helixmind 0.5.4

package/dist/cli/agent/monitor/alerter.js

@@ -0,0 +1,80 @@
+/**
+ * Monitor System — Alert routing to Brain/Relay/Web.
+ */
+import { randomUUID } from 'node:crypto';
+import { pushControlEvent as pushRawControlEvent, pushAgentFinding, } from '../../brain/generator.js';
+// ---------------------------------------------------------------------------
+// Pending approval requests
+// ---------------------------------------------------------------------------
+const pendingApprovals = new Map();
+export function getPendingApprovals() {
+    return Array.from(pendingApprovals.values());
+}
+export function resolveApproval(requestId, approved) {
+    const req = pendingApprovals.get(requestId);
+    if (req) {
+        pendingApprovals.delete(requestId);
+    }
+    return req;
+}
+// ---------------------------------------------------------------------------
+// Push functions
+// ---------------------------------------------------------------------------
+/**
+ * Push a threat event to all channels:
+ * 1. Brain visualization (as agent_finding)
+ * 2. Control protocol (for Web Dashboard)
+ */
+export function pushThreatEvent(threat) {
+    // Brain visualization — shows as finding popup
+    pushAgentFinding('Monitor', `[${threat.severity.toUpperCase()}] ${threat.title}: ${threat.details}`, threat.severity, threat.source);
+    // Control protocol — for Web Dashboard real-time updates
+    pushRawControlEvent({
+        type: 'threat_detected',
+        threat,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Push a defense activation event.
+ */
+export function pushDefenseEvent(defense) {
+    pushAgentFinding('Monitor', `Defense: ${defense.action} → ${defense.target} (${defense.reason})`, 'info', defense.target);
+    pushRawControlEvent({
+        type: 'defense_activated',
+        defense,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Push a monitor status update.
+ */
+export function pushMonitorStatus(status) {
+    pushRawControlEvent({
+        type: 'monitor_status',
+        ...status,
+        timestamp: Date.now(),
+    });
+}
+/**
+ * Request approval from the Web Dashboard for a defense action.
+ * Stores the request and pushes it to the web client.
+ */
+export function requestApproval(action, reason, severity) {
+    const request = {
+        id: randomUUID().slice(0, 8),
+        action: action,
+        target: reason,
+        reason,
+        severity,
+        timestamp: Date.now(),
+        expiresAt: Date.now() + 300_000, // 5 min expiry
+    };
+    pendingApprovals.set(request.id, request);
+    pushRawControlEvent({
+        type: 'approval_request',
+        request,
+        timestamp: Date.now(),
+    });
+}
+//# sourceMappingURL=alerter.js.map

package/dist/cli/agent/monitor/alerter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerter.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/alerter.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAAiB;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,+CAA+C;IAC/C,gBAAgB,CACd,SAAS,EACT,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,EACvE,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,yDAAyD;IACzD,mBAAmB,CAAC;QAClB,IAAI,EAAE,iBAAiB;QACvB,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,gBAAgB,CACd,SAAS,EACT,YAAY,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,EACpE,MAAM,EACN,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,mBAAmB,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAMjC;IACC,mBAAmB,CAAC;QAClB,IAAI,EAAE,gBAAgB;QACtB,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B,EAC9B,MAAc,EACd,QAAwB;IAExB,MAAM,OAAO,GAAoB;QAC/B,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,MAAuB;QAC/B,MAAM,EAAE,MAAM;QACd,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe;KACjD,CAAC;IAEF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE1C,mBAAmB,CAAC;QAClB,IAAI,EAAE,kBAAkB;QACxB,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/agent/monitor/baseline.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Monitor System — Builds and compares security baselines.
+ */
+import type { MonitorBaseline, ScanResult, Drift } from './types.js';
+/**
+ * Build a MonitorBaseline from a scan result.
+ * Parses the structured BASELINE_START block or raw command outputs.
+ */
+export declare function buildBaseline(scan: ScanResult): MonitorBaseline;
+/**
+ * Compare current scan against baseline and detect drift.
+ */
+export declare function diffBaseline(current: ScanResult, baseline: MonitorBaseline): Drift[];
+//# sourceMappingURL=baseline.d.ts.map

package/dist/cli/agent/monitor/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/baseline.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,KAAK,EAMN,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,eAAe,CAyC/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,GAAG,KAAK,EAAE,CA4DpF"}

package/dist/cli/agent/monitor/baseline.js

@@ -0,0 +1,157 @@
+/**
+ * Build a MonitorBaseline from a scan result.
+ * Parses the structured BASELINE_START block or raw command outputs.
+ */
+export function buildBaseline(scan) {
+    let processes = [];
+    let ports = [];
+    let configs = [];
+    let users = [];
+    let crons = [];
+    // Try to parse from the raw baseline JSON first
+    const rawBaseline = scan.rawBaseline;
+    if (rawBaseline) {
+        try {
+            const parsed = JSON.parse(rawBaseline);
+            if (Array.isArray(parsed.processes))
+                processes = parsed.processes;
+            if (Array.isArray(parsed.ports))
+                ports = parsed.ports;
+            if (Array.isArray(parsed.configs))
+                configs = parsed.configs;
+            if (Array.isArray(parsed.users))
+                users = parsed.users;
+            if (Array.isArray(parsed.crons))
+                crons = parsed.crons;
+        }
+        catch {
+            // Fall back to parsing raw text
+        }
+    }
+    // Fallback: parse processes from ps aux output
+    if (processes.length === 0 && scan.processes) {
+        processes = parseProcesses(scan.processes);
+    }
+    // Fallback: parse ports from ss output
+    if (ports.length === 0 && scan.ports) {
+        ports = parsePorts(scan.ports);
+    }
+    return {
+        processes,
+        ports,
+        configs,
+        packages: [],
+        users,
+        crons,
+        timestamp: scan.timestamp,
+    };
+}
+/**
+ * Compare current scan against baseline and detect drift.
+ */
+export function diffBaseline(current, baseline) {
+    const drifts = [];
+    // Parse current state
+    const currentProcesses = parseProcesses(current.processes);
+    const currentPorts = parsePorts(current.ports);
+    // Check for new processes
+    const baselineCommands = new Set(baseline.processes.map(p => p.command));
+    for (const proc of currentProcesses) {
+        if (!baselineCommands.has(proc.command)) {
+            drifts.push({
+                category: 'process',
+                description: `New process: ${proc.command} (PID: ${proc.pid}, user: ${proc.user})`,
+                severity: proc.user === 'root' ? 'high' : 'medium',
+                details: `CPU: ${proc.cpu}%, MEM: ${proc.mem}%`,
+            });
+        }
+    }
+    // Check for disappeared processes (might indicate killed service)
+    const currentCommands = new Set(currentProcesses.map(p => p.command));
+    for (const proc of baseline.processes) {
+        if (!currentCommands.has(proc.command) && isImportantProcess(proc.command)) {
+            drifts.push({
+                category: 'process',
+                description: `Missing process: ${proc.command} (was running as ${proc.user})`,
+                severity: 'high',
+                details: 'Expected process is no longer running',
+            });
+        }
+    }
+    // Check for new ports
+    const baselinePorts = new Set(baseline.ports.map(p => `${p.port}/${p.protocol}`));
+    for (const port of currentPorts) {
+        if (!baselinePorts.has(`${port.port}/${port.protocol}`)) {
+            drifts.push({
+                category: 'port',
+                description: `New listening port: ${port.port}/${port.protocol} (${port.process})`,
+                severity: port.port < 1024 ? 'high' : 'medium',
+                details: `Address: ${port.address}`,
+            });
+        }
+    }
+    // Check for closed ports
+    const currentPortSet = new Set(currentPorts.map(p => `${p.port}/${p.protocol}`));
+    for (const port of baseline.ports) {
+        if (!currentPortSet.has(`${port.port}/${port.protocol}`)) {
+            drifts.push({
+                category: 'port',
+                description: `Closed port: ${port.port}/${port.protocol} (was ${port.process})`,
+                severity: 'medium',
+                details: 'Previously open port is no longer listening',
+            });
+        }
+    }
+    return drifts;
+}
+// ---------------------------------------------------------------------------
+// Parsers
+// ---------------------------------------------------------------------------
+function parseProcesses(raw) {
+    const processes = [];
+    const lines = raw.split('\n').filter(l => l.trim());
+    for (const line of lines) {
+        // Skip header
+        if (line.includes('USER') && line.includes('PID'))
+            continue;
+        if (line.startsWith('---'))
+            continue;
+        const parts = line.trim().split(/\s+/);
+        if (parts.length >= 11) {
+            processes.push({
+                user: parts[0],
+                pid: parseInt(parts[1], 10) || 0,
+                cpu: parseFloat(parts[2]) || 0,
+                mem: parseFloat(parts[3]) || 0,
+                command: parts.slice(10).join(' '),
+            });
+        }
+    }
+    return processes;
+}
+function parsePorts(raw) {
+    const ports = [];
+    const lines = raw.split('\n').filter(l => l.trim());
+    for (const line of lines) {
+        // Skip header
+        if (line.includes('State') && line.includes('Local'))
+            continue;
+        // Parse ss -tlnp output: State  Recv-Q  Send-Q  Local Address:Port  ...
+        const match = line.match(/([\d.*:]+):(\d+)\s/);
+        if (match) {
+            const processMatch = line.match(/users:\(\("([^"]+)"/);
+            ports.push({
+                address: match[1],
+                port: parseInt(match[2], 10),
+                protocol: line.includes('udp') ? 'udp' : 'tcp',
+                process: processMatch?.[1] || 'unknown',
+            });
+        }
+    }
+    return ports;
+}
+function isImportantProcess(command) {
+    const important = ['sshd', 'nginx', 'apache', 'postgres', 'mysql', 'redis', 'docker', 'systemd'];
+    return important.some(name => command.toLowerCase().includes(name));
+}
+//# sourceMappingURL=baseline.js.map

package/dist/cli/agent/monitor/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/baseline.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,IAAI,SAAS,GAAkB,EAAE,CAAC;IAClC,IAAI,KAAK,GAAe,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAqB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAe,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAgB,EAAE,CAAC;IAE5B,gDAAgD;IAChD,MAAM,WAAW,GAAI,IAA0C,CAAC,WAAW,CAAC;IAC5E,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YAClE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,EAAE;QACZ,KAAK;QACL,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,QAAyB;IACzE,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,sBAAsB;IACtB,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/C,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,gBAAgB,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,IAAI,GAAG;gBAClF,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAClD,OAAO,EAAE,QAAQ,IAAI,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,GAAG;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,oBAAoB,IAAI,CAAC,IAAI,GAAG;gBAC7E,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,uBAAuB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,GAAG;gBAClF,QAAQ,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC9C,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,gBAAgB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,OAAO,GAAG;gBAC/E,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,cAAc;QACd,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAErC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;gBAChC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9B,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9B,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,cAAc;QACd,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAE/D,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;gBAC9C,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjG,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli/agent/monitor/prompts.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Monitor System — LLM prompts for each phase and check type.
+ */
+import type { MonitorMode, MonitorBaseline, ThreatEvent } from './types.js';
+export declare const SCAN_SYSTEM_PROMPT = "You are a SECURITY MONITOR performing a full system scan.\n\nUse the run_command tool to gather system state. Run these commands:\n1. ps aux --sort=-%cpu | head -50\n2. ss -tlnp\n3. cat /etc/ssh/sshd_config 2>/dev/null || echo \"No SSH config\"\n4. crontab -l 2>/dev/null; for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null && echo \"--- User: $u ---\"; done\n5. iptables -L -n 2>/dev/null || echo \"No iptables access\"\n6. last -20 2>/dev/null || echo \"No login history\"\n7. find /etc -newer /etc/hostname -type f -mmin -1440 2>/dev/null | head -30\n8. cat /etc/passwd | grep -v nologin | grep -v false\n\nAfter gathering all data, output a structured baseline report between these markers:\n\nBASELINE_START\n{\n  \"processes\": [{\"pid\": N, \"user\": \"...\", \"command\": \"...\", \"cpu\": N, \"mem\": N}],\n  \"ports\": [{\"port\": N, \"protocol\": \"tcp|udp\", \"process\": \"...\", \"address\": \"...\"}],\n  \"configs\": [{\"file\": \"...\", \"hash\": \"...\", \"lastModified\": N}],\n  \"users\": [{\"name\": \"...\", \"uid\": N, \"shell\": \"...\", \"lastLogin\": N}],\n  \"crons\": [{\"user\": \"...\", \"schedule\": \"...\", \"command\": \"...\"}],\n  \"packages\": []\n}\nBASELINE_END\n\nBe thorough but efficient. Only include active/relevant entries.";
+export declare function watchPrompt(baseline: MonitorBaseline, mode: MonitorMode): string;
+export declare function analyzeThreatPrompt(threat: ThreatEvent, mode: MonitorMode): string;
+export declare const ACTIVE_INTEL_PROMPT = "You are a THREAT INTELLIGENCE analyst in ACTIVE mode.\n\nAnalyze the collected threat data and create an attacker profile:\n1. Group related events by source IP or pattern\n2. Identify attack vectors and techniques (MITRE ATT&CK if possible)\n3. Assess attacker sophistication\n4. Suggest honeypot configuration\n\nOutput:\nINTEL: {\"attackerProfile\": \"...\", \"techniques\": [\"...\"], \"sophistication\": \"low|medium|high|apt\", \"honeypotConfig\": {\"port\": N, \"service\": \"...\", \"purpose\": \"...\"}}";
+//# sourceMappingURL=prompts.d.ts.map

package/dist/cli/agent/monitor/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/prompts.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM5E,eAAO,MAAM,kBAAkB,4wCAyBkC,CAAC;AAMlE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CA+BhF;AAMD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAsBlF;AAMD,eAAO,MAAM,mBAAmB,qgBASqI,CAAC"}

package/dist/cli/agent/monitor/prompts.js

@@ -0,0 +1,103 @@
+// ---------------------------------------------------------------------------
+// Phase 1: Full System Scan
+// ---------------------------------------------------------------------------
+export const SCAN_SYSTEM_PROMPT = `You are a SECURITY MONITOR performing a full system scan.
+
+Use the run_command tool to gather system state. Run these commands:
+1. ps aux --sort=-%cpu | head -50
+2. ss -tlnp
+3. cat /etc/ssh/sshd_config 2>/dev/null || echo "No SSH config"
+4. crontab -l 2>/dev/null; for u in $(cut -f1 -d: /etc/passwd); do crontab -l -u $u 2>/dev/null && echo "--- User: $u ---"; done
+5. iptables -L -n 2>/dev/null || echo "No iptables access"
+6. last -20 2>/dev/null || echo "No login history"
+7. find /etc -newer /etc/hostname -type f -mmin -1440 2>/dev/null | head -30
+8. cat /etc/passwd | grep -v nologin | grep -v false
+
+After gathering all data, output a structured baseline report between these markers:
+
+BASELINE_START
+{
+  "processes": [{"pid": N, "user": "...", "command": "...", "cpu": N, "mem": N}],
+  "ports": [{"port": N, "protocol": "tcp|udp", "process": "...", "address": "..."}],
+  "configs": [{"file": "...", "hash": "...", "lastModified": N}],
+  "users": [{"name": "...", "uid": N, "shell": "...", "lastLogin": N}],
+  "crons": [{"user": "...", "schedule": "...", "command": "..."}],
+  "packages": []
+}
+BASELINE_END
+
+Be thorough but efficient. Only include active/relevant entries.`;
+// ---------------------------------------------------------------------------
+// Phase 3: Continuous Watch
+// ---------------------------------------------------------------------------
+export function watchPrompt(baseline, mode) {
+    const modeDesc = {
+        passive: 'PASSIVE mode — read-only, report only, no actions',
+        defensive: 'DEFENSIVE mode — can block IPs, kill processes, rotate secrets',
+        active: 'ACTIVE mode — can deploy honeypots, counter-intel, all defensive actions',
+    }[mode];
+    return `You are a SECURITY MONITOR in ${modeDesc}.
+
+Current baseline (established ${new Date(baseline.timestamp).toISOString()}):
+- ${baseline.processes.length} known processes
+- ${baseline.ports.length} open ports
+- ${baseline.users.length} system users
+- ${baseline.crons.length} cron jobs
+
+Perform a quick security check using run_command:
+1. ps aux --sort=-%cpu | head -30
+2. ss -tlnp
+3. last -5 2>/dev/null
+4. dmesg -T 2>/dev/null | tail -20
+
+Compare the current state against the baseline.
+
+If you detect ANY anomaly or threat, output:
+THREAT: {"severity": "critical|high|medium|low|info", "category": "bruteforce|portscan|exfiltration|malware|config_change|privilege_escalation|secret_leak|anomaly", "title": "...", "details": "...", "source": "..."}
+
+If everything looks normal, output:
+ALL_CLEAR
+
+${mode !== 'passive' ? `In ${mode} mode, also suggest a response:
+RESPONSE: {"action": "block_ip|kill_process|close_port|rotate_secret|isolate_service|deploy_honeypot", "target": "...", "reason": "..."}` : ''}`;
+}
+// ---------------------------------------------------------------------------
+// Threat Analysis
+// ---------------------------------------------------------------------------
+export function analyzeThreatPrompt(threat, mode) {
+    return `You are a SECURITY ANALYST evaluating a detected threat.
+
+Threat: ${threat.title}
+Severity: ${threat.severity}
+Category: ${threat.category}
+Details: ${threat.details}
+Source: ${threat.source}
+Time: ${new Date(threat.timestamp).toISOString()}
+
+Monitor Mode: ${mode.toUpperCase()}
+
+Investigate this threat using run_command tools:
+1. Check the source (IP, process, file) for more context
+2. Look at related log entries
+3. Assess real severity (could be false positive)
+
+Output your assessment:
+ASSESSMENT: {"confirmedSeverity": "critical|high|medium|low|info", "isFalsePositive": true|false, "details": "..."}
+
+${mode !== 'passive' ? `If action is warranted, output:
+RESPONSE: {"action": "block_ip|kill_process|close_port|rotate_secret|isolate_service|deploy_honeypot", "target": "...", "reason": "...", "autoApprove": true|false}` : 'In PASSIVE mode, only report findings — do not suggest actions.'}`;
+}
+// ---------------------------------------------------------------------------
+// Active Mode: Attacker Profiling
+// ---------------------------------------------------------------------------
+export const ACTIVE_INTEL_PROMPT = `You are a THREAT INTELLIGENCE analyst in ACTIVE mode.
+
+Analyze the collected threat data and create an attacker profile:
+1. Group related events by source IP or pattern
+2. Identify attack vectors and techniques (MITRE ATT&CK if possible)
+3. Assess attacker sophistication
+4. Suggest honeypot configuration
+
+Output:
+INTEL: {"attackerProfile": "...", "techniques": ["..."], "sophistication": "low|medium|high|apt", "honeypotConfig": {"port": N, "service": "...", "purpose": "..."}}`;
+//# sourceMappingURL=prompts.js.map

package/dist/cli/agent/monitor/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/prompts.ts"],"names":[],"mappings":"AAKA,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;iEAyB+B,CAAC;AAElE,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,QAAyB,EAAE,IAAiB;IACtE,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,gEAAgE;QAC3E,MAAM,EAAE,0EAA0E;KACnF,CAAC,IAAI,CAAC,CAAC;IAER,OAAO,iCAAiC,QAAQ;;gCAElB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;IACtE,QAAQ,CAAC,SAAS,CAAC,MAAM;IACzB,QAAQ,CAAC,KAAK,CAAC,MAAM;IACrB,QAAQ,CAAC,KAAK,CAAC,MAAM;IACrB,QAAQ,CAAC,KAAK,CAAC,MAAM;;;;;;;;;;;;;;;;EAgBvB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI;yIACwG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjJ,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,MAAmB,EAAE,IAAiB;IACxE,OAAO;;UAEC,MAAM,CAAC,KAAK;YACV,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;WAChB,MAAM,CAAC,OAAO;UACf,MAAM,CAAC,MAAM;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;;gBAEhC,IAAI,CAAC,WAAW,EAAE;;;;;;;;;;EAUhC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC;oKAC6I,CAAC,CAAC,CAAC,iEAAiE,EAAE,CAAC;AAC3O,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;qKASkI,CAAC"}

package/dist/cli/agent/monitor/responder.d.ts

@@ -0,0 +1,12 @@
+import type { DefenseAction, DefenseRecord } from './types.js';
+type SendFn = (prompt: string) => Promise<string>;
+/**
+ * Execute a defense action using the agent's run_command tool.
+ */
+export declare function executeDefense(action: DefenseAction | string, target: string, sendMessage: SendFn): Promise<DefenseRecord>;
+/**
+ * Undo a reversible defense action.
+ */
+export declare function undoDefense(defense: DefenseRecord, sendMessage: SendFn): Promise<boolean>;
+export {};
+//# sourceMappingURL=responder.d.ts.map

package/dist/cli/agent/monitor/responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/responder.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAElD;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,GAAG,MAAM,EAC9B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/cli/agent/monitor/responder.js

@@ -0,0 +1,59 @@
+/**
+ * Monitor System — Executes defense actions (defensive/active mode only).
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Execute a defense action using the agent's run_command tool.
+ */
+export async function executeDefense(action, target, sendMessage) {
+    const defensePrompts = {
+        block_ip: `Block the IP address ${target} using iptables. Run:
+iptables -A INPUT -s ${target} -j DROP
+Then verify with: iptables -L -n | grep ${target}`,
+        kill_process: `Kill the suspicious process: ${target}. Run:
+kill -9 ${target}
+Then verify it's gone with: ps aux | grep ${target}`,
+        close_port: `Close port ${target} using iptables. Run:
+iptables -A INPUT --dport ${target} -j DROP
+Then verify with: ss -tlnp | grep ${target}`,
+        rotate_secret: `Rotate the compromised secret for: ${target}
+Generate a new secure random key and update the relevant config file.`,
+        isolate_service: `Isolate the service: ${target}
+Stop the service and block its network access:
+systemctl stop ${target} 2>/dev/null
+iptables -A OUTPUT -m owner --uid-owner $(id -u ${target}) -j DROP 2>/dev/null`,
+        deploy_honeypot: `Deploy a honeypot for: ${target}
+Start a fake service that logs all connection attempts.
+Use: ncat -l -k -p ${target} -c 'echo "SSH-2.0-OpenSSH_8.2p1"; cat >> /tmp/honeypot.log' &`,
+    };
+    const prompt = defensePrompts[action] || `Execute defense action "${action}" against target "${target}".`;
+    await sendMessage(prompt);
+    return {
+        id: randomUUID().slice(0, 8),
+        action: action,
+        target,
+        reason: `Auto-response to detected threat`,
+        autoApproved: true,
+        reversible: action === 'block_ip' || action === 'close_port',
+        timestamp: Date.now(),
+    };
+}
+/**
+ * Undo a reversible defense action.
+ */
+export async function undoDefense(defense, sendMessage) {
+    if (!defense.reversible)
+        return false;
+    const undoPrompts = {
+        block_ip: `Unblock IP address ${defense.target}. Run:
+iptables -D INPUT -s ${defense.target} -j DROP`,
+        close_port: `Re-open port ${defense.target}. Run:
+iptables -D INPUT --dport ${defense.target} -j DROP`,
+    };
+    const prompt = undoPrompts[defense.action];
+    if (!prompt)
+        return false;
+    await sendMessage(prompt);
+    return true;
+}
+//# sourceMappingURL=responder.js.map

package/dist/cli/agent/monitor/responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/responder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA8B,EAC9B,MAAc,EACd,WAAmB;IAEnB,MAAM,cAAc,GAA2B;QAC7C,QAAQ,EAAE,wBAAwB,MAAM;uBACrB,MAAM;0CACa,MAAM,EAAE;QAE9C,YAAY,EAAE,gCAAgC,MAAM;UAC9C,MAAM;4CAC4B,MAAM,EAAE;QAEhD,UAAU,EAAE,cAAc,MAAM;4BACR,MAAM;oCACE,MAAM,EAAE;QAExC,aAAa,EAAE,sCAAsC,MAAM;sEACO;QAElE,eAAe,EAAE,wBAAwB,MAAM;;iBAElC,MAAM;kDAC2B,MAAM,uBAAuB;QAE3E,eAAe,EAAE,0BAA0B,MAAM;;qBAEhC,MAAM,gEAAgE;KACxF,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,2BAA2B,MAAM,qBAAqB,MAAM,IAAI,CAAC;IAE1G,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO;QACL,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,MAAuB;QAC/B,MAAM;QACN,MAAM,EAAE,kCAAkC;QAC1C,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY;QAC5D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAsB,EACtB,WAAmB;IAEnB,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,WAAW,GAA2B;QAC1C,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM;uBAC3B,OAAO,CAAC,MAAM,UAAU;QAE3C,UAAU,EAAE,gBAAgB,OAAO,CAAC,MAAM;4BAClB,OAAO,CAAC,MAAM,UAAU;KACjD,CAAC;IAEF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/agent/monitor/scanner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Monitor System — System scanner that uses the LLM + run_command to read system state.
+ */
+import type { ScanResult, MonitorCallbacks } from './types.js';
+/**
+ * Perform a full system scan by sending the scan prompt to the agent.
+ * The agent will use run_command tools to gather system information.
+ */
+export declare function scanSystem(callbacks: MonitorCallbacks): Promise<ScanResult>;
+/**
+ * Perform a quick check (subset of full scan) for the watch loop.
+ */
+export declare function quickScan(callbacks: MonitorCallbacks): Promise<string>;
+/**
+ * Perform a medium check (config drift + packages).
+ */
+export declare function mediumScan(callbacks: MonitorCallbacks): Promise<string>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/cli/agent/monitor/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/scanner.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG/D;;;GAGG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBjF;AAmCD;;GAEG;AACH,wBAAsB,SAAS,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW7E"}

package/dist/cli/agent/monitor/scanner.js

@@ -0,0 +1,81 @@
+import { SCAN_SYSTEM_PROMPT } from './prompts.js';
+/**
+ * Perform a full system scan by sending the scan prompt to the agent.
+ * The agent will use run_command tools to gather system information.
+ */
+export async function scanSystem(callbacks) {
+    callbacks.onScanComplete('scan_start');
+    const resultText = await callbacks.sendMessage(SCAN_SYSTEM_PROMPT);
+    // Parse structured baseline from the LLM response
+    const parsed = parseBaselineFromResponse(resultText);
+    const result = {
+        processes: parsed.processes || '',
+        ports: parsed.ports || '',
+        sshConfig: parsed.sshConfig || '',
+        firewall: parsed.firewall || '',
+        crontabs: parsed.crontabs || '',
+        packages: parsed.packages || '',
+        recentLogins: parsed.recentLogins || '',
+        configChanges: parsed.configChanges || '',
+        timestamp: Date.now(),
+    };
+    callbacks.onScanComplete('scan_complete');
+    return result;
+}
+/**
+ * Parse the BASELINE_START...BASELINE_END block from the LLM response.
+ */
+function parseBaselineFromResponse(text) {
+    const result = {};
+    // Extract the structured block
+    const baselineMatch = text.match(/BASELINE_START\s*([\s\S]*?)\s*BASELINE_END/);
+    if (baselineMatch) {
+        result.rawBaseline = baselineMatch[1].trim();
+    }
+    // Also extract raw command outputs for backup
+    const sections = [
+        { key: 'processes', pattern: /ps aux[\s\S]*?(?=\n(?:ss |cat |crontab|iptables|last |find )|$)/i },
+        { key: 'ports', pattern: /ss -tlnp[\s\S]*?(?=\n(?:cat |crontab|iptables|last |find )|$)/i },
+        { key: 'sshConfig', pattern: /sshd_config[\s\S]*?(?=\n(?:crontab|iptables|last |find )|$)/i },
+        { key: 'firewall', pattern: /iptables[\s\S]*?(?=\n(?:last |find )|$)/i },
+        { key: 'crontabs', pattern: /crontab[\s\S]*?(?=\n(?:iptables|last |find )|$)/i },
+        { key: 'recentLogins', pattern: /last [\s\S]*?(?=\n(?:find )|$)/i },
+        { key: 'configChanges', pattern: /find \/etc[\s\S]*/i },
+    ];
+    for (const { key, pattern } of sections) {
+        const match = text.match(pattern);
+        if (match) {
+            result[key] = match[0].trim();
+        }
+    }
+    return result;
+}
+/**
+ * Perform a quick check (subset of full scan) for the watch loop.
+ */
+export async function quickScan(callbacks) {
+    const quickPrompt = `Quick security check. Run these commands and report any anomalies:
+1. ps aux --sort=-%cpu | head -15
+2. ss -tlnp
+3. last -3 2>/dev/null
+
+Compare with what you know from the baseline. Report only NEW or CHANGED items.
+If everything matches baseline: ALL_CLEAR
+If anomaly detected: THREAT: {"severity": "...", "category": "...", "title": "...", "details": "...", "source": "..."}`;
+    return callbacks.sendMessage(quickPrompt);
+}
+/**
+ * Perform a medium check (config drift + packages).
+ */
+export async function mediumScan(callbacks) {
+    const mediumPrompt = `Medium security check. Run these commands:
+1. find /etc -newer /etc/hostname -type f -mmin -5 2>/dev/null | head -20
+2. ps aux --sort=-%cpu | head -20
+3. ss -tlnp
+4. dmesg -T 2>/dev/null | tail -10
+
+Look for config changes, new processes, new ports. Report:
+ALL_CLEAR or THREAT: {"severity": "...", "category": "...", "title": "...", "details": "...", "source": "..."}`;
+    return callbacks.sendMessage(mediumPrompt);
+}
+//# sourceMappingURL=scanner.js.map

package/dist/cli/agent/monitor/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAA2B;IAC1D,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAEvC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEnE,kDAAkD;IAClD,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAe;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IAEF,SAAS,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/E,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG;QACf,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE;QACjG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,gEAAgE,EAAE;QAC3F,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,8DAA8D,EAAE;QAC7F,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0CAA0C,EAAE;QACxE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,kDAAkD,EAAE;QAChF,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE;QACnE,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE;KACxD,CAAC;IAEF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAA2B;IACzD,MAAM,WAAW,GAAG;;;;;;;uHAOiG,CAAC;IAEtH,OAAO,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAA2B;IAC1D,MAAM,YAAY,GAAG;;;;;;;+GAOwF,CAAC;IAE9G,OAAO,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC"}