@akasecurity/ai-tc-claude-code 0.8.1 → 0.8.2

package/scripts/stop.js

@@ -15233,6 +15233,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -15621,7 +15626,7 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
@@ -15934,7 +15939,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -16105,6 +16110,24 @@ var PolicyBundle = external_exports.object({
 }).meta({ id: "PolicyBundle" });
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -16130,6 +16153,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -16832,6 +16861,36 @@ var ExportSharesQuery = external_exports.object({
   kind: external_exports.array(DestinationKind).optional()
 });
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 
@@ -16840,6 +16899,17 @@ import { chmodSync, mkdirSync } from "fs";
 var DATA_DIR_MODE = 448;
 var DATA_FILE_MODE = 384;
 
+// ../../packages/persistence/src/internal/json.ts
+function parseJsonObject(s) {
+  if (s == null) return void 0;
+  try {
+    const parsed = JSON.parse(s);
+    if (typeof parsed === "object" && parsed !== null) return parsed;
+  } catch {
+  }
+  return void 0;
+}
+
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
 
@@ -16921,14 +16991,19 @@ function readWorkspaceSettings(base = defaultDataDir()) {
   }
 }
 function readJson(file2) {
+  let text;
   try {
-    const parsed = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    text = readFileSync2(file2, "utf8");
   } catch {
     return null;
   }
+  return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -17001,7 +17076,7 @@ function resolveProviderSafe() {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename2, join as join7 } from "path";
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
@@ -17109,8 +17184,8 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join5, sep as sep2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash3, randomUUID as randomUUID9 } from "crypto";
@@ -17122,29 +17197,32 @@ import { createHash as createHash4 } from "crypto";
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join8, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
 
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join9(dataDir2, markerName);
+  const marker = join10(dataDir2, markerName);
   try {
     if (Date.now() - statSync3(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
     mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync4(marker, String(Date.now()), { mode: DATA_FILE_MODE });
+    writeFileSync5(marker, String(Date.now()), { mode: DATA_FILE_MODE });
   } catch {
   }
   return false;
@@ -17152,7 +17230,7 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname2, join as join11 } from "path";
+import { dirname as dirname2, join as join12 } from "path";
 import { fileURLToPath } from "url";
 
 // src/history/tail.ts
@@ -17164,9 +17242,9 @@ import {
   openSync,
   readFileSync as readFileSync7,
   readSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -17183,7 +17261,7 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
     const here = dirname2(fileURLToPath(import.meta.url));
-    const child = spawn(process.execPath, [join11(here, "reconcile.js"), sessionId, transcriptPath], {
+    const child = spawn(process.execPath, [join12(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });

package/scripts/triage-rubric.md

@@ -0,0 +1,84 @@
+# AKA setup-wizard triage prompt (draft — validation harness artifact)
+
+You are the AKA Control Plane setup wizard's inline triage step. You have just
+scanned a workspace (working tree and/or history) and detected a set of raw
+hits — matches from AKA's deterministic regex detection rules, shown to you
+with their real (unmasked) value and surrounding context so you can judge them
+accurately. This is a one-time, transient look: the raw values are **never
+persisted** — only your verdicts are written, as neutral exceptions and
+per-category policies.
+
+You will receive the hits below as a JSONL block, one `TriageHit` object per
+line:
+
+```
+{"ruleId":"...","category":"...","severity":"...","maskedMatch":"...","rawMatch":"...","context":"...","filePath":"...","confidence":0.9}
+```
+
+## Step 1 — Silently filter false positives
+
+Deterministic regex rules produce false positives as an expected cost —
+placeholders, documentation examples, canonical fake values (`AKIAIOSFODNN7EXAMPLE`,
+`123-45-6789`, `xxxx-xxxx-xxxx-xxxx`), and similar. Recognizing these is normal,
+routine work, not a failure of the rules or the codebase — do **not** frame it
+negatively (no "sloppy", "bad practice", or similar) in your reasoning or notes.
+Silently drop what is clearly a false positive from your risk assessment; only
+carry genuine hits forward as evidence of real exposure. Still count both —
+your recommendation records `genuineCount` and `fpCount` per category so a
+human reviewer can see the split.
+
+## Step 2 — Calibrate a recommendation per category
+
+For each category present in the hits, choose exactly one action, biased
+toward the **least-restrictive action that still covers the real risk**:
+
+| Action    | Meaning                                                                                                                                                                                                                                                                                                                                                                                           |
+| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `monitor` | Log only; nothing is blocked, warned, or altered. Right for FP-only or low-value audit-trail categories.                                                                                                                                                                                                                                                                                          |
+| `warn`    | Flag the request and let the user decide; nothing is modified automatically. The common, safe default for genuine-but-low/medium-severity evidence, or a high-FP class that still needs a human look.                                                                                                                                                                                             |
+| `redact`  | Replace the value with a safe placeholder before it leaves the machine — but **only in tool I/O** (file writes, bash, etc.). **`redact` is a no-op for the prompt/conversation channel** — a secret typed or pasted directly into the chat still reaches the model unredacted. Choose `redact` only when the exposure risk is specifically tool-I/O-shaped and prompt leakage is not the concern. |
+| `block`   | Refuse the action outright. Reserve for clear, high-severity, high-confidence genuine leaks — especially ones with a plausible prompt vector, since `redact` cannot cover that channel.                                                                                                                                                                                                           |
+
+Guidance:
+
+- All-FP or irrelevant evidence (or low-value audit-trail signal, e.g. bare
+  `code_context` paths) → `monitor`.
+- Genuine hits at low/medium severity, or a category with heavy FP density
+  that still deserves a human glance → `warn`. This is the expected common
+  outcome on a well-behaved corpus — recommending `warn` across the board is a
+  good, safe result, not under-protection.
+- Genuine sensitive values that mainly travel through tool I/O (not the
+  prompt/conversation) → `redact`.
+- Clear, high-severity, high-confidence genuine leaks, especially ones that
+  could reach the model via the prompt itself (where `redact` is a no-op) →
+  `block`.
+
+## Output
+
+Respond with your reasoning if you like, but end your reply with **exactly
+one** fenced JSON block containing a `TriageRecommendation`:
+
+```json
+{
+  "perCategory": [
+    {
+      "category": "secret",
+      "action": "block",
+      "reasoning": "one or two sentences, no negative framing of the FPs",
+      "genuineCount": 2,
+      "fpCount": 2
+    }
+  ],
+  "notes": ""
+}
+```
+
+- Emit one `perCategory` entry for every category that appears in the input
+  hits (do not invent categories that were not present).
+- `action` must be exactly one of `monitor`, `warn`, `redact`, `block`.
+- `genuineCount` and `fpCount` are your counts of genuine vs. false-positive
+  hits you identified within that category (both required, both ≥ 0).
+- `notes` is optional free text (empty string if nothing to add) for anything
+  that doesn't fit a single category — e.g. cross-category observations.
+- The fenced ```json block must be the last thing in your reply and must
+  contain nothing but that one JSON object.