feelgoodbot 🛡️

Pronounced "Feel good, bot"

macOS file integrity monitor + TOTP step-up authentication for AI agents.

GitHub: https://github.com/kris-hansen/feelgoodbot

⭐ If you find this useful, please star the repo! It helps others discover it.

Features

1. File Integrity Monitoring — Detects tampering of system files
2. TOTP Step-Up Auth — Requires OTP for sensitive agent actions

---

Part 1: File Integrity Monitoring

Requirements

• Go 1.21+ — Install with brew install go
• macOS — Uses launchd for daemon

Quick Setup

# Install via go install
go install github.com/kris-hansen/feelgoodbot/cmd/feelgoodbot@latest

# Initialize baseline snapshot
feelgoodbot init

# Install and start daemon
feelgoodbot daemon install
feelgoodbot daemon start

# Check it's running
feelgoodbot status

Clawdbot Integration (Alerts)

Enable webhooks:

clawdbot config set hooks.enabled true
clawdbot config set hooks.token "$(openssl rand -base64 32)"
clawdbot gateway restart

Configure ~/.config/feelgoodbot/config.yaml:

scan_interval: 5m
alerts:
  clawdbot:
    enabled: true
    webhook: "http://127.0.0.1:18789/hooks/wake"
    secret: "<hooks.token from clawdbot config get hooks.token>"
  local_notification: true

What It Monitors

• System binaries (/usr/bin, /usr/sbin)
• Launch daemons/agents (persistence mechanisms)
• SSH authorized_keys, sudoers, PAM
• Shell configs (.zshrc, .bashrc)
• Browser extensions
• AI agent configs (Claude, Cursor)

---

Part 2: TOTP Step-Up Authentication

Step-up auth requires the user to enter an OTP code from Google Authenticator before the agent can perform sensitive actions.

Setup (User runs in terminal)

# Initialize TOTP (shows QR code to scan)
feelgoodbot totp init --account "user@feelgoodbot"

# Verify it works
feelgoodbot totp verify

# Check status
feelgoodbot totp status

Configure Protected Actions

# List current protected actions
feelgoodbot totp actions list

# Add actions that require step-up
feelgoodbot totp actions add "send_email"
feelgoodbot totp actions add "payment:*"
feelgoodbot totp actions add "delete:*"
feelgoodbot totp actions add "ssh:*"
feelgoodbot totp actions add "publish:*"
feelgoodbot totp actions add "gateway:*"
feelgoodbot totp actions add "voice_call:*"
feelgoodbot totp actions add "message:external"

# Remove an action
feelgoodbot totp actions remove "send_email"

TOTP Commands

Command	Description
feelgoodbot totp init	Set up TOTP with QR code
feelgoodbot totp verify [code]	Test a code
feelgoodbot totp status	Show TOTP status and session
feelgoodbot totp check <action>	Check if action needs step-up, prompt if needed
feelgoodbot totp reset	Remove TOTP config (requires code)
feelgoodbot totp backup show	Show remaining backup codes
feelgoodbot totp backup regenerate	Generate new backup codes
feelgoodbot totp actions list	List protected actions
feelgoodbot totp actions add <action>	Add protected action
feelgoodbot totp actions remove <action>	Remove protected action
feelgoodbot totp respond <code>	Submit OTP response (for async flow)

Session Caching

After successful authentication, a session is cached for 15 minutes (configurable). Subsequent actions within this window don't require re-authentication.

---

Agent Integration (IMPORTANT)

Before performing any sensitive action, the agent MUST check step-up requirements.

Action Mapping

Map your intended actions to step-up patterns:

Agent Action	Step-Up Pattern
Sending email	send_email
Making payments	payment:*
Deleting files	delete:*
SSH/remote access	ssh:*
Publishing code	publish:*
Modifying Clawdbot config	gateway:*
Making phone calls	voice_call:*
Messaging external contacts	message:external
Modifying step-up config	config:update

Step-Up Check Flow

Before executing a sensitive action:

# Check if action requires step-up (non-interactive check)
feelgoodbot totp check <action>
# Exit code 0 = proceed, Exit code 1 = denied/not authenticated

If session is valid: Command succeeds immediately (exit 0)

If step-up required and no session:

1. Agent sends Telegram message: "🔐 Action <action> requires step-up. Reply with your OTP code."
2. Wait for user to reply with 6-digit code
3. Validate: feelgoodbot totp verify <code>
4. If valid, create session and proceed
5. If invalid, deny action and notify user

Example Agent Flow (Pseudocode)

function performSensitiveAction(action, execute_fn):
    # Check step-up requirement
    result = exec("feelgoodbot totp check " + action)
    
    if result.exit_code == 0:
        # Session valid or action not protected
        execute_fn()
        return success
    
    # Need to prompt user
    send_telegram("🔐 Action '{action}' requires step-up authentication.\nReply with your OTP code from Google Authenticator.")
    
    code = wait_for_user_reply(timeout=120s)
    
    if code is None:
        send_telegram("⏰ Step-up authentication timed out. Action cancelled.")
        return denied
    
    # Validate the code
    valid = exec("feelgoodbot totp verify " + code)
    
    if valid.exit_code != 0:
        send_telegram("❌ Invalid code. Action cancelled.")
        return denied
    
    # Create session by running check again (it will pass now)
    exec("feelgoodbot totp check " + action)
    
    execute_fn()
    send_telegram("✅ Action completed.")
    return success

Quick Reference for Agent

Check before these actions:

• send_email — Before sending any email
• payment:* — Before any financial transaction
• delete:* — Before deleting files (delete:file, delete:backup, etc.)
• ssh:* — Before SSH connections
• publish:* — Before publishing/deploying
• gateway:* — Before modifying Clawdbot config
• voice_call:* — Before making phone calls
• message:external — Before messaging non-owner contacts
• config:update — Before modifying step-up config

Commands to use:

# Check and prompt (interactive)
feelgoodbot totp check send_email

# Just validate a code
feelgoodbot totp verify 123456

# Check session status
feelgoodbot totp status

---

File Locations

File	Purpose
~/.config/feelgoodbot/config.yaml	Main config
~/.config/feelgoodbot/totp.json	TOTP secret + backup codes
~/.config/feelgoodbot/stepup-config.json	Protected actions
~/.config/feelgoodbot/totp-session	Session cache
~/.config/feelgoodbot/snapshots/	File integrity baselines
~/.config/feelgoodbot/daemon.log	Daemon logs

---

Troubleshooting

TOTP code always invalid:

• Check system clock is accurate (date)
• Ensure you're using the correct authenticator entry
• Try a backup code

Step-up not prompting:

• Verify action is in protected list: feelgoodbot totp actions list
• Check TOTP is initialized: feelgoodbot totp status

Reset everything:

# Reset TOTP (requires valid code or backup code)
feelgoodbot totp reset

# Or manually remove (loses access without backup codes!)
rm ~/.config/feelgoodbot/totp.json
rm ~/.config/feelgoodbot/totp-session

---

⭐ Like feelgoodbot? Star it on GitHub: https://github.com/kris-hansen/feelgoodbot