claude-watchman

OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.

ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.

ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.

claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)

EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.

OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.

OBSERVE: disk, inodes, memory, and log store size against configured thresholds. Handles both Linux (free/journalctl) and macOS (vm_stat/Unified Log).

OBSERVE: on a server, hunt inbound attack patterns; on a workstation, watch outbound connections. Queries CrowdSec where present, degrades gracefully when not.

ANALYZE: crash and OOM postmortem. Linux: journalctl across boots. macOS: DiagnosticReports and Unified Log jetsam events.

OBSERVE: are logs kept, persistent across boots, and rotated? Handles both Linux journald and macOS Unified Log.

OBSERVE: are the defenses being kept CURRENT? Pending security updates / known-CVE packages, threat-intel freshness (CrowdSec hub, ClamAV signatures, AIDE db), and whether the auto-update automation is even on — across Debian/RHEL/Arch. Detect + propose; never auto-applies.

OBSERVE: inventory what is installed and how it serves — web server, database, php-fpm — so other skills know what surface exists to check.

EXPRESS: email the operator via SMTP when the delta crosses a threshold. A quiet machine sends nothing. Credentials come only from .env via lib/smtp.sh.

OBSERVE: detect whether the forensic trail has been WIPED — shell history (all users + root) redirected to /dev/null, history-disabled in a shell rc, world-readable, or login records (wtmp) truncated. Metadata only — never reads what users typed.

OBSERVE (cPanel/WHM only): wrap the cPanel control plane read-only — cPHulk on?, EOL PHP per account, update cadence/tier, Exim outbound-spam queue, orphaned CSF, Imunify detections, altered cPanel RPMs. Self-gates to a no-op off cPanel boxes. Detect + propose; never edits cPanel config or applies a fix.

OBSERVE: index every web vhost/server block — config file+line, CORS policy, security headers, log paths — and journal per-site findings so the audit can reference each site and the fixer can maintain the exact directive.

OBSERVE: discover the host's OWN defensive tooling and bring it into scope — fail2ban, sshguard, CrowdSec, rkhunter, chkrootkit, auditd, ClamAV, AIDE, debsecan/arch-audit, wazuh/ossec. Reports what is present, whether it is actually effective, and flags a whole class of defense that is missing. Read-only; never installs or enables anything.

ANALYZE: the delta engine. Dedup is automatic via the fingerprint; this computes what CHANGED since the last run — new high-severity findings and regressions — and writes a run summary.

ANALYZE: severity scoring against the baseline and profile, so the report leads with what actually matters on THIS machine.

EXPRESS: a human-readable summary of journal state — open, regressed, fixed, ignored — leading with what matters most. Read-only.

EXPRESS: privacy-respecting web-traffic analytics from the server's own access logs — page views, unique visitors, top pages, referrers, status mix, bots-vs-humans, daily trend. On-demand only; never part of the loop. A GDPR-friendly alternative to third-party analytics.