feat(watchdog): daemon logs every attack for triage; threatcrush watchdog to verify, fix, PR

[ralyodio]

A ban says who attacked, not whether it worked. Watchdog mode keeps every attack on disk so each one can be verified afterwards and, when it is a real hole, fixed in a PR.

What's in it

• The daemon logs every attack from its event bus to <state dir>/watchdog/attacks.jsonl (daemon/watchdog-service.ts): buffered, flushed each second and on shutdown, rotated at 50 MB, deduped. On by default; [watchdog] enabled = false turns it off, [watchdog] dir moves it. An unwritable dir is reported in status and the daemon log, never fatal.
• Shared with adm when root: /var/lib/threatcrush/watchdog is setgid 2770 root:adm, the log and triage.json are 660, the same group the IPC socket trusts. Log readers can list and mark without sudo. A user-mode daemon keeps it 700/600.
• IPC status gains watchdog: {enabled, dir, logged, answered, errored, error?}. The TUI header shows ◉ WATCHDOG 42 · 3 answered · 1 5xx from it; the TUI writes nothing itself.
• What counts as an attack: any CRS-matched web request (even below the ban threshold), or any medium+ detection from another module. Firewall notices, heartbeats and plain 4xx/5xx are not.
• log-watcher now puts the HTTP status, method and full request target (url) in web event details. Status is what separates refused (4xx) from answered (2xx, a possible hole) or errored (5xx).
• threatcrush watchdog [list|show|brief|mark|path]: findings grouped by vhost+method+path+attack type, worst outcome first; refused/triaged hidden unless --all. brief <id> prints a Markdown hand-off (samples, repro curl, verify-then-fix steps) for an issue, PR body or agent. mark <id> hole|fp|fixed --note --pr stores the verdict. Reads the system daemon's directory first, like the client prefers the system socket.

Tested

• tsc --noEmit clean; CLI vitest 49 files / 497 tests pass (new: core/__tests__/watchdog.test.ts, daemon/__tests__/watchdog-service.test.ts, view badge tests).
• Built daemon booted under a throwaway HOME: logs [watchdog] logging attacks to …, IPC status returns {"enabled":true,…}, dir created 700 in user mode.
• Built CLI against a seeded log: list ordering (answered SQLi → 5xx LFI → SSH detection → 40× refused /wp-login.php as one row), brief, mark fixed --pr dropping it from the queue, --dir before and after the subcommand.

Daemons need upgrading and restarting to start logging (and for web events to carry status).

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

17 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 8

Severity	Rule	Location
HIGH	secret-aws-access-key	prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
MEDIUM	sql-string-concatenation	.github/workflows/migrate-dev2.yml:128
MEDIUM	js-open-redirect	apps/web/src/app/auth/login/page.tsx:67
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:104
MEDIUM	js-unescaped-html-sink	apps/web/src/app/hire/page.tsx:108
MEDIUM	js-open-redirect	apps/web/src/app/invite/[token]/invite-client.tsx:55
MEDIUM	js-open-redirect	apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM	js-unescaped-html-sink	apps/web/src/components/GuideReader.tsx:265
MEDIUM	js-uninitialized-buffer	packages/scan/src/node-rules.ts:456
LOW	secret-generic-credential	apps/web/src/app/api/auth/refresh/route.ts:17
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:26
LOW	secret-generic-credential	apps/web/src/app/api/auth/reset-password/route.ts:27
LOW	secret-generic-credential	PRD.md:269
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
LOW	tls-verification-disabled	prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
LOW	sh-remote-script-execution	scripts/smoke-test.sh:72
LOW	secret-aws-access-key	scripts/smoke-test.sh:150

Snippets are redacted; ThreatCrush never prints matched credential material.