neuralos 3.9.4 → 3.9.6

package/plugins/netdata-rterm/netdata-rterm.extreme.spec.ts

@@ -1,252 +0,0 @@
-import {
-  parseNetdataAlert, mapSeverity, buildFingerprint, toTriggerEvent, correlateWithRterm, register,
-} from './index.mjs'
-
-const cases: Array<{ name: string; run: () => void | Promise<void> }> = []
-function test(n: string, r: () => void | Promise<void>) { cases.push({ name: n, run: r }) }
-
-// ---- parseNetdataAlert ----
-test('parse: alert notification with all fields', () => {
-  const payload = {
-    message: 'CPU usage is 95%', alert: 'cpu_usage', info: 'CPU utilization too high',
-    chart: 'system.cpu', context: 'system.cpu', space: 'prod-cluster', family: 'cpu',
-    class: 'Error', severity: 'critical', date: '2026-07-22T10:00:00Z', duration: '5m',
-    additional_active_critical_alerts: 2, additional_active_warning_alerts: 1,
-    alert_url: 'https://app.netdata.cloud/alert/123',
-  }
-  const p = parseNetdataAlert(payload)
-  if (!p || p.kind !== 'alert') throw new Error('should parse alert')
-  if (p.alert !== 'cpu_usage') throw new Error('alert name')
-  if (p.severity !== 'critical') throw new Error('severity')
-  if (p.chart !== 'system.cpu') throw new Error('chart')
-  if (p.additionalCritical !== 2) throw new Error('additional critical')
-  if (p.host !== 'prod-cluster') throw new Error('host from space')
-  if (p.alertUrl !== 'https://app.netdata.cloud/alert/123') throw new Error('alert url')
-})
-
-test('parse: warning severity', () => {
-  const p = parseNetdataAlert({ alert: 'disk_space', severity: 'warning', message: 'Disk 80% full', space: 'web-01' })
-  if (!p || p.severity !== 'warning') throw new Error('should be warning')
-})
-
-test('parse: clear severity (alert resolved)', () => {
-  const p = parseNetdataAlert({ alert: 'cpu_usage', severity: 'clear', message: 'CPU back to normal', space: 'web-01' })
-  if (!p || p.severity !== 'clear') throw new Error('should be clear')
-})
-
-test('parse: reachability notification (node down)', () => {
-  const p = parseNetdataAlert({ message: 'Node unreachable', node: 'web-02', space: 'prod', status: 'down', date: '2026-07-22T10:00:00Z', duration: '2m' })
-  if (!p || p.kind !== 'reachability') throw new Error('should parse reachability')
-  if (p.status !== 'down') throw new Error('status')
-  if (p.host !== 'web-02') throw new Error('host from node')
-})
-
-test('parse: reachability notification (node up)', () => {
-  const p = parseNetdataAlert({ node: 'web-02', status: 'up', date: '2026-07-22T10:05:00Z' })
-  if (!p || p.status !== 'up') throw new Error('should be up')
-})
-
-test('parse: null for invalid payload', () => {
-  if (parseNetdataAlert(null) !== null) throw new Error('null payload')
-  if (parseNetdataAlert({}) !== null) throw new Error('empty object')
-  if (parseNetdataAlert('not an object') !== null) throw new Error('string')
-  if (parseNetdataAlert({ foo: 'bar' }) !== null) throw new Error('missing required fields')
-})
-
-// ---- mapSeverity ----
-test('mapSeverity: critical -> critical', () => {
-  if (mapSeverity('critical') !== 'critical') throw new Error('critical')
-})
-test('mapSeverity: warning -> warning', () => {
-  if (mapSeverity('warning') !== 'warning') throw new Error('warning')
-})
-test('mapSeverity: clear -> info', () => {
-  if (mapSeverity('clear') !== 'info') throw new Error('clear should map to info')
-})
-test('mapSeverity: unknown -> info', () => {
-  if (mapSeverity('unknown') !== 'info') throw new Error('unknown')
-})
-
-// ---- buildFingerprint ----
-test('buildFingerprint: alert fingerprint', () => {
-  const p = parseNetdataAlert({ alert: 'cpu_usage', severity: 'critical', space: 'web-01' })
-  const fp = buildFingerprint(p)
-  if (fp !== 'netdata:web-01:cpu_usage:critical') throw new Error(`got ${fp}`)
-})
-test('buildFingerprint: reachability fingerprint', () => {
-  const p = parseNetdataAlert({ node: 'web-02', status: 'down' })
-  const fp = buildFingerprint(p)
-  if (fp !== 'netdata:reachability:web-02:down') throw new Error(`got ${fp}`)
-})
-test('buildFingerprint: empty for null', () => {
-  if (buildFingerprint(null) !== '') throw new Error('should be empty')
-})
-
-// ---- toTriggerEvent ----
-test('toTriggerEvent: alert -> trigger event with correct severity', () => {
-  const p = parseNetdataAlert({ alert: 'disk_full', severity: 'critical', space: 'db-01', message: 'Disk 95%', date: '2026-07-22T10:00:00Z' })
-  const evt = toTriggerEvent(p)
-  if (!evt) throw new Error('should produce event')
-  if (evt.source !== 'netdata') throw new Error('source')
-  if (evt.severity !== 'critical') throw new Error('severity')
-  if (!evt.title.includes('disk_full')) throw new Error('title')
-  if (!evt.title.includes('db-01')) throw new Error('title host')
-  if (evt.labels.host !== 'db-01') throw new Error('labels host')
-  if (evt.labels.alert !== 'disk_full') throw new Error('labels alert')
-})
-
-test('toTriggerEvent: reachability down -> critical', () => {
-  const p = parseNetdataAlert({ node: 'web-03', status: 'down', date: '2026-07-22T10:00:00Z' })
-  const evt = toTriggerEvent(p)
-  if (!evt || evt.severity !== 'critical') throw new Error('down should be critical')
-  if (!evt.title.includes('DOWN')) throw new Error('title')
-})
-
-test('toTriggerEvent: reachability up -> info', () => {
-  const p = parseNetdataAlert({ node: 'web-03', status: 'up', date: '2026-07-22T10:00:00Z' })
-  const evt = toTriggerEvent(p)
-  if (!evt || evt.severity !== 'info') throw new Error('up should be info')
-})
-
-test('toTriggerEvent: null parsed -> null event', () => {
-  if (toTriggerEvent(null) !== null) throw new Error('should be null')
-})
-
-// ---- correlateWithRterm ----
-test('correlate: with metrics + incidents', () => {
-  const p = parseNetdataAlert({ alert: 'cpu_usage', severity: 'critical', space: 'web-01', additional_active_critical_alerts: 3 })
-  const mockMetrics = { snapshot: (host: string) => ({ host, cpuUsagePercent: 95, memoryUsagePercent: 70 }) }
-  const mockIncidents = { list: () => [
-    { title: 'web-01 disk full', affected: ['web-01'], status: 'open' },
-    { title: 'web-02 network issue', affected: ['web-02'], status: 'open' },
-    { title: 'web-01 resolved issue', affected: ['web-01'], status: 'resolved' },
-  ] }
-  const result = correlateWithRterm(p, mockMetrics as any, mockIncidents as any)
-  if (!result.recentMetrics || result.recentMetrics.cpuUsagePercent !== 95) throw new Error('metrics')
-  if (result.openIncidents.length !== 1) throw new Error(`expected 1 open incident, got ${result.openIncidents.length}`)
-  if (!result.correlation.includes('cpu_usage')) throw new Error('correlation should mention alert')
-  if (!result.correlation.includes('disk full')) throw new Error('correlation should mention incident')
-  if (!result.correlation.includes('3 additional critical')) throw new Error('correlation should mention additional alerts')
-})
-
-test('correlate: no prior context', () => {
-  const p = parseNetdataAlert({ alert: 'mem_usage', severity: 'warning', space: 'new-host' })
-  const result = correlateWithRterm(p, null, null)
-  if (result.recentMetrics !== null) throw new Error('no metrics')
-  if (result.openIncidents.length !== 0) throw new Error('no incidents')
-  if (!result.correlation.includes('No prior RTerm context')) throw new Error('should say no context')
-})
-
-test('correlate: null parsed -> empty', () => {
-  const result = correlateWithRterm(null, null, null)
-  if (result.recentMetrics !== null || result.openIncidents.length !== 0) throw new Error('should be empty')
-})
-
-// ---- register (plugin lifecycle) ----
-test('register: registers 2 tools, 2 triggers, 1 panel', () => {
-  const tools: any[] = [], triggers: any[] = [], panels: any[] = [], logs: string[] = []
-  register({
-    registerTool: (t) => tools.push(t),
-    registerTrigger: (t) => triggers.push(t),
-    registerPanel: (p) => panels.push(p),
-    exec: async () => '',
-    readLedger: () => ({}),
-    log: (line: string) => logs.push(line),
-  } as any)
-  if (tools.length !== 2) throw new Error(`expected 2 tools, got ${tools.length}`)
-  if (triggers.length !== 2) throw new Error(`expected 2 triggers, got ${triggers.length}`)
-  if (panels.length !== 1) throw new Error(`expected 1 panel, got ${panels.length}`)
-  if (!tools.some((t) => t.name === 'netdata_alert_summary')) throw new Error('missing alert_summary tool')
-  if (!tools.some((t) => t.name === 'netdata_correlate')) throw new Error('missing correlate tool')
-  if (!triggers.some((t) => t.name === 'netdata_critical_alert')) throw new Error('missing critical trigger')
-  if (!triggers.some((t) => t.name === 'netdata_warning_alert')) throw new Error('missing warning trigger')
-  if (!panels.some((p) => p.name === 'netdata-alert-feed')) throw new Error('missing alert feed panel')
-  if (!logs.some((l) => l.includes('registered'))) throw new Error('should log registration')
-})
-
-test('register: critical trigger matches critical events only', () => {
-  const triggers: any[] = []
-  register({
-    registerTool: () => {}, registerTrigger: (t) => triggers.push(t), registerPanel: () => {},
-    exec: async () => '', readLedger: () => ({}), log: () => {},
-  } as any)
-  const critTrigger = triggers.find((t) => t.name === 'netdata_critical_alert')
-  if (!critTrigger) throw new Error('missing critical trigger')
-  if (!critTrigger.match({ source: 'netdata', severity: 'critical' })) throw new Error('should match critical')
-  if (critTrigger.match({ source: 'netdata', severity: 'warning' })) throw new Error('should NOT match warning')
-  if (critTrigger.match({ source: 'other', severity: 'critical' })) throw new Error('should NOT match non-netdata')
-  if (critTrigger.match({})) throw new Error('should NOT match empty')
-})
-
-test('register: warning trigger matches warning events only', () => {
-  const triggers: any[] = []
-  register({
-    registerTool: () => {}, registerTrigger: (t) => triggers.push(t), registerPanel: () => {},
-    exec: async () => '', readLedger: () => ({}), log: () => {},
-  } as any)
-  const warnTrigger = triggers.find((t) => t.name === 'netdata_warning_alert')
-  if (!warnTrigger) throw new Error('missing warning trigger')
-  if (!warnTrigger.match({ source: 'netdata', severity: 'warning' })) throw new Error('should match warning')
-  if (warnTrigger.match({ source: 'netdata', severity: 'critical' })) throw new Error('should NOT match critical')
-})
-
-test('register: panel renders alert rows', () => {
-  const panels: any[] = []
-  register({
-    registerTool: () => {}, registerTrigger: () => {}, registerPanel: (p) => panels.push(p),
-    exec: async () => '', readLedger: () => ({}), log: () => {},
-  } as any)
-  const panel = panels[0]
-  const html = panel.render([
-    { host: 'web-01', alert: 'cpu_high', severity: 'critical', date: '2026-07-22' },
-    { host: 'web-02', alert: 'disk_full', severity: 'warning', date: '2026-07-22' },
-  ])
-  if (!html.includes('cpu_high') || !html.includes('disk_full')) throw new Error('should contain alert names')
-  if (!html.includes('<table>')) throw new Error('should render table')
-})
-
-test('register: panel renders empty feed', () => {
-  const panels: any[] = []
-  register({
-    registerTool: () => {}, registerTrigger: () => {}, registerPanel: (p) => panels.push(p),
-    exec: async () => '', readLedger: () => ({}), log: () => {},
-  } as any)
-  const html = panels[0].render(null)
-  if (!html.includes('Netdata Alerts')) throw new Error('should have title even when empty')
-})
-
-test('register: netdata_correlate tool handles invalid payload', async () => {
-  const tools: any[] = []
-  register({
-    registerTool: (t) => tools.push(t), registerTrigger: () => {}, registerPanel: () => {},
-    exec: async () => '', readLedger: () => ({}), log: () => {},
-  } as any)
-  const correlateTool = tools.find((t) => t.name === 'netdata_correlate')
-  const result = await correlateTool.handler({ alert: { foo: 'bar' } })
-  if (!result.error) throw new Error('should return error for invalid payload')
-})
-
-test('register: netdata_correlate tool correlates valid payload', async () => {
-  const tools: any[] = []
-  register({
-    registerTool: (t) => tools.push(t), registerTrigger: () => {}, registerPanel: () => {},
-    exec: async () => '', readLedger: () => null, log: () => {},
-  } as any)
-  const correlateTool = tools.find((t) => t.name === 'netdata_correlate')
-  const result = await correlateTool.handler({
-    alert: { alert: 'cpu_usage', severity: 'critical', space: 'web-01', message: 'CPU 95%' },
-  })
-  if (!result.parsed) throw new Error('should return parsed alert')
-  if (result.parsed.alert !== 'cpu_usage') throw new Error('alert name')
-})
-
-async function main() {
-  let pass = 0, fail = 0
-  for (const c of cases) {
-    try { await c.run(); pass++; console.log(`PASS ${c.name}`) }
-    catch (e: any) { fail++; console.log(`FAIL ${c.name}: ${e?.message ?? e}`) }
-  }
-  console.log(`\n${pass}/${cases.length} passed, ${fail} failed`)
-  if (fail > 0) process.exit(1)
-}
-void main()

package/plugins/netdata-rterm/plugin.json

@@ -1,22 +0,0 @@
-{
-  "name": "netdata-rterm",
-  "version": "1.0.0",
-  "description": "Netdata integration for RTerm — ingests Netdata alert webhooks as triggers, correlates anomalies with changes/incidents for agent RCA + auto-remediation. Bridges Netdata's per-second monitoring + ML anomaly detection with RTerm's AI agent and SRE pillar.",
-  "entry": "index.mjs",
-  "tools": [
-    "netdata_alert_summary",
-    "netdata_correlate"
-  ],
-  "triggers": [
-    "netdata_critical_alert",
-    "netdata_warning_alert"
-  ],
-  "panels": [
-    "netdata-alert-feed"
-  ],
-  "permissions": [
-    "exec",
-    "readLedger:metrics",
-    "readLedger:incidents"
-  ]
-}

package/plugins/netexec-bridge/index.d.mts

@@ -1,28 +0,0 @@
-// netexec-bridge plugin type declarations
-export function register(ctx: any): void
-export function buildNetexecCommand(opts: {
-  protocol: string
-  targets: string
-  action: string
-  extraArgs?: string[]
-  username?: string
-  passwordRef?: string
-  domain?: string
-  timeoutSec?: number
-}): { cmd: string; args: string[] }
-export function validateTargets(targets: string | null | undefined, allowlist: string[] | null | undefined): { ok: boolean; reason?: string; targets?: string[] }
-export function parseNetexecOutput(raw: string | null | undefined): {
-  hosts: Array<{ ip: string; hostname: string; status: string; detail?: string }>
-  authSuccess: Array<{ protocol: string; ip: string; port: number; hostname: string; detail: string; pwned: boolean }>
-  authFailed: Array<{ protocol: string; ip: string; port: number; hostname: string; detail: string }>
-  errors: string[]
-  raw: string
-}
-export function buildSprayPlan(opts: {
-  targets: string
-  usernames: string[]
-  attemptsPerUser?: number
-  delayMs?: number
-  jitterMs?: number
-}): { targets: string; steps: Array<{ username: string; attempt: number; waitBeforeMs: number }>; totalAttempts: number; note: string }
-export default any

package/plugins/netexec-bridge/index.mjs

@@ -1,325 +0,0 @@
-/**
- * netexec-bridge — NetExec external attack-simulation for RTerm.
- *
- * Complements rmagent (which watches FROM the boxes) by testing FROM the
- * outside: credential validation, SMB/LDAP enumeration, spray simulation.
- * The purple-team loop: NetExec stages an external attack, rmagent's attest
- * must catch the resulting 4625s — the drill then scores both halves.
- *
- * GOVERNANCE (non-negotiable):
- *   - Target allowlist required on every call. No unbounded scanning.
- *   - Targets must be hosts the operator administers (same rule as rmagent).
- *   - Credential sprays are rate-limited and jittered by default.
- *   - The plugin never stores credentials; they resolve from the vault/env.
- *
- * Pure + injectable: process spawning injected; command building and output
- * parsing are pure and fully testable.
- */
-
-// --- Pure: build the netexec command line ---
-
-export function buildNetexecCommand(opts) {
-  const {
-    protocol,        // smb | ldap | winrm | mssql | ssh | ftp | rdp | wmi
-    targets,         // string: CIDR, range, or comma-separated hosts
-    action,          // netexec subcommand: users, groups, shares, --sam, etc.
-    extraArgs = [],
-    username,
-    passwordRef,     // vault key — never the password itself
-    domain,
-    timeoutSec = 120,
-  } = opts || {}
-
-  if (!protocol) throw new Error('buildNetexecCommand needs a protocol (smb, ldap, winrm, ...)')
-  if (!targets) throw new Error('buildNetexecCommand needs targets')
-  if (!action) throw new Error('buildNetexecCommand needs an action')
-
-  const args = ['netexec', protocol, String(targets)]
-  if (username) args.push('-u', String(username))
-  // password resolves at runtime from the vault — we pass an env var name
-  if (passwordRef) args.push('-p', `env:${passwordRef}`)
-  if (domain) args.push('-d', String(domain))
-  args.push('--timeout', String(timeoutSec))
-  const actionStr = String(action)
-  if (actionStr.startsWith('--')) args.push(actionStr)
-  else args.push(actionStr)
-  for (const a of extraArgs) args.push(String(a))
-
-  return { cmd: 'netexec', args }
-}
-
-// --- Pure: validate targets against the authorized allowlist ---
-
-export function validateTargets(targets, allowlist) {
-  if (!targets || typeof targets !== 'string') {
-    return { ok: false, reason: 'targets must be a string (CIDR, range, or comma-separated hosts)' }
-  }
-  if (!Array.isArray(allowlist) || allowlist.length === 0) {
-    return { ok: false, reason: 'an authorized target allowlist is required — unbounded scanning is not permitted' }
-  }
-
-  const requested = targets.split(',').map((t) => t.trim()).filter(Boolean)
-  const allowedSet = new Set(allowlist.map((a) => String(a).trim()))
-  const denied = []
-
-  for (const t of requested) {
-    // exact host match
-    if (allowedSet.has(t)) continue
-    // CIDR membership: allowlist entry is a CIDR and target is a bare IP
-    const inCidr = allowlist.some((a) => {
-      const cidr = String(a).trim()
-      if (!cidr.includes('/')) return false
-      return ipInCidr(t, cidr)
-    })
-    if (inCidr) continue
-    denied.push(t)
-  }
-
-  if (denied.length > 0) {
-    return { ok: false, reason: `target(s) not in the authorized allowlist: ${denied.join(', ')}` }
-  }
-  return { ok: true, targets: requested }
-}
-
-function ipInCidr(ip, cidr) {
-  const [base, bitsStr] = cidr.split('/')
-  const bits = Number(bitsStr)
-  if (!Number.isInteger(bits) || bits < 0 || bits > 32) return false
-  const toInt = (s) => {
-    const parts = s.split('.').map(Number)
-    if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return null
-    return ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0
-  }
-  const ipInt = toInt(ip)
-  const baseInt = toInt(base)
-  if (ipInt === null || baseInt === null) return false
-  if (bits === 0) return true
-  const mask = (0xFFFFFFFF << (32 - bits)) >>> 0
-  return (ipInt & mask) === (baseInt & mask)
-}
-
-// --- Pure: parse netexec output ---
-
-/**
- * netexec prints lines like:
- *   SMB  192.168.1.10  445  HOSTNAME  [+] hostname\user (Pwn3d!)
- *   SMB  192.168.1.11  445  HOSTNAME2 [-] hostname\user:BADPW
- * Parse into hosts + auth results.
- */
-export function parseNetexecOutput(raw) {
-  const result = {
-    hosts: [],
-    authSuccess: [],
-    authFailed: [],
-    errors: [],
-    raw: typeof raw === 'string' ? raw.slice(0, 5000) : '',
-  }
-
-  if (typeof raw !== 'string') return result
-  const lines = raw.split('\n')
-
-  for (const line of lines) {
-    const trimmed = line.trim()
-    if (!trimmed) continue
-
-    // Host status line: PROTOCOL  ip  port  hostname  [status]
-    const m = trimmed.match(/^(\w+)\s+(\S+)\s+(\d+)\s+(\S+)\s+(.*)$/)
-    if (!m) {
-      if (/error|failed to|traceback/i.test(trimmed)) result.errors.push(trimmed.slice(0, 200))
-      continue
-    }
-
-    const [, proto, ip, port, hostname, rest] = m
-    const entry = { protocol: proto, ip, port: Number(port), hostname, detail: rest.slice(0, 200) }
-
-    if (/\[\+\]/.test(rest)) {
-      result.authSuccess.push({ ...entry, pwned: /\(Pwn3d!?\)/.test(rest) })
-      result.hosts.push({ ip, hostname, status: 'auth-ok' })
-    } else if (/\[-\]/.test(rest)) {
-      result.authFailed.push(entry)
-      result.hosts.push({ ip, hostname, status: 'auth-failed' })
-    } else if (/\[\*\]/.test(rest)) {
-      result.hosts.push({ ip, hostname, status: 'info', detail: rest.slice(0, 120) })
-    } else {
-      result.hosts.push({ ip, hostname, status: 'unknown' })
-    }
-  }
-
-  return result
-}
-
-// --- Pure: build a spray plan (rate-limited, jittered) ---
-
-export function buildSprayPlan(opts) {
-  const {
-    targets,
-    usernames,       // array of usernames to try
-    attemptsPerUser = 1,
-    delayMs = 5000,  // between attempts — slow by default
-    jitterMs = 2000,
-  } = opts || {}
-
-  if (!Array.isArray(usernames) || usernames.length === 0) {
-    throw new Error('buildSprayPlan needs usernames')
-  }
-  if (!targets) throw new Error('buildSprayPlan needs targets')
-
-  const plan = []
-  for (const user of usernames) {
-    for (let i = 0; i < Math.max(1, attemptsPerUser); i++) {
-      const jitter = Math.floor(Math.random() * Math.max(0, jitterMs))
-      plan.push({
-        username: String(user),
-        attempt: i + 1,
-        waitBeforeMs: delayMs + jitter,
-      })
-    }
-  }
-  return {
-    targets: String(targets),
-    steps: plan,
-    totalAttempts: plan.length,
-    note: `Spray plan: ${plan.length} attempt(s) across ${usernames.length} user(s), ≥${delayMs}ms between attempts (jitter ${jitterMs}ms). This is a SLOW spray by design — verify rmagent attest catches the 4625s.`,
-  }
-}
-
-// --- Plugin entry ---
-
-export function register(ctx) {
-  const { registerTool, registerTrigger, registerPanel, log, spawnProcess } = ctx
-
-  let lastResult = null
-
-  const runNetexec = async (plan) => {
-    if (typeof spawnProcess !== 'function') {
-      return { error: 'netexec-bridge requires process spawning, which is not available in this RTerm build.' }
-    }
-    return await new Promise((resolve) => {
-      let stdout = ''
-      let stderr = ''
-      let child
-      try {
-        child = spawnProcess(plan.cmd, plan.args, { stdio: 'pipe' })
-      } catch (e) {
-        resolve({ error: `failed to spawn netexec: ${e?.message ?? e}. Install with: pip install netexec` })
-        return
-      }
-      if (!child || typeof child.on !== 'function') {
-        resolve({ error: 'spawnProcess returned no child process' })
-        return
-      }
-      let settled = false
-      const settle = (v) => { if (!settled) { settled = true; resolve(v) } }
-      child.stdout?.on?.('data', (d) => { stdout += String(d) })
-      child.stderr?.on?.('data', (d) => { stderr += String(d) })
-      child.on('error', (e) => settle({ error: `netexec spawn error: ${e?.message ?? e}` }))
-      child.on('close', (code) => settle({ code, stdout, stderr }))
-      const t = setTimeout(() => {
-        try { child.kill?.() } catch { /* ignore */ }
-        settle({ error: 'netexec timed out', stdout, stderr })
-      }, 300_000)
-      child.on('close', () => clearTimeout(t))
-    })
-  }
-
-  registerTool({
-    name: 'netexec_check',
-    description: 'Run a NetExec check against authorized targets (credential validation, enumeration). Targets MUST be in the authorized allowlist — the same hosts you administer. Results parse into per-host auth outcomes; successful auths are findings.',
-    params: {
-      protocol: { type: 'string', description: 'smb | ldap | winrm | mssql | ssh | ftp | rdp | wmi' },
-      targets: { type: 'string', description: 'Target hosts (comma-separated IPs or a CIDR). Must be within the authorized allowlist.' },
-      action: { type: 'string', description: 'NetExec action: users, groups, shares, --sam, --users, etc.' },
-      allowlist: { type: 'array', description: 'Authorized target hosts/CIDRs. REQUIRED — no unbounded scanning.' },
-      username: { type: 'string', description: 'Username to test' },
-      passwordRef: { type: 'string', description: 'Vault key holding the password (never the password itself)' },
-      domain: { type: 'string', description: 'Optional domain' },
-    },
-    handler: async (params) => {
-      const { protocol, targets, action } = params || {}
-      const allowlist = Array.isArray(params?.allowlist) ? params.allowlist : []
-
-      // Governance gate FIRST.
-      const check = validateTargets(targets, allowlist)
-      if (!check.ok) {
-        return { error: `Authorization failed: ${check.reason}. Only test hosts you administer.` }
-      }
-
-      let plan
-      try {
-        plan = buildNetexecCommand({
-          protocol, targets, action,
-          username: params?.username,
-          passwordRef: params?.passwordRef,
-          domain: params?.domain,
-        })
-      } catch (e) {
-        return { error: e?.message ?? String(e) }
-      }
-
-      log(`[netexec] ${protocol} ${action} against ${check.targets.length} authorized target(s)`)
-      const run = await runNetexec(plan)
-      if (run?.error) return { error: run.error, stderr: run.stderr?.slice(0, 400) }
-
-      const parsed = parseNetexecOutput(run.stdout)
-      lastResult = parsed
-
-      log(`[netexec] ${parsed.hosts.length} host(s), ${parsed.authSuccess.length} auth success, ${parsed.authFailed.length} auth failed`)
-      return {
-        hosts: parsed.hosts,
-        authSuccess: parsed.authSuccess,
-        authFailed: parsed.authFailed,
-        errors: parsed.errors,
-        note: parsed.authSuccess.length > 0
-          ? '⚠ Successful authentication found — treat as a finding and verify rmagent attest saw the corresponding logons.'
-          : 'No successful authentications.',
-      }
-    },
-  })
-
-  registerTool({
-    name: 'netexec_spray_plan',
-    description: 'Build a rate-limited, jittered credential-spray plan (does NOT execute it). Returns the step schedule to review before running via netexec_check. Slow by design so rmagent attest can catch the 4625 pattern.',
-    params: {
-      targets: { type: 'string', description: 'Target hosts (must be authorized)' },
-      usernames: { type: 'array', description: 'Usernames to try' },
-      attemptsPerUser: { type: 'number', description: 'Attempts per username (default 1)' },
-    },
-    handler: async (params) => {
-      try {
-        const plan = buildSprayPlan({
-          targets: params?.targets,
-          usernames: params?.usernames,
-          attemptsPerUser: params?.attemptsPerUser,
-        })
-        return plan
-      } catch (e) {
-        return { error: e?.message ?? String(e) }
-      }
-    },
-  })
-
-  registerTrigger({
-    name: 'netexec_auth_success',
-    description: 'Fires when a NetExec check finds a successful authentication on an authorized target. Use for incident + rmagent correlation playbooks.',
-    match: (event) => {
-      if (event?.source !== 'netexec') return false
-      return Array.isArray(event?.authSuccess) && event.authSuccess.length > 0
-    },
-    action: 'run-playbook',
-  })
-
-  registerPanel({
-    name: 'netexec-results',
-    title: 'NetExec',
-    render: async () => {
-      if (!lastResult) return '<div class="panel-section"><h3>NetExec</h3><p>No check run yet. Use netexec_check.</p></div>'
-      const rows = lastResult.hosts.slice(0, 15)
-        .map((h) => `<tr><td>${h.ip}</td><td>${h.hostname}</td><td>${h.status}</td></tr>`)
-        .join('')
-      return `<div class="panel-section"><h3>NetExec — ${lastResult.hosts.length} host(s)</h3>
-        <table><tr><th>ip</th><th>hostname</th><th>status</th></tr>${rows}</table>
-        ${lastResult.authSuccess.length ? `<p class="warn">⚠ ${lastResult.authSuccess.length} successful auth(s)</p>` : ''}
-      </div>`
-    },
-  })
-}

package/plugins/netexec-bridge/plugin.json

@@ -1,20 +0,0 @@
-{
-  "name": "netexec-bridge",
-  "version": "1.0.0",
-  "description": "NetExec external attack-simulation for RTerm — credential validation, SMB/LDAP enumeration, and rate-limited spray simulation against authorized targets. Complements rmagent (inside view) with the outside view; closes the purple-team loop.",
-  "entry": "index.mjs",
-  "tools": [
-    "netexec_check",
-    "netexec_spray_plan"
-  ],
-  "triggers": [
-    "netexec_auth_success"
-  ],
-  "panels": [
-    "netexec-results"
-  ],
-  "permissions": [
-    "spawnProcess",
-    "readLedger:incidents"
-  ]
-}