helixmind 0.2.0 → 0.2.2

package/dist/cli/agent/monitor/responder.js

@@ -0,0 +1,59 @@
+/**
+ * Monitor System — Executes defense actions (defensive/active mode only).
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Execute a defense action using the agent's run_command tool.
+ */
+export async function executeDefense(action, target, sendMessage) {
+    const defensePrompts = {
+        block_ip: `Block the IP address ${target} using iptables. Run:
+iptables -A INPUT -s ${target} -j DROP
+Then verify with: iptables -L -n | grep ${target}`,
+        kill_process: `Kill the suspicious process: ${target}. Run:
+kill -9 ${target}
+Then verify it's gone with: ps aux | grep ${target}`,
+        close_port: `Close port ${target} using iptables. Run:
+iptables -A INPUT --dport ${target} -j DROP
+Then verify with: ss -tlnp | grep ${target}`,
+        rotate_secret: `Rotate the compromised secret for: ${target}
+Generate a new secure random key and update the relevant config file.`,
+        isolate_service: `Isolate the service: ${target}
+Stop the service and block its network access:
+systemctl stop ${target} 2>/dev/null
+iptables -A OUTPUT -m owner --uid-owner $(id -u ${target}) -j DROP 2>/dev/null`,
+        deploy_honeypot: `Deploy a honeypot for: ${target}
+Start a fake service that logs all connection attempts.
+Use: ncat -l -k -p ${target} -c 'echo "SSH-2.0-OpenSSH_8.2p1"; cat >> /tmp/honeypot.log' &`,
+    };
+    const prompt = defensePrompts[action] || `Execute defense action "${action}" against target "${target}".`;
+    await sendMessage(prompt);
+    return {
+        id: randomUUID().slice(0, 8),
+        action: action,
+        target,
+        reason: `Auto-response to detected threat`,
+        autoApproved: true,
+        reversible: action === 'block_ip' || action === 'close_port',
+        timestamp: Date.now(),
+    };
+}
+/**
+ * Undo a reversible defense action.
+ */
+export async function undoDefense(defense, sendMessage) {
+    if (!defense.reversible)
+        return false;
+    const undoPrompts = {
+        block_ip: `Unblock IP address ${defense.target}. Run:
+iptables -D INPUT -s ${defense.target} -j DROP`,
+        close_port: `Re-open port ${defense.target}. Run:
+iptables -D INPUT --dport ${defense.target} -j DROP`,
+    };
+    const prompt = undoPrompts[defense.action];
+    if (!prompt)
+        return false;
+    await sendMessage(prompt);
+    return true;
+}
+//# sourceMappingURL=responder.js.map

package/dist/cli/agent/monitor/responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/responder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA8B,EAC9B,MAAc,EACd,WAAmB;IAEnB,MAAM,cAAc,GAA2B;QAC7C,QAAQ,EAAE,wBAAwB,MAAM;uBACrB,MAAM;0CACa,MAAM,EAAE;QAE9C,YAAY,EAAE,gCAAgC,MAAM;UAC9C,MAAM;4CAC4B,MAAM,EAAE;QAEhD,UAAU,EAAE,cAAc,MAAM;4BACR,MAAM;oCACE,MAAM,EAAE;QAExC,aAAa,EAAE,sCAAsC,MAAM;sEACO;QAElE,eAAe,EAAE,wBAAwB,MAAM;;iBAElC,MAAM;kDAC2B,MAAM,uBAAuB;QAE3E,eAAe,EAAE,0BAA0B,MAAM;;qBAEhC,MAAM,gEAAgE;KACxF,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,2BAA2B,MAAM,qBAAqB,MAAM,IAAI,CAAC;IAE1G,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO;QACL,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,MAAuB;QAC/B,MAAM;QACN,MAAM,EAAE,kCAAkC;QAC1C,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY;QAC5D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAsB,EACtB,WAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,WAAW,GAA2B;QAC1C,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM;uBAC3B,OAAO,CAAC,MAAM,UAAU;QAE3C,UAAU,EAAE,gBAAgB,OAAO,CAAC,MAAM;4BAClB,OAAO,CAAC,MAAM,UAAU;KACjD,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/agent/monitor/scanner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Monitor System — System scanner that uses the LLM + run_command to read system state.
+ */
+import type { ScanResult, MonitorCallbacks } from './types.js';
+/**
+ * Perform a full system scan by sending the scan prompt to the agent.
+ * The agent will use run_command tools to gather system information.
+ */
+export declare function scanSystem(callbacks: MonitorCallbacks): Promise<ScanResult>;
+/**
+ * Perform a quick check (subset of full scan) for the watch loop.
+ */
+export declare function quickScan(callbacks: MonitorCallbacks): Promise<string>;
+/**
+ * Perform a medium check (config drift + packages).
+ */
+export declare function mediumScan(callbacks: MonitorCallbacks): Promise<string>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/cli/agent/monitor/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/scanner.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG/D;;;GAGG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBjF;AAmCD;;GAEG;AACH,wBAAsB,SAAS,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7E"}

package/dist/cli/agent/monitor/scanner.js

@@ -0,0 +1,81 @@
+import { SCAN_SYSTEM_PROMPT } from './prompts.js';
+/**
+ * Perform a full system scan by sending the scan prompt to the agent.
+ * The agent will use run_command tools to gather system information.
+ */
+export async function scanSystem(callbacks) {
+    callbacks.onScanComplete('scan_start');
+    const resultText = await callbacks.sendMessage(SCAN_SYSTEM_PROMPT);
+    // Parse structured baseline from the LLM response
+    const parsed = parseBaselineFromResponse(resultText);
+    const result = {
+        processes: parsed.processes || '',
+        ports: parsed.ports || '',
+        sshConfig: parsed.sshConfig || '',
+        firewall: parsed.firewall || '',
+        crontabs: parsed.crontabs || '',
+        packages: parsed.packages || '',
+        recentLogins: parsed.recentLogins || '',
+        configChanges: parsed.configChanges || '',
+        timestamp: Date.now(),
+    };
+    callbacks.onScanComplete('scan_complete');
+    return result;
+}
+/**
+ * Parse the BASELINE_START...BASELINE_END block from the LLM response.
+ */
+function parseBaselineFromResponse(text) {
+    const result = {};
+    // Extract the structured block
+    const baselineMatch = text.match(/BASELINE_START\s*([\s\S]*?)\s*BASELINE_END/);
+    if (baselineMatch) {
+        result.rawBaseline = baselineMatch[1].trim();
+    }
+    // Also extract raw command outputs for backup
+    const sections = [
+        { key: 'processes', pattern: /ps aux[\s\S]*?(?=\n(?:ss |cat |crontab|iptables|last |find )|$)/i },
+        { key: 'ports', pattern: /ss -tlnp[\s\S]*?(?=\n(?:cat |crontab|iptables|last |find )|$)/i },
+        { key: 'sshConfig', pattern: /sshd_config[\s\S]*?(?=\n(?:crontab|iptables|last |find )|$)/i },
+        { key: 'firewall', pattern: /iptables[\s\S]*?(?=\n(?:last |find )|$)/i },
+        { key: 'crontabs', pattern: /crontab[\s\S]*?(?=\n(?:iptables|last |find )|$)/i },
+        { key: 'recentLogins', pattern: /last [\s\S]*?(?=\n(?:find )|$)/i },
+        { key: 'configChanges', pattern: /find \/etc[\s\S]*/i },
+    ];
+    for (const { key, pattern } of sections) {
+        const match = text.match(pattern);
+        if (match) {
+            result[key] = match[0].trim();
+        }
+    }
+    return result;
+}
+/**
+ * Perform a quick check (subset of full scan) for the watch loop.
+ */
+export async function quickScan(callbacks) {
+    const quickPrompt = `Quick security check. Run these commands and report any anomalies:
+1. ps aux --sort=-%cpu | head -15
+2. ss -tlnp
+3. last -3 2>/dev/null
+
+Compare with what you know from the baseline. Report only NEW or CHANGED items.
+If everything matches baseline: ALL_CLEAR
+If anomaly detected: THREAT: {"severity": "...", "category": "...", "title": "...", "details": "...", "source": "..."}`;
+    return callbacks.sendMessage(quickPrompt);
+}
+/**
+ * Perform a medium check (config drift + packages).
+ */
+export async function mediumScan(callbacks) {
+    const mediumPrompt = `Medium security check. Run these commands:
+1. find /etc -newer /etc/hostname -type f -mmin -5 2>/dev/null | head -20
+2. ps aux --sort=-%cpu | head -20
+3. ss -tlnp
+4. dmesg -T 2>/dev/null | tail -10
+
+Look for config changes, new processes, new ports. Report:
+ALL_CLEAR or THREAT: {"severity": "...", "category": "...", "title": "...", "details": "...", "source": "..."}`;
+    return callbacks.sendMessage(mediumPrompt);
+}
+//# sourceMappingURL=scanner.js.map

package/dist/cli/agent/monitor/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAA2B;IAC1D,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEnE,kDAAkD;IAClD,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAe;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,SAAS,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/E,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG;QACf,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE;QACjG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,gEAAgE,EAAE;QAC3F,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;QAC7F,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0CAA0C,EAAE;QACxE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,kDAAkD,EAAE;QAChF,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;QACnE,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE;KACxD,CAAC;IAEF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAA2B;IACzD,MAAM,WAAW,GAAG;;;;;;;uHAOiG,CAAC;IAEtH,OAAO,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAA2B;IAC1D,MAAM,YAAY,GAAG;;;;;;;+GAOwF,CAAC;IAE9G,OAAO,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC"}

package/dist/cli/agent/monitor/types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Monitor System — shared types for the security monitoring agent.
+ */
+export type MonitorMode = 'passive' | 'defensive' | 'active';
+export type ThreatSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type ThreatCategory = 'bruteforce' | 'portscan' | 'exfiltration' | 'malware' | 'config_change' | 'privilege_escalation' | 'secret_leak' | 'anomaly';
+export type DefenseAction = 'block_ip' | 'kill_process' | 'close_port' | 'rotate_secret' | 'isolate_service' | 'deploy_honeypot';
+export interface ThreatEvent {
+    id: string;
+    severity: ThreatSeverity;
+    category: ThreatCategory;
+    title: string;
+    details: string;
+    source: string;
+    timestamp: number;
+    relatedEvents: string[];
+}
+export interface DefenseRecord {
+    id: string;
+    action: DefenseAction;
+    target: string;
+    reason: string;
+    autoApproved: boolean;
+    reversible: boolean;
+    timestamp: number;
+}
+export interface MonitorBaseline {
+    processes: ProcessInfo[];
+    ports: PortInfo[];
+    configs: ConfigSnapshot[];
+    packages: PackageInfo[];
+    users: UserInfo[];
+    crons: CronEntry[];
+    timestamp: number;
+}
+export interface ProcessInfo {
+    pid: number;
+    user: string;
+    command: string;
+    cpu: number;
+    mem: number;
+}
+export interface PortInfo {
+    port: number;
+    protocol: 'tcp' | 'udp';
+    process: string;
+    address: string;
+}
+export interface ConfigSnapshot {
+    file: string;
+    hash: string;
+    lastModified: number;
+}
+export interface PackageInfo {
+    name: string;
+    version: string;
+    vulnerabilities: number;
+}
+export interface UserInfo {
+    name: string;
+    uid: number;
+    shell: string;
+    lastLogin: number | null;
+}
+export interface CronEntry {
+    user: string;
+    schedule: string;
+    command: string;
+}
+export interface MonitorState {
+    mode: MonitorMode;
+    uptime: number;
+    threats: ThreatEvent[];
+    defenses: DefenseRecord[];
+    baseline: MonitorBaseline | null;
+    lastScan: number;
+}
+export interface ScanResult {
+    processes: string;
+    ports: string;
+    sshConfig: string;
+    firewall: string;
+    crontabs: string;
+    packages: string;
+    recentLogins: string;
+    configChanges: string;
+    timestamp: number;
+}
+export interface Drift {
+    category: 'process' | 'port' | 'config' | 'package' | 'user' | 'cron';
+    description: string;
+    severity: ThreatSeverity;
+    details: string;
+}
+export interface MonitorCallbacks {
+    sendMessage: (prompt: string) => Promise<string>;
+    isAborted: () => boolean;
+    onThreat: (threat: ThreatEvent) => void;
+    onDefense: (defense: DefenseRecord) => void;
+    onScanComplete: (phase: string) => void;
+    onStatusUpdate: (status: MonitorState) => void;
+    updateStatus: () => void;
+}
+export interface ApprovalRequest {
+    id: string;
+    action: DefenseAction;
+    target: string;
+    reason: string;
+    severity: ThreatSeverity;
+    timestamp: number;
+    expiresAt: number;
+}
+export interface ApprovalResponse {
+    requestId: string;
+    approved: boolean;
+    respondedBy: 'web' | 'cli' | 'auto';
+    timestamp: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/agent/monitor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE7D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7E,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,UAAU,GACV,cAAc,GACd,SAAS,GACT,eAAe,GACf,sBAAsB,GACtB,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,cAAc,GACd,YAAY,GACZ,eAAe,GACf,iBAAiB,GACjB,iBAAiB,CAAC;AAMtB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,KAAK;IACpB,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IAC5C,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/C,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AAMD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/cli/agent/monitor/types.js

@@ -0,0 +1,5 @@
+/**
+ * Monitor System — shared types for the security monitoring agent.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cli/agent/monitor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/cli/agent/monitor/watcher.d.ts

@@ -0,0 +1,4 @@
+import type { MonitorMode, MonitorBaseline, MonitorState, MonitorCallbacks } from './types.js';
+export declare function getMonitorState(): MonitorState | null;
+export declare function runMonitorLoop(callbacks: MonitorCallbacks, mode: MonitorMode, baseline: MonitorBaseline): Promise<void>;
+//# sourceMappingURL=watcher.d.ts.map

package/dist/cli/agent/monitor/watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/watcher.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AAqBpB,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAErD;AAMD,wBAAsB,cAAc,CAClC,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAgGf"}

package/dist/cli/agent/monitor/watcher.js

@@ -0,0 +1,214 @@
+/**
+ * Monitor System — Continuous watch loop with adaptive intervals.
+ */
+import { randomUUID } from 'node:crypto';
+import chalk from 'chalk';
+import { watchPrompt, analyzeThreatPrompt } from './prompts.js';
+import { quickScan, mediumScan } from './scanner.js';
+import { pushThreatEvent, pushDefenseEvent, requestApproval } from './alerter.js';
+import { executeDefense } from './responder.js';
+// ---------------------------------------------------------------------------
+// Timing constants
+// ---------------------------------------------------------------------------
+const QUICK_CHECK_INTERVAL = 60_000; // 60 seconds
+const MEDIUM_CHECK_INTERVAL = 300_000; // 5 minutes
+const FULL_CHECK_INTERVAL = 1_800_000; // 30 minutes
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+let monitorState = null;
+export function getMonitorState() {
+    return monitorState;
+}
+// ---------------------------------------------------------------------------
+// Main watch loop
+// ---------------------------------------------------------------------------
+export async function runMonitorLoop(callbacks, mode, baseline) {
+    const startTime = Date.now();
+    monitorState = {
+        mode,
+        uptime: 0,
+        threats: [],
+        defenses: [],
+        baseline,
+        lastScan: Date.now(),
+    };
+    let lastQuickCheck = Date.now();
+    let lastMediumCheck = Date.now();
+    let lastFullCheck = Date.now();
+    const d = chalk.dim;
+    const shield = mode === 'active' ? '\u2694\uFE0F' : mode === 'defensive' ? '\u{1F6E1}\uFE0F' : '\u{1F50D}';
+    process.stdout.write('\n');
+    process.stdout.write(d(`  ${shield} Monitor loop started (${mode} mode)\n`));
+    process.stdout.write(d('  Watching for security anomalies...\n\n'));
+    while (!callbacks.isAborted()) {
+        const now = Date.now();
+        monitorState.uptime = now - startTime;
+        // --- Quick check (every 60s) ---
+        if (now - lastQuickCheck >= QUICK_CHECK_INTERVAL) {
+            lastQuickCheck = now;
+            try {
+                const result = await quickScan(callbacks);
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(result);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Quick check error: ${err}\n`));
+            }
+        }
+        // --- Medium check (every 5min) ---
+        if (now - lastMediumCheck >= MEDIUM_CHECK_INTERVAL) {
+            lastMediumCheck = now;
+            try {
+                const result = await mediumScan(callbacks);
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(result);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Medium check error: ${err}\n`));
+            }
+        }
+        // --- Full check (every 30min) ---
+        if (now - lastFullCheck >= FULL_CHECK_INTERVAL) {
+            lastFullCheck = now;
+            try {
+                const fullResult = await callbacks.sendMessage(watchPrompt(baseline, mode));
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(fullResult);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Full check error: ${err}\n`));
+            }
+        }
+        // Sleep between checks (5 seconds)
+        await sleep(5_000);
+    }
+    monitorState = null;
+    process.stdout.write(d('\n  Monitor loop stopped.\n'));
+}
+// ---------------------------------------------------------------------------
+// Threat handling
+// ---------------------------------------------------------------------------
+async function handleThreat(threat, mode, callbacks) {
+    // Add to state
+    if (monitorState) {
+        monitorState.threats.push(threat);
+    }
+    // Notify via all channels
+    callbacks.onThreat(threat);
+    pushThreatEvent(threat);
+    const severityColor = {
+        critical: chalk.red.bold,
+        high: chalk.red,
+        medium: chalk.yellow,
+        low: chalk.dim,
+        info: chalk.dim,
+    }[threat.severity];
+    process.stdout.write(`\n  ${severityColor(`\u26A0 THREAT [${threat.severity.toUpperCase()}]`)} ${threat.title}\n`);
+    process.stdout.write(chalk.dim(`    ${threat.details}\n`));
+    process.stdout.write(chalk.dim(`    Source: ${threat.source}\n\n`));
+    // In passive mode, only alert — no response
+    if (mode === 'passive')
+        return;
+    // Analyze threat and decide response
+    try {
+        const analysisResult = await callbacks.sendMessage(analyzeThreatPrompt(threat, mode));
+        const response = parseResponse(analysisResult);
+        if (response) {
+            if (threat.severity === 'critical') {
+                // CRITICAL + defensive/active: auto-execute
+                const record = await executeDefense(response.action, response.target, callbacks.sendMessage);
+                if (monitorState)
+                    monitorState.defenses.push(record);
+                callbacks.onDefense(record);
+                pushDefenseEvent(record);
+                process.stdout.write(chalk.blue(`  \u{1F6E1}\uFE0F Auto-defense: ${response.action} → ${response.target}\n`));
+            }
+            else if (threat.severity === 'high') {
+                // HIGH + defensive/active: request approval from web
+                requestApproval(response.action, response.reason, threat.severity);
+                process.stdout.write(chalk.yellow(`  \u23F3 Awaiting approval: ${response.action} → ${response.target}\n`));
+            }
+        }
+    }
+    catch {
+        // Analysis failed — continue monitoring
+    }
+}
+// ---------------------------------------------------------------------------
+// Parsers
+// ---------------------------------------------------------------------------
+function parseThreats(text) {
+    const threats = [];
+    if (text.includes('ALL_CLEAR'))
+        return threats;
+    // Find all THREAT: {...} blocks
+    const threatRegex = /THREAT:\s*(\{[\s\S]*?\})/g;
+    let match;
+    while ((match = threatRegex.exec(text)) !== null) {
+        try {
+            const parsed = JSON.parse(match[1]);
+            threats.push({
+                id: randomUUID().slice(0, 8),
+                severity: (parsed.severity || 'info'),
+                category: (parsed.category || 'anomaly'),
+                title: parsed.title || 'Unknown threat',
+                details: parsed.details || '',
+                source: parsed.source || 'unknown',
+                timestamp: Date.now(),
+                relatedEvents: [],
+            });
+        }
+        catch {
+            // Skip unparseable threat
+        }
+    }
+    return threats;
+}
+function parseResponse(text) {
+    const responseMatch = text.match(/RESPONSE:\s*(\{[\s\S]*?\})/);
+    if (!responseMatch)
+        return null;
+    try {
+        const parsed = JSON.parse(responseMatch[1]);
+        return {
+            action: parsed.action || '',
+            target: parsed.target || '',
+            reason: parsed.reason || '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=watcher.js.map

package/dist/cli/agent/monitor/watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/watcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAU1B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAI,aAAa;AACrD,MAAM,qBAAqB,GAAG,OAAO,CAAC,CAAE,YAAY;AACpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAE,aAAa;AAErD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAA2B,EAC3B,IAAiB,EACjB,QAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,YAAY,GAAG;QACb,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,0BAA0B,IAAI,UAAU,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAEpE,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,YAAY,CAAC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;QAEtC,kCAAkC;QAClC,IAAI,GAAG,GAAG,cAAc,IAAI,oBAAoB,EAAE,CAAC;YACjD,cAAc,GAAG,GAAG,CAAC;YAErB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,GAAG,GAAG,eAAe,IAAI,qBAAqB,EAAE,CAAC;YACnD,eAAe,GAAG,GAAG,CAAC;YAEtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,GAAG,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC;YAC/C,aAAa,GAAG,GAAG,CAAC;YAEpB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5E,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CACzB,MAAmB,EACnB,IAAiB,EACjB,SAA2B;IAE3B,eAAe;IACf,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,0BAA0B;IAC1B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;QACxB,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,GAAG;KAChB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACnH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;IAEpE,4CAA4C;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAE/B,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAE/C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC7F,IAAI,YAAY;oBAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC5B,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAChH,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACtC,qDAAqD;gBACrD,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,gCAAgC;IAChC,MAAM,WAAW,GAAG,2BAA2B,CAAC;IAChD,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAmB;gBACvD,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAmB;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,aAAa,EAAE,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/cli/brain/control-protocol.d.ts

@@ -117,6 +117,23 @@ export interface GetBugsRequest extends WSMessage {
 export interface PingRequest extends WSMessage {
     type: 'ping';
 }
+export interface StartMonitorRequest extends WSMessage {
+    type: 'start_monitor';
+    mode: 'passive' | 'defensive' | 'active';
+}
+export interface StopMonitorRequest extends WSMessage {
+    type: 'stop_monitor';
+}
+export interface MonitorCommandRequest extends WSMessage {
+    type: 'monitor_command';
+    command: 'set_mode' | 'rescan' | 'unblock_ip' | 'stop_monitor';
+    params?: Record<string, string>;
+}
+export interface ApprovalResponseRequest extends WSMessage {
+    type: 'approval_response';
+    requestId: string;
+    approved: boolean;
+}
 export interface SessionsListResponse extends WSMessage {
     type: 'sessions_list';
     sessions: SessionInfo[];
@@ -150,6 +167,11 @@ export interface BugsListResponse extends WSMessage {
 export interface PongResponse extends WSMessage {
     type: 'pong';
 }
+export interface MonitorStartedResponse extends WSMessage {
+    type: 'monitor_started';
+    sessionId: string;
+    mode: string;
+}
 export interface SessionUpdatedEvent extends WSMessage {
     type: 'session_updated';
     session: SessionInfo;
@@ -184,6 +206,26 @@ export interface BrowserScreenshotEvent extends WSMessage {
     type: 'browser_screenshot';
     screenshot: BrowserScreenshotInfo;
 }
+export interface ThreatDetectedEvent extends WSMessage {
+    type: 'threat_detected';
+    threat: Record<string, unknown>;
+}
+export interface DefenseActivatedEvent extends WSMessage {
+    type: 'defense_activated';
+    defense: Record<string, unknown>;
+}
+export interface ApprovalRequestEvent extends WSMessage {
+    type: 'approval_request';
+    request: Record<string, unknown>;
+}
+export interface MonitorStatusEvent extends WSMessage {
+    type: 'monitor_status';
+    mode: string;
+    uptime: number;
+    threatCount: number;
+    defenseCount: number;
+    lastScan: number;
+}
 export interface ChatStartedEvent extends WSMessage {
     type: 'chat_started';
     chatId: string;
@@ -223,11 +265,15 @@ export interface ChatErrorEvent extends WSMessage {
     chatId: string;
     error: string;
 }
-export type ControlRequest = ListSessionsRequest | StartAutoRequest | StartSecurityRequest | AbortSessionRequest | SubscribeOutputRequest | UnsubscribeOutputRequest | SendChatRequest | GetFindingsRequest | GetBugsRequest | PingRequest;
+export type ControlRequest = ListSessionsRequest | StartAutoRequest | StartSecurityRequest | StartMonitorRequest | StopMonitorRequest | MonitorCommandRequest | ApprovalResponseRequest | AbortSessionRequest | SubscribeOutputRequest | UnsubscribeOutputRequest | SendChatRequest | GetFindingsRequest | GetBugsRequest | PingRequest;
 export interface ControlHandlers {
     listSessions(): SessionInfo[];
     startAuto(goal?: string): string;
     startSecurity(): string;
+    startMonitor(mode: 'passive' | 'defensive' | 'active'): string;
+    stopMonitor(): boolean;
+    handleMonitorCommand(command: string, params?: Record<string, string>): void;
+    handleApprovalResponse(requestId: string, approved: boolean): void;
     abortSession(sessionId: string): boolean;
     sendChat(text: string, chatId?: string, mode?: 'normal' | 'skip-permissions'): void;
     getFindings(): Finding[];