@akasecurity/ai-tc-claude-code 0.8.1 → 0.9.0-rc1

package/scripts/stop.js

@@ -547,6 +547,12 @@ var PRICE_MAP = {
 };
 var CANONICAL_ANTHROPIC_MODELS = Object.keys(ANTHROPIC_PRICES);
 
+// ../../packages/schema/src/token/format.ts
+var COMPACT = new Intl.NumberFormat("en-US", {
+  notation: "compact",
+  maximumFractionDigits: 1
+});
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15125,6 +15131,12 @@ var FindingInstance = external_exports.object({
   provider: FindingProvider,
   repo: external_exports.string(),
   file: external_exports.string(),
+  // Host tool that produced the scanned text (event metadata's toolName).
+  // Present whenever the capturing hook recorded one — including
+  // file-attributed captures (views prefer `file`); its display value is
+  // the location fallback ("via Bash") when no filePath exists. Absent for
+  // legacy rows and non-tool captures (prompts, worktree scans).
+  toolName: external_exports.string().optional(),
   // Effective action: override.action ?? actionTaken, translated to FindingAction.
   action: FindingAction,
   detectedAt: external_exports.iso.datetime(),
@@ -15180,6 +15192,9 @@ var ListGroupedFindingsQuery = external_exports.object({
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   q: external_exports.string().optional(),
+  // Scope to findings whose event carries this session id (the Activity page's
+  // session → findings drilldown). Findings without a session never match.
+  sessionId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15191,7 +15206,13 @@ var ListGroupedFindingsResponse = external_exports.object({
   }),
   facets: FindingFacets,
   items: external_exports.array(FindingGroup),
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  // Present only on session-scoped queries (`sessionId` set): per ruleId, how
+  // many times that rule fired in the session's persisted transcript. Findings
+  // here are deduplicated to unique values while the transcript tally counts
+  // every firing, so the two numbers legitimately differ — this map lets a
+  // session-scoped view show both.
+  sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
 }).meta({ id: "ListGroupedFindingsResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
@@ -15233,6 +15254,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -15584,6 +15610,10 @@ var ListActivitySessionsQuery = external_exports.object({
   from: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
   /** Upper bound on startedAt; omitted defaults to now. */
   to: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
+  /** Exclude zero-activity sessions — roots whose only recorded children are
+   * bookkeeping rows (hooks, config scans), typically background `claude`
+   * launches. Omitted = list everything. `z.stringbool()` per the note above. */
+  excludeEmpty: external_exports.stringbool().optional(),
   /** Page size, 1–100; out-of-range values are a 400. `z.coerce` — query params arrive as strings. */
   limit: external_exports.coerce.number().int().min(1).max(100).default(50),
   /** Opaque pagination cursor (most-recent first). */
@@ -15592,7 +15622,11 @@ var ListActivitySessionsQuery = external_exports.object({
 var ListActivitySessionsResponse = external_exports.object({
   items: external_exports.array(ActivitySessionSummary),
   /** `null` once the last page is reached. */
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  /** Zero-activity sessions matching the query's filters/range (whether or
+   * not `excludeEmpty` dropped them from `items`) — the count a UI toggle
+   * shows when collapsing them. */
+  emptyCount: external_exports.number().int().nonnegative()
 }).meta({ id: "ListActivitySessionsResponse" });
 var ListSessionEventsQuery = external_exports.object({
   /** Default 100, range 1–500. */
@@ -15621,12 +15655,18 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
   filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
   // Set (true) by the worktree scanner when the file is excluded by the
   // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
   // generated code can leak real secrets — but the provenance is recorded so
@@ -15934,7 +15974,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -15958,7 +15998,10 @@ var ExceptionBundleEntry = DetectionException.pick({
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
-  keywords: external_exports.array(external_exports.string()).min(1),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
   caseSensitive: external_exports.boolean().default(false)
 });
 function isValidRegex(pattern, flags) {
@@ -16105,6 +16148,24 @@ var PolicyBundle = external_exports.object({
 }).meta({ id: "PolicyBundle" });
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -16130,6 +16191,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -16176,6 +16243,10 @@ var ListEventsResponse = external_exports.object({
   items: external_exports.array(Event),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListEventsResponse" });
+var IngestResponse = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+}).meta({ id: "IngestResponse" });
 var ListFindingsQuery = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
@@ -16499,6 +16570,65 @@ var ProjectFilesScan = external_exports.object({
   scannedAt: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/ranges.ts
+var TIME_RANGES = ["7d", "30d", "3m", "6m"];
+var TimeRange = external_exports.enum(TIME_RANGES).meta({ id: "TimeRange" });
+var DEFAULT_TIME_RANGE = "7d";
+var TIME_RANGE_OR_DEFAULT = TimeRange.catch(DEFAULT_TIME_RANGE);
+
+// ../../packages/schema/src/zod/remediation.ts
+var SecretFindingState = external_exports.enum(["still-valid", "unknown", "invalid"]);
+var MaskedFindingLocation = external_exports.object({
+  filePath: external_exports.string(),
+  span: Span.optional()
+}).strict();
+var MaskedSecretFinding = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  where: MaskedFindingLocation,
+  state: SecretFindingState,
+  observedAt: external_exports.iso.datetime().optional()
+}).strict();
+var RotationChecklistEntry = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  consolePath: external_exports.string(),
+  occurrenceSpread: external_exports.number().int().positive()
+}).strict();
+var RemediationOption = external_exports.enum([
+  "redact-rotation-checklist",
+  "redact-only",
+  "set-secret-redact",
+  "leave"
+]);
+var RemediationEntrySource = external_exports.enum(["first-run", "pre-push", "secret-scan"]);
+var RemediationEntryContext = external_exports.object({
+  entrySource: RemediationEntrySource
+}).strict();
+var RemediationOptionChoice = external_exports.object({
+  id: RemediationOption,
+  label: external_exports.string()
+});
+var BatchedRemediationDecision = external_exports.object({
+  kind: external_exports.literal("decision"),
+  entrySource: RemediationEntrySource,
+  secretCount: external_exports.number().int().positive(),
+  prompt: external_exports.string(),
+  options: external_exports.tuple([
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-rotation-checklist") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-only") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("set-secret-redact") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("leave") })
+  ])
+});
+var NoRemediationDecision = external_exports.object({
+  kind: external_exports.literal("no-decision")
+});
+var BatchedRemediation = external_exports.discriminatedUnion("kind", [
+  BatchedRemediationDecision,
+  NoRemediationDecision
+]);
+
 // ../../packages/schema/src/zod/rule-test.ts
 var TestRulesRequest = external_exports.object({
   rules: external_exports.array(Rule).min(1).max(100),
@@ -16557,10 +16687,8 @@ var SeveritySummaryResponse = external_exports.object({
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });
-var SECURITY_RANGES = ["7d", "30d", "3m", "6m"];
-var SecurityRange = external_exports.enum(SECURITY_RANGES).meta({ id: "SecurityRange" });
 var SecurityRangeQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d")
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE)
 });
 var EnforcementActionKind = external_exports.enum(["blocked", "redacted", "warned"]).meta({ id: "EnforcementActionKind" });
 var EnforcementAction = external_exports.object({
@@ -16570,7 +16698,7 @@ var EnforcementAction = external_exports.object({
   delta: external_exports.number().int()
 }).meta({ id: "EnforcementAction" });
 var EnforcementActionsResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   // Sum of actions[].count in the window.
   total: external_exports.number().int().nonnegative(),
   // One entry per kind, always all three present (count may be 0).
@@ -16585,7 +16713,7 @@ var FindingsTimeseriesPoint = external_exports.object({
   medium: external_exports.number().int().nonnegative()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(FindingsTimeseriesPoint)
 }).meta({ id: "FindingsTimeseriesResponse" });
@@ -16600,7 +16728,7 @@ var MttrTrendPoint = external_exports.object({
   })
 }).meta({ id: "MttrTrendPoint" });
 var MttrTrendResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(MttrTrendPoint)
 }).meta({ id: "MttrTrendResponse" });
@@ -16627,11 +16755,11 @@ var TopSource = external_exports.object({
   findingsCount: external_exports.number().int().nonnegative()
 }).meta({ id: "TopSource" });
 var TopSourcesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   items: external_exports.array(TopSource)
 }).meta({ id: "TopSourcesResponse" });
 var TopSourcesQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d"),
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE),
   limit: external_exports.coerce.number().int().min(1).max(50).default(5),
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
@@ -16644,7 +16772,7 @@ var ScanCoverageProvider = external_exports.object({
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
 var ScanCoverageResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   providers: external_exports.array(ScanCoverageProvider)
 }).meta({ id: "ScanCoverageResponse" });
 var SubjectType = external_exports.enum(["repo", "user", "team", "policy", "share", "rule"]).meta({
@@ -16693,6 +16821,114 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../../packages/schema/src/zod/setup-frame.ts
+var CalibrationCounts = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  important: external_exports.number().int().nonnegative(),
+  routine: external_exports.number().int().nonnegative()
+}).refine((c) => c.total === c.important + c.routine, {
+  message: "total must equal important + routine",
+  path: ["total"]
+});
+var FalsePositivePatternValue = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  valueFingerprint: external_exports.string(),
+  keyVersion: external_exports.number().int().nonnegative()
+});
+var FalsePositivePatternGroup = external_exports.object({
+  pattern: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  values: external_exports.array(FalsePositivePatternValue).min(1)
+});
+var CalibrationFindingKind = external_exports.object({
+  category: DetectionCategory,
+  count: external_exports.number().int().nonnegative(),
+  egress: external_exports.boolean()
+});
+var CalibrationFrame = external_exports.object({
+  counts: CalibrationCounts,
+  routineCategories: external_exports.array(DetectionCategory),
+  surfacedCategories: external_exports.array(DetectionCategory),
+  findingKinds: external_exports.array(CalibrationFindingKind),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId),
+  maskedFindings: external_exports.array(MaskedSecretFinding).optional(),
+  falsePositivePatterns: external_exports.array(FalsePositivePatternGroup).optional()
+});
+var CalibrationPreviewCategory = TriageCategoryRec.pick({
+  category: true,
+  genuineCount: true,
+  fpCount: true
+}).extend({
+  egress: external_exports.boolean()
+});
+var CalibrationPreview = external_exports.object({
+  categories: external_exports.array(CalibrationPreviewCategory),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId)
+});
+var CalibrationResult = external_exports.object({
+  frame: CalibrationFrame,
+  copy: external_exports.string()
+});
+var FirstRunCalibration = external_exports.enum(["scan", "floor"]);
+var SetupHandoffOption = external_exports.object({
+  id: external_exports.enum(["enter-remediation", "open-dashboard", "not-now"]),
+  label: external_exports.string()
+});
+var DashboardHandoffOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var ComposedRemediationOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("enter-remediation") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var SetupHandoffOffer = external_exports.object({
+  worthALook: external_exports.number().int().nonnegative(),
+  liveKeys: external_exports.number().int().nonnegative().optional(),
+  options: external_exports.union([DashboardHandoffOptions, ComposedRemediationOptions])
+}).refine(
+  (o) => o.options.some((opt) => opt.id === "enter-remediation") === (o.liveKeys ?? 0) > 0,
+  {
+    message: "the chain-entry option is present exactly when liveKeys > 0",
+    path: ["options"]
+  }
+).refine((o) => (o.liveKeys ?? 0) <= o.worthALook, {
+  message: "liveKeys is a subset of worthALook and cannot exceed it",
+  path: ["liveKeys"]
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
@@ -16840,6 +17076,17 @@ import { chmodSync, mkdirSync } from "fs";
 var DATA_DIR_MODE = 448;
 var DATA_FILE_MODE = 384;
 
+// ../../packages/persistence/src/internal/json.ts
+function parseJsonObject(s) {
+  if (s == null) return void 0;
+  try {
+    const parsed = JSON.parse(s);
+    if (typeof parsed === "object" && parsed !== null) return parsed;
+  } catch {
+  }
+  return void 0;
+}
+
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
 
@@ -16921,14 +17168,19 @@ function readWorkspaceSettings(base = defaultDataDir()) {
   }
 }
 function readJson(file2) {
+  let text;
   try {
-    const parsed = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    text = readFileSync2(file2, "utf8");
   } catch {
     return null;
   }
+  return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -17001,23 +17253,30 @@ function resolveProviderSafe() {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename2, join as join7 } from "path";
+
+// ../../packages/detections/src/escape-regexp.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
-    const haystack = caseSensitive ? text : text.toLowerCase();
     const spans = [];
     for (const kw of keywords) {
-      const needle = caseSensitive ? kw : kw.toLowerCase();
-      let idx = 0;
-      while (idx < haystack.length) {
-        const pos = haystack.indexOf(needle, idx);
-        if (pos === -1) break;
-        spans.push({ start: pos, end: pos + kw.length });
-        idx = pos + 1;
+      if (kw.length === 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
     }
     return spans;
@@ -17025,7 +17284,6 @@ var KeywordMatcher2 = class {
 };
 
 // ../../packages/detections/src/matchers/regex.ts
-var MAX_MATCHES_PER_RULE = 1e4;
 var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
@@ -17109,8 +17367,8 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join5, sep as sep2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash3, randomUUID as randomUUID9 } from "crypto";
@@ -17122,29 +17380,32 @@ import { createHash as createHash4 } from "crypto";
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join8, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
 
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 function throttled(dataDir2, markerName, windowMs) {
-  const marker = join9(dataDir2, markerName);
+  const marker = join10(dataDir2, markerName);
   try {
     if (Date.now() - statSync3(marker).mtimeMs < windowMs) return true;
   } catch {
   }
   try {
     mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync4(marker, String(Date.now()), { mode: DATA_FILE_MODE });
+    writeFileSync5(marker, String(Date.now()), { mode: DATA_FILE_MODE });
   } catch {
   }
   return false;
@@ -17152,7 +17413,7 @@ function throttled(dataDir2, markerName, windowMs) {
 
 // src/history/reconcile-trigger.ts
 import { spawn } from "child_process";
-import { dirname as dirname2, join as join11 } from "path";
+import { dirname as dirname2, join as join12 } from "path";
 import { fileURLToPath } from "url";
 
 // src/history/tail.ts
@@ -17164,9 +17425,9 @@ import {
   openSync,
   readFileSync as readFileSync7,
   readSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
 function safeSessionId(sessionId) {
   if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
@@ -17183,7 +17444,7 @@ function triggerReconcile(dataDir2, sessionId, transcriptPath) {
     const marker = `${RECONCILE_MARKER_PREFIX}-${safeSessionId(sessionId)}`;
     if (throttled(dataDir2, marker, RECONCILE_THROTTLE_MS)) return;
     const here = dirname2(fileURLToPath(import.meta.url));
-    const child = spawn(process.execPath, [join11(here, "reconcile.js"), sessionId, transcriptPath], {
+    const child = spawn(process.execPath, [join12(here, "reconcile.js"), sessionId, transcriptPath], {
       detached: true,
       stdio: "ignore"
     });