hyperclaw 5.0.0 → 5.0.2

package/dist/osint-B6BZKQAD.js

@@ -0,0 +1,277 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const chalk = require_chunk.__toESM(require("chalk"));
+const inquirer = require_chunk.__toESM(require("inquirer"));
+const ora = require_chunk.__toESM(require("ora"));
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+
+//#region src/commands/osint.ts
+const HC_DIR = path.default.join(os.default.homedir(), ".hyperclaw");
+const CONFIG_FILE = path.default.join(HC_DIR, "hyperclaw.json");
+const OSINT_PROFILE_FILE = path.default.join(HC_DIR, "osint-profile.json");
+const MODE_DESCRIPTIONS = {
+	recon: "Passive reconnaissance — WHOIS, DNS, subdomains, public info gathering",
+	bugbounty: "Bug bounty workflow — target scope, vulnerability research, report drafting",
+	pentest: "Penetration testing — active recon, service enumeration, exploit research",
+	footprint: "Digital footprint — social media, email leaks, username tracking",
+	custom: "Custom — configure your own tools and system prompt"
+};
+const MODE_SYSTEM_PROMPTS = {
+	recon: `You are a professional OSINT analyst specializing in passive reconnaissance.
+Your goal is to gather publicly available information about the target without triggering detection.
+Use DNS lookups, WHOIS data, web scraping, and public databases.
+Always cite sources and stay within legal boundaries.
+Never attempt active exploitation — only passive information gathering.`,
+	bugbounty: `You are an experienced bug bounty hunter working within an authorized scope.
+Your goal is to identify security vulnerabilities in web applications and infrastructure.
+Follow responsible disclosure principles. Report findings clearly with reproduction steps.
+Focus on: XSS, SQLi, SSRF, authentication issues, business logic flaws, IDOR.
+Use tools methodically. Document everything for your report.`,
+	pentest: `You are a professional penetration tester with explicit written authorization.
+Conduct a thorough security assessment following the PTES methodology.
+Phases: Intelligence Gathering → Scanning → Exploitation → Post-Exploitation → Reporting.
+Document all findings with CVSS scores. Stay within defined scope at all times.
+Never exfiltrate real data — only demonstrate access.`,
+	footprint: `You are a digital forensics investigator mapping a target's online presence.
+Your goal is to build a comprehensive profile using only public sources.
+Search social media, data breach databases (HaveIBeenPwned, Dehashed), LinkedIn, GitHub.
+Create a timeline of online activity. Identify connected accounts, email patterns, usernames.
+This is for defensive intelligence gathering and authorized investigations only.`,
+	custom: `You are a security researcher with access to OSINT and analysis tools.
+Use available tools to assist with the research task.`
+};
+const MODE_MCP_SERVERS = {
+	recon: ["mcp-browser", "mcp-filesystem"],
+	bugbounty: [
+		"mcp-browser",
+		"mcp-filesystem",
+		"mcp-github"
+	],
+	pentest: [
+		"mcp-browser",
+		"mcp-filesystem",
+		"mcp-terminal",
+		"mcp-github"
+	],
+	footprint: ["mcp-browser", "mcp-filesystem"],
+	custom: ["mcp-browser", "mcp-filesystem"]
+};
+function printBanner() {
+	console.log();
+	console.log(chalk.default.red.bold("  ██████╗ ███████╗██╗███╗   ██╗████████╗"));
+	console.log(chalk.default.red.bold("  ██╔═══██╗██╔════╝██║████╗  ██║╚══██╔══╝"));
+	console.log(chalk.default.yellow.bold("  ██║   ██║███████╗██║██╔██╗ ██║   ██║   "));
+	console.log(chalk.default.yellow.bold("  ██║   ██║╚════██║██║██║╚██╗██║   ██║   "));
+	console.log(chalk.default.red.bold("  ╚██████╔╝███████║██║██║ ╚████║   ██║   "));
+	console.log(chalk.default.red.bold("   ╚═════╝ ╚══════╝╚═╝╚═╝  ╚═══╝   ╚═╝   "));
+	console.log();
+	console.log(chalk.default.gray("  HyperClaw OSINT / Ethical Hacking Mode"));
+	console.log(chalk.default.gray("  ────────────────────────────────────────────"));
+	console.log(chalk.default.yellow("  ⚠️  For authorized security research only."));
+	console.log(chalk.default.yellow("  ⚠️  Always have explicit written permission."));
+	console.log();
+}
+async function osintSetup(options) {
+	printBanner();
+	if (options.show) {
+		try {
+			const profile$1 = await fs_extra.default.readJson(OSINT_PROFILE_FILE);
+			console.log(chalk.default.cyan.bold("  Current OSINT Profile:\n"));
+			console.log(`  Mode:    ${chalk.default.yellow(profile$1.mode)}`);
+			console.log(`  Target:  ${chalk.default.white(profile$1.target || "(not set)")}`);
+			console.log(`  Type:    ${profile$1.targetType || "N/A"}`);
+			console.log(`  MCP:     ${profile$1.mcpServers.join(", ")}`);
+			console.log(`  Created: ${profile$1.createdAt}`);
+			if (profile$1.notes) console.log(`  Notes:   ${profile$1.notes}`);
+			console.log();
+		} catch {
+			console.log(chalk.default.gray("  No OSINT profile saved yet. Run: hyperclaw osint setup\n"));
+		}
+		return;
+	}
+	if (options.reset) {
+		await fs_extra.default.remove(OSINT_PROFILE_FILE);
+		console.log(chalk.default.green("  ✔  OSINT profile cleared.\n"));
+		return;
+	}
+	console.log(chalk.default.bold("  Select OSINT workflow:\n"));
+	for (const [mode$1, desc] of Object.entries(MODE_DESCRIPTIONS)) console.log(`  ${chalk.default.cyan(mode$1.padEnd(12))} ${chalk.default.gray(desc)}`);
+	console.log();
+	const { mode } = await inquirer.default.prompt([{
+		type: "list",
+		name: "mode",
+		message: "Workflow:",
+		choices: Object.keys(MODE_DESCRIPTIONS).map((m) => ({
+			name: `${m.padEnd(12)} — ${MODE_DESCRIPTIONS[m]}`,
+			value: m
+		})),
+		default: options.mode || "recon"
+	}]);
+	const { hasTarget } = await inquirer.default.prompt([{
+		type: "confirm",
+		name: "hasTarget",
+		message: "Set a target for this session?",
+		default: true
+	}]);
+	let target;
+	let targetType;
+	if (hasTarget) {
+		const resp = await inquirer.default.prompt([{
+			type: "list",
+			name: "targetType",
+			message: "Target type:",
+			choices: [
+				"domain",
+				"ip",
+				"username",
+				"email",
+				"org",
+				"custom"
+			]
+		}, {
+			type: "input",
+			name: "target",
+			message: "Target value (e.g. example.com):",
+			validate: (v) => v.trim().length > 0 || "Required"
+		}]);
+		target = resp.target.trim();
+		targetType = resp.targetType;
+	}
+	const { notes } = await inquirer.default.prompt([{
+		type: "input",
+		name: "notes",
+		message: "Session notes (optional, e.g. \"HackerOne program XYZ\"):"
+	}]);
+	console.log();
+	const { confirmed } = await inquirer.default.prompt([{
+		type: "confirm",
+		name: "confirmed",
+		message: chalk.default.yellow("I confirm I have explicit written authorization to test this target."),
+		default: false
+	}]);
+	if (!confirmed) {
+		console.log(chalk.default.red("\n  Aborted. OSINT mode requires authorization confirmation.\n"));
+		return;
+	}
+	const spinner = (0, ora.default)("Applying OSINT configuration...").start();
+	const mcpServers = MODE_MCP_SERVERS[mode];
+	const systemPrompt = MODE_SYSTEM_PROMPTS[mode];
+	const profile = {
+		mode,
+		target,
+		targetType,
+		notes: notes || void 0,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		mcpServers,
+		systemPromptOverride: systemPrompt
+	};
+	await fs_extra.default.ensureDir(HC_DIR);
+	await fs_extra.default.writeJson(OSINT_PROFILE_FILE, profile, { spaces: 2 });
+	let config = {};
+	try {
+		config = await fs_extra.default.readJson(CONFIG_FILE);
+	} catch {}
+	if (!config.agent) config.agent = {};
+	const agent = config.agent;
+	agent.systemPromptOverride = systemPrompt;
+	agent.osintMode = mode;
+	if (target) agent.osintTarget = `${targetType}: ${target}`;
+	const mcpFile = path.default.join(HC_DIR, "mcp-servers.json");
+	let mcpServersJson = [];
+	try {
+		mcpServersJson = await fs_extra.default.readJson(mcpFile);
+	} catch {}
+	const extensionsDir = path.default.join(path.default.dirname(CONFIG_FILE), "..", "..");
+	const serverDefs = {
+		"mcp-filesystem": {
+			command: `node ${path.default.join(process.cwd(), "extensions/mcp-filesystem/server.mjs")}`,
+			label: "Filesystem (OSINT)"
+		},
+		"mcp-browser": {
+			command: `node ${path.default.join(process.cwd(), "extensions/mcp-browser/server.mjs")}`,
+			label: "Browser/Web (OSINT)"
+		},
+		"mcp-terminal": {
+			command: `node ${path.default.join(process.cwd(), "extensions/mcp-terminal/server.mjs")}`,
+			label: "Terminal (OSINT)"
+		},
+		"mcp-github": {
+			command: `node ${path.default.join(process.cwd(), "extensions/mcp-github/server.mjs")}`,
+			label: "GitHub (OSINT)"
+		}
+	};
+	for (const serverId of mcpServers) {
+		const already = mcpServersJson.find((s) => s.id === serverId);
+		if (!already && serverDefs[serverId]) mcpServersJson.push({
+			id: serverId,
+			name: serverDefs[serverId].label,
+			transport: "stdio",
+			command: serverDefs[serverId].command,
+			enabled: true,
+			addedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		else if (already) already.enabled = true;
+	}
+	await fs_extra.default.ensureDir(path.default.dirname(mcpFile));
+	await fs_extra.default.writeJson(mcpFile, mcpServersJson, { spaces: 2 });
+	await fs_extra.default.writeJson(CONFIG_FILE, config, { spaces: 2 });
+	spinner.succeed("OSINT configuration applied");
+	console.log();
+	console.log(chalk.default.bold.cyan("  ✔  HyperClaw is now in OSINT mode:\n"));
+	console.log(`  Workflow: ${chalk.default.yellow(mode)}`);
+	if (target) console.log(`  Target:   ${chalk.default.white(target)} ${chalk.default.gray(`(${targetType})`)}`);
+	console.log(`  MCP:      ${chalk.default.cyan(mcpServers.join(", "))}`);
+	console.log();
+	console.log(chalk.default.bold("  Start your session:"));
+	console.log(`  ${chalk.default.cyan("hyperclaw daemon start")}           — start the assistant`);
+	console.log(`  ${chalk.default.cyan("hyperclaw agent --message \"...\"")} — send a message from CLI`);
+	console.log();
+	console.log(chalk.default.bold("  Example prompts:"));
+	if (mode === "recon" && target) {
+		console.log(chalk.default.gray(`  "Perform passive recon on ${target}: WHOIS, DNS, subdomains"`));
+		console.log(chalk.default.gray(`  "Find all public GitHub repos for ${target}"`));
+		console.log(chalk.default.gray(`  "Search for email addresses associated with ${target}"`));
+	} else if (mode === "bugbounty") {
+		console.log(chalk.default.gray(`  "What are common vulnerabilities in web login forms?"`));
+		console.log(chalk.default.gray(`  "Draft a bug bounty report for an XSS vulnerability"`));
+		console.log(chalk.default.gray(`  "Help me test for SSRF on the /api/fetch endpoint"`));
+	} else if (mode === "pentest") {
+		console.log(chalk.default.gray(`  "Create a pentest report template for a web application"`));
+		console.log(chalk.default.gray(`  "What ports should I check on a Linux server?"`));
+		console.log(chalk.default.gray(`  "Explain how to test for SQLi safely in a controlled environment"`));
+	} else if (mode === "footprint") {
+		console.log(chalk.default.gray(`  "Search for the digital footprint of the username 'target_user'"`));
+		console.log(chalk.default.gray(`  "Check HaveIBeenPwned for emails from domain example.com"`));
+	}
+	console.log();
+	console.log(chalk.default.gray("  To view profile: hyperclaw osint --show"));
+	console.log(chalk.default.gray("  To reset:        hyperclaw osint --reset"));
+	console.log();
+}
+async function osintQuickStart(mode) {
+	printBanner();
+	console.log(chalk.default.bold("  Available OSINT workflows:\n"));
+	for (const [m, desc] of Object.entries(MODE_DESCRIPTIONS)) {
+		const isActive = m === mode;
+		const bullet = isActive ? chalk.default.green("▶") : chalk.default.gray("○");
+		console.log(`  ${bullet} ${chalk.default.cyan(m.padEnd(12))} ${chalk.default.white(desc)}`);
+	}
+	console.log();
+	console.log(chalk.default.bold("  Commands:\n"));
+	console.log(`  ${chalk.default.cyan("hyperclaw osint setup")}           — interactive OSINT session setup`);
+	console.log(`  ${chalk.default.cyan("hyperclaw osint --show")}          — show current profile`);
+	console.log(`  ${chalk.default.cyan("hyperclaw osint --reset")}         — clear OSINT profile`);
+	console.log();
+	console.log(chalk.default.bold("  MCP servers for OSINT:\n"));
+	console.log(`  ${chalk.default.cyan("mcp-browser")}    — web_fetch, web_search, dns_lookup, whois_lookup, extract_links`);
+	console.log(`  ${chalk.default.cyan("mcp-filesystem")} — read_file, write_file, search_files (for saving reports)`);
+	console.log(`  ${chalk.default.cyan("mcp-github")}     — list_repos, search_code, get_file`);
+	console.log(`  ${chalk.default.cyan("mcp-terminal")}   — run_command (pentest mode only, requires authorization)`);
+	console.log();
+	console.log(chalk.default.yellow("  ⚠️  Always operate within authorized scope and applicable laws.\n"));
+}
+
+//#endregion
+exports.osintQuickStart = osintQuickStart;
+exports.osintSetup = osintSetup;

package/dist/pairing-B6RArWhD.js

@@ -0,0 +1,196 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const chalk = require_chunk.__toESM(require("chalk"));
+const fs_extra = require_chunk.__toESM(require("fs-extra"));
+const path = require_chunk.__toESM(require("path"));
+const os = require_chunk.__toESM(require("os"));
+const crypto = require_chunk.__toESM(require("crypto"));
+
+//#region src/channels/pairing.ts
+const CREDENTIALS_DIR = path.default.join(os.default.homedir(), ".hyperclaw", "credentials");
+const CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+const CODE_LENGTH = 8;
+const EXPIRY_MS = 60 * 60 * 1e3;
+const MAX_PENDING_PER_CHANNEL = 3;
+function generateCode() {
+	const bytes = crypto.default.randomBytes(CODE_LENGTH);
+	return Array.from(bytes).map((b) => CODE_ALPHABET[b % CODE_ALPHABET.length]).join("");
+}
+function pendingFile(channelId) {
+	return path.default.join(CREDENTIALS_DIR, `${channelId}-pairing.json`);
+}
+function allowFromFile(channelId, accountId = "default") {
+	const suffix = accountId === "default" ? "" : `-${accountId}`;
+	return path.default.join(CREDENTIALS_DIR, `${channelId}${suffix}-allowFrom.json`);
+}
+async function readPending(channelId) {
+	try {
+		const data = await fs_extra.default.readJson(pendingFile(channelId));
+		return Array.isArray(data) ? data : [];
+	} catch {
+		return [];
+	}
+}
+async function writePending(channelId, entries) {
+	await fs_extra.default.ensureDir(CREDENTIALS_DIR);
+	await fs_extra.default.writeJson(pendingFile(channelId), entries, {
+		spaces: 2,
+		mode: 384
+	});
+}
+async function readAllowFrom(channelId, accountId = "default") {
+	try {
+		return await fs_extra.default.readJson(allowFromFile(channelId, accountId));
+	} catch {
+		return {
+			senderIds: [],
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+	}
+}
+async function writeAllowFrom(channelId, store, accountId = "default") {
+	await fs_extra.default.ensureDir(CREDENTIALS_DIR);
+	await fs_extra.default.writeJson(allowFromFile(channelId, accountId), store, {
+		spaces: 2,
+		mode: 384
+	});
+}
+var PairingStore = class {
+	channelId;
+	accountId;
+	constructor(channelId, accountId = "default") {
+		this.channelId = channelId;
+		this.accountId = accountId;
+	}
+	async isApproved(senderId) {
+		const store = await readAllowFrom(this.channelId, this.accountId);
+		return store.senderIds.includes(senderId);
+	}
+	/**
+	* Returns the pairing code to send to the user, or null if already pending
+	* (code is resent only once per hour per sender).
+	*/
+	async createRequest(senderId) {
+		const now = Date.now();
+		const entries = (await readPending(this.channelId)).filter((e) => {
+			return new Date(e.expiresAt).getTime() > now;
+		});
+		const existing = entries.find((e) => e.senderId === senderId && e.channelId === this.channelId);
+		if (existing) return existing.code;
+		const channelPending = entries.filter((e) => e.channelId === this.channelId && e.accountId === this.accountId);
+		if (channelPending.length >= MAX_PENDING_PER_CHANNEL) return null;
+		const code = generateCode();
+		const entry = {
+			code,
+			channelId: this.channelId,
+			accountId: this.accountId,
+			senderId,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			expiresAt: new Date(now + EXPIRY_MS).toISOString()
+		};
+		entries.push(entry);
+		await writePending(this.channelId, entries);
+		return code;
+	}
+	/**
+	* Called when a sender submits a code.
+	* Returns true if the code was valid and the sender is now approved.
+	*/
+	async verify(code, senderId) {
+		const now = Date.now();
+		const entries = await readPending(this.channelId);
+		const idx = entries.findIndex((e) => e.code === code.toUpperCase() && e.channelId === this.channelId && e.accountId === this.accountId && new Date(e.expiresAt).getTime() > now);
+		if (idx === -1) return false;
+		const entry = entries[idx];
+		entries.splice(idx, 1);
+		await writePending(this.channelId, entries);
+		const store = await readAllowFrom(this.channelId, this.accountId);
+		if (!store.senderIds.includes(entry.senderId)) store.senderIds.push(entry.senderId);
+		store.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await writeAllowFrom(this.channelId, store, this.accountId);
+		return true;
+	}
+	async listPending() {
+		const now = Date.now();
+		const entries = await readPending(this.channelId);
+		return entries.filter((e) => e.channelId === this.channelId && e.accountId === this.accountId && new Date(e.expiresAt).getTime() > now);
+	}
+	async cliApprove(code) {
+		const now = Date.now();
+		const entries = await readPending(this.channelId);
+		const idx = entries.findIndex((e) => e.code === code.toUpperCase() && e.channelId === this.channelId && e.accountId === this.accountId && new Date(e.expiresAt).getTime() > now);
+		if (idx === -1) return false;
+		const entry = entries[idx];
+		entries.splice(idx, 1);
+		await writePending(this.channelId, entries);
+		const store = await readAllowFrom(this.channelId, this.accountId);
+		if (!store.senderIds.includes(entry.senderId)) store.senderIds.push(entry.senderId);
+		store.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await writeAllowFrom(this.channelId, store, this.accountId);
+		return true;
+	}
+};
+const SUPPORTED_CHANNELS = [
+	"telegram",
+	"whatsapp",
+	"signal",
+	"imessage",
+	"discord",
+	"slack",
+	"feishu"
+];
+var GlobalPairingManager = class {
+	async showList(channelFilter) {
+		const now = Date.now();
+		const channels = channelFilter ? [channelFilter] : SUPPORTED_CHANNELS;
+		console.log(chalk.default.bold.cyan("\n  🔑 PAIRING CODES\n"));
+		let total = 0;
+		for (const ch of channels) {
+			let pending = [];
+			try {
+				const raw = await readPending(ch);
+				pending = raw.filter((e) => new Date(e.expiresAt).getTime() > now);
+			} catch {}
+			if (pending.length === 0) continue;
+			total += pending.length;
+			console.log(chalk.default.yellow(`  ─── ${ch} ───`));
+			for (const e of pending) {
+				const expiresIn = Math.round((new Date(e.expiresAt).getTime() - now) / 6e4);
+				const acctSuffix = e.accountId !== "default" ? chalk.default.gray(` [${e.accountId}]`) : "";
+				console.log(`  ${chalk.default.yellow("○")} ${chalk.default.bold(e.code)}  sender: ${chalk.default.white(e.senderId)}${acctSuffix}  expires: ${chalk.default.gray(`${expiresIn}m`)}`);
+			}
+			console.log();
+		}
+		if (total === 0) console.log(chalk.default.gray(`  No pending pairing requests${channelFilter ? ` for ${channelFilter}` : ""}.\n`));
+	}
+	async cliApprove(channelId, code, accountId = "default") {
+		if (!SUPPORTED_CHANNELS.includes(channelId)) {
+			console.log(chalk.default.red(`\n  ✖  Unknown channel: ${channelId}`));
+			console.log(chalk.default.gray(`     Supported: ${SUPPORTED_CHANNELS.join(", ")}\n`));
+			return;
+		}
+		const store = new PairingStore(channelId, accountId);
+		const ok = await store.cliApprove(code);
+		if (ok) {
+			console.log(chalk.default.green(`\n  ✔  Pairing approved — ${channelId} code ${code.toUpperCase()}`));
+			console.log(chalk.default.gray(`  Sender added to ${channelId}${accountId !== "default" ? `-${accountId}` : ""}-allowFrom.json\n`));
+		} else console.log(chalk.default.red(`\n  ✖  Code not found, expired, or already used: ${channelId} ${code.toUpperCase()}\n`));
+	}
+	async getApprovedSenders(channelId, accountId = "default") {
+		const store = await readAllowFrom(channelId, accountId);
+		return store.senderIds;
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'GlobalPairingManager', {
+  enumerable: true,
+  get: function () {
+    return GlobalPairingManager;
+  }
+});
+Object.defineProperty(exports, 'PairingStore', {
+  enumerable: true,
+  get: function () {
+    return PairingStore;
+  }
+});

package/dist/pairing-BsQ08DLq.js

@@ -0,0 +1,4 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const require_pairing = require('./pairing-B6RArWhD.js');
+
+exports.PairingStore = require_pairing.PairingStore;