nox-openclaw-hunter 1.0.0

package/dist/reporter/webhook.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Webhook delivery for SIEM/alerting integrations.
+ */
+import type { DetectionResult, EnforcementResult, IsolationResult, WebhookOptions } from '../types/index.js';
+export type WebhookEventType = 'openclaw.detection' | 'openclaw.enforcement' | 'openclaw.isolation';
+export type WebhookSeverity = 'low' | 'medium' | 'high' | 'critical';
+export interface WebhookPayload {
+    event: WebhookEventType;
+    timestamp: string;
+    severity: WebhookSeverity;
+    host: {
+        hostname: string;
+        platform: string;
+    };
+    nox: {
+        version: string;
+        tool: string;
+    };
+    detection: DetectionResult;
+    enforcement?: EnforcementResult;
+    isolation?: IsolationResult;
+}
+export interface WebhookResult {
+    success: boolean;
+    statusCode?: number;
+    error?: string;
+    duration: number;
+}
+/**
+ * Build webhook payload for detection event.
+ */
+export declare function buildDetectionPayload(detection: DetectionResult): WebhookPayload;
+/**
+ * Build webhook payload for enforcement event.
+ */
+export declare function buildEnforcementPayload(detection: DetectionResult, enforcement: EnforcementResult): WebhookPayload;
+/**
+ * Build webhook payload for isolation event.
+ */
+export declare function buildIsolationPayload(detection: DetectionResult, isolation: IsolationResult, enforcement?: EnforcementResult): WebhookPayload;
+/**
+ * Send webhook payload to URL.
+ */
+export declare function sendWebhook(url: string, payload: WebhookPayload, options?: WebhookOptions): Promise<WebhookResult>;
+/**
+ * Send detection results to webhook.
+ */
+export declare function sendDetectionWebhook(url: string, detection: DetectionResult, options?: WebhookOptions): Promise<WebhookResult>;
+/**
+ * Send enforcement results to webhook.
+ */
+export declare function sendEnforcementWebhook(url: string, detection: DetectionResult, enforcement: EnforcementResult, options?: WebhookOptions): Promise<WebhookResult>;
+/**
+ * Send isolation results to webhook.
+ */
+export declare function sendIsolationWebhook(url: string, detection: DetectionResult, isolation: IsolationResult, enforcement?: EnforcementResult, options?: WebhookOptions): Promise<WebhookResult>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/reporter/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/reporter/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAkE3B,MAAM,MAAM,gBAAgB,GACxB,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,gBAAgB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,GAAG,EAAE;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAgBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,eAAe,GAAG,cAAc,CAehF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,iBAAiB,GAC7B,cAAc,CAgBhB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,eAAe,EAC1B,WAAW,CAAC,EAAE,iBAAiB,GAC9B,cAAc,CAmBhB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA+ExB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,EAC1B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,iBAAiB,EAC9B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,eAAe,EAC1B,WAAW,CAAC,EAAE,iBAAiB,EAC/B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAGxB"}

package/dist/reporter/webhook.js

@@ -0,0 +1,230 @@
+/**
+ * Webhook delivery for SIEM/alerting integrations.
+ */
+import { logger } from '../utils/logger.js';
+import { VERSION, TOOL_NAME } from '../branding.js';
+const DEFAULT_TIMEOUT = 30000; // 30 seconds
+/**
+ * Validate a webhook URL for security.
+ * Prevents SSRF by blocking internal/private IP ranges and non-HTTPS URLs in production.
+ */
+function validateWebhookUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid webhook URL: ${url}`);
+    }
+    // Only allow http and https protocols
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+        throw new Error(`Invalid webhook URL protocol: ${parsed.protocol} (only http/https allowed)`);
+    }
+    // Block private/internal IP addresses to prevent SSRF
+    const hostname = parsed.hostname.toLowerCase();
+    // Block localhost and loopback
+    if (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname.endsWith('.localhost')) {
+        throw new Error('Webhook URLs to localhost are not allowed');
+    }
+    // Block private IP ranges (RFC 1918)
+    const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4Match) {
+        const [, a, b] = ipv4Match.map(Number);
+        // 10.0.0.0/8
+        if (a === 10) {
+            throw new Error('Webhook URLs to private IP ranges are not allowed');
+        }
+        // 172.16.0.0/12
+        if (a === 172 && b >= 16 && b <= 31) {
+            throw new Error('Webhook URLs to private IP ranges are not allowed');
+        }
+        // 192.168.0.0/16
+        if (a === 192 && b === 168) {
+            throw new Error('Webhook URLs to private IP ranges are not allowed');
+        }
+        // 169.254.0.0/16 (link-local)
+        if (a === 169 && b === 254) {
+            throw new Error('Webhook URLs to link-local addresses are not allowed');
+        }
+    }
+    // Block internal cloud metadata endpoints
+    if (hostname === '169.254.169.254' ||
+        hostname === 'metadata.google.internal' ||
+        hostname.endsWith('.internal')) {
+        throw new Error('Webhook URLs to cloud metadata endpoints are not allowed');
+    }
+    return parsed;
+}
+/**
+ * Determine severity based on detection summary.
+ */
+function getSeverity(result) {
+    switch (result.summary) {
+        case 'installed-and-running':
+            return 'high';
+        case 'installed-not-running':
+            return 'medium';
+        case 'not-installed':
+            return 'low';
+    }
+}
+/**
+ * Build webhook payload for detection event.
+ */
+export function buildDetectionPayload(detection) {
+    return {
+        event: 'openclaw.detection',
+        timestamp: new Date().toISOString(),
+        severity: getSeverity(detection),
+        host: {
+            hostname: detection.hostname,
+            platform: detection.platform,
+        },
+        nox: {
+            version: VERSION,
+            tool: TOOL_NAME,
+        },
+        detection,
+    };
+}
+/**
+ * Build webhook payload for enforcement event.
+ */
+export function buildEnforcementPayload(detection, enforcement) {
+    return {
+        event: 'openclaw.enforcement',
+        timestamp: new Date().toISOString(),
+        severity: enforcement.summary.failed > 0 ? 'high' : 'medium',
+        host: {
+            hostname: detection.hostname,
+            platform: detection.platform,
+        },
+        nox: {
+            version: VERSION,
+            tool: TOOL_NAME,
+        },
+        detection,
+        enforcement,
+    };
+}
+/**
+ * Build webhook payload for isolation event.
+ */
+export function buildIsolationPayload(detection, isolation, enforcement) {
+    const hasFailedIsolation = isolation.actions.some(a => a.status === 'failed');
+    return {
+        event: 'openclaw.isolation',
+        timestamp: new Date().toISOString(),
+        severity: hasFailedIsolation ? 'critical' : 'high',
+        host: {
+            hostname: detection.hostname,
+            platform: detection.platform,
+        },
+        nox: {
+            version: VERSION,
+            tool: TOOL_NAME,
+        },
+        detection,
+        ...(enforcement && { enforcement }),
+        isolation,
+    };
+}
+/**
+ * Send webhook payload to URL.
+ */
+export async function sendWebhook(url, payload, options = {}) {
+    const startTime = Date.now();
+    const timeout = options.timeout ?? DEFAULT_TIMEOUT;
+    // Validate URL to prevent SSRF attacks
+    let validatedUrl;
+    try {
+        validatedUrl = validateWebhookUrl(url);
+    }
+    catch (err) {
+        const errorMessage = err instanceof Error ? err.message : 'Invalid URL';
+        logger.error(`Webhook URL validation failed: ${errorMessage}`);
+        return {
+            success: false,
+            error: errorMessage,
+            duration: Date.now() - startTime,
+        };
+    }
+    const headers = {
+        'Content-Type': 'application/json',
+        'User-Agent': `nox-openclaw-detector/${VERSION}`,
+    };
+    if (options.token) {
+        headers['Authorization'] = `Bearer ${options.token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+        logger.debug(`Sending webhook to ${validatedUrl.href}`);
+        const response = await fetch(validatedUrl.href, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+        clearTimeout(timeoutId);
+        const duration = Date.now() - startTime;
+        if (response.ok) {
+            logger.debug(`Webhook sent successfully (${response.status}) in ${duration}ms`);
+            return {
+                success: true,
+                statusCode: response.status,
+                duration,
+            };
+        }
+        else {
+            const errorText = await response.text().catch(() => 'Unknown error');
+            logger.warn(`Webhook failed with status ${response.status}: ${errorText}`);
+            return {
+                success: false,
+                statusCode: response.status,
+                error: `HTTP ${response.status}: ${errorText}`,
+                duration,
+            };
+        }
+    }
+    catch (error) {
+        clearTimeout(timeoutId);
+        const duration = Date.now() - startTime;
+        const errorMessage = error instanceof Error
+            ? error.name === 'AbortError'
+                ? `Timeout after ${timeout}ms`
+                : error.message
+            : 'Unknown error';
+        logger.error(`Webhook error: ${errorMessage}`);
+        return {
+            success: false,
+            error: errorMessage,
+            duration,
+        };
+    }
+}
+/**
+ * Send detection results to webhook.
+ */
+export async function sendDetectionWebhook(url, detection, options = {}) {
+    const payload = buildDetectionPayload(detection);
+    return sendWebhook(url, payload, options);
+}
+/**
+ * Send enforcement results to webhook.
+ */
+export async function sendEnforcementWebhook(url, detection, enforcement, options = {}) {
+    const payload = buildEnforcementPayload(detection, enforcement);
+    return sendWebhook(url, payload, options);
+}
+/**
+ * Send isolation results to webhook.
+ */
+export async function sendIsolationWebhook(url, detection, isolation, enforcement, options = {}) {
+    const payload = buildIsolationPayload(detection, isolation, enforcement);
+    return sendWebhook(url, payload, options);
+}
+//# sourceMappingURL=webhook.js.map

package/dist/reporter/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/reporter/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,aAAa;AAE5C;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,QAAQ,4BAA4B,CAAC,CAAC;IAChG,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,aAAa;QACb,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,gBAAgB;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,iBAAiB;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,8BAA8B;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,IAAI,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,0BAA0B;QACvC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAiCD;;GAEG;AACH,SAAS,WAAW,CAAC,MAAuB;IAC1C,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,uBAAuB;YAC1B,OAAO,MAAM,CAAC;QAChB,KAAK,uBAAuB;YAC1B,OAAO,QAAQ,CAAC;QAClB,KAAK,eAAe;YAClB,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAA0B;IAC9D,OAAO;QACL,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE;YACJ,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACD,GAAG,EAAE;YACH,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,SAAS;SAChB;QACD,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA0B,EAC1B,WAA8B;IAE9B,OAAO;QACL,KAAK,EAAE,sBAAsB;QAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC5D,IAAI,EAAE;YACJ,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACD,GAAG,EAAE;YACH,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,SAAS;SAChB;QACD,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,SAA0B,EAC1B,WAA+B;IAE/B,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAE9E,OAAO;QACL,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;QAClD,IAAI,EAAE;YACJ,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACD,GAAG,EAAE;YACH,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,SAAS;SAChB;QACD,SAAS;QACT,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,OAAuB,EACvB,UAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IAEnD,uCAAuC;IACvC,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,yBAAyB,OAAO,EAAE;KACjD,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,sBAAsB,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ;aACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE;gBAC9C,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK;YACzC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY;gBAC3B,CAAC,CAAC,iBAAiB,OAAO,IAAI;gBAC9B,CAAC,CAAC,KAAK,CAAC,OAAO;YACjB,CAAC,CAAC,eAAe,CAAC;QAEpB,MAAM,CAAC,KAAK,CAAC,kBAAkB,YAAY,EAAE,CAAC,CAAC;QAE/C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,YAAY;YACnB,QAAQ;SACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,SAA0B,EAC1B,UAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,SAA0B,EAC1B,WAA8B,EAC9B,UAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,SAA0B,EAC1B,SAA0B,EAC1B,WAA+B,EAC/B,UAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzE,OAAO,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/types/config.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Configuration types for the Nox OpenClaw Detector CLI.
+ * Includes both CLI options and detection pattern configurations.
+ */
+/**
+ * Options for detection operations.
+ */
+export interface DetectOptions {
+    /** Scan all user directories (requires root/admin) */
+    allUsers?: boolean;
+    /** Specific gateway port to check */
+    port?: number;
+}
+/**
+ * Options for webhook delivery.
+ */
+export interface WebhookOptions {
+    /** Webhook URL to send results to */
+    url?: string;
+    /** Bearer token for authentication */
+    token?: string;
+    /** Timeout in milliseconds */
+    timeout?: number;
+}
+/**
+ * Pattern for locating state directories.
+ */
+export interface StateDirPattern {
+    /** Directory name relative to home (e.g., '.clawdbot') */
+    name: string;
+    /** Human-readable description */
+    description?: string;
+}
+/**
+ * Pattern for locating config files.
+ */
+export interface ConfigFilePattern {
+    /** Directory name relative to home (e.g., '.clawdbot') */
+    dir: string;
+    /** Config filename (e.g., 'clawdbot.json') */
+    file: string;
+    /** Human-readable description */
+    description?: string;
+}
+/**
+ * Path pattern for extracting values from nested config objects.
+ * Uses dot notation (e.g., 'agents.defaults.model.primary').
+ */
+export type ConfigPath = string;
+/**
+ * Configuration extraction patterns.
+ * Defines where to look for various configuration values in the parsed config.
+ */
+export interface ConfigExtractionPatterns {
+    /** Paths to check for model configuration (in order of priority) */
+    model: ConfigPath[];
+    /** Paths to check for API provider */
+    apiProvider: ConfigPath[];
+    /** Paths to check for autonomous mode setting */
+    autonomousMode: ConfigPath[];
+    /** Paths to check for workspace/workdir */
+    workspace: ConfigPath[];
+    /** Paths to check for communication channels object */
+    channels: ConfigPath[];
+    /** Paths to check for permissions/capabilities */
+    permissions: ConfigPath[];
+    /** Paths to check for max concurrent agents (indicates autonomous capability) */
+    maxConcurrent: ConfigPath[];
+}
+/**
+ * Patterns for detecting known AI providers from model names.
+ */
+export interface ProviderDetectionPattern {
+    /** Provider identifier (e.g., 'anthropic', 'openai') */
+    provider: string;
+    /** Substrings to match in model name (case-insensitive) */
+    modelPatterns: string[];
+}
+/**
+ * Known communication channel identifiers.
+ */
+export interface ChannelPattern {
+    /** Channel identifier (e.g., 'telegram') */
+    id: string;
+    /** Display name (e.g., 'Telegram') */
+    displayName: string;
+    /** Alternative identifiers to check */
+    aliases?: string[];
+}
+/**
+ * Sensitive field patterns for redaction.
+ */
+export interface SensitiveFieldPattern {
+    /** Field name to redact */
+    field: string;
+    /** Optional parent path (e.g., 'gateway.auth' means redact 'auth' under 'gateway') */
+    parent?: string;
+}
+/**
+ * Complete detection configuration.
+ */
+export interface DetectionConfig {
+    /** State directory patterns to check */
+    stateDirs: StateDirPattern[];
+    /** Config file patterns to check */
+    configFiles: ConfigFilePattern[];
+    /** Paths for extracting config values */
+    extractionPatterns: ConfigExtractionPatterns;
+    /** Patterns for inferring provider from model name */
+    providerPatterns: ProviderDetectionPattern[];
+    /** Known communication channels */
+    channelPatterns: ChannelPattern[];
+    /** Sensitive fields to redact from raw config */
+    sensitiveFields: SensitiveFieldPattern[];
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,sCAAsC;IACtC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,iDAAiD;IACjD,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,2CAA2C;IAC3C,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,kDAAkD;IAClD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,iFAAiF;IACjF,aAAa,EAAE,UAAU,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,oCAAoC;IACpC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,yCAAyC;IACzC,kBAAkB,EAAE,wBAAwB,CAAC;IAC7C,sDAAsD;IACtD,gBAAgB,EAAE,wBAAwB,EAAE,CAAC;IAC7C,mCAAmC;IACnC,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,iDAAiD;IACjD,eAAe,EAAE,qBAAqB,EAAE,CAAC;CAC1C"}

package/dist/types/config.js

@@ -0,0 +1,6 @@
+/**
+ * Configuration types for the Nox OpenClaw Detector CLI.
+ * Includes both CLI options and detection pattern configurations.
+ */
+export {};
+//# sourceMappingURL=config.js.map

package/dist/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/types/detection.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Detection result types for OpenClaw detection.
+ */
+export type DetectionSummary = 'not-installed' | 'installed-not-running' | 'installed-and-running';
+export type PlatformName = 'darwin' | 'linux' | 'windows';
+export interface CliBinaryDetection {
+    found: boolean;
+    path?: string;
+    version?: string;
+}
+export interface AppBundleDetection {
+    found: boolean;
+    path?: string;
+}
+export interface StateDirDetection {
+    found: boolean;
+    path?: string;
+}
+export interface OpenClawConfigDetails {
+    /** AI model being used (e.g., claude-3-opus, gpt-4, etc.) */
+    model?: string;
+    /** Communication channels configured */
+    channels?: {
+        telegram?: boolean;
+        whatsapp?: boolean;
+        slack?: boolean;
+        discord?: boolean;
+        email?: boolean;
+        sms?: boolean;
+        other?: string[];
+    };
+    /** Whether autonomous mode is enabled */
+    autonomousMode?: boolean;
+    /** API provider (anthropic, openai, etc.) */
+    apiProvider?: string;
+    /** Permissions granted */
+    permissions?: string[];
+    /** Raw config for additional inspection */
+    raw?: Record<string, unknown>;
+}
+export interface ConfigDetection {
+    found: boolean;
+    path?: string;
+    /** Parsed configuration details */
+    details?: OpenClawConfigDetails;
+}
+export interface ServiceDetection {
+    found: boolean;
+    name?: string;
+    running?: boolean;
+}
+export interface GatewayDetection {
+    found: boolean;
+    port?: number;
+    listening?: boolean;
+}
+/** Platform-level process info (e.g. from ps/tasklist). */
+export interface ProcessInfo {
+    pid: number;
+    name: string;
+    memory?: number;
+    user?: string;
+}
+export interface ProcessDetection extends ProcessInfo {
+}
+export interface DockerDetection {
+    found: boolean;
+    containers?: string[];
+    images?: string[];
+}
+export interface DetectionResult {
+    summary: DetectionSummary;
+    platform: PlatformName;
+    hostname: string;
+    timestamp: string;
+    cli: CliBinaryDetection;
+    app: AppBundleDetection;
+    stateDir: StateDirDetection;
+    config: ConfigDetection;
+    service: ServiceDetection;
+    gateway: GatewayDetection;
+    processes: ProcessDetection[];
+    docker: DockerDetection;
+}
+//# sourceMappingURL=detection.d.ts.map

package/dist/types/detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.d.ts","sourceRoot":"","sources":["../../src/types/detection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,yCAAyC;IACzC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;CAAG;AAExD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,kBAAkB,CAAC;IACxB,GAAG,EAAE,kBAAkB,CAAC;IACxB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;CACzB"}

package/dist/types/detection.js

@@ -0,0 +1,5 @@
+/**
+ * Detection result types for OpenClaw detection.
+ */
+export {};
+//# sourceMappingURL=detection.js.map

package/dist/types/detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.js","sourceRoot":"","sources":["../../src/types/detection.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/types/enforcement.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Enforcement action types for OpenClaw removal.
+ */
+export type EnforcementActionType = 'kill-process' | 'stop-service' | 'remove-file' | 'remove-dir' | 'docker-rm';
+export type EnforcementActionStatus = 'pending' | 'success' | 'failed' | 'skipped';
+export interface EnforcementAction {
+    type: EnforcementActionType;
+    target: string;
+    status: EnforcementActionStatus;
+    error?: string;
+    dryRun: boolean;
+}
+export interface EnforcementResult {
+    actions: EnforcementAction[];
+    summary: EnforcementSummary;
+}
+export interface EnforcementSummary {
+    total: number;
+    success: number;
+    failed: number;
+    skipped: number;
+}
+export interface EnforceOptions {
+    kill?: boolean;
+    stopService?: boolean;
+    removeCli?: boolean;
+    removeApp?: boolean;
+    removeConfig?: boolean;
+    all?: boolean;
+    dryRun?: boolean;
+    force?: boolean;
+}
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/types/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../src/types/enforcement.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,cAAc,GACd,aAAa,GACb,YAAY,GACZ,WAAW,CAAC;AAEhB,MAAM,MAAM,uBAAuB,GAC/B,SAAS,GACT,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,uBAAuB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB"}

package/dist/types/enforcement.js

@@ -0,0 +1,5 @@
+/**
+ * Enforcement action types for OpenClaw removal.
+ */
+export {};
+//# sourceMappingURL=enforcement.js.map

package/dist/types/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../src/types/enforcement.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/types/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Type exports for Nox OpenClaw Detector.
+ */
+export * from './detection.js';
+export * from './enforcement.js';
+export * from './isolation.js';
+export * from './config.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,8 @@
+/**
+ * Type exports for Nox OpenClaw Detector.
+ */
+export * from './detection.js';
+export * from './enforcement.js';
+export * from './isolation.js';
+export * from './config.js';
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC"}

package/dist/types/isolation.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Isolation action types for firewall, quarantine, and lockdown.
+ */
+export type IsolationActionType = 'block-port' | 'quarantine' | 'lockdown';
+export type IsolationActionStatus = 'pending' | 'success' | 'failed';
+export interface IsolationAction {
+    type: IsolationActionType;
+    target: string;
+    status: IsolationActionStatus;
+    quarantinePath?: string;
+    error?: string;
+}
+export interface QuarantineArtifact {
+    type: 'binary' | 'config' | 'app';
+    original: string;
+    quarantined: string;
+}
+export interface QuarantineManifest {
+    id: string;
+    timestamp: string;
+    hostname: string;
+    artifacts: QuarantineArtifact[];
+    /** Detection details captured at quarantine time */
+    detection?: {
+        /** AI model configured */
+        model?: string;
+        /** API provider (anthropic, openai, google, etc.) */
+        provider?: string;
+        /** Communication channels enabled */
+        channels?: string[];
+        /** Whether autonomous mode was enabled */
+        autonomous?: boolean;
+        /** Gateway port if detected */
+        gatewayPort?: number;
+        /** Running process count at quarantine time */
+        processCount?: number;
+    };
+}
+export interface QuarantineResult {
+    id: string;
+    path: string;
+    manifest: QuarantineManifest;
+}
+export interface IsolationResult {
+    actions: IsolationAction[];
+    quarantine?: QuarantineResult;
+}
+export interface IsolateOptions {
+    blockPort?: boolean;
+    quarantine?: boolean;
+    lockdown?: boolean;
+    all?: boolean;
+    webhook?: string;
+}
+//# sourceMappingURL=isolation.d.ts.map