erosolar-cli 2.1.243 → 2.1.244

package/dist/core/agentOrchestrator.js

@@ -1,6 +1,8 @@
 import { TASK_FULLY_COMPLETE } from './constants.js';
 import { TaskCompletionDetector } from './taskCompletionDetector.js';
-import { planAttackChain, selectNextTechnique, executeTechniqueInChain, techniqueRegistry, parseNaturalLanguageIntent, validateAuthorizationContext, } from '../tools/tao/index.js';
+import { planAttackChain, selectNextTechnique, executeTechniqueInChain, techniqueRegistry, parseNaturalLanguageIntent, validateAuthorizationContext, getRLState, listActiveChains, } from '../tools/tao/index.js';
+import { getInfrastructureStack, generateDeploymentScript, generateTeardownScript, generateOpsecChecklist, } from './infrastructureTemplates.js';
+import { getAgencyContacts, getApplicableLegalFrameworks, } from './governmentProcedures.js';
 /**
  * Single-pass orchestration: drive the agent to finish as much as possible
  * in one go, with strong bias toward real actions over planning.
@@ -1200,5 +1202,555 @@ Please provide context so I can help appropriately.`,
         }
         return lines.join('\n');
     }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // UNIFIED ORCHESTRATION - FULL STACK INTEGRATION
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /** Goal-to-technique mapping for goal-oriented execution */
+    goalTechniques = {
+        reconnaissance: [
+            'dns_enum', 'whois_recon', 'asn_lookup', 'subdomain_enum', 'dns_zone_transfer',
+            'ssl_analysis', 'ct_search', 'web_fingerprint', 'tech_fingerprint',
+            'cloud_detect', 's3_enum', 'gcs_enum', 'azure_enum', 'email_security',
+            'port_scan', 'service_enum', 'api_discovery', 'git_analysis',
+        ],
+        access: [
+            'credential_spray', 'exploit_attempt', 'cloud_metadata', 'container_escape',
+        ],
+        persistence: [
+            'persistence', 'sched_persist', 'ssh_persist', 'c2_beacon',
+        ],
+        privilege: [
+            'privesc', 'credential_harvest', 'memory_dump', 'cloud_creds',
+        ],
+        lateral: [
+            'lateral_move', 'network_discovery', 'smb_enum', 'ssh_enum',
+        ],
+        collection: [
+            'file_discovery', 'data_discovery', 'process_enum', 'cloud_enum',
+            'credential_harvest', 'git_analysis', 'api_surface_map',
+        ],
+        exfiltration: [
+            'data_staging', 'exfil', 'c2_beacon',
+        ],
+        impact: [
+            'service_disruption', 'resource_exhaustion', 'cleanup',
+        ],
+        stealth: [
+            'cleanup', 'process_enum', 'network_discovery',
+        ],
+        all: [], // Dynamically populated
+    };
+    /**
+     * Unified orchestration entry point.
+     * Routes to appropriate execution strategy based on mode and options.
+     *
+     * This is the primary method for full-stack unified orchestration that
+     * combines LLM-driven orchestration with direct TAO technique execution,
+     * infrastructure deployment, and goal-oriented APT simulation.
+     */
+    async runUnified(request, options = {}) {
+        const mode = options.unifiedMode || this.detectMode(request, options);
+        switch (mode) {
+            case 'attack-chain':
+                return this.runWithAttackChain(request, options);
+            case 'apt-simulation':
+                return this.runAPTSimulation(request, options);
+            case 'infrastructure':
+                return this.runInfrastructureMode(request, options);
+            case 'red-team':
+                return this.runRedTeamMode(request, options);
+            case 'intel-collection':
+                return this.runIntelCollectionMode(request, options);
+            case 'compliance':
+                return this.runComplianceMode(request, options);
+            case 'standard':
+            default:
+                // Check for goal-oriented execution
+                if (options.goal || options.goals) {
+                    return this.runGoalOriented(request, options);
+                }
+                return this.runToCompletion(request, options);
+        }
+    }
+    /**
+     * Auto-detect the appropriate orchestration mode from request content.
+     */
+    detectMode(request, options) {
+        const lower = request.toLowerCase();
+        // Check for explicit goals first
+        if (options.goal || options.goals) {
+            return 'attack-chain';
+        }
+        // Infrastructure keywords
+        if (lower.includes('infrastructure') || lower.includes('deploy') ||
+            lower.includes('c2 server') || lower.includes('redirector')) {
+            return 'infrastructure';
+        }
+        // Compliance keywords
+        if (lower.includes('compliance') || lower.includes('audit') ||
+            lower.includes('legal') || lower.includes('framework')) {
+            return 'compliance';
+        }
+        // Intel collection keywords
+        if (lower.includes('intelligence') || lower.includes('osint') ||
+            lower.includes('gather') || lower.includes('collect')) {
+            return 'intel-collection';
+        }
+        // Red team keywords
+        if (lower.includes('red team') || lower.includes('adversary') ||
+            lower.includes('full simulation')) {
+            return 'red-team';
+        }
+        // APT simulation keywords
+        if (lower.includes('apt') || lower.includes('kill chain') ||
+            lower.includes('kill-chain') || lower.includes('attack chain')) {
+            return 'apt-simulation';
+        }
+        // Security operation keywords (attack chain)
+        const securityKeywords = ['scan', 'recon', 'enumerate', 'exploit', 'pentest', 'hack'];
+        if (securityKeywords.some(kw => lower.includes(kw))) {
+            return 'attack-chain';
+        }
+        return 'standard';
+    }
+    /**
+     * Run full APT simulation with all kill-chain phases.
+     */
+    async runAPTSimulation(request, options) {
+        const startTime = Date.now();
+        const intent = parseNaturalLanguageIntent(request);
+        const targets = options.attackTargets ?? intent.targets;
+        const depth = this.normalizeDepth(options.attackDepth ?? intent.depth);
+        const stealth = options.stealthMode ?? intent.constraints.includes('stealth');
+        // Validate authorization
+        const auth = this.validateAttackAuthorization(intent, options.authorizationContext);
+        if (!auth.authorized) {
+            return this.buildAuthorizationError(auth);
+        }
+        const realExecutions = [];
+        const completedPhases = new Set();
+        const allArtifacts = [];
+        // APT Kill Chain Phases
+        const killChainPhases = [
+            'reconnaissance',
+            'weaponization',
+            'delivery',
+            'exploitation',
+            'installation',
+            'command-control',
+            'actions-on-objectives',
+        ];
+        // Execute techniques for each target
+        for (const target of targets) {
+            const chain = planAttackChain(intent, `APT Simulation: ${target}`);
+            for (const phase of killChainPhases) {
+                const phaseTechniques = techniqueRegistry.getByPhase(phase);
+                const techniqueLimit = depth === 'quick' ? 2 : depth === 'standard' ? 4 : phaseTechniques.length;
+                for (const technique of phaseTechniques.slice(0, techniqueLimit)) {
+                    if (stealth && technique.stealthRating < 0.3)
+                        continue;
+                    options.onTechniqueStart?.(technique.id, target);
+                    try {
+                        const result = await technique.execute({
+                            target,
+                            depth,
+                            stealth,
+                            timeout: depth === 'deep' ? 60000 : 30000,
+                            context: { chainId: chain.id, phase },
+                        });
+                        const execResult = {
+                            techniqueId: technique.id,
+                            techniqueName: technique.name,
+                            phase,
+                            success: result.success,
+                            duration: result.duration,
+                            artifacts: result.artifacts,
+                            detectionRisk: result.detectionRisk,
+                            nextTechniques: result.nextTechniques,
+                        };
+                        realExecutions.push(execResult);
+                        allArtifacts.push(...result.artifacts);
+                        options.onTechniqueComplete?.(execResult);
+                        if (result.success) {
+                            completedPhases.add(phase);
+                        }
+                        // Stealth abort if detection risk too high
+                        if (stealth && result.detectionRisk > 0.7)
+                            break;
+                    }
+                    catch {
+                        realExecutions.push({
+                            techniqueId: technique.id,
+                            techniqueName: technique.name,
+                            phase,
+                            success: false,
+                            duration: 0,
+                            artifacts: [],
+                            detectionRisk: 0.5,
+                            nextTechniques: [],
+                        });
+                    }
+                }
+            }
+        }
+        const metrics = this.computeMetrics(realExecutions, startTime);
+        return {
+            finalResponse: this.buildExecutionSummary(realExecutions, metrics, 'APT Simulation'),
+            toolsUsed: realExecutions.map(r => `tao:${r.techniqueId}`),
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis(metrics),
+            exitReason: metrics.successfulTechniques > 0 ? 'attack-chain-complete' : 'attack-chain-aborted',
+            statusSummary: `APT: ${metrics.successfulTechniques}/${metrics.totalTechniquesExecuted} techniques`,
+            limitations: [],
+            recommendations: this.buildRecommendations(realExecutions),
+            realExecutions,
+            realMetrics: metrics,
+            attackChains: listActiveChains(),
+            attackChainPhases: Array.from(completedPhases),
+            collectedArtifacts: allArtifacts,
+        };
+    }
+    /**
+     * Run infrastructure deployment mode.
+     */
+    async runInfrastructureMode(request, options) {
+        const region = options.region || 'us';
+        const stack = getInfrastructureStack(region);
+        if (!stack) {
+            return {
+                finalResponse: `No infrastructure stack available for region: ${region}`,
+                toolsUsed: [],
+                planOnly: false,
+                tookAction: false,
+                completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 0, successfulTechniques: 0, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+                exitReason: 'incomplete',
+                statusSummary: 'No infrastructure stack',
+                limitations: [`Region '${region}' not supported`],
+                recommendations: ['Use us or ukraine region'],
+            };
+        }
+        const deployScript = generateDeploymentScript(stack);
+        const teardownScript = generateTeardownScript(stack);
+        const opsecList = generateOpsecChecklist(stack);
+        options.onInfrastructure?.(stack);
+        return {
+            finalResponse: `## Infrastructure Stack: ${stack.name}\n\n` +
+                `**Region:** ${stack.region}\n` +
+                `**Components:** ${stack.components.length}\n` +
+                `**Persistence Mechanisms:** ${stack.persistence.length}\n` +
+                `**Monthly Cost:** $${stack.costEstimate.monthly}\n\n` +
+                `### Components\n${stack.components.map(c => `- ${c.name} (${c.type})`).join('\n')}\n\n` +
+                `### Deployment Script Generated\n### Teardown Script Generated\n### OPSEC Checklist Generated`,
+            toolsUsed: ['infrastructure-deploy', 'script-generator'],
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 1, successfulTechniques: 1, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+            exitReason: 'complete',
+            statusSummary: `Infrastructure: ${stack.components.length} components`,
+            limitations: [],
+            recommendations: ['Review OPSEC checklist before deployment'],
+            infrastructureStack: stack,
+            deploymentScript: deployScript,
+            teardownScript: teardownScript,
+            opsecChecklist: opsecList,
+        };
+    }
+    /**
+     * Run combined red team mode.
+     */
+    async runRedTeamMode(request, options) {
+        // Red team combines infrastructure + APT simulation
+        const infraResult = await this.runInfrastructureMode(request, options);
+        const aptResult = await this.runAPTSimulation(request, {
+            ...options,
+            attackDepth: 'deep',
+            stealthMode: true,
+        });
+        return {
+            ...aptResult,
+            finalResponse: `## Red Team Operation\n\n${infraResult.finalResponse}\n\n---\n\n${aptResult.finalResponse}`,
+            toolsUsed: [...infraResult.toolsUsed, ...aptResult.toolsUsed],
+            infrastructureStack: infraResult.infrastructureStack,
+            deploymentScript: infraResult.deploymentScript,
+            teardownScript: infraResult.teardownScript,
+            opsecChecklist: infraResult.opsecChecklist,
+            statusSummary: `Red Team: ${aptResult.realMetrics?.successfulTechniques || 0} techniques + ${infraResult.infrastructureStack?.components.length || 0} infra components`,
+        };
+    }
+    /**
+     * Run intelligence collection mode.
+     */
+    async runIntelCollectionMode(request, options) {
+        return this.runGoalOriented(request, {
+            ...options,
+            goals: ['reconnaissance', 'collection'],
+            collectIntel: true,
+            minimizeFootprint: true,
+        });
+    }
+    /**
+     * Run compliance mode with legal frameworks.
+     */
+    async runComplianceMode(request, options) {
+        const agencyTypes = options.agencyTypes || ['federal-le', 'regulatory'];
+        const contacts = agencyTypes.flatMap(at => getAgencyContacts(at));
+        const frameworks = getApplicableLegalFrameworks(agencyTypes);
+        const response = `## Compliance Analysis\n\n` +
+            `### Applicable Legal Frameworks\n` +
+            frameworks.map(f => `- **${f.name}** (${f.jurisdiction})\n  Requirements: ${f.requirements.length}`).join('\n') +
+            `\n\n### Agency Contacts\n` +
+            contacts.map(c => `- **${c.agency}** - ${c.division}\n  Contact: ${c.contact.email}`).join('\n');
+        return {
+            finalResponse: response,
+            toolsUsed: ['compliance-check'],
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis({ totalTechniquesExecuted: 1, successfulTechniques: 1, failedTechniques: 0, totalDuration: 0, averageDetectionRisk: 0, phasesCompleted: [], artifactsCollected: 0, rlRewardAverage: 0 }),
+            exitReason: 'complete',
+            statusSummary: `Compliance: ${frameworks.length} frameworks`,
+            limitations: [],
+            recommendations: frameworks.flatMap(f => f.requirements.map(r => r.requirement)),
+        };
+    }
+    /**
+     * Run goal-oriented APT execution.
+     */
+    async runGoalOriented(request, options) {
+        const startTime = Date.now();
+        const goals = options.goals || (options.goal ? [options.goal] : ['reconnaissance']);
+        const targets = options.attackTargets || [];
+        const depth = this.normalizeDepth(options.attackDepth ?? 'standard');
+        const stealth = options.stealthMode ?? options.minimizeFootprint ?? false;
+        // Build technique list from goals
+        let techniques = [];
+        for (const goal of goals) {
+            if (goal === 'all') {
+                techniques = techniqueRegistry.list().map(t => t.id);
+                break;
+            }
+            techniques.push(...(this.goalTechniques[goal] || []));
+        }
+        techniques = [...new Set(techniques)];
+        const realExecutions = [];
+        const achievedGoals = [];
+        const allArtifacts = [];
+        // Execute techniques
+        for (const target of targets) {
+            for (const techniqueId of techniques) {
+                const technique = techniqueRegistry.get(techniqueId);
+                if (!technique)
+                    continue;
+                if (stealth && technique.stealthRating < 0.3)
+                    continue;
+                options.onTechniqueStart?.(techniqueId, target);
+                try {
+                    const result = await technique.execute({
+                        target,
+                        depth,
+                        stealth,
+                        timeout: 60000,
+                        context: {},
+                    });
+                    const execResult = {
+                        techniqueId: technique.id,
+                        techniqueName: technique.name,
+                        phase: technique.phase,
+                        success: result.success,
+                        duration: result.duration,
+                        artifacts: result.artifacts,
+                        detectionRisk: result.detectionRisk,
+                        nextTechniques: result.nextTechniques,
+                    };
+                    realExecutions.push(execResult);
+                    allArtifacts.push(...result.artifacts);
+                    options.onTechniqueComplete?.(execResult);
+                    // Check goal achievement
+                    for (const goal of goals) {
+                        if (!achievedGoals.includes(goal)) {
+                            const goalTechs = this.goalTechniques[goal] || [];
+                            if (goalTechs.includes(techniqueId) && result.success) {
+                                achievedGoals.push(goal);
+                                options.onGoalAchieved?.(goal, result.artifacts);
+                            }
+                        }
+                    }
+                    if (stealth && result.detectionRisk > 0.7)
+                        break;
+                }
+                catch {
+                    realExecutions.push({
+                        techniqueId: technique.id,
+                        techniqueName: technique.name,
+                        phase: technique.phase,
+                        success: false,
+                        duration: 0,
+                        artifacts: [],
+                        detectionRisk: 0.5,
+                        nextTechniques: [],
+                    });
+                }
+            }
+            // Maintain persistence if requested
+            if (options.maintainAccess) {
+                for (const persistTech of ['persistence', 'sched_persist', 'ssh_persist']) {
+                    const technique = techniqueRegistry.get(persistTech);
+                    if (technique) {
+                        try {
+                            await technique.execute({ target, depth, stealth, timeout: 30000, context: {} });
+                        }
+                        catch { /* ignore */ }
+                    }
+                }
+            }
+        }
+        const metrics = this.computeMetrics(realExecutions, startTime);
+        return {
+            finalResponse: this.buildExecutionSummary(realExecutions, metrics, `Goal-Oriented: ${goals.join(', ')}`),
+            toolsUsed: realExecutions.map(r => r.techniqueId),
+            planOnly: false,
+            tookAction: true,
+            completion: this.buildCompletionAnalysis(metrics),
+            exitReason: metrics.successfulTechniques > 0 ? 'attack-chain-complete' : 'attack-chain-aborted',
+            statusSummary: `Goals: ${achievedGoals.length}/${goals.length} achieved`,
+            limitations: [],
+            recommendations: this.buildRecommendations(realExecutions),
+            realExecutions,
+            realMetrics: metrics,
+            attackChains: listActiveChains(),
+            achievedGoals,
+            collectedArtifacts: allArtifacts,
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // HELPER METHODS
+    // ═══════════════════════════════════════════════════════════════════════════════
+    normalizeDepth(depth) {
+        if (depth === 'quick' || depth === 'standard' || depth === 'deep') {
+            return depth;
+        }
+        return 'standard';
+    }
+    computeMetrics(executions, startTime) {
+        const successful = executions.filter(e => e.success).length;
+        const rlState = getRLState();
+        return {
+            totalTechniquesExecuted: executions.length,
+            successfulTechniques: successful,
+            failedTechniques: executions.length - successful,
+            totalDuration: Date.now() - startTime,
+            averageDetectionRisk: executions.length > 0
+                ? executions.reduce((s, e) => s + e.detectionRisk, 0) / executions.length
+                : 0,
+            phasesCompleted: [...new Set(executions.filter(e => e.success).map(e => e.phase))],
+            artifactsCollected: executions.reduce((s, e) => s + e.artifacts.length, 0),
+            rlRewardAverage: rlState.avgReward,
+        };
+    }
+    buildCompletionAnalysis(metrics) {
+        const confidence = metrics.totalTechniquesExecuted > 0
+            ? metrics.successfulTechniques / metrics.totalTechniquesExecuted
+            : 0;
+        return {
+            isComplete: true,
+            confidence,
+            signals: {
+                hasExplicitCompletionStatement: true,
+                hasIncompleteWorkIndicators: false,
+                hasPendingActionIndicators: false,
+                hasErrorIndicators: metrics.failedTechniques > metrics.successfulTechniques,
+                hasFollowUpQuestions: false,
+                toolsUsedInLastResponse: metrics.totalTechniquesExecuted,
+                lastToolWasReadOnly: false,
+                consecutiveResponsesWithoutTools: 0,
+                hasRecentFileWrites: false,
+                hasRecentCommits: false,
+                todoItemsPending: 0,
+                todoItemsCompleted: metrics.successfulTechniques,
+                mentionsFutureWork: false,
+                completionConfidence: confidence,
+            },
+            reason: 'Unified execution complete',
+            shouldVerify: confidence < 0.8,
+        };
+    }
+    buildAuthorizationError(auth) {
+        return {
+            finalResponse: `## Authorization Required\n\n${auth.reason}\n\n### Warnings\n${auth.warnings.map(w => `- ${w}`).join('\n')}`,
+            toolsUsed: [],
+            planOnly: false,
+            tookAction: false,
+            completion: {
+                isComplete: true,
+                confidence: 1.0,
+                signals: {
+                    hasExplicitCompletionStatement: true,
+                    hasIncompleteWorkIndicators: false,
+                    hasPendingActionIndicators: false,
+                    hasErrorIndicators: false,
+                    hasFollowUpQuestions: true,
+                    toolsUsedInLastResponse: 0,
+                    lastToolWasReadOnly: false,
+                    consecutiveResponsesWithoutTools: 0,
+                    hasRecentFileWrites: false,
+                    hasRecentCommits: false,
+                    todoItemsPending: 0,
+                    todoItemsCompleted: 0,
+                    mentionsFutureWork: false,
+                    completionConfidence: 1.0,
+                },
+                reason: 'Authorization required',
+                shouldVerify: false,
+            },
+            exitReason: 'attack-chain-aborted',
+            statusSummary: `Authorization required: ${auth.reason}`,
+            limitations: auth.warnings,
+            recommendations: [
+                'Provide CTF/lab context',
+                'Specify pentest authorization',
+                'Use --auth-context flag',
+            ],
+        };
+    }
+    buildExecutionSummary(executions, metrics, title) {
+        const lines = [];
+        lines.push(`## ${title} Execution Summary\n`);
+        lines.push(`**Total Techniques:** ${metrics.totalTechniquesExecuted}`);
+        lines.push(`**Successful:** ${metrics.successfulTechniques}`);
+        lines.push(`**Failed:** ${metrics.failedTechniques}`);
+        lines.push(`**Duration:** ${(metrics.totalDuration / 1000).toFixed(1)}s`);
+        lines.push(`**Detection Risk:** ${(metrics.averageDetectionRisk * 100).toFixed(1)}%`);
+        lines.push(`**Artifacts:** ${metrics.artifactsCollected}`);
+        lines.push(`**Phases:** ${metrics.phasesCompleted.join(', ') || 'none'}`);
+        lines.push('');
+        lines.push(`### Technique Results\n`);
+        for (const exec of executions) {
+            const status = exec.success ? '✓' : '✗';
+            lines.push(`**${status} ${exec.techniqueName}** (${exec.phase})`);
+            lines.push(`- Duration: ${exec.duration}ms`);
+            lines.push(`- Risk: ${(exec.detectionRisk * 100).toFixed(0)}%`);
+            if (exec.artifacts.length > 0) {
+                lines.push(`- Artifacts: ${exec.artifacts.length}`);
+            }
+            lines.push('');
+        }
+        return lines.join('\n');
+    }
+    buildRecommendations(executions) {
+        const recommendations = [];
+        const failed = executions.filter(e => !e.success);
+        if (failed.length > 0) {
+            recommendations.push(`Review ${failed.length} failed technique(s)`);
+        }
+        const highRisk = executions.filter(e => e.detectionRisk > 0.7);
+        if (highRisk.length > 0) {
+            recommendations.push(`${highRisk.length} technique(s) have high detection risk`);
+        }
+        const nextTechniques = [...new Set(executions.flatMap(e => e.nextTechniques))];
+        if (nextTechniques.length > 0) {
+            recommendations.push(`Consider: ${nextTechniques.slice(0, 5).join(', ')}`);
+        }
+        return recommendations;
+    }
 }
 //# sourceMappingURL=agentOrchestrator.js.map