internal/

Package analysis is the one place a package gets analyzed.

Package baseline implements org known-good profiles and package diffing — the deterministic mechanism behind every *_CHANGED and UNEXPECTED_* detection ("unexpected relative to what?").

Package casepkg implements the sealed zone of the .adfir evidence package: content-addressed artifact storage, manifest, hash-chained collection and custody logs, and SHA256SUMS sealing/verification.

Package cli wires the agentdfir subcommands.

Package collector implements manifest-driven forensic acquisition.

Package correlate raises agent-reported/observed activity to corroborated (or contradicted) by comparing it against independent endpoint evidence (plan §16).

Injection-surface detections (plan §14): prompt-injection indicators, context/tool poisoning, invisible-Unicode instruction smuggling, and honeytoken access.

Package encrypt provides full-package encryption for .adfir packages (plan §19).

Package endpoint loads independent operating-system telemetry — the second witness for what an agent did on a machine.

Package export renders normalized findings and events into interoperability formats: STIX 2.1 bundles and OpenTelemetry (GenAI/agent semantic conventions).

Package hashchain implements tamper-evident, hash-chained JSONL logs.

Package live acquires volatile evidence in RFC 3227 order of volatility (plan §6): clock state first, then logged-in users, running processes, and network state.

Package mcpaudit inventories every MCP server an agent host is configured to load and raises supply-chain / configuration findings.

Package netdest extracts network destinations from agent-invoked shell commands so timeline, exports and detections can reason about where an agent reached out to.

Package normalize runs every registered parser over a sealed package and merges their output into one schema.Normalized result.

Package productpack implements declarative product packs: one signed JSON file that teaches AgentDFIR a new AI agent product — how to detect it, what to collect, and how to normalize its transcripts — with no Go change.

Package products embeds the product-knowledge pack: which AI agent products exist, how to detect them, and their collector manifests.

Package provenance answers "how did this line get here?" for agent instruction, memory and configuration files.

Package realtime turns the read-only transcript tail into a live sensor: new lines are normalized by the product's line parser, run through the streaming detection rules, and findings are pushed to alert sinks within one poll interval.

Package report renders a case into analyst-facing outputs.

Package rulepack implements declarative, shareable detection rules (plan §14, killer feature #4 — Sigma-style shareability).

Package sanitize neutralizes hostile content in evidence-derived strings before they reach a terminal or log.

Package schema defines the unified, vendor-neutral agent forensic schema: normalized events, entities and relationships.

Package seal provides ed25519 detached signatures over a package's SHA256SUMS (plan §7, §19).

Package serve hosts a local-only, read-only case explorer for one .adfir package: agent tree, timeline with density scrubber, evidence pane with the raw transcript line, findings, topology, and the MCP / provenance / corroboration results when present.

Package simulate generates synthetic incident scenarios — adversary emulation for AI agents.

Package supportpkg derives a privacy-reduced "support" package from a sealed forensic package (plan §4, §17).

Package unpack turns containers and archives into a directory tree the import-tree collector understands.

Package version holds build/version identity for the agentdfir binary.

Package watch implements live monitoring of agent session directories (killer feature #5): it tails growing transcript files and emits normalized event lines in real time.