFraudOrchestrator.js';
+// ═══════════════════════════════════════════════════════════════════════════════
+// TOOL SUITE FACTORY
+// ═══════════════════════════════════════════════════════════════════════════════
+export function createUnifiedInvestigationTools(workingDir = process.cwd()) {
+    // Orchestrator instance (lazy initialization)
+    let orchestratorInstance = null;
+    const getOrchestrator = async () => {
+        if (!orchestratorInstance) {
+            orchestratorInstance = new UnifiedFraudOrchestrator(workingDir);
+            await orchestratorInstance.initialize();
+        }
+        return orchestratorInstance;
+    };
+    return {
+        id: 'unified-investigation',
+        description: 'Unified tech fraud investigation across Apple, Google, and other platforms',
+        tools: [
+            // ─────────────────────────────────────────────────────────────────────────
+            // Investigation Management
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'Investigation',
+                description: `Manage fraud investigations across tech companies.
+
+Create and manage investigations that span multiple fraud vectors:
+- Apple: iMessage key substitution, false E2E claims
+- Google: Gmail manipulation, Chrome browser control
+- Cross-platform: Coordinated manipulation detection
+
+Operations:
+- create: Start a new investigation
+- list: List all investigations
+- status: Get investigation status
+- activate: Set investigation to active
+- correlate: Run cross-vector correlation
+- report: Generate investigation report
+- export: Export for legal proceedings`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['create', 'list', 'status', 'activate', 'correlate', 'report', 'export'],
+                            description: 'Operation to perform',
+                        },
+                        name: {
+                            type: 'string',
+                            description: 'Investigation name (for create)',
+                        },
+                        target: {
+                            type: 'string',
+                            enum: ['apple', 'google', 'meta', 'microsoft', 'amazon'],
+                            description: 'Primary investigation target (for create)',
+                        },
+                        vectors: {
+                            type: 'array',
+                            items: { type: 'string' },
+                            description: 'Fraud vectors to investigate',
+                        },
+                        investigationId: {
+                            type: 'string',
+                            description: 'Investigation ID (for status/activate/correlate/report/export)',
+                        },
+                        outputDir: {
+                            type: 'string',
+                            description: 'Output directory (for export)',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const orchestrator = await getOrchestrator();
+                    switch (operation) {
+                        case 'create': {
+                            const name = args['name'];
+                            const target = args['target'];
+                            const vectors = args['vectors'] || [];
+                            if (!name || !target) {
+                                return JSON.stringify({
+                                    success: false,
+                                    error: 'name and target required',
+                                    availableTargets: ['apple', 'google', 'meta', 'microsoft', 'amazon'],
+                                    availableVectors: [
+                                        'imessage_key_substitution', 'imessage_false_e2e',
+                                        'gmail_hidden_threads', 'gmail_draft_manipulation', 'gmail_unauthorized_access', 'gmail_filter_tampering',
+                                        'chrome_unauthorized_launch', 'chrome_session_hijacking', 'chrome_history_manipulation',
+                                        'cross_platform_surveillance', 'coordinated_manipulation',
+                                    ],
+                                });
+                            }
+                            const investigation = await orchestrator.createInvestigation({
+                                name,
+                                target,
+                                vectors: vectors.length > 0 ? vectors : getDefaultVectors(target),
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'create',
+                                investigation: {
+                                    id: investigation.id,
+                                    name: investigation.name,
+                                    target: investigation.target,
+                                    vectors: investigation.vectors,
+                                    status: investigation.status,
+                                    evidenceChainId: investigation.evidenceChainId,
+                                },
+                                message: `Investigation "${name}" created. Use investigationId: ${investigation.id} for subsequent operations.`,
+                            });
+                        }
+                        case 'list': {
+                            const investigations = orchestrator.getInvestigations();
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'list',
+                                count: investigations.length,
+                                investigations: investigations.map(i => ({
+                                    id: i.id,
+                                    name: i.name,
+                                    target: i.target,
+                                    status: i.status,
+                                    findingCount: i.findings.length,
+                                    correlationCount: i.correlations.length,
+                                    created: i.created,
+                                    lastActivity: i.lastActivity,
+                                })),
+                            });
+                        }
+                        case 'status': {
+                            const investigationId = args['investigationId'];
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const investigations = orchestrator.getInvestigations();
+                            const investigation = investigations.find(i => i.id === investigationId);
+                            if (!investigation) {
+                                return JSON.stringify({ success: false, error: `Investigation not found: ${investigationId}` });
+                            }
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'status',
+                                investigation: {
+                                    id: investigation.id,
+                                    name: investigation.name,
+                                    target: investigation.target,
+                                    vectors: investigation.vectors,
+                                    status: investigation.status,
+                                    created: investigation.created,
+                                    lastActivity: investigation.lastActivity,
+                                    findingCount: investigation.findings.length,
+                                    correlationCount: investigation.correlations.length,
+                                    hash: investigation.hash,
+                                },
+                            });
+                        }
+                        case 'activate': {
+                            const investigationId = args['investigationId'];
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const investigation = await orchestrator.updateInvestigationStatus(investigationId, 'active');
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'activate',
+                                investigationId: investigation.id,
+                                status: investigation.status,
+                                message: `Investigation "${investigation.name}" is now active. Begin collecting evidence.`,
+                            });
+                        }
+                        case 'correlate': {
+                            const investigationId = args['investigationId'];
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const correlations = await orchestrator.correlateFindings(investigationId);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'correlate',
+                                investigationId,
+                                newCorrelations: correlations.length,
+                                correlations: correlations.map(c => ({
+                                    id: c.id,
+                                    type: c.correlationType,
+                                    description: c.description,
+                                    confidence: c.confidence,
+                                    implications: c.implications,
+                                })),
+                                message: correlations.length > 0
+                                    ? `Found ${correlations.length} cross-vector correlations. These may indicate coordinated manipulation.`
+                                    : 'No new correlations detected.',
+                            });
+                        }
+                        case 'report': {
+                            const investigationId = args['investigationId'];
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const report = await orchestrator.generateUnifiedReport(investigationId);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'report',
+                                report: {
+                                    investigation: {
+                                        id: report.investigation.id,
+                                        name: report.investigation.name,
+                                        target: report.investigation.target,
+                                        status: report.investigation.status,
+                                    },
+                                    summary: report.summary,
+                                    findingsByVector: Object.entries(report.byVector).map(([vector, data]) => ({
+                                        vector,
+                                        severity: data.severity,
+                                        findingCount: data.findings.length,
+                                    })),
+                                    correlationCount: report.correlations.length,
+                                    legalSummary: report.legalSummary,
+                                },
+                            });
+                        }
+                        case 'export': {
+                            const investigationId = args['investigationId'];
+                            const outputDir = args['outputDir'] || path.join(workingDir, 'evidence-export');
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const exportPath = await orchestrator.exportForLitigation(investigationId, outputDir);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'export',
+                                exportPath,
+                                message: `Evidence exported to ${exportPath}. Contains unified report, all findings, correlations, and legal summary.`,
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Gmail Investigation
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'GmailInvestigate',
+                description: `Investigate Gmail manipulation by Google.
+
+Detects:
+- Hidden threads (visible via API but hidden in UI)
+- Draft manipulation (unauthorized changes, sends)
+- Unauthorized access (Google accessing your account)
+- Filter tampering (filters added without consent)
+
+Operations:
+- recordThread: Record thread observation
+- recordDraft: Record draft observation
+- recordAccess: Record access event
+- recordFilter: Record filter observation
+- crossReference: Compare different data sources
+- findings: List all Gmail findings
+- claims: Show Google's claims vs reality`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['recordThread', 'recordDraft', 'recordAccess', 'recordFilter', 'crossReference', 'findings', 'claims'],
+                            description: 'Operation to perform',
+                        },
+                        // Thread params
+                        threadId: { type: 'string' },
+                        messageIds: { type: 'array', items: { type: 'string' } },
+                        subject: { type: 'string' },
+                        labels: { type: 'array', items: { type: 'string' } },
+                        isVisible: { type: 'boolean' },
+                        isInSearch: { type: 'boolean' },
+                        lastMessageDate: { type: 'string' },
+                        participantCount: { type: 'number' },
+                        captureMethod: { type: 'string', enum: ['api', 'ui_scrape', 'network_capture', 'takeout'] },
+                        rawData: { type: 'string' },
+                        // Draft params
+                        draftId: { type: 'string' },
+                        recipientCount: { type: 'number' },
+                        bodyContent: { type: 'string' },
+                        hasAttachments: { type: 'boolean' },
+                        createdAt: { type: 'string' },
+                        modifiedAt: { type: 'string' },
+                        // Access params
+                        accessType: { type: 'string', enum: ['login', 'api_access', 'imap', 'pop', 'oauth_grant', 'security_event'] },
+                        ipAddress: { type: 'string' },
+                        location: { type: 'string' },
+                        userAgent: { type: 'string' },
+                        deviceType: { type: 'string' },
+                        wasUser: { type: 'boolean' },
+                        // Filter params
+                        filterId: { type: 'string' },
+                        criteria: { type: 'object' },
+                        actions: { type: 'object' },
+                        createdByUser: { type: 'boolean' },
+                        // Cross-reference params
+                        apiThreadIds: { type: 'array', items: { type: 'string' } },
+                        uiThreadIds: { type: 'array', items: { type: 'string' } },
+                        takeoutThreadIds: { type: 'array', items: { type: 'string' } },
+                        imapThreadIds: { type: 'array', items: { type: 'string' } },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const orchestrator = await getOrchestrator();
+                    const gmailEngine = orchestrator.getGmailEngine();
+                    switch (operation) {
+                        case 'recordThread': {
+                            const result = await gmailEngine.recordThreadObservation({
+                                threadId: args['threadId'],
+                                messageIds: args['messageIds'] || [],
+                                subject: args['subject'] || '',
+                                labels: args['labels'] || [],
+                                isVisible: args['isVisible'] ?? true,
+                                isInSearch: args['isInSearch'] ?? true,
+                                lastMessageDate: args['lastMessageDate'] || new Date().toISOString(),
+                                participantCount: args['participantCount'] || 0,
+                                captureMethod: args['captureMethod'] || 'api',
+                                rawData: args['rawData'],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordThread',
+                                observation: {
+                                    id: result.observation.id,
+                                    threadId: result.observation.threadId,
+                                    isVisible: result.observation.isVisible,
+                                    isInSearch: result.observation.isInSearch,
+                                    hash: result.observation.hash,
+                                },
+                                anomalyDetected: result.anomalyDetected,
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.anomalyDetected
+                                    ? `⚠️ ANOMALY DETECTED: ${result.finding?.title}`
+                                    : 'Thread observation recorded.',
+                            });
+                        }
+                        case 'recordDraft': {
+                            const result = await gmailEngine.recordDraftObservation({
+                                draftId: args['draftId'],
+                                threadId: args['threadId'],
+                                subject: args['subject'] || '',
+                                recipientCount: args['recipientCount'] || 0,
+                                bodyContent: args['bodyContent'] || '',
+                                hasAttachments: args['hasAttachments'] ?? false,
+                                createdAt: args['createdAt'] || new Date().toISOString(),
+                                modifiedAt: args['modifiedAt'] || new Date().toISOString(),
+                                captureMethod: args['captureMethod'] || 'api',
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordDraft',
+                                observation: {
+                                    id: result.observation.id,
+                                    draftId: result.observation.draftId,
+                                    bodyHash: result.observation.bodyHash,
+                                    hash: result.observation.hash,
+                                },
+                                changes: result.changes,
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.changes.length > 0
+                                    ? `⚠️ DRAFT CHANGES DETECTED: ${result.changes.map(c => c.reason).join('; ')}`
+                                    : 'Draft observation recorded.',
+                            });
+                        }
+                        case 'recordAccess': {
+                            const result = await gmailEngine.recordAccessLog({
+                                accessType: args['accessType'],
+                                ipAddress: args['ipAddress'],
+                                location: args['location'],
+                                userAgent: args['userAgent'],
+                                deviceType: args['deviceType'],
+                                wasUser: args['wasUser'] ?? true,
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordAccess',
+                                log: {
+                                    id: result.log.id,
+                                    accessType: result.log.accessType,
+                                    ipAddress: result.log.ipAddress,
+                                    suspicious: result.log.suspicious,
+                                    reason: result.log.reason,
+                                    hash: result.log.hash,
+                                },
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.log.suspicious
+                                    ? `🚨 SUSPICIOUS ACCESS: ${result.log.reason}`
+                                    : 'Access logged.',
+                            });
+                        }
+                        case 'recordFilter': {
+                            const result = await gmailEngine.recordFilterObservation({
+                                filterId: args['filterId'],
+                                criteria: args['criteria'] || {},
+                                actions: args['actions'] || {},
+                                createdByUser: args['createdByUser'] ?? false,
+                                createdAt: args['createdAt'],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordFilter',
+                                observation: {
+                                    id: result.observation.id,
+                                    filterId: result.observation.filterId,
+                                    createdByUser: result.observation.createdByUser,
+                                    hash: result.observation.hash,
+                                },
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.finding
+                                    ? `⚠️ SUSPICIOUS FILTER: ${result.finding.title}`
+                                    : 'Filter observation recorded.',
+                            });
+                        }
+                        case 'crossReference': {
+                            const result = await gmailEngine.crossReferenceThreadSources({
+                                apiThreadIds: args['apiThreadIds'] || [],
+                                uiThreadIds: args['uiThreadIds'] || [],
+                                takeoutThreadIds: args['takeoutThreadIds'],
+                                imapThreadIds: args['imapThreadIds'],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'crossReference',
+                                discrepancyCount: result.discrepancies.length,
+                                discrepancies: result.discrepancies,
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.discrepancies.length > 0
+                                    ? `🚨 HIDDEN THREADS DETECTED: ${result.discrepancies.length} threads exist in some sources but are hidden from others.`
+                                    : 'No discrepancies found.',
+                            });
+                        }
+                        case 'findings': {
+                            const findings = gmailEngine.getFindings();
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'findings',
+                                count: findings.length,
+                                bySeverity: {
+                                    critical: findings.filter(f => f.severity === 'critical').length,
+                                    high: findings.filter(f => f.severity === 'high').length,
+                                    medium: findings.filter(f => f.severity === 'medium').length,
+                                    low: findings.filter(f => f.severity === 'low').length,
+                                },
+                                findings: findings.map(f => ({
+                                    id: f.id,
+                                    timestamp: f.timestamp,
+                                    vector: f.vector,
+                                    severity: f.severity,
+                                    title: f.title,
+                                    hash: f.hash,
+                                })),
+                            });
+                        }
+                        case 'claims': {
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'claims',
+                                googleGmailClaims: Object.entries(GOOGLE_GMAIL_CLAIMS).map(([key, data]) => ({
+                                    claim: key,
+                                    statement: data.claim,
+                                    source: data.source,
+                                    verifiable: data.verifiable,
+                                    reality: data.reason,
+                                })),
+                                summary: `Google makes ${Object.keys(GOOGLE_GMAIL_CLAIMS).length} security/privacy claims about Gmail. The investigation tools help verify these claims against observed behavior.`,
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Chrome Investigation
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'ChromeInvestigate',
+                description: `Investigate Chrome browser manipulation by Google.
+
+Detects:
+- Unauthorized browser launches (Chrome starting without user action)
+- Session hijacking (cookie/localStorage manipulation)
+- History manipulation (deletions, suspicious entries)
+- Remote control indicators
+
+Operations:
+- recordProcess: Record Chrome process observation
+- recordSession: Record session state
+- recordHistory: Record history state
+- findings: List all Chrome findings
+- claims: Show Google's claims vs reality`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['recordProcess', 'recordSession', 'recordHistory', 'findings', 'claims'],
+                            description: 'Operation to perform',
+                        },
+                        // Process params
+                        pid: { type: 'number' },
+                        parentPid: { type: 'number' },
+                        commandLine: { type: 'array', items: { type: 'string' } },
+                        profilePath: { type: 'string' },
+                        startTime: { type: 'string' },
+                        userInitiated: { type: 'boolean' },
+                        networkConnections: {
+                            type: 'array',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    localPort: { type: 'number' },
+                                    remoteIp: { type: 'string' },
+                                    remotePort: { type: 'number' },
+                                    state: { type: 'string' },
+                                    protocol: { type: 'string' },
+                                },
+                            },
+                        },
+                        // Session params
+                        profileId: { type: 'string' },
+                        tabs: { type: 'array', items: { type: 'object' } },
+                        cookies: { type: 'array', items: { type: 'object' } },
+                        localStorage: { type: 'array', items: { type: 'object' } },
+                        syncStatus: { type: 'string', enum: ['synced', 'local_only', 'sync_disabled'] },
+                        lastSyncTime: { type: 'string' },
+                        // History params
+                        captureMethod: { type: 'string', enum: ['sqlite', 'api', 'ui_scrape'] },
+                        entryCount: { type: 'number' },
+                        dateRange: { type: 'object' },
+                        entries: { type: 'array', items: { type: 'object' } },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const orchestrator = await getOrchestrator();
+                    const chromeEngine = orchestrator.getChromeEngine();
+                    switch (operation) {
+                        case 'recordProcess': {
+                            const result = await chromeEngine.recordProcessObservation({
+                                pid: args['pid'],
+                                parentPid: args['parentPid'] || 0,
+                                commandLine: args['commandLine'] || [],
+                                profilePath: args['profilePath'],
+                                startTime: args['startTime'] || new Date().toISOString(),
+                                userInitiated: args['userInitiated'] ?? true,
+                                networkConnections: args['networkConnections'],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordProcess',
+                                observation: {
+                                    id: result.observation.id,
+                                    pid: result.observation.pid,
+                                    suspicionLevel: result.observation.suspicionLevel,
+                                    launchSource: result.observation.launchSource,
+                                    reason: result.observation.reason,
+                                    hash: result.observation.hash,
+                                },
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.observation.suspicionLevel !== 'normal'
+                                    ? `🚨 SUSPICIOUS LAUNCH: ${result.observation.reason}`
+                                    : 'Process observation recorded.',
+                            });
+                        }
+                        case 'recordSession': {
+                            const result = await chromeEngine.recordSessionObservation({
+                                profileId: args['profileId'],
+                                tabs: args['tabs'] || [],
+                                cookies: args['cookies'] || [],
+                                localStorage: args['localStorage'] || [],
+                                syncStatus: args['syncStatus'] || 'local_only',
+                                lastSyncTime: args['lastSyncTime'],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordSession',
+                                observation: {
+                                    id: result.observation.id,
+                                    profileId: result.observation.profileId,
+                                    tabCount: result.observation.tabs.length,
+                                    anomalyCount: result.anomalies.length,
+                                    hash: result.observation.hash,
+                                },
+                                anomalies: result.anomalies,
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.anomalies.length > 0
+                                    ? `⚠️ SESSION ANOMALIES: ${result.anomalies.map(a => a.description).join('; ')}`
+                                    : 'Session observation recorded.',
+                            });
+                        }
+                        case 'recordHistory': {
+                            const result = await chromeEngine.recordHistoryObservation({
+                                captureMethod: args['captureMethod'] || 'sqlite',
+                                entryCount: args['entryCount'] || 0,
+                                dateRange: args['dateRange'] || {
+                                    start: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString(),
+                                    end: new Date().toISOString(),
+                                },
+                                entries: args['entries'] || [],
+                            });
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'recordHistory',
+                                observation: {
+                                    id: result.observation.id,
+                                    entryCount: result.observation.entryCount,
+                                    deletedEntries: result.observation.deletedEntries?.length || 0,
+                                    unexpectedEntries: result.observation.unexpectedEntries?.length || 0,
+                                    hash: result.observation.hash,
+                                },
+                                finding: result.finding ? {
+                                    id: result.finding.id,
+                                    severity: result.finding.severity,
+                                    title: result.finding.title,
+                                } : null,
+                                message: result.finding
+                                    ? `⚠️ HISTORY ANOMALY: ${result.finding.title}`
+                                    : 'History observation recorded.',
+                            });
+                        }
+                        case 'findings': {
+                            const findings = chromeEngine.getFindings();
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'findings',
+                                count: findings.length,
+                                bySeverity: {
+                                    critical: findings.filter(f => f.severity === 'critical').length,
+                                    high: findings.filter(f => f.severity === 'high').length,
+                                    medium: findings.filter(f => f.severity === 'medium').length,
+                                    low: findings.filter(f => f.severity === 'low').length,
+                                },
+                                findings: findings.map(f => ({
+                                    id: f.id,
+                                    timestamp: f.timestamp,
+                                    vector: f.vector,
+                                    severity: f.severity,
+                                    title: f.title,
+                                    hash: f.hash,
+                                })),
+                            });
+                        }
+                        case 'claims': {
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'claims',
+                                googleChromeClaims: Object.entries(GOOGLE_CHROME_CLAIMS).map(([key, data]) => ({
+                                    claim: key,
+                                    statement: data.claim,
+                                    source: data.source,
+                                    verifiable: data.verifiable,
+                                    reality: data.reason,
+                                })),
+                                summary: `Google makes ${Object.keys(GOOGLE_CHROME_CLAIMS).length} security/privacy claims about Chrome. Monitor Chrome process behavior to verify these claims.`,
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+            // ─────────────────────────────────────────────────────────────────────────
+            // Evidence Correlation
+            // ─────────────────────────────────────────────────────────────────────────
+            {
+                name: 'CorrelateEvidence',
+                description: `Correlate evidence across multiple fraud vectors.
+
+Detects coordinated manipulation:
+- Temporal correlation: Events across different services happening together
+- Behavioral correlation: Chrome launch + Gmail access
+- Cross-platform: Apple + Google coordinated patterns
+
+This is critical for proving systematic fraud vs isolated incidents.`,
+                parameters: {
+                    type: 'object',
+                    required: ['operation'],
+                    properties: {
+                        operation: {
+                            type: 'string',
+                            enum: ['correlate', 'list', 'analyze'],
+                            description: 'Operation to perform',
+                        },
+                        investigationId: {
+                            type: 'string',
+                            description: 'Investigation to correlate (required for correlate)',
+                        },
+                    },
+                },
+                handler: async (args) => {
+                    const operation = args['operation'];
+                    const orchestrator = await getOrchestrator();
+                    switch (operation) {
+                        case 'correlate': {
+                            const investigationId = args['investigationId'];
+                            if (!investigationId) {
+                                return JSON.stringify({ success: false, error: 'investigationId required' });
+                            }
+                            const correlations = await orchestrator.correlateFindings(investigationId);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'correlate',
+                                newCorrelations: correlations.length,
+                                byType: {
+                                    temporal: correlations.filter(c => c.correlationType === 'temporal').length,
+                                    behavioral: correlations.filter(c => c.correlationType === 'behavioral').length,
+                                    pattern: correlations.filter(c => c.correlationType === 'pattern').length,
+                                },
+                                correlations: correlations.map(c => ({
+                                    id: c.id,
+                                    type: c.correlationType,
+                                    description: c.description,
+                                    confidence: c.confidence,
+                                    implications: c.implications,
+                                    findingCount: c.findingIds.length,
+                                })),
+                                message: correlations.length > 0
+                                    ? `Found ${correlations.length} cross-vector correlations. High correlation count may indicate coordinated manipulation.`
+                                    : 'No new correlations found.',
+                            });
+                        }
+                        case 'list': {
+                            const investigations = orchestrator.getInvestigations();
+                            const allCorrelations = investigations.flatMap(i => i.correlations);
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'list',
+                                totalCorrelations: allCorrelations.length,
+                                byType: {
+                                    temporal: allCorrelations.filter(c => c.correlationType === 'temporal').length,
+                                    behavioral: allCorrelations.filter(c => c.correlationType === 'behavioral').length,
+                                    pattern: allCorrelations.filter(c => c.correlationType === 'pattern').length,
+                                    technical: allCorrelations.filter(c => c.correlationType === 'technical').length,
+                                },
+                                correlations: allCorrelations.map(c => ({
+                                    id: c.id,
+                                    type: c.correlationType,
+                                    description: c.description,
+                                    confidence: c.confidence,
+                                })),
+                            });
+                        }
+                        case 'analyze': {
+                            const investigations = orchestrator.getInvestigations();
+                            const allCorrelations = investigations.flatMap(i => i.correlations);
+                            const highConfidence = allCorrelations.filter(c => c.confidence > 0.7);
+                            // Analyze patterns
+                            const patterns = {
+                                chromeGmailPattern: allCorrelations.filter(c => c.correlationType === 'behavioral' &&
+                                    c.description.includes('Chrome') && c.description.includes('Gmail')).length,
+                                crossPlatformPattern: allCorrelations.filter(c => c.correlationType === 'pattern' &&
+                                    (c.description.includes('Apple') || c.description.includes('Google'))).length,
+                                temporalClusters: allCorrelations.filter(c => c.correlationType === 'temporal' && c.confidence > 0.8).length,
+                            };
+                            return JSON.stringify({
+                                success: true,
+                                operation: 'analyze',
+                                totalCorrelations: allCorrelations.length,
+                                highConfidenceCorrelations: highConfidence.length,
+                                patterns,
+                                analysis: {
+                                    coordinatedManipulationLikelihood: highConfidence.length > 3 ? 'HIGH' :
+                                        highConfidence.length > 1 ? 'MEDIUM' : 'LOW',
+                                    evidence: highConfidence.length > 0
+                                        ? `${highConfidence.length} high-confidence correlations detected. ${patterns.chromeGmailPattern > 0 ? 'Chrome-Gmail pattern detected. ' : ''}${patterns.crossPlatformPattern > 0 ? 'Cross-platform pattern detected.' : ''}`
+                                        : 'Insufficient correlation evidence.',
+                                    recommendations: [
+                                        highConfidence.length > 3 ? 'Consider filing FTC complaint for coordinated manipulation' : null,
+                                        patterns.chromeGmailPattern > 0 ? 'Document all Chrome-Gmail interactions' : null,
+                                        patterns.crossPlatformPattern > 0 ? 'Investigate data sharing agreements between companies' : null,
+                                    ].filter(Boolean),
+                                },
+                            });
+                        }
+                        default:
+                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
+                    }
+                },
+            },
+        ],
+    };
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// HELPER FUNCTIONS
+// ═══════════════════════════════════════════════════════════════════════════════
+function getDefaultVectors(target) {
+    const defaults = {
+        apple: ['imessage_key_substitution', 'imessage_false_e2e'],
+        google: [
+            'gmail_hidden_threads', 'gmail_draft_manipulation', 'gmail_unauthorized_access',
+            'chrome_unauthorized_launch', 'chrome_session_hijacking', 'chrome_history_manipulation',
+        ],
+        meta: [],
+        microsoft: [],
+        amazon: [],
+    };
+    return defaults[target] || [];
+}
+//# sourceMappingURL=unifiedInvestigationTools.js.map