whale-code 6.4.0

package/dist/local-agent/connection.js

@@ -0,0 +1,332 @@
+/**
+ * Local Agent Connection — maintains WebSocket connection to SwagManager cloud.
+ *
+ * Features:
+ * - Outbound WSS connection (no firewall issues)
+ * - Auto-reconnection with exponential backoff
+ * - Heartbeat/pong handling
+ * - Command routing to executor
+ */
+import WebSocket from "ws";
+import os from "node:os";
+import { discoverTools } from "./discovery.js";
+import { exec, getSystemInfo } from "./executor.js";
+// ============================================================================
+// CONFIG
+// ============================================================================
+const DEFAULT_SERVER_URL = "wss://whale-agent.fly.dev/agent/ws";
+const MAX_RECONNECT_DELAY_MS = 60_000;
+const INITIAL_RECONNECT_DELAY_MS = 1_000;
+// ============================================================================
+// AGENT CONNECTION
+// ============================================================================
+export class LocalAgentConnection {
+    ws = null;
+    config;
+    reconnectAttempts = 0;
+    reconnectTimer = null;
+    intentionalClose = false;
+    discoveredTools = [];
+    _agentId = null;
+    constructor(config) {
+        this.config = {
+            serverUrl: DEFAULT_SERVER_URL,
+            autoReconnect: true,
+            onConnected: () => { },
+            onDisconnected: () => { },
+            onError: () => { },
+            onLog: () => { },
+            ...config,
+        };
+    }
+    /**
+     * Connect to the SwagManager cloud gateway.
+     */
+    async connect() {
+        this.intentionalClose = false;
+        // Discover tools before connecting
+        this.log("Scanning for installed security tools...");
+        this.discoveredTools = discoverTools();
+        this.log(`Found ${this.discoveredTools.length} tools: ${this.discoveredTools.map(t => t.name).join(", ") || "none"}`);
+        this.log(`Connecting to ${this.config.serverUrl}...`);
+        return new Promise((resolve, reject) => {
+            try {
+                this.ws = new WebSocket(this.config.serverUrl, {
+                    headers: {
+                        "User-Agent": "swag-agent/1.0",
+                    },
+                });
+            }
+            catch (err) {
+                reject(err);
+                return;
+            }
+            const connectTimeout = setTimeout(() => {
+                if (this.ws?.readyState !== WebSocket.OPEN) {
+                    this.ws?.terminate();
+                    reject(new Error("Connection timeout"));
+                }
+            }, 15_000);
+            this.ws.on("open", () => {
+                clearTimeout(connectTimeout);
+                this.reconnectAttempts = 0;
+                // Send auth message
+                this.send({
+                    type: "auth",
+                    api_key: this.config.apiKey,
+                    capabilities: this.discoveredTools.map(t => t.name),
+                    platform: process.platform,
+                    hostname: os.hostname(),
+                    version: "1.0.0",
+                });
+            });
+            this.ws.on("message", (raw) => {
+                let msg;
+                try {
+                    msg = JSON.parse(raw.toString());
+                }
+                catch {
+                    this.log("Received invalid JSON");
+                    return;
+                }
+                this.handleMessage(msg, resolve);
+            });
+            this.ws.on("close", (code, reason) => {
+                clearTimeout(connectTimeout);
+                const reasonStr = reason?.toString() || `code ${code}`;
+                this.log(`Disconnected: ${reasonStr}`);
+                this.config.onDisconnected(reasonStr);
+                if (!this.intentionalClose && this.config.autoReconnect) {
+                    this.scheduleReconnect();
+                }
+            });
+            this.ws.on("error", (err) => {
+                clearTimeout(connectTimeout);
+                this.config.onError(err);
+                if (this.ws?.readyState !== WebSocket.OPEN) {
+                    reject(err);
+                }
+            });
+        });
+    }
+    /**
+     * Disconnect gracefully.
+     */
+    disconnect() {
+        this.intentionalClose = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.ws) {
+            this.ws.close(1000, "Agent shutting down");
+            this.ws = null;
+        }
+    }
+    /**
+     * Check if connected.
+     */
+    get connected() {
+        return this.ws?.readyState === WebSocket.OPEN;
+    }
+    // ============================================================================
+    // MESSAGE HANDLING
+    // ============================================================================
+    handleMessage(msg, connectResolve) {
+        switch (msg.type) {
+            case "authenticated":
+                this._agentId = msg.agent_id;
+                this.log(msg.message || "Authenticated");
+                this.config.onConnected();
+                connectResolve?.();
+                break;
+            case "error":
+                this.log(`Server error: ${msg.error}`);
+                if (msg.error?.includes("Authentication")) {
+                    this.intentionalClose = true; // Don't reconnect on auth failure
+                }
+                break;
+            case "ping":
+                this.send({ type: "pong" });
+                break;
+            case "exec":
+                this.handleExec(msg);
+                break;
+            case "tool_exec":
+                this.handleToolExec(msg);
+                break;
+            case "discover":
+                this.handleDiscover(msg);
+                break;
+            case "shutdown":
+                this.log("Server requested shutdown — will reconnect");
+                // Do NOT set intentionalClose — server restarts (deploys) should auto-reconnect
+                this.ws?.close(1000, "Server shutdown");
+                break;
+            default:
+                this.log(`Unknown message type: ${msg.type}`);
+        }
+    }
+    async handleExec(msg) {
+        const { request_id, command, session_id, timeout } = msg;
+        if (!command) {
+            this.sendResult(request_id, { success: false, error: "No command provided" });
+            return;
+        }
+        this.log(`Executing: ${command.substring(0, 80)}${command.length > 80 ? "..." : ""}`);
+        try {
+            const result = await exec(command, { session_id, timeout });
+            this.sendResult(request_id, result);
+        }
+        catch (err) {
+            this.sendResult(request_id, {
+                success: false,
+                error: err.message || "Execution failed",
+            });
+        }
+    }
+    async handleToolExec(msg) {
+        const { request_id, tool, args, timeout } = msg;
+        this.log(`Tool exec: ${tool}`);
+        // Route to tool-specific handlers or fallback to generic exec
+        try {
+            let result;
+            switch (tool) {
+                case "tshark": {
+                    const iface = args.interface || (process.platform === "darwin" ? "en0" : "eth0");
+                    const filter = args.filter ? `-f "${args.filter}"` : "";
+                    const count = args.count || 100;
+                    const cmd = `tshark -i ${iface} ${filter} -c ${count} 2>&1`;
+                    result = await exec(cmd, { timeout: timeout || 60000 });
+                    break;
+                }
+                case "burpsuite": {
+                    const port = args.port || 1337;
+                    const action = args.action || "status";
+                    if (action === "status") {
+                        result = await exec(`curl -s http://localhost:${port}/v0.1/ 2>&1 || echo "Burp Suite not running on port ${port}"`, { timeout: 5000 });
+                    }
+                    else if (action === "scan") {
+                        result = await exec(`curl -s -X POST http://localhost:${port}/v0.1/scan -H "Content-Type: application/json" -d '${JSON.stringify({ urls: [args.target_url] })}' 2>&1`, { timeout: 10000 });
+                    }
+                    else {
+                        result = { success: false, error: `Unknown burpsuite action: ${action}` };
+                    }
+                    break;
+                }
+                case "zap": {
+                    const port = args.port || 8090;
+                    const action = args.action || "status";
+                    const apiKey = args.api_key || "";
+                    const base = `http://localhost:${port}/JSON`;
+                    if (action === "status") {
+                        result = await exec(`curl -s "${base}/core/view/version/?apikey=${apiKey}" 2>&1`, { timeout: 5000 });
+                    }
+                    else if (action === "spider") {
+                        result = await exec(`curl -s "${base}/spider/action/scan/?apikey=${apiKey}&url=${encodeURIComponent(args.target_url || "")}" 2>&1`, { timeout: 10000 });
+                    }
+                    else if (action === "active_scan") {
+                        result = await exec(`curl -s "${base}/ascan/action/scan/?apikey=${apiKey}&url=${encodeURIComponent(args.target_url || "")}" 2>&1`, { timeout: 10000 });
+                    }
+                    else {
+                        result = { success: false, error: `Unknown zap action: ${action}` };
+                    }
+                    break;
+                }
+                case "aircrack-ng": {
+                    const action = args.action || "help";
+                    if (action === "scan") {
+                        const iface = args.interface || "wlan0";
+                        result = await exec(`airmon-ng start ${iface} && airodump-ng ${iface}mon --write /tmp/airodump --output-format csv -w 10 2>&1`, { timeout: timeout || 30000 });
+                    }
+                    else if (action === "crack") {
+                        const capFile = args.cap_file;
+                        const wordlist = args.wordlist || "/usr/share/wordlists/rockyou.txt";
+                        if (!capFile) {
+                            result = { success: false, error: "cap_file is required" };
+                        }
+                        else {
+                            result = await exec(`aircrack-ng -w ${wordlist} ${capFile} 2>&1`, { timeout: timeout || 300000 });
+                        }
+                    }
+                    else {
+                        result = await exec(`aircrack-ng --help 2>&1`, { timeout: 5000 });
+                    }
+                    break;
+                }
+                case "netdiscover": {
+                    const iface = args.interface || (process.platform === "darwin" ? "en0" : "eth0");
+                    const range = args.range || "";
+                    const rangeFlag = range ? `-r ${range}` : "";
+                    result = await exec(`netdiscover -i ${iface} ${rangeFlag} -P -N 2>&1 | head -50`, { timeout: timeout || 30000 });
+                    break;
+                }
+                default:
+                    // Generic: try to run as command
+                    result = await exec(`${tool} ${args.args || ""} 2>&1`, { timeout: timeout || 30000 });
+            }
+            this.sendResult(request_id, result);
+        }
+        catch (err) {
+            this.sendResult(request_id, {
+                success: false,
+                error: err.message || `Tool ${tool} failed`,
+            });
+        }
+    }
+    handleDiscover(msg) {
+        const tools = discoverTools();
+        this.discoveredTools = tools;
+        // Update capabilities on the server
+        this.send({
+            type: "tools",
+            tools: tools.map(t => t.name),
+        });
+        // Also send as result
+        this.sendResult(msg.request_id, {
+            success: true,
+            data: {
+                tools: tools.map(t => ({
+                    name: t.name,
+                    path: t.path,
+                    version: t.version,
+                    category: t.category,
+                    running: t.running,
+                })),
+                system: getSystemInfo(),
+            },
+        });
+    }
+    // ============================================================================
+    // HELPERS
+    // ============================================================================
+    send(data) {
+        if (this.ws?.readyState === WebSocket.OPEN) {
+            this.ws.send(JSON.stringify(data));
+        }
+    }
+    sendResult(requestId, result) {
+        this.send({
+            type: "result",
+            request_id: requestId,
+            ...result,
+        });
+    }
+    scheduleReconnect() {
+        this.reconnectAttempts++;
+        const delay = Math.min(INITIAL_RECONNECT_DELAY_MS * Math.pow(2, this.reconnectAttempts - 1), MAX_RECONNECT_DELAY_MS);
+        this.log(`Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.reconnectAttempts})...`);
+        this.reconnectTimer = setTimeout(async () => {
+            try {
+                await this.connect();
+            }
+            catch (err) {
+                this.log(`Reconnect failed: ${err.message}`);
+                // connect() will trigger close event which will schedule another reconnect
+            }
+        }, delay);
+    }
+    log(msg) {
+        this.config.onLog(`[swag-agent] ${msg}`);
+    }
+}

package/dist/local-agent/discovery.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Local Tool Discovery — auto-detect security tools installed on the user's machine.
+ *
+ * Scans PATH for known security tools and checks for running services (Burp, ZAP).
+ * Returns a capabilities list that the gateway uses for routing.
+ */
+export interface DiscoveredTool {
+    name: string;
+    path: string;
+    version?: string;
+    category: string;
+    running?: boolean;
+}
+export declare function discoverTools(): DiscoveredTool[];
+/**
+ * Get just the tool names (for capabilities list).
+ */
+export declare function discoverToolNames(): string[];

package/dist/local-agent/discovery.js

@@ -0,0 +1,146 @@
+/**
+ * Local Tool Discovery — auto-detect security tools installed on the user's machine.
+ *
+ * Scans PATH for known security tools and checks for running services (Burp, ZAP).
+ * Returns a capabilities list that the gateway uses for routing.
+ */
+import { execSync } from "node:child_process";
+const TOOL_SPECS = [
+    // Network Scanning
+    { name: "nmap", binaries: ["nmap"], category: "network_scanning", versionFlag: "--version" },
+    { name: "masscan", binaries: ["masscan"], category: "network_scanning", versionFlag: "--version" },
+    { name: "netdiscover", binaries: ["netdiscover"], category: "network_scanning" },
+    // Packet Analysis
+    { name: "tshark", binaries: ["tshark"], category: "packet_analysis", versionFlag: "--version" },
+    { name: "wireshark", binaries: ["wireshark"], category: "packet_analysis", versionFlag: "--version" },
+    { name: "tcpdump", binaries: ["tcpdump"], category: "packet_analysis", versionFlag: "--version" },
+    // Web Application Security
+    { name: "sqlmap", binaries: ["sqlmap"], category: "web_security", versionFlag: "--version" },
+    { name: "gobuster", binaries: ["gobuster"], category: "web_security", versionFlag: "version" },
+    { name: "nikto", binaries: ["nikto"], category: "web_security", versionFlag: "-Version" },
+    { name: "dirb", binaries: ["dirb"], category: "web_security" },
+    { name: "ffuf", binaries: ["ffuf"], category: "web_security", versionFlag: "-V" },
+    {
+        name: "burpsuite",
+        binaries: ["burpsuite", "BurpSuiteCommunity", "BurpSuitePro"],
+        category: "web_security",
+        serviceCheck: () => checkPort(8080) || checkPort(1337),
+    },
+    {
+        name: "zap",
+        binaries: ["zaproxy", "zap", "zap.sh"],
+        category: "web_security",
+        serviceCheck: () => checkPort(8090),
+    },
+    // Exploitation
+    { name: "metasploit", binaries: ["msfconsole", "msfvenom"], category: "exploitation", versionFlag: "--version" },
+    { name: "setoolkit", binaries: ["setoolkit", "se-toolkit"], category: "exploitation" },
+    // Password Cracking
+    { name: "john", binaries: ["john"], category: "password_cracking", versionFlag: "--help" },
+    { name: "hashcat", binaries: ["hashcat"], category: "password_cracking", versionFlag: "--version" },
+    { name: "hydra", binaries: ["hydra"], category: "password_cracking", versionFlag: "-h" },
+    // Wireless
+    { name: "aircrack-ng", binaries: ["aircrack-ng"], category: "wireless", versionFlag: "--help" },
+    { name: "airodump-ng", binaries: ["airodump-ng"], category: "wireless" },
+    { name: "aireplay-ng", binaries: ["aireplay-ng"], category: "wireless" },
+    { name: "wifite", binaries: ["wifite", "wifite2"], category: "wireless" },
+    // Reconnaissance
+    { name: "recon-ng", binaries: ["recon-ng"], category: "recon" },
+    { name: "maltego", binaries: ["maltego"], category: "recon" },
+    { name: "theharvester", binaries: ["theHarvester", "theharvester"], category: "recon" },
+    { name: "amass", binaries: ["amass"], category: "recon", versionFlag: "version" },
+    { name: "subfinder", binaries: ["subfinder"], category: "recon", versionFlag: "-version" },
+    // Post-Exploitation
+    { name: "responder", binaries: ["responder", "Responder.py"], category: "post_exploitation" },
+    { name: "impacket", binaries: ["impacket-smbclient", "impacket-secretsdump"], category: "post_exploitation" },
+    { name: "evil-winrm", binaries: ["evil-winrm"], category: "post_exploitation" },
+    { name: "chisel", binaries: ["chisel"], category: "post_exploitation" },
+    // Forensics
+    { name: "autopsy", binaries: ["autopsy"], category: "forensics" },
+    { name: "volatility", binaries: ["vol.py", "volatility3", "vol3"], category: "forensics" },
+    { name: "binwalk", binaries: ["binwalk"], category: "forensics", versionFlag: "--help" },
+    // Misc
+    { name: "curl", binaries: ["curl"], category: "utility", versionFlag: "--version" },
+    { name: "wget", binaries: ["wget"], category: "utility", versionFlag: "--version" },
+    { name: "python3", binaries: ["python3"], category: "utility", versionFlag: "--version" },
+    { name: "docker", binaries: ["docker"], category: "utility", versionFlag: "--version" },
+];
+export function discoverTools() {
+    const discovered = [];
+    for (const spec of TOOL_SPECS) {
+        for (const bin of spec.binaries) {
+            const path = which(bin);
+            if (!path)
+                continue;
+            const tool = {
+                name: spec.name,
+                path,
+                category: spec.category,
+            };
+            // Try to get version
+            if (spec.versionFlag) {
+                try {
+                    const output = execSync(`${bin} ${spec.versionFlag} 2>&1`, {
+                        timeout: 5000,
+                        encoding: "utf8",
+                        stdio: ["pipe", "pipe", "pipe"],
+                    });
+                    // Extract version number from first line
+                    const match = output.match(/(\d+\.\d+[\.\d]*)/);
+                    if (match)
+                        tool.version = match[1];
+                }
+                catch {
+                    // Tool exists but version check failed — still valid
+                }
+            }
+            // Check if running as service
+            if (spec.serviceCheck) {
+                try {
+                    tool.running = spec.serviceCheck();
+                }
+                catch {
+                    tool.running = false;
+                }
+            }
+            discovered.push(tool);
+            break; // Found one binary for this tool, move to next
+        }
+    }
+    return discovered;
+}
+/**
+ * Get just the tool names (for capabilities list).
+ */
+export function discoverToolNames() {
+    return discoverTools().map(t => t.name);
+}
+// ============================================================================
+// HELPERS
+// ============================================================================
+function which(binary) {
+    try {
+        const result = execSync(`which ${binary} 2>/dev/null`, {
+            timeout: 3000,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        return result || null;
+    }
+    catch {
+        return null;
+    }
+}
+function checkPort(port) {
+    try {
+        execSync(`lsof -i :${port} -sTCP:LISTEN 2>/dev/null | head -1`, {
+            timeout: 3000,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/local-agent/executor.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Local Command Executor — safely runs commands on the user's machine.
+ *
+ * Features:
+ * - Persistent sessions (cwd preserved per session_id)
+ * - Output streaming with truncation
+ * - Timeout enforcement
+ * - Background job support
+ */
+export interface ExecResult {
+    success: boolean;
+    stdout: string;
+    stderr: string;
+    exit_code: number;
+    killed: boolean;
+    cwd: string;
+    duration_ms: number;
+}
+export declare function exec(command: string, options?: {
+    session_id?: string;
+    timeout?: number;
+}): Promise<ExecResult>;
+export declare function execBackground(command: string, sessionId?: string): {
+    job_id: string;
+};
+export declare function getJobStatus(jobId: string, tail?: number): Record<string, unknown> | null;
+export declare function killJob(jobId: string): boolean;
+export declare function listJobs(): Array<Record<string, unknown>>;
+export declare function listSessions(): Array<{
+    session_id: string;
+    cwd: string;
+}>;
+export declare function resetSessions(): void;
+export declare function getSystemInfo(): Record<string, unknown>;