helixmind 0.2.1 → 0.2.3

package/README.md

@@ -102,6 +102,20 @@ AI can **edit files, run commands, commit changes, and browse the web** — with
 ### 🔐 Authentication & Security
 **OAuth login, API keys, feature gating** — secure access control with subscription tier enforcement.
 
+</td>
+</tr>
+<tr>
+<td width="50%">
+
+### 🛡️ Security Monitor
+**Continuous security monitoring** — threat detection, automated defenses, real-time dashboard with approval queue.
+
+</td>
+<td width="50%">
+
+### 📈 MCP Integration
+**Model Context Protocol** — works with Claude Code, Cursor, VS Code, Windsurf, Codex, JetBrains AI.
+
 </td>
 </tr>
 </table>
@@ -331,6 +345,23 @@ npm run dev
 
 ---
 
+## 📚 Documentation
+
+Complete documentation is available in the web dashboard and includes:
+
+| Category | Topics |
+|:---------|:-------|
+| **Core Concepts** | Spiral Memory, Validation Matrix, Web Knowledge, Bug Tracking, Browser Automation |
+| **Usage Guides** | Getting Started, Configuration, Authentication, Project Setup |
+| **Advanced** | Autonomous Modes, Agent Tools, MCP Integration, SWE-Bench |
+| **Reference** | CLI Commands, Slash Commands, Permission System, Export/Import |
+
+**Web Dashboard Docs**: Start the web dashboard (`cd web && npm run dev`) and navigate to `/docs`.
+
+**CLI Help**: Use `helixmind --help` or `helixmind chat --help` for command reference.
+
+---
+
 ## 📄 License
 
 [AGPL-3.0](LICENSE) — Free for open-source use. Commercial licenses available.

package/dist/cli/agent/autonomous.d.ts

@@ -7,4 +7,18 @@ export interface AutonomousCallbacks {
     updateStatus: () => void;
 }
 export declare function runAutonomousLoop(callbacks: AutonomousCallbacks, initialGoal?: string): Promise<number>;
+export declare const MONITOR_MODES: readonly [{
+    readonly key: "passive";
+    readonly label: "🔍 Passive";
+    readonly description: "Read-only, alerts only";
+}, {
+    readonly key: "defensive";
+    readonly label: "🛡️ Defensive";
+    readonly description: "Auto-block attacks, rotate secrets";
+}, {
+    readonly key: "active";
+    readonly label: "⚔️ Active";
+    readonly description: "+ Honeypots, counter-intel, deception";
+}];
+export declare const MONITOR_WARNINGS: Record<string, string[]>;
 //# sourceMappingURL=autonomous.d.ts.map

package/dist/cli/agent/autonomous.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"autonomous.d.ts","sourceRoot":"","sources":["../../../src/cli/agent/autonomous.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,eAAe,sqCAoB+C,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AA+BD,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,mBAAmB,EAC9B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAiFjB"}
+{"version":3,"file":"autonomous.d.ts","sourceRoot":"","sources":["../../../src/cli/agent/autonomous.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,eAAe,sqCAoB+C,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AA+BD,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,mBAAmB,EAC9B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAiFjB;AAMD,eAAO,MAAM,aAAa;;;;;;;;;;;;EAIhB,CAAC;AAEX,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAarD,CAAC"}

package/dist/cli/agent/autonomous.js

@@ -157,6 +157,28 @@ export async function runAutonomousLoop(callbacks, initialGoal) {
     }
     return completed.length;
 }
+// ---------------------------------------------------------------------------
+// Monitor mode helpers
+// ---------------------------------------------------------------------------
+export const MONITOR_MODES = [
+    { key: 'passive', label: '\u{1F50D} Passive', description: 'Read-only, alerts only' },
+    { key: 'defensive', label: '\u{1F6E1}\uFE0F Defensive', description: 'Auto-block attacks, rotate secrets' },
+    { key: 'active', label: '\u2694\uFE0F Active', description: '+ Honeypots, counter-intel, deception' },
+];
+export const MONITOR_WARNINGS = {
+    defensive: [
+        'Block attacking IPs via iptables/fail2ban',
+        'Kill suspicious processes',
+        'Rotate compromised secrets',
+        'Write firewall rules',
+    ],
+    active: [
+        'All defensive actions, plus:',
+        'Deploy honeypot services',
+        'Attacker profiling & counter-intel',
+        'Deception infrastructure',
+    ],
+};
 function extractSummary(text) {
     // Look for "DONE: ..." line
     const doneMatch = text.match(/DONE:\s*(.+)/i);

package/dist/cli/agent/autonomous.js.map

@@ -1 +1 @@
-{"version":3,"file":"autonomous.js","sourceRoot":"","sources":["../../../src/cli/agent/autonomous.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;gGAe4E,CAAC;AAEjG,SAAS,cAAc,CAAC,SAAmB;IACzC,OAAO,qCAAqC,SAAS,CAAC,MAAM,GAAG,CAAC;;;EAGhE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;0EAMkB,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;2EAoB4C,CAAC;AAU5E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO;;QAED,IAAI;;;;;;;;;4EASgE,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,SAAmB;IAC3D,OAAO,qCAAqC,SAAS,CAAC,MAAM,GAAG,CAAC;;QAE1D,IAAI;;;EAGV,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;oDAKJ,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAA8B,EAC9B,WAAoB;IAEpB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAuB,WAAW,CAAC;IAE3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4RAA4R,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7T,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClH,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,WAAW,GAAG,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,+BAA+B,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;IACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC,CAAC;IACzG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4RAA4R,CAAC,GAAG,MAAM,CAAC,CAAC;IAE/T,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9B,KAAK,EAAE,CAAC;QACR,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9B,SAAS,CAAC,YAAY,EAAE,CAAC;QAEzB,IAAI,MAAc,CAAC;QACnB,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAE1G,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,SAAS,CAAC,SAAS,EAAE;gBAAE,MAAM;YAEjC,gCAAgC;YAChC,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9C,IAAI,IAAI,EAAE,CAAC;oBACT,kDAAkD;oBAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,4CAA4C,CAAC,CAAC,CAAC;oBACjH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,GAAG,SAAS,CAAC,CAAC,4CAA4C;oBAC9D,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,0CAA0C;oBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,SAAS,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;oBACxG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAErC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,SAAS,EAAE;gBAAE,MAAM;YACjC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,KAAK,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"autonomous.js","sourceRoot":"","sources":["../../../src/cli/agent/autonomous.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;gGAe4E,CAAC;AAEjG,SAAS,cAAc,CAAC,SAAmB;IACzC,OAAO,qCAAqC,SAAS,CAAC,MAAM,GAAG,CAAC;;;EAGhE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;0EAMkB,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;2EAoB4C,CAAC;AAU5E,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO;;QAED,IAAI;;;;;;;;;4EASgE,CAAC;AAC7E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,SAAmB;IAC3D,OAAO,qCAAqC,SAAS,CAAC,MAAM,GAAG,CAAC;;QAE1D,IAAI;;;EAGV,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;oDAKJ,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAA8B,EAC9B,WAAoB;IAEpB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAuB,WAAW,CAAC;IAE3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4RAA4R,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7T,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,gCAAgC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClH,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,WAAW,GAAG,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,+BAA+B,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,qDAAqD,CAAC,GAAG,IAAI,CAAC,CAAC;IACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC,CAAC;IACzG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4RAA4R,CAAC,GAAG,MAAM,CAAC,CAAC;IAE/T,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9B,KAAK,EAAE,CAAC;QACR,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9B,SAAS,CAAC,YAAY,EAAE,CAAC;QAEzB,IAAI,MAAc,CAAC;QACnB,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAE1G,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,SAAS,CAAC,SAAS,EAAE;gBAAE,MAAM;YAEjC,gCAAgC;YAChC,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC9C,IAAI,IAAI,EAAE,CAAC;oBACT,kDAAkD;oBAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,4CAA4C,CAAC,CAAC,CAAC;oBACjH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,GAAG,SAAS,CAAC,CAAC,4CAA4C;oBAC9D,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,0CAA0C;oBAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,4CAA4C,SAAS,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC;oBACxG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,MAAM;gBACR,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAErC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,SAAS,EAAE;gBAAE,MAAM;YACjC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,KAAK,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,0CAA0C,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,EAAE,GAAG,EAAE,SAAkB,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAC9F,EAAE,GAAG,EAAE,WAAoB,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,oCAAoC,EAAE;IACpH,EAAE,GAAG,EAAE,QAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,uCAAuC,EAAE;CACtG,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,SAAS,EAAE;QACT,2CAA2C;QAC3C,2BAA2B;QAC3B,4BAA4B;QAC5B,sBAAsB;KACvB;IACD,MAAM,EAAE;QACN,8BAA8B;QAC9B,0BAA0B;QAC1B,oCAAoC;QACpC,0BAA0B;KAC3B;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,gCAAgC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC"}

package/dist/cli/agent/monitor/alerter.d.ts

@@ -0,0 +1,29 @@
+import type { ThreatEvent, DefenseRecord, ThreatSeverity, DefenseAction, ApprovalRequest } from './types.js';
+export declare function getPendingApprovals(): ApprovalRequest[];
+export declare function resolveApproval(requestId: string, approved: boolean): ApprovalRequest | undefined;
+/**
+ * Push a threat event to all channels:
+ * 1. Brain visualization (as agent_finding)
+ * 2. Control protocol (for Web Dashboard)
+ */
+export declare function pushThreatEvent(threat: ThreatEvent): void;
+/**
+ * Push a defense activation event.
+ */
+export declare function pushDefenseEvent(defense: DefenseRecord): void;
+/**
+ * Push a monitor status update.
+ */
+export declare function pushMonitorStatus(status: {
+    mode: string;
+    uptime: number;
+    threatCount: number;
+    defenseCount: number;
+    lastScan: number;
+}): void;
+/**
+ * Request approval from the Web Dashboard for a defense action.
+ * Stores the request and pushes it to the web client.
+ */
+export declare function requestApproval(action: DefenseAction | string, reason: string, severity: ThreatSeverity): void;
+//# sourceMappingURL=alerter.d.ts.map

package/dist/cli/agent/monitor/alerter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerter.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/alerter.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAY7G,wBAAgB,mBAAmB,IAAI,eAAe,EAAE,CAEvD;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAMjG;AAMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAezD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAa7D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAMP;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,aAAa,GAAG,MAAM,EAC9B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,GACvB,IAAI,CAkBN"}

package/dist/cli/agent/monitor/alerter.js

@@ -0,0 +1,80 @@
+/**
+ * Monitor System — Alert routing to Brain/Relay/Web.
+ */
+import { randomUUID } from 'node:crypto';
+import { pushControlEvent as pushRawControlEvent, pushAgentFinding, } from '../../brain/generator.js';
+// ---------------------------------------------------------------------------
+// Pending approval requests
+// ---------------------------------------------------------------------------
+const pendingApprovals = new Map();
+export function getPendingApprovals() {
+    return Array.from(pendingApprovals.values());
+}
+export function resolveApproval(requestId, approved) {
+    const req = pendingApprovals.get(requestId);
+    if (req) {
+        pendingApprovals.delete(requestId);
+    }
+    return req;
+}
+// ---------------------------------------------------------------------------
+// Push functions
+// ---------------------------------------------------------------------------
+/**
+ * Push a threat event to all channels:
+ * 1. Brain visualization (as agent_finding)
+ * 2. Control protocol (for Web Dashboard)
+ */
+export function pushThreatEvent(threat) {
+    // Brain visualization — shows as finding popup
+    pushAgentFinding('Monitor', `[${threat.severity.toUpperCase()}] ${threat.title}: ${threat.details}`, threat.severity, threat.source);
+    // Control protocol — for Web Dashboard real-time updates
+    pushRawControlEvent({
+        type: 'threat_detected',
+        threat,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Push a defense activation event.
+ */
+export function pushDefenseEvent(defense) {
+    pushAgentFinding('Monitor', `Defense: ${defense.action} → ${defense.target} (${defense.reason})`, 'info', defense.target);
+    pushRawControlEvent({
+        type: 'defense_activated',
+        defense,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Push a monitor status update.
+ */
+export function pushMonitorStatus(status) {
+    pushRawControlEvent({
+        type: 'monitor_status',
+        ...status,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Request approval from the Web Dashboard for a defense action.
+ * Stores the request and pushes it to the web client.
+ */
+export function requestApproval(action, reason, severity) {
+    const request = {
+        id: randomUUID().slice(0, 8),
+        action: action,
+        target: reason,
+        reason,
+        severity,
+        timestamp: Date.now(),
+        expiresAt: Date.now() + 300_000, // 5 min expiry
+    };
+    pendingApprovals.set(request.id, request);
+    pushRawControlEvent({
+        type: 'approval_request',
+        request,
+        timestamp: Date.now(),
+    });
+}
+//# sourceMappingURL=alerter.js.map

package/dist/cli/agent/monitor/alerter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerter.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/alerter.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAiB;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,+CAA+C;IAC/C,gBAAgB,CACd,SAAS,EACT,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,EACvE,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,yDAAyD;IACzD,mBAAmB,CAAC;QAClB,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,gBAAgB,CACd,SAAS,EACT,YAAY,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,EACpE,MAAM,EACN,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,mBAAmB,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAMjC;IACC,mBAAmB,CAAC;QAClB,IAAI,EAAE,gBAAgB;QACtB,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B,EAC9B,MAAc,EACd,QAAwB;IAExB,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,MAAuB;QAC/B,MAAM,EAAE,MAAM;QACd,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe;KACjD,CAAC;IAEF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE1C,mBAAmB,CAAC;QAClB,IAAI,EAAE,kBAAkB;QACxB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/agent/monitor/baseline.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Monitor System — Builds and compares security baselines.
+ */
+import type { MonitorBaseline, ScanResult, Drift } from './types.js';
+/**
+ * Build a MonitorBaseline from a scan result.
+ * Parses the structured BASELINE_START block or raw command outputs.
+ */
+export declare function buildBaseline(scan: ScanResult): MonitorBaseline;
+/**
+ * Compare current scan against baseline and detect drift.
+ */
+export declare function diffBaseline(current: ScanResult, baseline: MonitorBaseline): Drift[];
+//# sourceMappingURL=baseline.d.ts.map

package/dist/cli/agent/monitor/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/baseline.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,KAAK,EAMN,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,CAyC/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,GAAG,KAAK,EAAE,CA4DpF"}

package/dist/cli/agent/monitor/baseline.js

@@ -0,0 +1,157 @@
+/**
+ * Build a MonitorBaseline from a scan result.
+ * Parses the structured BASELINE_START block or raw command outputs.
+ */
+export function buildBaseline(scan) {
+    let processes = [];
+    let ports = [];
+    let configs = [];
+    let users = [];
+    let crons = [];
+    // Try to parse from the raw baseline JSON first
+    const rawBaseline = scan.rawBaseline;
+    if (rawBaseline) {
+        try {
+            const parsed = JSON.parse(rawBaseline);
+            if (Array.isArray(parsed.processes))
+                processes = parsed.processes;
+            if (Array.isArray(parsed.ports))
+                ports = parsed.ports;
+            if (Array.isArray(parsed.configs))
+                configs = parsed.configs;
+            if (Array.isArray(parsed.users))
+                users = parsed.users;
+            if (Array.isArray(parsed.crons))
+                crons = parsed.crons;
+        }
+        catch {
+            // Fall back to parsing raw text
+        }
+    }
+    // Fallback: parse processes from ps aux output
+    if (processes.length === 0 && scan.processes) {
+        processes = parseProcesses(scan.processes);
+    }
+    // Fallback: parse ports from ss output
+    if (ports.length === 0 && scan.ports) {
+        ports = parsePorts(scan.ports);
+    }
+    return {
+        processes,
+        ports,
+        configs,
+        packages: [],
+        users,
+        crons,
+        timestamp: scan.timestamp,
+    };
+}
+/**
+ * Compare current scan against baseline and detect drift.
+ */
+export function diffBaseline(current, baseline) {
+    const drifts = [];
+    // Parse current state
+    const currentProcesses = parseProcesses(current.processes);
+    const currentPorts = parsePorts(current.ports);
+    // Check for new processes
+    const baselineCommands = new Set(baseline.processes.map(p => p.command));
+    for (const proc of currentProcesses) {
+        if (!baselineCommands.has(proc.command)) {
+            drifts.push({
+                category: 'process',
+                description: `New process: ${proc.command} (PID: ${proc.pid}, user: ${proc.user})`,
+                severity: proc.user === 'root' ? 'high' : 'medium',
+                details: `CPU: ${proc.cpu}%, MEM: ${proc.mem}%`,
+            });
+        }
+    }
+    // Check for disappeared processes (might indicate killed service)
+    const currentCommands = new Set(currentProcesses.map(p => p.command));
+    for (const proc of baseline.processes) {
+        if (!currentCommands.has(proc.command) && isImportantProcess(proc.command)) {
+            drifts.push({
+                category: 'process',
+                description: `Missing process: ${proc.command} (was running as ${proc.user})`,
+                severity: 'high',
+                details: 'Expected process is no longer running',
+            });
+        }
+    }
+    // Check for new ports
+    const baselinePorts = new Set(baseline.ports.map(p => `${p.port}/${p.protocol}`));
+    for (const port of currentPorts) {
+        if (!baselinePorts.has(`${port.port}/${port.protocol}`)) {
+            drifts.push({
+                category: 'port',
+                description: `New listening port: ${port.port}/${port.protocol} (${port.process})`,
+                severity: port.port < 1024 ? 'high' : 'medium',
+                details: `Address: ${port.address}`,
+            });
+        }
+    }
+    // Check for closed ports
+    const currentPortSet = new Set(currentPorts.map(p => `${p.port}/${p.protocol}`));
+    for (const port of baseline.ports) {
+        if (!currentPortSet.has(`${port.port}/${port.protocol}`)) {
+            drifts.push({
+                category: 'port',
+                description: `Closed port: ${port.port}/${port.protocol} (was ${port.process})`,
+                severity: 'medium',
+                details: 'Previously open port is no longer listening',
+            });
+        }
+    }
+    return drifts;
+}
+// ---------------------------------------------------------------------------
+// Parsers
+// ---------------------------------------------------------------------------
+function parseProcesses(raw) {
+    const processes = [];
+    const lines = raw.split('\n').filter(l => l.trim());
+    for (const line of lines) {
+        // Skip header
+        if (line.includes('USER') && line.includes('PID'))
+            continue;
+        if (line.startsWith('---'))
+            continue;
+        const parts = line.trim().split(/\s+/);
+        if (parts.length >= 11) {
+            processes.push({
+                user: parts[0],
+                pid: parseInt(parts[1], 10) || 0,
+                cpu: parseFloat(parts[2]) || 0,
+                mem: parseFloat(parts[3]) || 0,
+                command: parts.slice(10).join(' '),
+            });
+        }
+    }
+    return processes;
+}
+function parsePorts(raw) {
+    const ports = [];
+    const lines = raw.split('\n').filter(l => l.trim());
+    for (const line of lines) {
+        // Skip header
+        if (line.includes('State') && line.includes('Local'))
+            continue;
+        // Parse ss -tlnp output: State  Recv-Q  Send-Q  Local Address:Port  ...
+        const match = line.match(/([\d.*:]+):(\d+)\s/);
+        if (match) {
+            const processMatch = line.match(/users:\(\("([^"]+)"/);
+            ports.push({
+                address: match[1],
+                port: parseInt(match[2], 10),
+                protocol: line.includes('udp') ? 'udp' : 'tcp',
+                process: processMatch?.[1] || 'unknown',
+            });
+        }
+    }
+    return ports;
+}
+function isImportantProcess(command) {
+    const important = ['sshd', 'nginx', 'apache', 'postgres', 'mysql', 'redis', 'docker', 'systemd'];
+    return important.some(name => command.toLowerCase().includes(name));
+}
+//# sourceMappingURL=baseline.js.map

package/dist/cli/agent/monitor/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/baseline.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,IAAI,SAAS,GAAkB,EAAE,CAAC;IAClC,IAAI,KAAK,GAAe,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAqB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAe,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAgB,EAAE,CAAC;IAE5B,gDAAgD;IAChD,MAAM,WAAW,GAAI,IAA0C,CAAC,WAAW,CAAC;IAC5E,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YAClE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,EAAE;QACZ,KAAK;QACL,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,QAAyB;IACzE,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,sBAAsB;IACtB,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/C,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,gBAAgB,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,GAAG;gBAClF,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAClD,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,oBAAoB,IAAI,CAAC,IAAI,GAAG;gBAC7E,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,uBAAuB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,GAAG;gBAClF,QAAQ,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9C,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,OAAO,GAAG;gBAC/E,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,cAAc;QACd,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;gBAChC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9B,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,cAAc;QACd,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAE/D,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;gBAC9C,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjG,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli/agent/monitor/prompts.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Monitor System — LLM prompts for each phase and check type.
+ */
+import type { MonitorMode, MonitorBaseline, ThreatEvent } from './types.js';
+export declare const SCAN_SYSTEM_PROMPT = "You are a SECURITY MONITOR performing a full system scan.\n\nUse the run_command tool to gather system state. Run these commands:\n1. ps aux --sort=-%cpu | head -50\n2. ss -tlnp\n3. cat /etc/ssh/sshd_config 2>/dev/null || echo \"No SSH config\"\n4. crontab -l 2>/dev/null; for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null && echo \"--- User: $u ---\"; done\n5. iptables -L -n 2>/dev/null || echo \"No iptables access\"\n6. last -20 2>/dev/null || echo \"No login history\"\n7. find /etc -newer /etc/hostname -type f -mmin -1440 2>/dev/null | head -30\n8. cat /etc/passwd | grep -v nologin | grep -v false\n\nAfter gathering all data, output a structured baseline report between these markers:\n\nBASELINE_START\n{\n  \"processes\": [{\"pid\": N, \"user\": \"...\", \"command\": \"...\", \"cpu\": N, \"mem\": N}],\n  \"ports\": [{\"port\": N, \"protocol\": \"tcp|udp\", \"process\": \"...\", \"address\": \"...\"}],\n  \"configs\": [{\"file\": \"...\", \"hash\": \"...\", \"lastModified\": N}],\n  \"users\": [{\"name\": \"...\", \"uid\": N, \"shell\": \"...\", \"lastLogin\": N}],\n  \"crons\": [{\"user\": \"...\", \"schedule\": \"...\", \"command\": \"...\"}],\n  \"packages\": []\n}\nBASELINE_END\n\nBe thorough but efficient. Only include active/relevant entries.";
+export declare function watchPrompt(baseline: MonitorBaseline, mode: MonitorMode): string;
+export declare function analyzeThreatPrompt(threat: ThreatEvent, mode: MonitorMode): string;
+export declare const ACTIVE_INTEL_PROMPT = "You are a THREAT INTELLIGENCE analyst in ACTIVE mode.\n\nAnalyze the collected threat data and create an attacker profile:\n1. Group related events by source IP or pattern\n2. Identify attack vectors and techniques (MITRE ATT&CK if possible)\n3. Assess attacker sophistication\n4. Suggest honeypot configuration\n\nOutput:\nINTEL: {\"attackerProfile\": \"...\", \"techniques\": [\"...\"], \"sophistication\": \"low|medium|high|apt\", \"honeypotConfig\": {\"port\": N, \"service\": \"...\", \"purpose\": \"...\"}}";
+//# sourceMappingURL=prompts.d.ts.map

package/dist/cli/agent/monitor/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/prompts.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM5E,eAAO,MAAM,kBAAkB,4wCAyBkC,CAAC;AAMlE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CA+BhF;AAMD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAsBlF;AAMD,eAAO,MAAM,mBAAmB,qgBASqI,CAAC"}

package/dist/cli/agent/monitor/prompts.js

@@ -0,0 +1,103 @@
+// ---------------------------------------------------------------------------
+// Phase 1: Full System Scan
+// ---------------------------------------------------------------------------
+export const SCAN_SYSTEM_PROMPT = `You are a SECURITY MONITOR performing a full system scan.
+
+Use the run_command tool to gather system state. Run these commands:
+1. ps aux --sort=-%cpu | head -50
+2. ss -tlnp
+3. cat /etc/ssh/sshd_config 2>/dev/null || echo "No SSH config"
+4. crontab -l 2>/dev/null; for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null && echo "--- User: $u ---"; done
+5. iptables -L -n 2>/dev/null || echo "No iptables access"
+6. last -20 2>/dev/null || echo "No login history"
+7. find /etc -newer /etc/hostname -type f -mmin -1440 2>/dev/null | head -30
+8. cat /etc/passwd | grep -v nologin | grep -v false
+
+After gathering all data, output a structured baseline report between these markers:
+
+BASELINE_START
+{
+  "processes": [{"pid": N, "user": "...", "command": "...", "cpu": N, "mem": N}],
+  "ports": [{"port": N, "protocol": "tcp|udp", "process": "...", "address": "..."}],
+  "configs": [{"file": "...", "hash": "...", "lastModified": N}],
+  "users": [{"name": "...", "uid": N, "shell": "...", "lastLogin": N}],
+  "crons": [{"user": "...", "schedule": "...", "command": "..."}],
+  "packages": []
+}
+BASELINE_END
+
+Be thorough but efficient. Only include active/relevant entries.`;
+// ---------------------------------------------------------------------------
+// Phase 3: Continuous Watch
+// ---------------------------------------------------------------------------
+export function watchPrompt(baseline, mode) {
+    const modeDesc = {
+        passive: 'PASSIVE mode — read-only, report only, no actions',
+        defensive: 'DEFENSIVE mode — can block IPs, kill processes, rotate secrets',
+        active: 'ACTIVE mode — can deploy honeypots, counter-intel, all defensive actions',
+    }[mode];
+    return `You are a SECURITY MONITOR in ${modeDesc}.
+
+Current baseline (established ${new Date(baseline.timestamp).toISOString()}):
+- ${baseline.processes.length} known processes
+- ${baseline.ports.length} open ports
+- ${baseline.users.length} system users
+- ${baseline.crons.length} cron jobs
+
+Perform a quick security check using run_command:
+1. ps aux --sort=-%cpu | head -30
+2. ss -tlnp
+3. last -5 2>/dev/null
+4. dmesg -T 2>/dev/null | tail -20
+
+Compare the current state against the baseline.
+
+If you detect ANY anomaly or threat, output:
+THREAT: {"severity": "critical|high|medium|low|info", "category": "bruteforce|portscan|exfiltration|malware|config_change|privilege_escalation|secret_leak|anomaly", "title": "...", "details": "...", "source": "..."}
+
+If everything looks normal, output:
+ALL_CLEAR
+
+${mode !== 'passive' ? `In ${mode} mode, also suggest a response:
+RESPONSE: {"action": "block_ip|kill_process|close_port|rotate_secret|isolate_service|deploy_honeypot", "target": "...", "reason": "..."}` : ''}`;
+}
+// ---------------------------------------------------------------------------
+// Threat Analysis
+// ---------------------------------------------------------------------------
+export function analyzeThreatPrompt(threat, mode) {
+    return `You are a SECURITY ANALYST evaluating a detected threat.
+
+Threat: ${threat.title}
+Severity: ${threat.severity}
+Category: ${threat.category}
+Details: ${threat.details}
+Source: ${threat.source}
+Time: ${new Date(threat.timestamp).toISOString()}
+
+Monitor Mode: ${mode.toUpperCase()}
+
+Investigate this threat using run_command tools:
+1. Check the source (IP, process, file) for more context
+2. Look at related log entries
+3. Assess real severity (could be false positive)
+
+Output your assessment:
+ASSESSMENT: {"confirmedSeverity": "critical|high|medium|low|info", "isFalsePositive": true|false, "details": "..."}
+
+${mode !== 'passive' ? `If action is warranted, output:
+RESPONSE: {"action": "block_ip|kill_process|close_port|rotate_secret|isolate_service|deploy_honeypot", "target": "...", "reason": "...", "autoApprove": true|false}` : 'In PASSIVE mode, only report findings — do not suggest actions.'}`;
+}
+// ---------------------------------------------------------------------------
+// Active Mode: Attacker Profiling
+// ---------------------------------------------------------------------------
+export const ACTIVE_INTEL_PROMPT = `You are a THREAT INTELLIGENCE analyst in ACTIVE mode.
+
+Analyze the collected threat data and create an attacker profile:
+1. Group related events by source IP or pattern
+2. Identify attack vectors and techniques (MITRE ATT&CK if possible)
+3. Assess attacker sophistication
+4. Suggest honeypot configuration
+
+Output:
+INTEL: {"attackerProfile": "...", "techniques": ["..."], "sophistication": "low|medium|high|apt", "honeypotConfig": {"port": N, "service": "...", "purpose": "..."}}`;
+//# sourceMappingURL=prompts.js.map

package/dist/cli/agent/monitor/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/prompts.ts"],"names":[],"mappings":"AAKA,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;iEAyB+B,CAAC;AAElE,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,QAAyB,EAAE,IAAiB;IACtE,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,gEAAgE;QAC3E,MAAM,EAAE,0EAA0E;KACnF,CAAC,IAAI,CAAC,CAAC;IAER,OAAO,iCAAiC,QAAQ;;gCAElB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;IACtE,QAAQ,CAAC,SAAS,CAAC,MAAM;IACzB,QAAQ,CAAC,KAAK,CAAC,MAAM;IACrB,QAAQ,CAAC,KAAK,CAAC,MAAM;IACrB,QAAQ,CAAC,KAAK,CAAC,MAAM;;;;;;;;;;;;;;;;EAgBvB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI;yIACwG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,MAAmB,EAAE,IAAiB;IACxE,OAAO;;UAEC,MAAM,CAAC,KAAK;YACV,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;WAChB,MAAM,CAAC,OAAO;UACf,MAAM,CAAC,MAAM;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;;gBAEhC,IAAI,CAAC,WAAW,EAAE;;;;;;;;;;EAUhC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC;oKAC6I,CAAC,CAAC,CAAC,iEAAiE,EAAE,CAAC;AAC3O,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;qKASkI,CAAC"}

package/dist/cli/agent/monitor/responder.d.ts

@@ -0,0 +1,12 @@
+import type { DefenseAction, DefenseRecord } from './types.js';
+type SendFn = (prompt: string) => Promise<string>;
+/**
+ * Execute a defense action using the agent's run_command tool.
+ */
+export declare function executeDefense(action: DefenseAction | string, target: string, sendMessage: SendFn): Promise<DefenseRecord>;
+/**
+ * Undo a reversible defense action.
+ */
+export declare function undoDefense(defense: DefenseRecord, sendMessage: SendFn): Promise<boolean>;
+export {};
+//# sourceMappingURL=responder.d.ts.map

package/dist/cli/agent/monitor/responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/responder.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAElD;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,GAAG,MAAM,EAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/cli/agent/monitor/responder.js

@@ -0,0 +1,59 @@
+/**
+ * Monitor System — Executes defense actions (defensive/active mode only).
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Execute a defense action using the agent's run_command tool.
+ */
+export async function executeDefense(action, target, sendMessage) {
+    const defensePrompts = {
+        block_ip: `Block the IP address ${target} using iptables. Run:
+iptables -A INPUT -s ${target} -j DROP
+Then verify with: iptables -L -n | grep ${target}`,
+        kill_process: `Kill the suspicious process: ${target}. Run:
+kill -9 ${target}
+Then verify it's gone with: ps aux | grep ${target}`,
+        close_port: `Close port ${target} using iptables. Run:
+iptables -A INPUT --dport ${target} -j DROP
+Then verify with: ss -tlnp | grep ${target}`,
+        rotate_secret: `Rotate the compromised secret for: ${target}
+Generate a new secure random key and update the relevant config file.`,
+        isolate_service: `Isolate the service: ${target}
+Stop the service and block its network access:
+systemctl stop ${target} 2>/dev/null
+iptables -A OUTPUT -m owner --uid-owner $(id -u ${target}) -j DROP 2>/dev/null`,
+        deploy_honeypot: `Deploy a honeypot for: ${target}
+Start a fake service that logs all connection attempts.
+Use: ncat -l -k -p ${target} -c 'echo "SSH-2.0-OpenSSH_8.2p1"; cat >> /tmp/honeypot.log' &`,
+    };
+    const prompt = defensePrompts[action] || `Execute defense action "${action}" against target "${target}".`;
+    await sendMessage(prompt);
+    return {
+        id: randomUUID().slice(0, 8),
+        action: action,
+        target,
+        reason: `Auto-response to detected threat`,
+        autoApproved: true,
+        reversible: action === 'block_ip' || action === 'close_port',
+        timestamp: Date.now(),
+    };
+}
+/**
+ * Undo a reversible defense action.
+ */
+export async function undoDefense(defense, sendMessage) {
+    if (!defense.reversible)
+        return false;
+    const undoPrompts = {
+        block_ip: `Unblock IP address ${defense.target}. Run:
+iptables -D INPUT -s ${defense.target} -j DROP`,
+        close_port: `Re-open port ${defense.target}. Run:
+iptables -D INPUT --dport ${defense.target} -j DROP`,
+    };
+    const prompt = undoPrompts[defense.action];
+    if (!prompt)
+        return false;
+    await sendMessage(prompt);
+    return true;
+}
+//# sourceMappingURL=responder.js.map