helixmind 0.5.4

package/dist/cli/agent/monitor/types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Monitor System — shared types for the security monitoring agent.
+ */
+export type MonitorMode = 'passive' | 'defensive' | 'active';
+export type ThreatSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type ThreatCategory = 'bruteforce' | 'portscan' | 'exfiltration' | 'malware' | 'config_change' | 'privilege_escalation' | 'secret_leak' | 'anomaly';
+export type DefenseAction = 'block_ip' | 'kill_process' | 'close_port' | 'rotate_secret' | 'isolate_service' | 'deploy_honeypot';
+export interface ThreatEvent {
+    id: string;
+    severity: ThreatSeverity;
+    category: ThreatCategory;
+    title: string;
+    details: string;
+    source: string;
+    timestamp: number;
+    relatedEvents: string[];
+}
+export interface DefenseRecord {
+    id: string;
+    action: DefenseAction;
+    target: string;
+    reason: string;
+    autoApproved: boolean;
+    reversible: boolean;
+    timestamp: number;
+}
+export interface MonitorBaseline {
+    processes: ProcessInfo[];
+    ports: PortInfo[];
+    configs: ConfigSnapshot[];
+    packages: PackageInfo[];
+    users: UserInfo[];
+    crons: CronEntry[];
+    timestamp: number;
+}
+export interface ProcessInfo {
+    pid: number;
+    user: string;
+    command: string;
+    cpu: number;
+    mem: number;
+}
+export interface PortInfo {
+    port: number;
+    protocol: 'tcp' | 'udp';
+    process: string;
+    address: string;
+}
+export interface ConfigSnapshot {
+    file: string;
+    hash: string;
+    lastModified: number;
+}
+export interface PackageInfo {
+    name: string;
+    version: string;
+    vulnerabilities: number;
+}
+export interface UserInfo {
+    name: string;
+    uid: number;
+    shell: string;
+    lastLogin: number | null;
+}
+export interface CronEntry {
+    user: string;
+    schedule: string;
+    command: string;
+}
+export interface MonitorState {
+    mode: MonitorMode;
+    uptime: number;
+    threats: ThreatEvent[];
+    defenses: DefenseRecord[];
+    baseline: MonitorBaseline | null;
+    lastScan: number;
+}
+export interface ScanResult {
+    processes: string;
+    ports: string;
+    sshConfig: string;
+    firewall: string;
+    crontabs: string;
+    packages: string;
+    recentLogins: string;
+    configChanges: string;
+    timestamp: number;
+}
+export interface Drift {
+    category: 'process' | 'port' | 'config' | 'package' | 'user' | 'cron';
+    description: string;
+    severity: ThreatSeverity;
+    details: string;
+}
+export interface MonitorCallbacks {
+    sendMessage: (prompt: string) => Promise<string>;
+    isAborted: () => boolean;
+    onThreat: (threat: ThreatEvent) => void;
+    onDefense: (defense: DefenseRecord) => void;
+    onScanComplete: (phase: string) => void;
+    onStatusUpdate: (status: MonitorState) => void;
+    updateStatus: () => void;
+}
+export interface ApprovalRequest {
+    id: string;
+    action: DefenseAction;
+    target: string;
+    reason: string;
+    severity: ThreatSeverity;
+    timestamp: number;
+    expiresAt: number;
+}
+export interface ApprovalResponse {
+    requestId: string;
+    approved: boolean;
+    respondedBy: 'web' | 'cli' | 'auto';
+    timestamp: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/agent/monitor/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE7D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7E,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,UAAU,GACV,cAAc,GACd,SAAS,GACT,eAAe,GACf,sBAAsB,GACtB,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,cAAc,GACd,YAAY,GACZ,eAAe,GACf,iBAAiB,GACjB,iBAAiB,CAAC;AAMtB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAMD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,KAAK;IACpB,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IAC5C,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/C,YAAY,EAAE,MAAM,IAAI,CAAC;CAC1B;AAMD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/cli/agent/monitor/types.js

@@ -0,0 +1,5 @@
+/**
+ * Monitor System — shared types for the security monitoring agent.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cli/agent/monitor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/cli/agent/monitor/watcher.d.ts

@@ -0,0 +1,4 @@
+import type { MonitorMode, MonitorBaseline, MonitorState, MonitorCallbacks } from './types.js';
+export declare function getMonitorState(): MonitorState | null;
+export declare function runMonitorLoop(callbacks: MonitorCallbacks, mode: MonitorMode, baseline: MonitorBaseline): Promise<void>;
+//# sourceMappingURL=watcher.d.ts.map

package/dist/cli/agent/monitor/watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.d.ts","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/watcher.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AAqBpB,wBAAgB,eAAe,IAAI,YAAY,GAAG,IAAI,CAErD;AAMD,wBAAsB,cAAc,CAClC,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAgGf"}

package/dist/cli/agent/monitor/watcher.js

@@ -0,0 +1,214 @@
+/**
+ * Monitor System — Continuous watch loop with adaptive intervals.
+ */
+import { randomUUID } from 'node:crypto';
+import chalk from 'chalk';
+import { watchPrompt, analyzeThreatPrompt } from './prompts.js';
+import { quickScan, mediumScan } from './scanner.js';
+import { pushThreatEvent, pushDefenseEvent, requestApproval } from './alerter.js';
+import { executeDefense } from './responder.js';
+// ---------------------------------------------------------------------------
+// Timing constants
+// ---------------------------------------------------------------------------
+const QUICK_CHECK_INTERVAL = 60_000; // 60 seconds
+const MEDIUM_CHECK_INTERVAL = 300_000; // 5 minutes
+const FULL_CHECK_INTERVAL = 1_800_000; // 30 minutes
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+let monitorState = null;
+export function getMonitorState() {
+    return monitorState;
+}
+// ---------------------------------------------------------------------------
+// Main watch loop
+// ---------------------------------------------------------------------------
+export async function runMonitorLoop(callbacks, mode, baseline) {
+    const startTime = Date.now();
+    monitorState = {
+        mode,
+        uptime: 0,
+        threats: [],
+        defenses: [],
+        baseline,
+        lastScan: Date.now(),
+    };
+    let lastQuickCheck = Date.now();
+    let lastMediumCheck = Date.now();
+    let lastFullCheck = Date.now();
+    const d = chalk.dim;
+    const shield = mode === 'active' ? '\u2694\uFE0F' : mode === 'defensive' ? '\u{1F6E1}\uFE0F' : '\u{1F50D}';
+    process.stdout.write('\n');
+    process.stdout.write(d(`  ${shield} Monitor loop started (${mode} mode)\n`));
+    process.stdout.write(d('  Watching for security anomalies...\n\n'));
+    while (!callbacks.isAborted()) {
+        const now = Date.now();
+        monitorState.uptime = now - startTime;
+        // --- Quick check (every 60s) ---
+        if (now - lastQuickCheck >= QUICK_CHECK_INTERVAL) {
+            lastQuickCheck = now;
+            try {
+                const result = await quickScan(callbacks);
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(result);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Quick check error: ${err}\n`));
+            }
+        }
+        // --- Medium check (every 5min) ---
+        if (now - lastMediumCheck >= MEDIUM_CHECK_INTERVAL) {
+            lastMediumCheck = now;
+            try {
+                const result = await mediumScan(callbacks);
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(result);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Medium check error: ${err}\n`));
+            }
+        }
+        // --- Full check (every 30min) ---
+        if (now - lastFullCheck >= FULL_CHECK_INTERVAL) {
+            lastFullCheck = now;
+            try {
+                const fullResult = await callbacks.sendMessage(watchPrompt(baseline, mode));
+                if (callbacks.isAborted())
+                    break;
+                const threats = parseThreats(fullResult);
+                for (const threat of threats) {
+                    await handleThreat(threat, mode, callbacks);
+                }
+                monitorState.lastScan = Date.now();
+                callbacks.onStatusUpdate(monitorState);
+            }
+            catch (err) {
+                if (callbacks.isAborted())
+                    break;
+                process.stdout.write(d(`  \u26A0 Full check error: ${err}\n`));
+            }
+        }
+        // Sleep between checks (5 seconds)
+        await sleep(5_000);
+    }
+    monitorState = null;
+    process.stdout.write(d('\n  Monitor loop stopped.\n'));
+}
+// ---------------------------------------------------------------------------
+// Threat handling
+// ---------------------------------------------------------------------------
+async function handleThreat(threat, mode, callbacks) {
+    // Add to state
+    if (monitorState) {
+        monitorState.threats.push(threat);
+    }
+    // Notify via all channels
+    callbacks.onThreat(threat);
+    pushThreatEvent(threat);
+    const severityColor = {
+        critical: chalk.red.bold,
+        high: chalk.red,
+        medium: chalk.yellow,
+        low: chalk.dim,
+        info: chalk.dim,
+    }[threat.severity];
+    process.stdout.write(`\n  ${severityColor(`\u26A0 THREAT [${threat.severity.toUpperCase()}]`)} ${threat.title}\n`);
+    process.stdout.write(chalk.dim(`    ${threat.details}\n`));
+    process.stdout.write(chalk.dim(`    Source: ${threat.source}\n\n`));
+    // In passive mode, only alert — no response
+    if (mode === 'passive')
+        return;
+    // Analyze threat and decide response
+    try {
+        const analysisResult = await callbacks.sendMessage(analyzeThreatPrompt(threat, mode));
+        const response = parseResponse(analysisResult);
+        if (response) {
+            if (threat.severity === 'critical') {
+                // CRITICAL + defensive/active: auto-execute
+                const record = await executeDefense(response.action, response.target, callbacks.sendMessage);
+                if (monitorState)
+                    monitorState.defenses.push(record);
+                callbacks.onDefense(record);
+                pushDefenseEvent(record);
+                process.stdout.write(chalk.blue(`  \u{1F6E1}\uFE0F Auto-defense: ${response.action} → ${response.target}\n`));
+            }
+            else if (threat.severity === 'high') {
+                // HIGH + defensive/active: request approval from web
+                requestApproval(response.action, response.reason, threat.severity);
+                process.stdout.write(chalk.yellow(`  \u23F3 Awaiting approval: ${response.action} → ${response.target}\n`));
+            }
+        }
+    }
+    catch {
+        // Analysis failed — continue monitoring
+    }
+}
+// ---------------------------------------------------------------------------
+// Parsers
+// ---------------------------------------------------------------------------
+function parseThreats(text) {
+    const threats = [];
+    if (text.includes('ALL_CLEAR'))
+        return threats;
+    // Find all THREAT: {...} blocks
+    const threatRegex = /THREAT:\s*(\{[\s\S]*?\})/g;
+    let match;
+    while ((match = threatRegex.exec(text)) !== null) {
+        try {
+            const parsed = JSON.parse(match[1]);
+            threats.push({
+                id: randomUUID().slice(0, 8),
+                severity: (parsed.severity || 'info'),
+                category: (parsed.category || 'anomaly'),
+                title: parsed.title || 'Unknown threat',
+                details: parsed.details || '',
+                source: parsed.source || 'unknown',
+                timestamp: Date.now(),
+                relatedEvents: [],
+            });
+        }
+        catch {
+            // Skip unparseable threat
+        }
+    }
+    return threats;
+}
+function parseResponse(text) {
+    const responseMatch = text.match(/RESPONSE:\s*(\{[\s\S]*?\})/);
+    if (!responseMatch)
+        return null;
+    try {
+        const parsed = JSON.parse(responseMatch[1]);
+        return {
+            action: parsed.action || '',
+            target: parsed.target || '',
+            reason: parsed.reason || '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=watcher.js.map

package/dist/cli/agent/monitor/watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.js","sourceRoot":"","sources":["../../../../src/cli/agent/monitor/watcher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAU1B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAI,aAAa;AACrD,MAAM,qBAAqB,GAAG,OAAO,CAAC,CAAE,YAAY;AACpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAE,aAAa;AAErD,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAA2B,EAC3B,IAAiB,EACjB,QAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,YAAY,GAAG;QACb,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,0BAA0B,IAAI,UAAU,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAEpE,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,YAAY,CAAC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC;QAEtC,kCAAkC;QAClC,IAAI,GAAG,GAAG,cAAc,IAAI,oBAAoB,EAAE,CAAC;YACjD,cAAc,GAAG,GAAG,CAAC;YAErB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,IAAI,GAAG,GAAG,eAAe,IAAI,qBAAqB,EAAE,CAAC;YACnD,eAAe,GAAG,GAAG,CAAC;YAEtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;gBAC3C,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,GAAG,GAAG,aAAa,IAAI,mBAAmB,EAAE,CAAC;YAC/C,aAAa,GAAG,GAAG,CAAC;YAEpB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5E,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBAEjC,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAED,YAAY,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnC,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,SAAS,EAAE;oBAAE,MAAM;gBACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CACzB,MAAmB,EACnB,IAAiB,EACjB,SAA2B;IAE3B,eAAe;IACf,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,0BAA0B;IAC1B,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,MAAM,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;QACxB,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,GAAG;KAChB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,kBAAkB,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACnH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;IAEpE,4CAA4C;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAE/B,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAE/C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;gBAC7F,IAAI,YAAY;oBAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC5B,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAChH,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACtC,qDAAqD;gBACrD,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,gCAAgC;IAChC,MAAM,WAAW,GAAG,2BAA2B,CAAC;IAChD,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAmB;gBACvD,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAmB;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBAClC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,aAAa,EAAE,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/cli/agent/permissions.d.ts

@@ -0,0 +1,65 @@
+import * as readline from 'node:readline';
+import type { ToolPermissionRequest } from '../brain/control-protocol.js';
+export type PermissionLevel = 'auto' | 'ask' | 'dangerous';
+interface RemoteHandlerOpts {
+    onRequest: (req: ToolPermissionRequest) => void;
+    onReminder: (req: ToolPermissionRequest) => void;
+    onResolved: (requestId: string, approved: boolean, deniedBy?: 'user' | 'system_timeout') => void;
+}
+export declare class PermissionManager {
+    private yoloMode;
+    private skipPermissionsMode;
+    private _planMode;
+    private rl;
+    private onPromptActive?;
+    private pendingRemote;
+    private remoteHandler;
+    private useSelectMenu;
+    setReadline(rl: readline.Interface): void;
+    /** Callback to suppress statusbar while permission prompt is active */
+    setPromptCallback(cb: (active: boolean) => void): void;
+    setYolo(enabled: boolean): void;
+    isYolo(): boolean;
+    setSkipPermissions(enabled: boolean): void;
+    isSkipPermissions(): boolean;
+    /** Enable/disable select menu mode (Enterprise feature) */
+    setSelectMenuMode(enabled: boolean): void;
+    /** Enable/disable plan mode (read-only — blocks write/execute tools) */
+    setPlanMode(enabled: boolean): void;
+    isPlanMode(): boolean;
+    /** Get the current mode label for display */
+    getModeLabel(): 'safe' | 'skip' | 'yolo' | 'plan';
+    /** Register remote approval handler (Brain server, Telegram, etc.) */
+    setRemoteHandler(opts: RemoteHandlerOpts): void;
+    /** Resolve a pending remote permission request (called from WebSocket/Telegram handler) */
+    resolveRemote(requestId: string, approved: boolean, deniedBy?: 'user' | 'system_timeout'): void;
+    /** Clean up all pending remote requests (e.g. on session end) */
+    clearPending(): void;
+    /**
+     * Check permission for external path access.
+     * Always treated as 'dangerous' level — user MUST confirm.
+     * Only YOLO mode auto-allows; skip-permissions still prompts.
+     */
+    checkExternalAccess(toolName: string, externalPath: string, input: Record<string, unknown>, displayFn: (msg: string) => void): Promise<boolean>;
+    /**
+     * Check if a tool call is allowed.
+     * Returns true if allowed, false if denied.
+     */
+    check(toolName: string, input: Record<string, unknown>, displayFn: (msg: string) => void): Promise<boolean>;
+    private promptUser;
+    /**
+     * Enterprise: Show permission prompt as select menu
+     * This is the main improvement - no text input required!
+     */
+    private promptWithSelectMenu;
+    /** Handle local readline input and return approval boolean */
+    private askLocal;
+    /** Ask a single question via readline, suppressing statusbar during input */
+    private ask;
+    /** Format a human-readable description of what a tool call does (with ANSI colors) */
+    private formatToolDetail;
+    /** Format a plain-text description (no ANSI) for remote channels (Telegram, Web) */
+    formatToolDetailPlain(name: string, input: Record<string, unknown>): string;
+}
+export {};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/cli/agent/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/cli/agent/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAG1C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAI1E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;AA8C3D,UAAU,iBAAiB;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAChD,UAAU,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,IAAI,CAAC;IACjD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,KAAK,IAAI,CAAC;CAClG;AAQD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,EAAE,CAAmC;IAC7C,OAAO,CAAC,cAAc,CAAC,CAA4B;IAGnD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,aAAa,CAAkC;IAGvD,OAAO,CAAC,aAAa,CAAQ;IAE7B,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI;IAIzC,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAItD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI/B,MAAM,IAAI,OAAO;IAIjB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAI1C,iBAAiB,IAAI,OAAO;IAI5B,2DAA2D;IAC3D,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIzC,wEAAwE;IACxE,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAInC,UAAU,IAAI,OAAO;IAIrB,6CAA6C;IAC7C,YAAY,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM;IAOjD,sEAAsE;IACtE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI;IAI/C,2FAA2F;IAC3F,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAM,GAAG,gBAAyB,GAAG,IAAI;IAavG,iEAAiE;IACjE,YAAY,IAAI,IAAI;IASpB;;;;OAIG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC;IAUnB;;;OAGG;IACG,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC;YAmCL,UAAU;IA+GxB;;;OAGG;YACW,oBAAoB;IAqElC,8DAA8D;YAChD,QAAQ;IA4CtB,6EAA6E;IAC7E,OAAO,CAAC,GAAG;IAUX,sFAAsF;IACtF,OAAO,CAAC,gBAAgB;IAoCxB,oFAAoF;IACpF,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;CAmC5E"}