erosolar-cli 2.1.270 → 2.1.272

package/dist/tools/unifiedInvestigationTools.js

@@ -1,1163 +0,0 @@
-/**
- * Unified Tech Fraud Investigation Tools
- *
- * CLI tool suite for investigating tech company fraud across:
- * - Apple iMessage (via existing iMessageVerificationTools)
- * - Google Gmail (hidden threads, draft manipulation, unauthorized access)
- * - Google Chrome (unauthorized launches, session hijacking, history manipulation)
- * - Cross-platform correlation
- *
- * Tools:
- * - Investigation: Manage investigations
- * - GmailInvestigate: Gmail manipulation detection
- * - ChromeInvestigate: Chrome browser control detection
- * - CorrelateEvidence: Cross-vector correlation
- * - FraudReport: Generate unified reports
- */
-import * as path from 'node:path';
-import { UnifiedFraudOrchestrator, GOOGLE_GMAIL_CLAIMS, GOOGLE_CHROME_CLAIMS, ATTACK_CHAIN_REGISTRY, } from '../core/unifiedFraudOrchestrator.js';
-// ═══════════════════════════════════════════════════════════════════════════════
-// TOOL SUITE FACTORY
-// ═══════════════════════════════════════════════════════════════════════════════
-export function createUnifiedInvestigationTools(workingDir = process.cwd()) {
-    // Orchestrator instance (lazy initialization)
-    let orchestratorInstance = null;
-    const getOrchestrator = async () => {
-        if (!orchestratorInstance) {
-            orchestratorInstance = new UnifiedFraudOrchestrator(workingDir);
-            await orchestratorInstance.initialize();
-        }
-        return orchestratorInstance;
-    };
-    return {
-        id: 'unified-investigation',
-        description: 'Unified tech fraud investigation across Apple, Google, and other platforms',
-        tools: [
-            // ─────────────────────────────────────────────────────────────────────────
-            // Investigation Management
-            // ─────────────────────────────────────────────────────────────────────────
-            {
-                name: 'Investigation',
-                description: `Manage fraud investigations across tech companies.
-
-Create and manage investigations that span multiple fraud vectors:
-- Apple: iMessage key substitution, false E2E claims
-- Google: Gmail manipulation, Chrome browser control
-- Cross-platform: Coordinated manipulation detection
-
-Operations:
-- create: Start a new investigation
-- list: List all investigations
-- status: Get investigation status
-- activate: Set investigation to active
-- correlate: Run cross-vector correlation
-- report: Generate investigation report
-- export: Export for legal proceedings`,
-                parameters: {
-                    type: 'object',
-                    required: ['operation'],
-                    properties: {
-                        operation: {
-                            type: 'string',
-                            enum: ['create', 'list', 'status', 'activate', 'correlate', 'report', 'export'],
-                            description: 'Operation to perform',
-                        },
-                        name: {
-                            type: 'string',
-                            description: 'Investigation name (for create)',
-                        },
-                        target: {
-                            type: 'string',
-                            enum: ['apple', 'google', 'meta', 'microsoft', 'amazon'],
-                            description: 'Primary investigation target (for create)',
-                        },
-                        vectors: {
-                            type: 'array',
-                            items: { type: 'string' },
-                            description: 'Fraud vectors to investigate',
-                        },
-                        investigationId: {
-                            type: 'string',
-                            description: 'Investigation ID (for status/activate/correlate/report/export)',
-                        },
-                        outputDir: {
-                            type: 'string',
-                            description: 'Output directory (for export)',
-                        },
-                    },
-                },
-                handler: async (args) => {
-                    const operation = args['operation'];
-                    const orchestrator = await getOrchestrator();
-                    switch (operation) {
-                        case 'create': {
-                            const name = args['name'];
-                            const target = args['target'];
-                            const vectors = args['vectors'] || [];
-                            if (!name || !target) {
-                                return JSON.stringify({
-                                    success: false,
-                                    error: 'name and target required',
-                                    availableTargets: ['apple', 'google', 'meta', 'microsoft', 'amazon'],
-                                    availableVectors: [
-                                        'imessage_key_substitution', 'imessage_false_e2e',
-                                        'gmail_hidden_threads', 'gmail_draft_manipulation', 'gmail_unauthorized_access', 'gmail_filter_tampering',
-                                        'chrome_unauthorized_launch', 'chrome_session_hijacking', 'chrome_history_manipulation',
-                                        'cross_platform_surveillance', 'coordinated_manipulation',
-                                    ],
-                                });
-                            }
-                            const investigation = await orchestrator.createInvestigation({
-                                name,
-                                target,
-                                vectors: vectors.length > 0 ? vectors : getDefaultVectors(target),
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'create',
-                                investigation: {
-                                    id: investigation.id,
-                                    name: investigation.name,
-                                    target: investigation.target,
-                                    vectors: investigation.vectors,
-                                    status: investigation.status,
-                                    evidenceChainId: investigation.evidenceChainId,
-                                },
-                                message: `Investigation "${name}" created. Use investigationId: ${investigation.id} for subsequent operations.`,
-                            });
-                        }
-                        case 'list': {
-                            const investigations = orchestrator.getInvestigations();
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'list',
-                                count: investigations.length,
-                                investigations: investigations.map(i => ({
-                                    id: i.id,
-                                    name: i.name,
-                                    target: i.target,
-                                    status: i.status,
-                                    findingCount: i.findings.length,
-                                    correlationCount: i.correlations.length,
-                                    created: i.created,
-                                    lastActivity: i.lastActivity,
-                                })),
-                            });
-                        }
-                        case 'status': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const investigations = orchestrator.getInvestigations();
-                            const investigation = investigations.find(i => i.id === investigationId);
-                            if (!investigation) {
-                                return JSON.stringify({ success: false, error: `Investigation not found: ${investigationId}` });
-                            }
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'status',
-                                investigation: {
-                                    id: investigation.id,
-                                    name: investigation.name,
-                                    target: investigation.target,
-                                    vectors: investigation.vectors,
-                                    status: investigation.status,
-                                    created: investigation.created,
-                                    lastActivity: investigation.lastActivity,
-                                    findingCount: investigation.findings.length,
-                                    correlationCount: investigation.correlations.length,
-                                    hash: investigation.hash,
-                                },
-                            });
-                        }
-                        case 'activate': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const investigation = await orchestrator.updateInvestigationStatus(investigationId, 'active');
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'activate',
-                                investigationId: investigation.id,
-                                status: investigation.status,
-                                message: `Investigation "${investigation.name}" is now active. Begin collecting evidence.`,
-                            });
-                        }
-                        case 'correlate': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const correlations = await orchestrator.correlateFindings(investigationId);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'correlate',
-                                investigationId,
-                                newCorrelations: correlations.length,
-                                correlations: correlations.map(c => ({
-                                    id: c.id,
-                                    type: c.correlationType,
-                                    description: c.description,
-                                    confidence: c.confidence,
-                                    implications: c.implications,
-                                })),
-                                message: correlations.length > 0
-                                    ? `Found ${correlations.length} cross-vector correlations. These may indicate coordinated manipulation.`
-                                    : 'No new correlations detected.',
-                            });
-                        }
-                        case 'report': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const report = await orchestrator.generateUnifiedReport(investigationId);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'report',
-                                report: {
-                                    investigation: {
-                                        id: report.investigation.id,
-                                        name: report.investigation.name,
-                                        target: report.investigation.target,
-                                        status: report.investigation.status,
-                                    },
-                                    summary: report.summary,
-                                    findingsByVector: Object.entries(report.byVector).map(([vector, data]) => ({
-                                        vector,
-                                        severity: data.severity,
-                                        findingCount: data.findings.length,
-                                    })),
-                                    correlationCount: report.correlations.length,
-                                    legalSummary: report.legalSummary,
-                                },
-                            });
-                        }
-                        case 'export': {
-                            const investigationId = args['investigationId'];
-                            const outputDir = args['outputDir'] || path.join(workingDir, 'evidence-export');
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const exportPath = await orchestrator.exportForLitigation(investigationId, outputDir);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'export',
-                                exportPath,
-                                message: `Evidence exported to ${exportPath}. Contains unified report, all findings, correlations, and legal summary.`,
-                            });
-                        }
-                        default:
-                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
-                    }
-                },
-            },
-            // ─────────────────────────────────────────────────────────────────────────
-            // Gmail Investigation
-            // ─────────────────────────────────────────────────────────────────────────
-            {
-                name: 'GmailInvestigate',
-                description: `Investigate Gmail manipulation by Google.
-
-Detects:
-- Hidden threads (visible via API but hidden in UI)
-- Draft manipulation (unauthorized changes, sends)
-- Unauthorized access (Google accessing your account)
-- Filter tampering (filters added without consent)
-
-Operations:
-- recordThread: Record thread observation
-- recordDraft: Record draft observation
-- recordAccess: Record access event
-- recordFilter: Record filter observation
-- crossReference: Compare different data sources
-- findings: List all Gmail findings
-- claims: Show Google's claims vs reality`,
-                parameters: {
-                    type: 'object',
-                    required: ['operation'],
-                    properties: {
-                        operation: {
-                            type: 'string',
-                            enum: ['recordThread', 'recordDraft', 'recordAccess', 'recordFilter', 'crossReference', 'findings', 'claims'],
-                            description: 'Operation to perform',
-                        },
-                        // Thread params
-                        threadId: { type: 'string' },
-                        messageIds: { type: 'array', items: { type: 'string' } },
-                        subject: { type: 'string' },
-                        labels: { type: 'array', items: { type: 'string' } },
-                        isVisible: { type: 'boolean' },
-                        isInSearch: { type: 'boolean' },
-                        lastMessageDate: { type: 'string' },
-                        participantCount: { type: 'number' },
-                        captureMethod: { type: 'string', enum: ['api', 'ui_scrape', 'network_capture', 'takeout'] },
-                        rawData: { type: 'string' },
-                        // Draft params
-                        draftId: { type: 'string' },
-                        recipientCount: { type: 'number' },
-                        bodyContent: { type: 'string' },
-                        hasAttachments: { type: 'boolean' },
-                        createdAt: { type: 'string' },
-                        modifiedAt: { type: 'string' },
-                        // Access params
-                        accessType: { type: 'string', enum: ['login', 'api_access', 'imap', 'pop', 'oauth_grant', 'security_event'] },
-                        ipAddress: { type: 'string' },
-                        location: { type: 'string' },
-                        userAgent: { type: 'string' },
-                        deviceType: { type: 'string' },
-                        wasUser: { type: 'boolean' },
-                        // Filter params
-                        filterId: { type: 'string' },
-                        criteria: { type: 'object' },
-                        actions: { type: 'object' },
-                        createdByUser: { type: 'boolean' },
-                        // Cross-reference params
-                        apiThreadIds: { type: 'array', items: { type: 'string' } },
-                        uiThreadIds: { type: 'array', items: { type: 'string' } },
-                        takeoutThreadIds: { type: 'array', items: { type: 'string' } },
-                        imapThreadIds: { type: 'array', items: { type: 'string' } },
-                    },
-                },
-                handler: async (args) => {
-                    const operation = args['operation'];
-                    const orchestrator = await getOrchestrator();
-                    const gmailEngine = orchestrator.getGmailEngine();
-                    switch (operation) {
-                        case 'recordThread': {
-                            const result = await gmailEngine.recordThreadObservation({
-                                threadId: args['threadId'],
-                                messageIds: args['messageIds'] || [],
-                                subject: args['subject'] || '',
-                                labels: args['labels'] || [],
-                                isVisible: args['isVisible'] ?? true,
-                                isInSearch: args['isInSearch'] ?? true,
-                                lastMessageDate: args['lastMessageDate'] || new Date().toISOString(),
-                                participantCount: args['participantCount'] || 0,
-                                captureMethod: args['captureMethod'] || 'api',
-                                rawData: args['rawData'],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordThread',
-                                observation: {
-                                    id: result.observation.id,
-                                    threadId: result.observation.threadId,
-                                    isVisible: result.observation.isVisible,
-                                    isInSearch: result.observation.isInSearch,
-                                    hash: result.observation.hash,
-                                },
-                                anomalyDetected: result.anomalyDetected,
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.anomalyDetected
-                                    ? `⚠️ ANOMALY DETECTED: ${result.finding?.title}`
-                                    : 'Thread observation recorded.',
-                            });
-                        }
-                        case 'recordDraft': {
-                            const result = await gmailEngine.recordDraftObservation({
-                                draftId: args['draftId'],
-                                threadId: args['threadId'],
-                                subject: args['subject'] || '',
-                                recipientCount: args['recipientCount'] || 0,
-                                bodyContent: args['bodyContent'] || '',
-                                hasAttachments: args['hasAttachments'] ?? false,
-                                createdAt: args['createdAt'] || new Date().toISOString(),
-                                modifiedAt: args['modifiedAt'] || new Date().toISOString(),
-                                captureMethod: args['captureMethod'] || 'api',
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordDraft',
-                                observation: {
-                                    id: result.observation.id,
-                                    draftId: result.observation.draftId,
-                                    bodyHash: result.observation.bodyHash,
-                                    hash: result.observation.hash,
-                                },
-                                changes: result.changes,
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.changes.length > 0
-                                    ? `⚠️ DRAFT CHANGES DETECTED: ${result.changes.map(c => c.reason).join('; ')}`
-                                    : 'Draft observation recorded.',
-                            });
-                        }
-                        case 'recordAccess': {
-                            const result = await gmailEngine.recordAccessLog({
-                                accessType: args['accessType'],
-                                ipAddress: args['ipAddress'],
-                                location: args['location'],
-                                userAgent: args['userAgent'],
-                                deviceType: args['deviceType'],
-                                wasUser: args['wasUser'] ?? true,
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordAccess',
-                                log: {
-                                    id: result.log.id,
-                                    accessType: result.log.accessType,
-                                    ipAddress: result.log.ipAddress,
-                                    suspicious: result.log.suspicious,
-                                    reason: result.log.reason,
-                                    hash: result.log.hash,
-                                },
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.log.suspicious
-                                    ? `🚨 SUSPICIOUS ACCESS: ${result.log.reason}`
-                                    : 'Access logged.',
-                            });
-                        }
-                        case 'recordFilter': {
-                            const result = await gmailEngine.recordFilterObservation({
-                                filterId: args['filterId'],
-                                criteria: args['criteria'] || {},
-                                actions: args['actions'] || {},
-                                createdByUser: args['createdByUser'] ?? false,
-                                createdAt: args['createdAt'],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordFilter',
-                                observation: {
-                                    id: result.observation.id,
-                                    filterId: result.observation.filterId,
-                                    createdByUser: result.observation.createdByUser,
-                                    hash: result.observation.hash,
-                                },
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.finding
-                                    ? `⚠️ SUSPICIOUS FILTER: ${result.finding.title}`
-                                    : 'Filter observation recorded.',
-                            });
-                        }
-                        case 'crossReference': {
-                            const result = await gmailEngine.crossReferenceThreadSources({
-                                apiThreadIds: args['apiThreadIds'] || [],
-                                uiThreadIds: args['uiThreadIds'] || [],
-                                takeoutThreadIds: args['takeoutThreadIds'],
-                                imapThreadIds: args['imapThreadIds'],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'crossReference',
-                                discrepancyCount: result.discrepancies.length,
-                                discrepancies: result.discrepancies,
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.discrepancies.length > 0
-                                    ? `🚨 HIDDEN THREADS DETECTED: ${result.discrepancies.length} threads exist in some sources but are hidden from others.`
-                                    : 'No discrepancies found.',
-                            });
-                        }
-                        case 'findings': {
-                            const findings = gmailEngine.getFindings();
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'findings',
-                                count: findings.length,
-                                bySeverity: {
-                                    critical: findings.filter(f => f.severity === 'critical').length,
-                                    high: findings.filter(f => f.severity === 'high').length,
-                                    medium: findings.filter(f => f.severity === 'medium').length,
-                                    low: findings.filter(f => f.severity === 'low').length,
-                                },
-                                findings: findings.map(f => ({
-                                    id: f.id,
-                                    timestamp: f.timestamp,
-                                    vector: f.vector,
-                                    severity: f.severity,
-                                    title: f.title,
-                                    hash: f.hash,
-                                })),
-                            });
-                        }
-                        case 'claims': {
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'claims',
-                                googleGmailClaims: Object.entries(GOOGLE_GMAIL_CLAIMS).map(([key, data]) => ({
-                                    claim: key,
-                                    statement: data.claim,
-                                    source: data.source,
-                                    verifiable: data.verifiable,
-                                    reality: data.reason,
-                                })),
-                                summary: `Google makes ${Object.keys(GOOGLE_GMAIL_CLAIMS).length} security/privacy claims about Gmail. The investigation tools help verify these claims against observed behavior.`,
-                            });
-                        }
-                        default:
-                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
-                    }
-                },
-            },
-            // ─────────────────────────────────────────────────────────────────────────
-            // Chrome Investigation
-            // ─────────────────────────────────────────────────────────────────────────
-            {
-                name: 'ChromeInvestigate',
-                description: `Investigate Chrome browser manipulation by Google.
-
-Detects:
-- Unauthorized browser launches (Chrome starting without user action)
-- Session hijacking (cookie/localStorage manipulation)
-- History manipulation (deletions, suspicious entries)
-- Remote control indicators
-
-Operations:
-- recordProcess: Record Chrome process observation
-- recordSession: Record session state
-- recordHistory: Record history state
-- findings: List all Chrome findings
-- claims: Show Google's claims vs reality`,
-                parameters: {
-                    type: 'object',
-                    required: ['operation'],
-                    properties: {
-                        operation: {
-                            type: 'string',
-                            enum: ['recordProcess', 'recordSession', 'recordHistory', 'findings', 'claims'],
-                            description: 'Operation to perform',
-                        },
-                        // Process params
-                        pid: { type: 'number' },
-                        parentPid: { type: 'number' },
-                        commandLine: { type: 'array', items: { type: 'string' } },
-                        profilePath: { type: 'string' },
-                        startTime: { type: 'string' },
-                        userInitiated: { type: 'boolean' },
-                        networkConnections: {
-                            type: 'array',
-                            items: {
-                                type: 'object',
-                                properties: {
-                                    localPort: { type: 'number' },
-                                    remoteIp: { type: 'string' },
-                                    remotePort: { type: 'number' },
-                                    state: { type: 'string' },
-                                    protocol: { type: 'string' },
-                                },
-                            },
-                        },
-                        // Session params
-                        profileId: { type: 'string' },
-                        tabs: { type: 'array', items: { type: 'object' } },
-                        cookies: { type: 'array', items: { type: 'object' } },
-                        localStorage: { type: 'array', items: { type: 'object' } },
-                        syncStatus: { type: 'string', enum: ['synced', 'local_only', 'sync_disabled'] },
-                        lastSyncTime: { type: 'string' },
-                        // History params
-                        captureMethod: { type: 'string', enum: ['sqlite', 'api', 'ui_scrape'] },
-                        entryCount: { type: 'number' },
-                        dateRange: { type: 'object' },
-                        entries: { type: 'array', items: { type: 'object' } },
-                    },
-                },
-                handler: async (args) => {
-                    const operation = args['operation'];
-                    const orchestrator = await getOrchestrator();
-                    const chromeEngine = orchestrator.getChromeEngine();
-                    switch (operation) {
-                        case 'recordProcess': {
-                            const result = await chromeEngine.recordProcessObservation({
-                                pid: args['pid'],
-                                parentPid: args['parentPid'] || 0,
-                                commandLine: args['commandLine'] || [],
-                                profilePath: args['profilePath'],
-                                startTime: args['startTime'] || new Date().toISOString(),
-                                userInitiated: args['userInitiated'] ?? true,
-                                networkConnections: args['networkConnections'],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordProcess',
-                                observation: {
-                                    id: result.observation.id,
-                                    pid: result.observation.pid,
-                                    suspicionLevel: result.observation.suspicionLevel,
-                                    launchSource: result.observation.launchSource,
-                                    reason: result.observation.reason,
-                                    hash: result.observation.hash,
-                                },
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.observation.suspicionLevel !== 'normal'
-                                    ? `🚨 SUSPICIOUS LAUNCH: ${result.observation.reason}`
-                                    : 'Process observation recorded.',
-                            });
-                        }
-                        case 'recordSession': {
-                            const result = await chromeEngine.recordSessionObservation({
-                                profileId: args['profileId'],
-                                tabs: args['tabs'] || [],
-                                cookies: args['cookies'] || [],
-                                localStorage: args['localStorage'] || [],
-                                syncStatus: args['syncStatus'] || 'local_only',
-                                lastSyncTime: args['lastSyncTime'],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordSession',
-                                observation: {
-                                    id: result.observation.id,
-                                    profileId: result.observation.profileId,
-                                    tabCount: result.observation.tabs.length,
-                                    anomalyCount: result.anomalies.length,
-                                    hash: result.observation.hash,
-                                },
-                                anomalies: result.anomalies,
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.anomalies.length > 0
-                                    ? `⚠️ SESSION ANOMALIES: ${result.anomalies.map(a => a.description).join('; ')}`
-                                    : 'Session observation recorded.',
-                            });
-                        }
-                        case 'recordHistory': {
-                            const result = await chromeEngine.recordHistoryObservation({
-                                captureMethod: args['captureMethod'] || 'sqlite',
-                                entryCount: args['entryCount'] || 0,
-                                dateRange: args['dateRange'] || {
-                                    start: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString(),
-                                    end: new Date().toISOString(),
-                                },
-                                entries: args['entries'] || [],
-                            });
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'recordHistory',
-                                observation: {
-                                    id: result.observation.id,
-                                    entryCount: result.observation.entryCount,
-                                    deletedEntries: result.observation.deletedEntries?.length || 0,
-                                    unexpectedEntries: result.observation.unexpectedEntries?.length || 0,
-                                    hash: result.observation.hash,
-                                },
-                                finding: result.finding ? {
-                                    id: result.finding.id,
-                                    severity: result.finding.severity,
-                                    title: result.finding.title,
-                                } : null,
-                                message: result.finding
-                                    ? `⚠️ HISTORY ANOMALY: ${result.finding.title}`
-                                    : 'History observation recorded.',
-                            });
-                        }
-                        case 'findings': {
-                            const findings = chromeEngine.getFindings();
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'findings',
-                                count: findings.length,
-                                bySeverity: {
-                                    critical: findings.filter(f => f.severity === 'critical').length,
-                                    high: findings.filter(f => f.severity === 'high').length,
-                                    medium: findings.filter(f => f.severity === 'medium').length,
-                                    low: findings.filter(f => f.severity === 'low').length,
-                                },
-                                findings: findings.map(f => ({
-                                    id: f.id,
-                                    timestamp: f.timestamp,
-                                    vector: f.vector,
-                                    severity: f.severity,
-                                    title: f.title,
-                                    hash: f.hash,
-                                })),
-                            });
-                        }
-                        case 'claims': {
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'claims',
-                                googleChromeClaims: Object.entries(GOOGLE_CHROME_CLAIMS).map(([key, data]) => ({
-                                    claim: key,
-                                    statement: data.claim,
-                                    source: data.source,
-                                    verifiable: data.verifiable,
-                                    reality: data.reason,
-                                })),
-                                summary: `Google makes ${Object.keys(GOOGLE_CHROME_CLAIMS).length} security/privacy claims about Chrome. Monitor Chrome process behavior to verify these claims.`,
-                            });
-                        }
-                        default:
-                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
-                    }
-                },
-            },
-            // ─────────────────────────────────────────────────────────────────────────
-            // Evidence Correlation
-            // ─────────────────────────────────────────────────────────────────────────
-            {
-                name: 'CorrelateEvidence',
-                description: `Correlate evidence across multiple fraud vectors.
-
-Detects coordinated manipulation:
-- Temporal correlation: Events across different services happening together
-- Behavioral correlation: Chrome launch + Gmail access
-- Cross-platform: Apple + Google coordinated patterns
-
-This is critical for proving systematic fraud vs isolated incidents.`,
-                parameters: {
-                    type: 'object',
-                    required: ['operation'],
-                    properties: {
-                        operation: {
-                            type: 'string',
-                            enum: ['correlate', 'list', 'analyze'],
-                            description: 'Operation to perform',
-                        },
-                        investigationId: {
-                            type: 'string',
-                            description: 'Investigation to correlate (required for correlate)',
-                        },
-                    },
-                },
-                handler: async (args) => {
-                    const operation = args['operation'];
-                    const orchestrator = await getOrchestrator();
-                    switch (operation) {
-                        case 'correlate': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const correlations = await orchestrator.correlateFindings(investigationId);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'correlate',
-                                newCorrelations: correlations.length,
-                                byType: {
-                                    temporal: correlations.filter(c => c.correlationType === 'temporal').length,
-                                    behavioral: correlations.filter(c => c.correlationType === 'behavioral').length,
-                                    pattern: correlations.filter(c => c.correlationType === 'pattern').length,
-                                },
-                                correlations: correlations.map(c => ({
-                                    id: c.id,
-                                    type: c.correlationType,
-                                    description: c.description,
-                                    confidence: c.confidence,
-                                    implications: c.implications,
-                                    findingCount: c.findingIds.length,
-                                })),
-                                message: correlations.length > 0
-                                    ? `Found ${correlations.length} cross-vector correlations. High correlation count may indicate coordinated manipulation.`
-                                    : 'No new correlations found.',
-                            });
-                        }
-                        case 'list': {
-                            const investigations = orchestrator.getInvestigations();
-                            const allCorrelations = investigations.flatMap(i => i.correlations);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'list',
-                                totalCorrelations: allCorrelations.length,
-                                byType: {
-                                    temporal: allCorrelations.filter(c => c.correlationType === 'temporal').length,
-                                    behavioral: allCorrelations.filter(c => c.correlationType === 'behavioral').length,
-                                    pattern: allCorrelations.filter(c => c.correlationType === 'pattern').length,
-                                    technical: allCorrelations.filter(c => c.correlationType === 'technical').length,
-                                },
-                                correlations: allCorrelations.map(c => ({
-                                    id: c.id,
-                                    type: c.correlationType,
-                                    description: c.description,
-                                    confidence: c.confidence,
-                                })),
-                            });
-                        }
-                        case 'analyze': {
-                            const investigations = orchestrator.getInvestigations();
-                            const allCorrelations = investigations.flatMap(i => i.correlations);
-                            const highConfidence = allCorrelations.filter(c => c.confidence > 0.7);
-                            // Analyze patterns
-                            const patterns = {
-                                chromeGmailPattern: allCorrelations.filter(c => c.correlationType === 'behavioral' &&
-                                    c.description.includes('Chrome') && c.description.includes('Gmail')).length,
-                                crossPlatformPattern: allCorrelations.filter(c => c.correlationType === 'pattern' &&
-                                    (c.description.includes('Apple') || c.description.includes('Google'))).length,
-                                temporalClusters: allCorrelations.filter(c => c.correlationType === 'temporal' && c.confidence > 0.8).length,
-                            };
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'analyze',
-                                totalCorrelations: allCorrelations.length,
-                                highConfidenceCorrelations: highConfidence.length,
-                                patterns,
-                                analysis: {
-                                    coordinatedManipulationLikelihood: highConfidence.length > 3 ? 'HIGH' :
-                                        highConfidence.length > 1 ? 'MEDIUM' : 'LOW',
-                                    evidence: highConfidence.length > 0
-                                        ? `${highConfidence.length} high-confidence correlations detected. ${patterns.chromeGmailPattern > 0 ? 'Chrome-Gmail pattern detected. ' : ''}${patterns.crossPlatformPattern > 0 ? 'Cross-platform pattern detected.' : ''}`
-                                        : 'Insufficient correlation evidence.',
-                                    recommendations: [
-                                        highConfidence.length > 3 ? 'Consider filing FTC complaint for coordinated manipulation' : null,
-                                        patterns.chromeGmailPattern > 0 ? 'Document all Chrome-Gmail interactions' : null,
-                                        patterns.crossPlatformPattern > 0 ? 'Investigate data sharing agreements between companies' : null,
-                                    ].filter(Boolean),
-                                },
-                            });
-                        }
-                        default:
-                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
-                    }
-                },
-            },
-            // ─────────────────────────────────────────────────────────────────────────
-            // Attack Chain Detection
-            // ─────────────────────────────────────────────────────────────────────────
-            {
-                name: 'AttackChain',
-                description: `Detect and analyze multi-step attack chains.
-
-Attack chains model coordinated fraud that spans multiple steps:
-- Google Surveillance Chain: Chrome→Gmail→Data Exfiltration
-- Gmail Draft Exploitation: Access→Modify→Send→Suppress
-- Apple iMessage MITM: IDS Control→Key Sub→Intercept→Modify
-- Apple CKV Bypass: CKV Disabled→Alert Suppress→Remote Disable
-- Cross-Platform: Parallel Access→Content Correlation→Suppression
-
-Each chain has steps, phases, and legal implications.
-Detecting partial chains provides early warning.
-Complete chains provide prosecution-ready evidence.
-
-Operations:
-- list: List all known attack chains
-- progress: Get detection progress for all chains
-- detect: Run attack chain detection on findings
-- report: Get detailed report for a chain
-- analyze: Analyze evidence strength and legal readiness`,
-                parameters: {
-                    type: 'object',
-                    required: ['operation'],
-                    properties: {
-                        operation: {
-                            type: 'string',
-                            enum: ['list', 'progress', 'detect', 'report', 'analyze'],
-                            description: 'Operation to perform',
-                        },
-                        chainId: {
-                            type: 'string',
-                            description: 'Attack chain ID (for report/analyze)',
-                        },
-                        investigationId: {
-                            type: 'string',
-                            description: 'Investigation ID (for detect)',
-                        },
-                        target: {
-                            type: 'string',
-                            enum: ['apple', 'google', 'meta', 'microsoft', 'amazon'],
-                            description: 'Filter chains by target',
-                        },
-                    },
-                },
-                handler: async (args) => {
-                    const operation = args['operation'];
-                    const orchestrator = await getOrchestrator();
-                    // Initialize attack chains
-                    await orchestrator.initializeAttackChains();
-                    switch (operation) {
-                        case 'list': {
-                            const target = args['target'];
-                            const chains = target
-                                ? ATTACK_CHAIN_REGISTRY.filter(c => c.target === target)
-                                : ATTACK_CHAIN_REGISTRY;
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'list',
-                                count: chains.length,
-                                chains: chains.map(chain => ({
-                                    id: chain.id,
-                                    name: chain.name,
-                                    target: chain.target,
-                                    description: chain.description.trim(),
-                                    stepCount: chain.steps.length,
-                                    minimumStepsForEvidence: chain.minimumStepsForEvidence,
-                                    phases: [...new Set(chain.steps.map(s => s.phase))],
-                                    legalImplications: {
-                                        fraudType: chain.legalImplications.fraudType,
-                                        lawCount: chain.legalImplications.applicableLaws.length,
-                                    },
-                                })),
-                                message: `${chains.length} attack chains available. Use 'report' with chainId for details.`,
-                            });
-                        }
-                        case 'progress': {
-                            const target = args['target'];
-                            const allProgress = await orchestrator.attackChainDetector.getAllProgress();
-                            const filtered = target
-                                ? allProgress.filter(p => p.target === target)
-                                : allProgress;
-                            // Categorize by threat level
-                            const critical = filtered.filter(p => p.riskLevel === 'critical');
-                            const high = filtered.filter(p => p.riskLevel === 'high');
-                            const medium = filtered.filter(p => p.riskLevel === 'medium');
-                            const low = filtered.filter(p => p.riskLevel === 'low');
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'progress',
-                                summary: {
-                                    total: filtered.length,
-                                    critical: critical.length,
-                                    high: high.length,
-                                    medium: medium.length,
-                                    low: low.length,
-                                    completeChains: filtered.filter(p => p.isComplete).length,
-                                },
-                                chains: filtered.map(p => ({
-                                    chainId: p.chainId,
-                                    chainName: p.chainName,
-                                    target: p.target,
-                                    completionPercentage: Math.round(p.completionPercentage),
-                                    currentPhase: p.currentPhase,
-                                    riskLevel: p.riskLevel,
-                                    isComplete: p.isComplete,
-                                    observedSteps: p.observedSteps.length,
-                                    nextExpectedSteps: p.nextExpectedSteps.length,
-                                })),
-                                alerts: [
-                                    ...critical.map(p => `🚨 CRITICAL: ${p.chainName} at ${Math.round(p.completionPercentage)}% completion`),
-                                    ...high.map(p => `⚠️ HIGH: ${p.chainName} at ${Math.round(p.completionPercentage)}% completion`),
-                                ],
-                            });
-                        }
-                        case 'detect': {
-                            const investigationId = args['investigationId'];
-                            if (!investigationId) {
-                                return JSON.stringify({ success: false, error: 'investigationId required' });
-                            }
-                            const result = await orchestrator.detectAttackChains(investigationId);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'detect',
-                                investigationId,
-                                results: {
-                                    completeChains: result.completeChains.length,
-                                    partialChains: result.partialChains.length,
-                                    activeThreats: result.activeThreats.length,
-                                },
-                                completeChains: result.completeChains.map(p => ({
-                                    chainId: p.chainId,
-                                    chainName: p.chainName,
-                                    target: p.target,
-                                    riskLevel: p.riskLevel,
-                                    message: '⚠️ COMPLETE ATTACK CHAIN DETECTED - Prosecution ready',
-                                })),
-                                partialChains: result.partialChains.map(p => ({
-                                    chainId: p.chainId,
-                                    chainName: p.chainName,
-                                    completionPercentage: Math.round(p.completionPercentage),
-                                    currentPhase: p.currentPhase,
-                                    message: 'Sufficient evidence for legal action',
-                                })),
-                                activeThreats: result.activeThreats.map(p => ({
-                                    chainId: p.chainId,
-                                    chainName: p.chainName,
-                                    riskLevel: p.riskLevel,
-                                    nextExpectedSteps: p.nextExpectedSteps.map(s => s.name),
-                                })),
-                                message: result.completeChains.length > 0
-                                    ? `🚨 ${result.completeChains.length} COMPLETE ATTACK CHAINS DETECTED`
-                                    : result.partialChains.length > 0
-                                        ? `⚠️ ${result.partialChains.length} partial chains with sufficient evidence for legal action`
-                                        : result.activeThreats.length > 0
-                                            ? `Active threats detected: ${result.activeThreats.length} chains in progress`
-                                            : 'No attack chains detected',
-                            });
-                        }
-                        case 'report': {
-                            const chainId = args['chainId'];
-                            if (!chainId) {
-                                return JSON.stringify({
-                                    success: false,
-                                    error: 'chainId required',
-                                    availableChains: ATTACK_CHAIN_REGISTRY.map(c => ({ id: c.id, name: c.name })),
-                                });
-                            }
-                            const report = await orchestrator.getAttackChainReport(chainId);
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'report',
-                                chain: {
-                                    id: report.chain.id,
-                                    name: report.chain.name,
-                                    target: report.chain.target,
-                                    description: report.chain.description.trim(),
-                                },
-                                progress: {
-                                    completionPercentage: Math.round(report.progress.completionPercentage),
-                                    currentPhase: report.progress.currentPhase,
-                                    riskLevel: report.progress.riskLevel,
-                                    isComplete: report.progress.isComplete,
-                                },
-                                evidenceStrength: report.evidenceStrength,
-                                legalReadiness: report.legalReadiness,
-                                timeline: report.timeline.map(t => ({
-                                    stepId: t.step.id,
-                                    stepName: t.step.name,
-                                    phase: t.step.phase,
-                                    description: t.step.description,
-                                    indicators: t.step.indicators,
-                                    detectionMethods: t.step.detectionMethods,
-                                    observed: t.observation !== null,
-                                    observation: t.observation ? {
-                                        timestamp: t.observation.timestamp,
-                                        confidence: t.observation.confidence,
-                                        evidence: t.observation.evidence.slice(0, 200),
-                                    } : null,
-                                })),
-                                gaps: report.gaps.map(g => ({
-                                    stepId: g.id,
-                                    stepName: g.name,
-                                    phase: g.phase,
-                                    indicators: g.indicators,
-                                    detectionMethods: g.detectionMethods,
-                                })),
-                                legalImplications: report.chain.legalImplications,
-                            });
-                        }
-                        case 'analyze': {
-                            const chainId = args['chainId'];
-                            if (chainId) {
-                                // Analyze specific chain
-                                const report = await orchestrator.getAttackChainReport(chainId);
-                                return JSON.stringify({
-                                    success: true,
-                                    operation: 'analyze',
-                                    chainId,
-                                    analysis: {
-                                        evidenceStrength: report.evidenceStrength,
-                                        legalReadiness: report.legalReadiness,
-                                        completionPercentage: Math.round(report.progress.completionPercentage),
-                                        observedSteps: report.timeline.filter(t => t.observation !== null).length,
-                                        totalSteps: report.timeline.length,
-                                        gapCount: report.gaps.length,
-                                        recommendations: getRecommendationsForEvidence(report.evidenceStrength, report.legalReadiness, report.chain),
-                                    },
-                                });
-                            }
-                            // Analyze all chains
-                            const allProgress = await orchestrator.attackChainDetector.getAllProgress();
-                            const overallAnalysis = {
-                                totalChains: allProgress.length,
-                                chainsWithEvidence: allProgress.filter(p => p.observedSteps.length > 0).length,
-                                completeChains: allProgress.filter(p => p.isComplete).length,
-                                criticalThreats: allProgress.filter(p => p.riskLevel === 'critical').length,
-                                highThreats: allProgress.filter(p => p.riskLevel === 'high').length,
-                                avgCompletion: allProgress.length > 0
-                                    ? Math.round(allProgress.reduce((sum, p) => sum + p.completionPercentage, 0) / allProgress.length)
-                                    : 0,
-                            };
-                            const threatAssessment = overallAnalysis.completeChains > 0 ? 'PROSECUTION_READY' :
-                                overallAnalysis.criticalThreats > 0 ? 'CRITICAL' :
-                                    overallAnalysis.highThreats > 0 ? 'HIGH' :
-                                        overallAnalysis.chainsWithEvidence > 0 ? 'MODERATE' : 'LOW';
-                            return JSON.stringify({
-                                success: true,
-                                operation: 'analyze',
-                                overallAnalysis,
-                                threatAssessment,
-                                byTarget: {
-                                    google: allProgress.filter(p => p.target === 'google').length,
-                                    apple: allProgress.filter(p => p.target === 'apple').length,
-                                },
-                                topThreats: allProgress
-                                    .filter(p => p.observedSteps.length > 0)
-                                    .sort((a, b) => b.completionPercentage - a.completionPercentage)
-                                    .slice(0, 5)
-                                    .map(p => ({
-                                    chainId: p.chainId,
-                                    chainName: p.chainName,
-                                    target: p.target,
-                                    completionPercentage: Math.round(p.completionPercentage),
-                                    riskLevel: p.riskLevel,
-                                })),
-                                recommendations: [
-                                    overallAnalysis.completeChains > 0
-                                        ? 'File immediate FTC complaint for complete attack chains'
-                                        : null,
-                                    overallAnalysis.criticalThreats > 0
-                                        ? 'Preserve all evidence immediately - critical threats detected'
-                                        : null,
-                                    overallAnalysis.chainsWithEvidence > allProgress.length / 2
-                                        ? 'Consider engaging legal counsel - multiple attack chains with evidence'
-                                        : null,
-                                ].filter(Boolean),
-                            });
-                        }
-                        default:
-                            return JSON.stringify({ success: false, error: `Unknown operation: ${operation}` });
-                    }
-                },
-            },
-        ],
-    };
-}
-// ═══════════════════════════════════════════════════════════════════════════════
-// HELPER FUNCTIONS
-// ═══════════════════════════════════════════════════════════════════════════════
-function getRecommendationsForEvidence(evidenceStrength, legalReadiness, chain) {
-    const recs = [];
-    if (legalReadiness === 'prosecution_ready') {
-        recs.push('Evidence is prosecution-ready. Engage legal counsel immediately.');
-        recs.push('File FTC complaint with complete evidence package.');
-        recs.push('Consider filing with state AG for additional enforcement.');
-    }
-    else if (legalReadiness === 'actionable') {
-        recs.push('Sufficient evidence for legal action. Consult attorney.');
-        recs.push('Continue monitoring to strengthen case.');
-        recs.push('File preliminary FTC complaint.');
-    }
-    else if (legalReadiness === 'preliminary') {
-        recs.push('Evidence is building. Continue monitoring attack chain steps.');
-        recs.push('Focus on detecting: ' + chain.steps.slice(0, 2).map(s => s.name).join(', '));
-        recs.push('Preserve all current observations.');
-    }
-    else {
-        recs.push('Insufficient evidence. Increase monitoring.');
-        recs.push('Use detection methods: ' + chain.steps[0]?.detectionMethods.slice(0, 2).join(', '));
-    }
-    // Add specific recommendations from chain
-    recs.push(...chain.legalImplications.recommendations.slice(0, 2));
-    return recs;
-}
-function getDefaultVectors(target) {
-    const defaults = {
-        apple: ['imessage_key_substitution', 'imessage_false_e2e'],
-        google: [
-            'gmail_hidden_threads', 'gmail_draft_manipulation', 'gmail_unauthorized_access',
-            'chrome_unauthorized_launch', 'chrome_session_hijacking', 'chrome_history_manipulation',
-        ],
-        meta: [],
-        microsoft: [],
-        amazon: [],
-    };
-    return defaults[target] || [];
-}
-//# sourceMappingURL=unifiedInvestigationTools.js.map