feat(integration-crowdstrike): endpoint block event poller (Stage 1)

[KunalSin9h]

What

Adds safedep integration crowdstrike run, a cursor-based poller that streams SafeDep endpoint package-guard block events and, in this stage, logs them. Two signals, treated as one stream tagged by action:

• Malicious package blocks (PmgPackageAction.BLOCKED)
• Dependency cooldown blocks (PmgPackageAction.COOLDOWN_BLOCKED)

This is Stage 1 (poll + log). Stage 2 (push to CrowdStrike SIEM) and Stage 3 are future work — the sink is a port from day one, so Stage 2 is a new adapter plus one wiring line.

How

• Source: EndpointManagementService.ListEndpointPackageGuardEvents over the control plane (a.ControlPlane(), OAuth), the same service the safedep endpoint commands use. Filtered server-side to PACKAGE_DECISION + the two block actions, ascending by event time.
• Cursor: profile-scoped KV watermark on event.Timestamp with EventId boundary dedup (the API doesn't document TimeRange.Start inclusivity, so we're correct either way). TimeRange requires both Start and End and rejects start >= end, so End is capped at now per drain.
• Sink port (eventSink): printClient adapter logs each event — JSONL on stdout under -o json, human line on stderr otherwise. Swapping in a crowdstrikeClient (Stage 2) changes nothing in the source/service/cursor.
• Mirrors the jfrog integration patterns (reporter, cursor store, poll loop, cursor set/remove verbs). jfrog is untouched (copied the small generic pieces rather than refactor a shipped feature).

Auth

Control-plane OAuth: safedep auth login (device flow). An API-key-only login does not work for this service.

Tests / checks

• go build ./..., go vet, golangci-lint (0 issues), and the full internal/cmd/... suite incl. the cobra convention tests — all green.
• Unit tests cover: request shape (both actions, ascending, page size, start<end), multi-page token walk, cursor advance + EventId dedup, backfill, first-run anchor, PermissionDenied→not-entitled, Unauthenticated→auth error, callback-error wrap, infra-retry, and event→JSON/human mapping for both actions.

Notes for reviewers

• docs/integration-crowdstrike-spec.md is the design record (staging, decisions, open items).
• Draft: pending a live end-to-end run against a tenant with the endpoint add-on.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}