@akasecurity/ai-tc-claude-code 0.8.1 → 0.9.0-rc1

package/scripts/intro.js

@@ -494,71 +494,15 @@ var require_ignore = __commonJS({
 // src/intro.ts
 import { readFileSync as readFileSync7 } from "fs";
 
-// src/present.ts
-var SHADE = {
-  light: "\u2591",
-  medium: "\u2592",
-  dark: "\u2593",
-  full: "\u2588"
-};
-var ANSI_RE = /\x1b\[[0-9;]*m/g;
-function visibleLength(text) {
-  return text.replace(ANSI_RE, "").length;
-}
-var fg = (hex3) => (text) => {
-  const r = Number.parseInt(hex3.slice(1, 3), 16);
-  const g = Number.parseInt(hex3.slice(3, 5), 16);
-  const b = Number.parseInt(hex3.slice(5, 7), 16);
-  return `\x1B[38;2;${String(r)};${String(g)};${String(b)}m${text}\x1B[0m`;
-};
-var paint = {
-  brand: fg("#33e6c6"),
-  // --color-brand        · ▸▸ AKA wordmark (accent text)
-  dim: fg("#838995"),
-  // --color-text-3      · separators · "/100" · the "unreviewed" label
-  bold: (text) => `\x1B[1m${text}\x1B[0m`,
-  // the health score number
-  ok: fg("#0db15f"),
-  // --color-ok          · healthy ● dot
-  critical: fg("#e63448"),
-  // --color-sev-critical · ■ and the open-findings flag
-  high: fg("#e97a0a"),
-  // --color-sev-high     · ■ and the mid-health dot
-  medium: fg("#f7bd00"),
-  // --color-sev-medium   · ■
-  low: fg("#0581d4")
-  // --color-sev-low      · ■ (azure blue, not purple)
-};
-function padEnd(text, width) {
-  const pad = width - visibleLength(text);
-  return pad > 0 ? text + " ".repeat(pad) : text;
-}
-function defList(rows, gap = 4) {
-  const labelWidth = Math.max(0, ...rows.map(([label]) => visibleLength(label)));
-  return rows.map(([label, value]) => `${padEnd(label, labelWidth)}${" ".repeat(gap)}${value}`).join("\n");
-}
-function indent(text, spaces = 2) {
-  const pad = " ".repeat(spaces);
-  return text.split("\n").map((line) => pad + line).join("\n");
-}
-function fenced(body) {
-  const longestRun = Math.max(0, ...[...body.matchAll(/`+/g)].map((m) => m[0].length));
-  const fence = "`".repeat(Math.max(3, longestRun + 1));
-  return [fence, body, fence].join("\n");
-}
-
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID8 } from "crypto";
-import { existsSync, renameSync, rmSync } from "fs";
-import { join, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
-
 // ../../packages/schema/src/exception-scope.ts
 var MINUTE_MS = 6e4;
 var HOUR_MS = 60 * MINUTE_MS;
 var MAX_TEMPORARY_MS = 24 * HOUR_MS;
 var ONCE_BACKSTOP_MS = 30 * MINUTE_MS;
 
+// ../../packages/schema/src/identity.ts
+var PRODUCT_NAME = "AKA Security";
+
 // ../../packages/schema/src/token/cost-model.ts
 var CACHE_WRITE_5M_MULT = 1.25;
 var CACHE_WRITE_1H_MULT = 2;
@@ -603,6 +547,12 @@ var PRICE_MAP = {
 };
 var CANONICAL_ANTHROPIC_MODELS = Object.keys(ANTHROPIC_PRICES);
 
+// ../../packages/schema/src/token/format.ts
+var COMPACT = new Intl.NumberFormat("en-US", {
+  notation: "compact",
+  maximumFractionDigits: 1
+});
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15181,6 +15131,12 @@ var FindingInstance = external_exports.object({
   provider: FindingProvider,
   repo: external_exports.string(),
   file: external_exports.string(),
+  // Host tool that produced the scanned text (event metadata's toolName).
+  // Present whenever the capturing hook recorded one — including
+  // file-attributed captures (views prefer `file`); its display value is
+  // the location fallback ("via Bash") when no filePath exists. Absent for
+  // legacy rows and non-tool captures (prompts, worktree scans).
+  toolName: external_exports.string().optional(),
   // Effective action: override.action ?? actionTaken, translated to FindingAction.
   action: FindingAction,
   detectedAt: external_exports.iso.datetime(),
@@ -15236,6 +15192,9 @@ var ListGroupedFindingsQuery = external_exports.object({
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   q: external_exports.string().optional(),
+  // Scope to findings whose event carries this session id (the Activity page's
+  // session → findings drilldown). Findings without a session never match.
+  sessionId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15247,7 +15206,13 @@ var ListGroupedFindingsResponse = external_exports.object({
   }),
   facets: FindingFacets,
   items: external_exports.array(FindingGroup),
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  // Present only on session-scoped queries (`sessionId` set): per ruleId, how
+  // many times that rule fired in the session's persisted transcript. Findings
+  // here are deduplicated to unique values while the transcript tally counts
+  // every firing, so the two numbers legitimately differ — this map lets a
+  // session-scoped view show both.
+  sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
 }).meta({ id: "ListGroupedFindingsResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
@@ -15289,6 +15254,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -15640,6 +15610,10 @@ var ListActivitySessionsQuery = external_exports.object({
   from: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
   /** Upper bound on startedAt; omitted defaults to now. */
   to: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
+  /** Exclude zero-activity sessions — roots whose only recorded children are
+   * bookkeeping rows (hooks, config scans), typically background `claude`
+   * launches. Omitted = list everything. `z.stringbool()` per the note above. */
+  excludeEmpty: external_exports.stringbool().optional(),
   /** Page size, 1–100; out-of-range values are a 400. `z.coerce` — query params arrive as strings. */
   limit: external_exports.coerce.number().int().min(1).max(100).default(50),
   /** Opaque pagination cursor (most-recent first). */
@@ -15648,7 +15622,11 @@ var ListActivitySessionsQuery = external_exports.object({
 var ListActivitySessionsResponse = external_exports.object({
   items: external_exports.array(ActivitySessionSummary),
   /** `null` once the last page is reached. */
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  /** Zero-activity sessions matching the query's filters/range (whether or
+   * not `excludeEmpty` dropped them from `items`) — the count a UI toggle
+   * shows when collapsing them. */
+  emptyCount: external_exports.number().int().nonnegative()
 }).meta({ id: "ListActivitySessionsResponse" });
 var ListSessionEventsQuery = external_exports.object({
   /** Default 100, range 1–500. */
@@ -15677,12 +15655,18 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
   filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
   // Set (true) by the worktree scanner when the file is excluded by the
   // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
   // generated code can leak real secrets — but the provenance is recorded so
@@ -15990,7 +15974,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -16014,7 +15998,10 @@ var ExceptionBundleEntry = DetectionException.pick({
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
-  keywords: external_exports.array(external_exports.string()).min(1),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
   caseSensitive: external_exports.boolean().default(false)
 });
 function isValidRegex(pattern, flags) {
@@ -16161,6 +16148,24 @@ var PolicyBundle = external_exports.object({
 }).meta({ id: "PolicyBundle" });
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -16186,6 +16191,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -16232,6 +16243,10 @@ var ListEventsResponse = external_exports.object({
   items: external_exports.array(Event),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListEventsResponse" });
+var IngestResponse = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+}).meta({ id: "IngestResponse" });
 var ListFindingsQuery = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
@@ -16552,6 +16567,65 @@ var ProjectFilesScan = external_exports.object({
   scannedAt: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/ranges.ts
+var TIME_RANGES = ["7d", "30d", "3m", "6m"];
+var TimeRange = external_exports.enum(TIME_RANGES).meta({ id: "TimeRange" });
+var DEFAULT_TIME_RANGE = "7d";
+var TIME_RANGE_OR_DEFAULT = TimeRange.catch(DEFAULT_TIME_RANGE);
+
+// ../../packages/schema/src/zod/remediation.ts
+var SecretFindingState = external_exports.enum(["still-valid", "unknown", "invalid"]);
+var MaskedFindingLocation = external_exports.object({
+  filePath: external_exports.string(),
+  span: Span.optional()
+}).strict();
+var MaskedSecretFinding = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  where: MaskedFindingLocation,
+  state: SecretFindingState,
+  observedAt: external_exports.iso.datetime().optional()
+}).strict();
+var RotationChecklistEntry = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  consolePath: external_exports.string(),
+  occurrenceSpread: external_exports.number().int().positive()
+}).strict();
+var RemediationOption = external_exports.enum([
+  "redact-rotation-checklist",
+  "redact-only",
+  "set-secret-redact",
+  "leave"
+]);
+var RemediationEntrySource = external_exports.enum(["first-run", "pre-push", "secret-scan"]);
+var RemediationEntryContext = external_exports.object({
+  entrySource: RemediationEntrySource
+}).strict();
+var RemediationOptionChoice = external_exports.object({
+  id: RemediationOption,
+  label: external_exports.string()
+});
+var BatchedRemediationDecision = external_exports.object({
+  kind: external_exports.literal("decision"),
+  entrySource: RemediationEntrySource,
+  secretCount: external_exports.number().int().positive(),
+  prompt: external_exports.string(),
+  options: external_exports.tuple([
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-rotation-checklist") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-only") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("set-secret-redact") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("leave") })
+  ])
+});
+var NoRemediationDecision = external_exports.object({
+  kind: external_exports.literal("no-decision")
+});
+var BatchedRemediation = external_exports.discriminatedUnion("kind", [
+  BatchedRemediationDecision,
+  NoRemediationDecision
+]);
+
 // ../../packages/schema/src/zod/rule-test.ts
 var TestRulesRequest = external_exports.object({
   rules: external_exports.array(Rule).min(1).max(100),
@@ -16610,10 +16684,8 @@ var SeveritySummaryResponse = external_exports.object({
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });
-var SECURITY_RANGES = ["7d", "30d", "3m", "6m"];
-var SecurityRange = external_exports.enum(SECURITY_RANGES).meta({ id: "SecurityRange" });
 var SecurityRangeQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d")
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE)
 });
 var EnforcementActionKind = external_exports.enum(["blocked", "redacted", "warned"]).meta({ id: "EnforcementActionKind" });
 var EnforcementAction = external_exports.object({
@@ -16623,7 +16695,7 @@ var EnforcementAction = external_exports.object({
   delta: external_exports.number().int()
 }).meta({ id: "EnforcementAction" });
 var EnforcementActionsResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   // Sum of actions[].count in the window.
   total: external_exports.number().int().nonnegative(),
   // One entry per kind, always all three present (count may be 0).
@@ -16638,7 +16710,7 @@ var FindingsTimeseriesPoint = external_exports.object({
   medium: external_exports.number().int().nonnegative()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(FindingsTimeseriesPoint)
 }).meta({ id: "FindingsTimeseriesResponse" });
@@ -16653,7 +16725,7 @@ var MttrTrendPoint = external_exports.object({
   })
 }).meta({ id: "MttrTrendPoint" });
 var MttrTrendResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(MttrTrendPoint)
 }).meta({ id: "MttrTrendResponse" });
@@ -16680,11 +16752,11 @@ var TopSource = external_exports.object({
   findingsCount: external_exports.number().int().nonnegative()
 }).meta({ id: "TopSource" });
 var TopSourcesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   items: external_exports.array(TopSource)
 }).meta({ id: "TopSourcesResponse" });
 var TopSourcesQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d"),
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE),
   limit: external_exports.coerce.number().int().min(1).max(50).default(5),
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
@@ -16697,7 +16769,7 @@ var ScanCoverageProvider = external_exports.object({
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
 var ScanCoverageResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   providers: external_exports.array(ScanCoverageProvider)
 }).meta({ id: "ScanCoverageResponse" });
 var SubjectType = external_exports.enum(["repo", "user", "team", "policy", "share", "rule"]).meta({
@@ -16746,6 +16818,114 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../../packages/schema/src/zod/setup-frame.ts
+var CalibrationCounts = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  important: external_exports.number().int().nonnegative(),
+  routine: external_exports.number().int().nonnegative()
+}).refine((c) => c.total === c.important + c.routine, {
+  message: "total must equal important + routine",
+  path: ["total"]
+});
+var FalsePositivePatternValue = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  valueFingerprint: external_exports.string(),
+  keyVersion: external_exports.number().int().nonnegative()
+});
+var FalsePositivePatternGroup = external_exports.object({
+  pattern: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  values: external_exports.array(FalsePositivePatternValue).min(1)
+});
+var CalibrationFindingKind = external_exports.object({
+  category: DetectionCategory,
+  count: external_exports.number().int().nonnegative(),
+  egress: external_exports.boolean()
+});
+var CalibrationFrame = external_exports.object({
+  counts: CalibrationCounts,
+  routineCategories: external_exports.array(DetectionCategory),
+  surfacedCategories: external_exports.array(DetectionCategory),
+  findingKinds: external_exports.array(CalibrationFindingKind),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId),
+  maskedFindings: external_exports.array(MaskedSecretFinding).optional(),
+  falsePositivePatterns: external_exports.array(FalsePositivePatternGroup).optional()
+});
+var CalibrationPreviewCategory = TriageCategoryRec.pick({
+  category: true,
+  genuineCount: true,
+  fpCount: true
+}).extend({
+  egress: external_exports.boolean()
+});
+var CalibrationPreview = external_exports.object({
+  categories: external_exports.array(CalibrationPreviewCategory),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId)
+});
+var CalibrationResult = external_exports.object({
+  frame: CalibrationFrame,
+  copy: external_exports.string()
+});
+var FirstRunCalibration = external_exports.enum(["scan", "floor"]);
+var SetupHandoffOption = external_exports.object({
+  id: external_exports.enum(["enter-remediation", "open-dashboard", "not-now"]),
+  label: external_exports.string()
+});
+var DashboardHandoffOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var ComposedRemediationOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("enter-remediation") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var SetupHandoffOffer = external_exports.object({
+  worthALook: external_exports.number().int().nonnegative(),
+  liveKeys: external_exports.number().int().nonnegative().optional(),
+  options: external_exports.union([DashboardHandoffOptions, ComposedRemediationOptions])
+}).refine(
+  (o) => o.options.some((opt) => opt.id === "enter-remediation") === (o.liveKeys ?? 0) > 0,
+  {
+    message: "the chain-entry option is present exactly when liveKeys > 0",
+    path: ["options"]
+  }
+).refine((o) => (o.liveKeys ?? 0) <= o.worthALook, {
+  message: "liveKeys is a subset of worthALook and cannot exceed it",
+  path: ["liveKeys"]
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
@@ -16885,6 +17065,16 @@ var ExportSharesQuery = external_exports.object({
   kind: external_exports.array(DestinationKind).optional()
 });
 
+// src/provenance.ts
+import { execFileSync } from "child_process";
+var USE_SHELL = process.platform === "win32";
+
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID8 } from "crypto";
+import { existsSync, renameSync, rmSync } from "fs";
+import { join, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 
@@ -16934,6 +17124,10 @@ import { join as join3 } from "path";
 import { readFileSync as readFileSync2, renameSync as renameSync4, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
 
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+
 // ../../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
   if (v === void 0) return void 0;
@@ -16955,23 +17149,30 @@ var ProviderEnvSchema = external_exports.object(providerEnvShape);
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename2, join as join7 } from "path";
+
+// ../../packages/detections/src/escape-regexp.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
-    const haystack = caseSensitive ? text : text.toLowerCase();
     const spans = [];
     for (const kw of keywords) {
-      const needle = caseSensitive ? kw : kw.toLowerCase();
-      let idx = 0;
-      while (idx < haystack.length) {
-        const pos = haystack.indexOf(needle, idx);
-        if (pos === -1) break;
-        spans.push({ start: pos, end: pos + kw.length });
-        idx = pos + 1;
+      if (kw.length === 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
     }
     return spans;
@@ -16979,7 +17180,6 @@ var KeywordMatcher2 = class {
 };
 
 // ../../packages/detections/src/matchers/regex.ts
-var MAX_MATCHES_PER_RULE = 1e4;
 var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
@@ -17063,8 +17263,8 @@ var CONFIG_POSTURE_RULES = [
 ];
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join5, sep as sep2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash3, randomUUID as randomUUID9 } from "crypto";
@@ -17076,20 +17276,82 @@ import { createHash as createHash4 } from "crypto";
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join8, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
 
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
+
+// src/command-registry.ts
+import { readdirSync as readdirSync3 } from "fs";
+import { fileURLToPath } from "url";
+var COMMANDS_DIR = fileURLToPath(new URL("../commands", import.meta.url));
+
+// src/setup-show.ts
+var SHOW_BEGIN = "<<<AKA_SHOW";
+var SHOW_END = "AKA_SHOW>>>";
+function showBlock(body) {
+  return `${SHOW_BEGIN}
+${body}
+${SHOW_END}
+`;
+}
+
+// src/present.ts
+var SHADE = {
+  light: "\u2591",
+  medium: "\u2592",
+  dark: "\u2593",
+  full: "\u2588"
+};
+var fg = (hex3) => (text) => {
+  const r = Number.parseInt(hex3.slice(1, 3), 16);
+  const g = Number.parseInt(hex3.slice(3, 5), 16);
+  const b = Number.parseInt(hex3.slice(5, 7), 16);
+  return `\x1B[38;2;${String(r)};${String(g)};${String(b)}m${text}\x1B[0m`;
+};
+var paint = {
+  brand: fg("#33e6c6"),
+  // --color-brand        · ▸▸ AKA wordmark (accent text)
+  dim: fg("#838995"),
+  // --color-text-3      · separators · "/100" · the "unreviewed" label
+  bold: (text) => `\x1B[1m${text}\x1B[0m`,
+  // the health score number
+  ok: fg("#0db15f"),
+  // --color-ok          · healthy ● dot
+  critical: fg("#e63448"),
+  // --color-sev-critical · ■ and the open-findings flag
+  high: fg("#e97a0a"),
+  // --color-sev-high     · ■ and the mid-health dot
+  medium: fg("#f7bd00"),
+  // --color-sev-medium   · ■
+  low: fg("#0581d4")
+  // --color-sev-low      · ■ (azure blue, not purple)
+};
+function indent(text, spaces = 2) {
+  const pad = " ".repeat(spaces);
+  return text.split("\n").map((line) => pad + line).join("\n");
+}
+function fenced(body) {
+  const longestRun = Math.max(0, ...[...body.matchAll(/`+/g)].map((m) => m[0].length));
+  const fence = "`".repeat(Math.max(3, longestRun + 1));
+  return [fence, body, fence].join("\n");
+}
+function show(body) {
+  return showBlock(body);
+}
 
 // src/render.ts
 var SEVERITY_GLYPH = {
@@ -17098,48 +17360,44 @@ var SEVERITY_GLYPH = {
   medium: SHADE.medium,
   low: SHADE.light
 };
+var CATEGORY_ORDER = DetectionCategory.options;
 function renderSetupIntro(meta3) {
-  const heading = `\u25CF Found ${meta3.name} \u2014 ${meta3.tagline}`;
-  const details = defList([
-    ["Repository", meta3.repository],
-    ["Version", `${meta3.version} \xB7 ${meta3.publisher}`],
-    ["Adds", meta3.adds]
-  ]);
-  const ask = "Before installing I'll ask two quick questions to tailor the setup.";
-  return [heading, "", indent(details), "", indent(ask)].join("\n");
+  const provenance = meta3.verified === true ? `v${meta3.version} \xB7 ${meta3.repository} \xB7 verified` : `v${meta3.version} \xB7 ${meta3.repository}`;
+  const heading = `\u25CF ${meta3.name}  \xB7  ${provenance}`;
+  return [
+    heading,
+    "",
+    indent("I'm a security harness for Claude."),
+    "",
+    indent(
+      "While it codes, I keep the sensitive information \u2014 secrets, keys, regulated data \u2014 safely on your machine."
+    ),
+    indent("Most of it I handle quietly; I only notify you when it's worth your call.")
+  ].join("\n");
 }
 
-// src/intro.ts
-var NAME = "AKA Security";
-var TAGLINE = "Agent Harness Security for Claude Code.";
-var ADDS = "Secures your local environment to prevent secret leakage and vulnerabilities.";
+// src/intro-card.ts
 function repoLabel(homepage) {
   if (!homepage) return "";
   const stripped = homepage.replace(/^https?:\/\//, "");
   const parts = stripped.split("/");
   return parts.length >= 3 ? parts.slice(0, 3).join("/") : stripped;
 }
-function authorName(author) {
-  if (typeof author === "string") return author;
-  return author?.name ?? "";
+function buildIntroCard(manifest2, verified) {
+  return renderSetupIntro({
+    name: PRODUCT_NAME,
+    repository: repoLabel(manifest2.homepage),
+    version: manifest2.version ?? "",
+    verified: verified === true
+  });
 }
+
+// src/intro.ts
 var manifestPath = process.argv[2];
 var manifest = {};
 try {
   manifest = JSON.parse(readFileSync7(manifestPath ?? "", "utf8"));
 } catch {
 }
-process.stdout.write(
-  `${fenced(
-    renderSetupIntro({
-      name: NAME,
-      tagline: TAGLINE,
-      repository: repoLabel(manifest.homepage),
-      version: manifest.version ?? "",
-      publisher: authorName(manifest.author),
-      adds: ADDS
-    })
-  )}
-`
-);
+process.stdout.write(show(fenced(buildIntroCard(manifest))));
 process.exit(0);