hackmyagent 0.7.2 → 0.8.1

package/dist/arp/monitors/network.js

@@ -0,0 +1,301 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkMonitor = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+/** Known exfiltration/suspicious destinations */
+const SUSPICIOUS_HOSTS = [
+    'webhook.site', 'requestbin', 'ngrok.io', 'pipedream.net',
+    'hookbin.com', 'burpcollaborator', 'interact.sh', 'oastify.com',
+    'pastebin.com', 'transfer.sh',
+];
+/**
+ * Network monitor — tracks outbound connections using lsof/ss.
+ * Detects connections to suspicious hosts, new outbound destinations,
+ * and unexpected port usage.
+ */
+class NetworkMonitor {
+    constructor(engine, intervalMs = 10000, allowedHosts) {
+        this.type = 'network';
+        this.knownDestinations = new Set();
+        this.engine = engine;
+        this.intervalMs = intervalMs;
+        this.allowedHosts = new Set(allowedHosts ?? []);
+    }
+    async start() {
+        // Initial snapshot
+        const connections = this.getConnections();
+        for (const conn of connections) {
+            this.knownDestinations.add(`${conn.remoteAddr}:${conn.remotePort}`);
+        }
+        this.timer = setInterval(() => this.poll(), this.intervalMs);
+        if (this.timer.unref)
+            this.timer.unref();
+    }
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+    }
+    isRunning() {
+        return this.timer !== undefined;
+    }
+    poll() {
+        try {
+            const connections = this.getConnections();
+            for (const conn of connections) {
+                const dest = `${conn.remoteAddr}:${conn.remotePort}`;
+                // Check for suspicious hosts
+                const isSuspicious = SUSPICIOUS_HOSTS.some((h) => conn.remoteAddr.includes(h));
+                if (isSuspicious) {
+                    this.engine.emit({
+                        source: 'network',
+                        category: 'threat',
+                        severity: 'critical',
+                        description: `Connection to suspicious host: ${dest}`,
+                        data: {
+                            remoteAddr: conn.remoteAddr,
+                            remotePort: conn.remotePort,
+                            protocol: conn.protocol,
+                            pid: conn.pid,
+                        },
+                    });
+                    continue;
+                }
+                // Check for new outbound destinations
+                if (!this.knownDestinations.has(dest)) {
+                    const isAllowed = this.allowedHosts.size === 0 ||
+                        this.allowedHosts.has(conn.remoteAddr) ||
+                        Array.from(this.allowedHosts).some((h) => conn.remoteAddr === h || conn.remoteAddr.endsWith('.' + h));
+                    this.engine.emit({
+                        source: 'network',
+                        category: isAllowed ? 'normal' : 'anomaly',
+                        severity: isAllowed ? 'info' : 'medium',
+                        description: `New outbound connection: ${dest}`,
+                        data: {
+                            remoteAddr: conn.remoteAddr,
+                            remotePort: conn.remotePort,
+                            protocol: conn.protocol,
+                            pid: conn.pid,
+                            allowed: isAllowed,
+                        },
+                    });
+                    this.knownDestinations.add(dest);
+                }
+            }
+        }
+        catch {
+            // lsof/ss failed — skip
+        }
+    }
+    getConnections() {
+        const platform = os.platform();
+        if (platform === 'darwin') {
+            // macOS: try lsof first, fall back to netstat
+            const lsof = this.parseLsof();
+            if (lsof.length > 0)
+                return lsof;
+            return this.parseNetstat();
+        }
+        // Linux: try ss first, fall back to /proc/net/tcp, then netstat
+        const ss = this.parseSs();
+        if (ss.length > 0)
+            return ss;
+        const proc = this.parseProcNetTcp();
+        if (proc.length > 0)
+            return proc;
+        return this.parseNetstat();
+    }
+    parseLsof() {
+        const connections = [];
+        try {
+            const output = (0, child_process_1.execSync)('lsof -i -n -P 2>/dev/null | grep ESTABLISHED', { encoding: 'utf-8', timeout: 5000 });
+            for (const line of output.trim().split('\n')) {
+                if (!line)
+                    continue;
+                const parts = line.split(/\s+/);
+                if (parts.length < 9)
+                    continue;
+                const nameField = parts[8] ?? '';
+                const match = nameField.match(/(\S+):(\d+)->(\S+):(\d+)/);
+                if (!match)
+                    continue;
+                connections.push({
+                    protocol: parts[7]?.includes('TCP') ? 'tcp' : 'udp',
+                    localAddr: match[1],
+                    localPort: parseInt(match[2]),
+                    remoteAddr: match[3],
+                    remotePort: parseInt(match[4]),
+                    state: 'ESTABLISHED',
+                    pid: parseInt(parts[1]) || undefined,
+                });
+            }
+        }
+        catch {
+            // lsof not available or no connections
+        }
+        return connections;
+    }
+    parseSs() {
+        const connections = [];
+        try {
+            const output = (0, child_process_1.execSync)('ss -tpn state established 2>/dev/null', { encoding: 'utf-8', timeout: 5000 });
+            for (const line of output.trim().split('\n').slice(1)) {
+                if (!line)
+                    continue;
+                const parts = line.split(/\s+/);
+                if (parts.length < 5)
+                    continue;
+                const local = parts[3]?.split(':') ?? [];
+                const remote = parts[4]?.split(':') ?? [];
+                connections.push({
+                    protocol: 'tcp',
+                    localAddr: local.slice(0, -1).join(':'),
+                    localPort: parseInt(local[local.length - 1] ?? '0'),
+                    remoteAddr: remote.slice(0, -1).join(':'),
+                    remotePort: parseInt(remote[remote.length - 1] ?? '0'),
+                    state: 'ESTABLISHED',
+                });
+            }
+        }
+        catch {
+            // ss not available
+        }
+        return connections;
+    }
+    /** Parse /proc/net/tcp (Linux) — no external tools required */
+    parseProcNetTcp() {
+        const connections = [];
+        try {
+            const content = fs.readFileSync('/proc/net/tcp', 'utf-8');
+            for (const line of content.trim().split('\n').slice(1)) {
+                const parts = line.trim().split(/\s+/);
+                if (parts.length < 4)
+                    continue;
+                const state = parseInt(parts[3], 16);
+                if (state !== 1)
+                    continue; // 01 = ESTABLISHED
+                const local = this.parseHexAddr(parts[1]);
+                const remote = this.parseHexAddr(parts[2]);
+                if (!local || !remote)
+                    continue;
+                connections.push({
+                    protocol: 'tcp',
+                    localAddr: local.addr,
+                    localPort: local.port,
+                    remoteAddr: remote.addr,
+                    remotePort: remote.port,
+                    state: 'ESTABLISHED',
+                });
+            }
+        }
+        catch {
+            // /proc/net/tcp not available (macOS, containers without /proc)
+        }
+        return connections;
+    }
+    /** Parse hex address:port from /proc/net/tcp (e.g., "0100007F:0050") */
+    parseHexAddr(hexPair) {
+        const [hexAddr, hexPort] = hexPair.split(':');
+        if (!hexAddr || !hexPort)
+            return null;
+        const port = parseInt(hexPort, 16);
+        const addrNum = parseInt(hexAddr, 16);
+        // /proc/net/tcp stores addresses in little-endian
+        const addr = [
+            addrNum & 0xff,
+            (addrNum >> 8) & 0xff,
+            (addrNum >> 16) & 0xff,
+            (addrNum >> 24) & 0xff,
+        ].join('.');
+        return { addr, port };
+    }
+    /** Parse netstat output — available on most systems as last resort */
+    parseNetstat() {
+        const connections = [];
+        try {
+            const output = (0, child_process_1.execSync)('netstat -an 2>/dev/null | grep ESTABLISHED', { encoding: 'utf-8', timeout: 5000 });
+            for (const line of output.trim().split('\n')) {
+                if (!line)
+                    continue;
+                const parts = line.trim().split(/\s+/);
+                if (parts.length < 5)
+                    continue;
+                const proto = parts[0];
+                if (!proto.startsWith('tcp'))
+                    continue;
+                const localParts = this.splitAddrPort(parts[3]);
+                const remoteParts = this.splitAddrPort(parts[4]);
+                if (!localParts || !remoteParts)
+                    continue;
+                connections.push({
+                    protocol: 'tcp',
+                    localAddr: localParts.addr,
+                    localPort: localParts.port,
+                    remoteAddr: remoteParts.addr,
+                    remotePort: remoteParts.port,
+                    state: 'ESTABLISHED',
+                });
+            }
+        }
+        catch {
+            // netstat not available
+        }
+        return connections;
+    }
+    /** Split "addr.port" or "addr:port" into components */
+    splitAddrPort(value) {
+        // Try colon separator first (Linux netstat, IPv6)
+        const colonIdx = value.lastIndexOf(':');
+        if (colonIdx > 0) {
+            const port = parseInt(value.slice(colonIdx + 1));
+            if (!isNaN(port))
+                return { addr: value.slice(0, colonIdx), port };
+        }
+        // macOS netstat uses dot separator: "127.0.0.1.8080"
+        const dotIdx = value.lastIndexOf('.');
+        if (dotIdx > 0) {
+            const port = parseInt(value.slice(dotIdx + 1));
+            if (!isNaN(port))
+                return { addr: value.slice(0, dotIdx), port };
+        }
+        return null;
+    }
+}
+exports.NetworkMonitor = NetworkMonitor;
+//# sourceMappingURL=network.js.map

package/dist/arp/monitors/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/arp/monitors/network.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAyC;AACzC,uCAAyB;AACzB,uCAAyB;AAczB,iDAAiD;AACjD,MAAM,gBAAgB,GAAG;IACvB,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe;IACzD,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,aAAa;IAC/D,cAAc,EAAE,aAAa;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAa,cAAc;IAQzB,YAAY,MAAmB,EAAE,aAAqB,KAAK,EAAE,YAAuB;QAP3E,SAAI,GAAgB,SAAS,CAAC;QAK/B,sBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAG5C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,mBAAmB;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAClC,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAErD,6BAA6B;gBAC7B,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5B,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,UAAU;wBACpB,WAAW,EAAE,kCAAkC,IAAI,EAAE;wBACrD,IAAI,EAAE;4BACJ,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,GAAG,EAAE,IAAI,CAAC,GAAG;yBACd;qBACF,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,sCAAsC;gBACtC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;wBAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAC3D,CAAC;oBAEJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;wBAC1C,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;wBACvC,WAAW,EAAE,4BAA4B,IAAI,EAAE;wBAC/C,IAAI,EAAE;4BACJ,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,GAAG,EAAE,IAAI,CAAC,GAAG;4BACb,OAAO,EAAE,SAAS;yBACnB;qBACF,CAAC,CAAC;oBAEH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAE/B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,CAAC;QAED,gEAAgE;QAChE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEO,SAAS;QACf,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,8CAA8C,EAC9C,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAE/B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC1D,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAErB,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;oBACnD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC7B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC9B,KAAK,EAAE,aAAa;oBACpB,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS;iBACrC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,OAAO;QACb,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,uCAAuC,EACvC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAE1C,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;oBACnD,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;oBACzC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;oBACtD,KAAK,EAAE,aAAa;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,+DAA+D;IACvD,eAAe;QACrB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAE/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,KAAK,KAAK,CAAC;oBAAE,SAAS,CAAC,mBAAmB;gBAE9C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;oBAAE,SAAS;gBAEhC,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,KAAK,EAAE,aAAa;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,wEAAwE;IAChE,YAAY,CAAC,OAAe;QAClC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,kDAAkD;QAClD,MAAM,IAAI,GAAG;YACX,OAAO,GAAG,IAAI;YACd,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI;YACrB,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI;YACtB,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI;SACvB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,sEAAsE;IAC9D,YAAY;QAClB,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,4CAA4C,EAC5C,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;YAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,SAAS;gBAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAEvC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAE1C,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,UAAU,CAAC,IAAI;oBAC1B,SAAS,EAAE,UAAU,CAAC,IAAI;oBAC1B,UAAU,EAAE,WAAW,CAAC,IAAI;oBAC5B,UAAU,EAAE,WAAW,CAAC,IAAI;oBAC5B,KAAK,EAAE,aAAa;iBACrB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,uDAAuD;IAC/C,aAAa,CAAC,KAAa;QACjC,kDAAkD;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,qDAAqD;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArRD,wCAqRC"}

package/dist/arp/monitors/process.d.ts

@@ -0,0 +1,24 @@
+import type { Monitor, MonitorType } from '../types';
+import type { EventEngine } from '../engine/event-engine';
+/**
+ * Process monitor — tracks agent lifecycle, child processes, and resource usage.
+ * Uses `ps` polling (cross-platform, no root required).
+ */
+export declare class ProcessMonitor implements Monitor {
+    readonly type: MonitorType;
+    private timer?;
+    private readonly engine;
+    private readonly intervalMs;
+    private knownPids;
+    private agentPid?;
+    constructor(engine: EventEngine, intervalMs?: number);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    isRunning(): boolean;
+    private poll;
+    /** Walk the full process tree to find all descendants of parentPid.
+     *  Uses `ps -ax -o pid=,ppid=` which works on both macOS and Linux. */
+    private getDescendantPids;
+    private getProcessInfo;
+}
+//# sourceMappingURL=process.d.ts.map

package/dist/arp/monitors/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../../src/arp/monitors/process.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAY,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAkB1D;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAa;IACvC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,MAAM,EAAE,WAAW,EAAE,UAAU,GAAE,MAAa;IAKpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,SAAS,IAAI,OAAO;IAIpB,OAAO,CAAC,IAAI;IAgFZ;2EACuE;IACvE,OAAO,CAAC,iBAAiB;IAgCzB,OAAO,CAAC,cAAc;CAwBvB"}

package/dist/arp/monitors/process.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessMonitor = void 0;
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/** Binaries commonly used for exfiltration, lateral movement, or exploitation */
+const SUSPICIOUS_BINARIES = [
+    'curl', 'wget', 'nc', 'ncat', 'nmap', 'ssh', 'scp',
+    'python', 'python3', 'perl', 'ruby', 'base64',
+    'socat', 'telnet', 'ftp', 'rsync',
+];
+/**
+ * Process monitor — tracks agent lifecycle, child processes, and resource usage.
+ * Uses `ps` polling (cross-platform, no root required).
+ */
+class ProcessMonitor {
+    constructor(engine, intervalMs = 5000) {
+        this.type = 'process';
+        this.knownPids = new Set();
+        this.engine = engine;
+        this.intervalMs = intervalMs;
+    }
+    async start() {
+        this.agentPid = process.pid; // Monitor children of the current (agent) process
+        this.knownPids = new Set(this.getDescendantPids(this.agentPid));
+        this.timer = setInterval(() => this.poll(), this.intervalMs);
+        if (this.timer.unref)
+            this.timer.unref();
+    }
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+    }
+    isRunning() {
+        return this.timer !== undefined;
+    }
+    poll() {
+        try {
+            const currentPids = this.getDescendantPids(this.agentPid);
+            const currentSet = new Set(currentPids);
+            // Detect new child processes
+            for (const pid of currentPids) {
+                if (!this.knownPids.has(pid)) {
+                    const info = this.getProcessInfo(pid);
+                    if (info) {
+                        this.engine.emit({
+                            source: 'process',
+                            category: 'normal',
+                            severity: 'info',
+                            description: `New child process: PID ${pid} — ${info.command.slice(0, 100)}`,
+                            data: { pid, command: info.command, user: info.user, cpu: info.cpu, mem: info.mem },
+                        });
+                    }
+                }
+            }
+            // Detect terminated processes
+            for (const pid of this.knownPids) {
+                if (!currentSet.has(pid)) {
+                    this.engine.emit({
+                        source: 'process',
+                        category: 'normal',
+                        severity: 'info',
+                        description: `Child process terminated: PID ${pid}`,
+                        data: { pid, action: 'terminated' },
+                    });
+                }
+            }
+            // Check for suspicious processes (binaries, high CPU, unexpected users)
+            for (const pid of currentPids) {
+                const info = this.getProcessInfo(pid);
+                if (!info)
+                    continue;
+                // Suspicious binary detection
+                const binaryName = path.basename(info.command.split(/\s+/)[0]);
+                if (SUSPICIOUS_BINARIES.includes(binaryName)) {
+                    this.engine.emit({
+                        source: 'process',
+                        category: 'violation',
+                        severity: 'high',
+                        description: `Suspicious binary executed: ${binaryName} (PID ${pid})`,
+                        data: { pid, binary: binaryName, command: info.command, user: info.user },
+                    });
+                }
+                // High CPU for extended period
+                if (info.cpu > 90) {
+                    this.engine.emit({
+                        source: 'process',
+                        category: 'anomaly',
+                        severity: 'medium',
+                        description: `High CPU usage: PID ${pid} at ${info.cpu}% — ${info.command.slice(0, 60)}`,
+                        data: { pid, cpu: info.cpu, command: info.command },
+                    });
+                }
+                // Running as different user
+                if (info.user === 'root' && os.userInfo().username !== 'root') {
+                    this.engine.emit({
+                        source: 'process',
+                        category: 'violation',
+                        severity: 'high',
+                        description: `Child process running as root: PID ${pid} — ${info.command.slice(0, 60)}`,
+                        data: { pid, user: info.user, command: info.command },
+                    });
+                }
+            }
+            this.knownPids = currentSet;
+        }
+        catch {
+            // ps command failed — skip this cycle
+        }
+    }
+    /** Walk the full process tree to find all descendants of parentPid.
+     *  Uses `ps -ax -o pid=,ppid=` which works on both macOS and Linux. */
+    getDescendantPids(parentPid) {
+        if (!parentPid)
+            return [];
+        try {
+            const output = (0, child_process_1.execSync)('ps -ax -o pid=,ppid=', { encoding: 'utf-8', timeout: 5000 });
+            const childMap = new Map();
+            for (const line of output.trim().split('\n')) {
+                const parts = line.trim().split(/\s+/);
+                const pid = parseInt(parts[0]);
+                const ppid = parseInt(parts[1]);
+                if (isNaN(pid) || isNaN(ppid))
+                    continue;
+                if (!childMap.has(ppid))
+                    childMap.set(ppid, []);
+                childMap.get(ppid).push(pid);
+            }
+            // BFS from parentPid
+            const result = [];
+            const queue = [parentPid];
+            while (queue.length > 0) {
+                const current = queue.shift();
+                for (const child of childMap.get(current) ?? []) {
+                    result.push(child);
+                    queue.push(child);
+                }
+            }
+            return result;
+        }
+        catch {
+            return [];
+        }
+    }
+    getProcessInfo(pid) {
+        try {
+            const output = (0, child_process_1.execSync)(`ps -o pid=,ppid=,user=,%cpu=,%mem=,command= -p ${pid}`, { encoding: 'utf-8', timeout: 5000 });
+            const line = output.trim();
+            if (!line)
+                return null;
+            const parts = line.trim().split(/\s+/);
+            if (parts.length < 6)
+                return null;
+            return {
+                pid: parseInt(parts[0]),
+                ppid: parseInt(parts[1]),
+                user: parts[2],
+                cpu: parseFloat(parts[3]),
+                mem: parseFloat(parts[4]),
+                command: parts.slice(5).join(' '),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.ProcessMonitor = ProcessMonitor;
+//# sourceMappingURL=process.js.map

package/dist/arp/monitors/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../src/arp/monitors/process.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAyC;AACzC,uCAAyB;AACzB,2CAA6B;AAa7B,iFAAiF;AACjF,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;IAClD,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;IAC7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;CAClC,CAAC;AAEF;;;GAGG;AACH,MAAa,cAAc;IAQzB,YAAY,MAAmB,EAAE,aAAqB,IAAI;QAPjD,SAAI,GAAgB,SAAS,CAAC;QAI/B,cAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAIpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,kDAAkD;QAC/E,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhE,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAClC,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YAExC,6BAA6B;YAC7B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;4BACf,MAAM,EAAE,SAAS;4BACjB,QAAQ,EAAE,QAAQ;4BAClB,QAAQ,EAAE,MAAM;4BAChB,WAAW,EAAE,0BAA0B,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;4BAC5E,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;yBACpF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,8BAA8B;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,MAAM;wBAChB,WAAW,EAAE,iCAAiC,GAAG,EAAE;wBACnD,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBAEpB,8BAA8B;gBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,IAAI,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,WAAW;wBACrB,QAAQ,EAAE,MAAM;wBAChB,WAAW,EAAE,+BAA+B,UAAU,SAAS,GAAG,GAAG;wBACrE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,QAAQ;wBAClB,WAAW,EAAE,uBAAuB,GAAG,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;wBACxF,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;qBACpD,CAAC,CAAC;gBACL,CAAC;gBAED,4BAA4B;gBAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,WAAW;wBACrB,QAAQ,EAAE,MAAM;wBAChB,WAAW,EAAE,sCAAsC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;wBACvF,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;qBACtD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED;2EACuE;IAC/D,iBAAiB,CAAC,SAAkB;QAC1C,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;YAE7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YAED,qBAAqB;YACrB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;gBAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,kDAAkD,GAAG,EAAE,EACvD,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CACrC,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAElC,OAAO;gBACL,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAClC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AA1KD,wCA0KC"}

package/dist/arp/patterns/ai-threats.d.ts

@@ -0,0 +1,48 @@
+export interface ThreatPattern {
+    /** Pattern identifier (e.g., PI-001) */
+    id: string;
+    /** Attack category */
+    category: 'prompt-injection' | 'jailbreak' | 'data-exfiltration' | 'output-leak' | 'context-manipulation' | 'mcp-exploitation' | 'a2a-attack';
+    /** Human-readable description */
+    description: string;
+    /** Regex pattern to match */
+    pattern: RegExp;
+    /** Severity when matched */
+    severity: 'medium' | 'high' | 'critical';
+}
+export declare const ALL_PATTERNS: ThreatPattern[];
+/** Pattern sets by category for targeted scanning */
+export declare const PATTERN_SETS: {
+    readonly promptInjection: ThreatPattern[];
+    readonly jailbreak: ThreatPattern[];
+    readonly dataExfiltration: ThreatPattern[];
+    readonly outputLeak: ThreatPattern[];
+    readonly contextManipulation: ThreatPattern[];
+    readonly mcpExploitation: ThreatPattern[];
+    readonly a2aAttack: ThreatPattern[];
+    /** Input scanning: patterns relevant to user/agent input */
+    readonly inputPatterns: readonly ThreatPattern[];
+    /** Output scanning: patterns relevant to LLM responses */
+    readonly outputPatterns: readonly ThreatPattern[];
+    /** MCP scanning: patterns relevant to tool call parameters */
+    readonly mcpPatterns: readonly ThreatPattern[];
+    /** A2A scanning: patterns relevant to inter-agent messages */
+    readonly a2aPatterns: readonly ThreatPattern[];
+};
+/** Scan result from matching */
+export interface ScanResult {
+    detected: boolean;
+    matches: Array<{
+        pattern: ThreatPattern;
+        matchedText: string;
+    }>;
+    /** True if input was truncated before scanning */
+    truncated?: boolean;
+}
+/**
+ * Scan text against a set of threat patterns.
+ * Returns all matches (not just first) for comprehensive reporting.
+ * Input is truncated to MAX_SCAN_LENGTH to prevent ReDoS.
+ */
+export declare function scanText(text: string, patterns: readonly ThreatPattern[]): ScanResult;
+//# sourceMappingURL=ai-threats.d.ts.map

package/dist/arp/patterns/ai-threats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-threats.d.ts","sourceRoot":"","sources":["../../../src/arp/patterns/ai-threats.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,QAAQ,EAAE,kBAAkB,GAAG,WAAW,GAAG,mBAAmB,GAAG,aAAa,GAAG,sBAAsB,GAAG,kBAAkB,GAAG,YAAY,CAAC;IAC9I,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CAC1C;AA4KD,eAAO,MAAM,YAAY,EAAE,aAAa,EAQvC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,YAAY;;;;;;;;IAQvB,4DAA4D;;IAE5D,0DAA0D;;IAE1D,8DAA8D;;IAE9D,8DAA8D;;CAEtD,CAAC;AAKX,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,KAAK,CAAC;QACb,OAAO,EAAE,aAAa,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,UAAU,CAoBrF"}