@paramira/device-scanner

Home: this package lives in proto (packages/device-scanner), the public home of the hardened relay layer (proto ADR-0013). It moved here from the Rubanda apps monorepo on 2026-10-17, as its current code without that repo's history.

Heuristic threat classification from a stream of BLE/wifi device observations. Feed it { address, rssi, timestamp, advertises } as you see devices; it flags four patterns:

• passive sniffer — present constantly, never advertises a service
• strong signal — anomalously close (RSSI above -30 dBm)
• follower — the same device, seen again across separate time windows, not just once
• sybil cluster — many brand-new devices appearing together in a short window

import { createDeviceScanner } from '@paramira/device-scanner'

const scanner = createDeviceScanner()
scanner.observe({ address: 'AA:BB:CC:DD:EE:FF', rssi: -55, timestamp: Date.now(), advertises: true })

scanner.classify('AA:BB:CC:DD:EE:FF') // 'normal' | 'suspicious' | 'hostile'
scanner.getAlerts()                   // every ThreatAlert raised so far
scanner.getDevices()                  // every observed device + its classification

Not @paramira/device-link — that's linking a browser as a full paramira device (WhatsApp-Web style trust). This is nearby-radio monitoring, an unrelated concept that happens to share the word "device."

Where this came from, and an honest note on where it'd go

Ported from a censorship-resistant DIDComm messaging spike (/home/pat/dev/proto) — a factory-function port of a class with zero DIDComm/Credo coupling already.

Unlike this session's other extractions, there's no existing paramira app gap to point at here: no abantu/iwacu/isoko feature scans nearby BLE/wifi devices today. demo/mesh-monitor.mjs is honest about that — it's the shape this would take if one of those apps grew an offline/local-mesh discovery feature (the same domain proto's own DIDComm-over-BLE/LoRa work explores), not a fix for a gap that exists today.

node demo/mesh-monitor.mjs

What this doesn't address

Pure heuristics over observation counts/timing/signal strength — no actual radio-layer verification (MAC randomization defeats the address-based tracking entirely, the same way it's designed to defeat real-world BLE tracking). Good enough to flag "something about this pattern is off," not a security boundary on its own.