@akasecurity/ai-tc-claude-code 0.8.2 → 0.9.0

package/scripts/stop.js

@@ -547,6 +547,12 @@ var PRICE_MAP = {
 };
 var CANONICAL_ANTHROPIC_MODELS = Object.keys(ANTHROPIC_PRICES);
 
+// ../../packages/schema/src/token/format.ts
+var COMPACT = new Intl.NumberFormat("en-US", {
+  notation: "compact",
+  maximumFractionDigits: 1
+});
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -15125,6 +15131,12 @@ var FindingInstance = external_exports.object({
   provider: FindingProvider,
   repo: external_exports.string(),
   file: external_exports.string(),
+  // Host tool that produced the scanned text (event metadata's toolName).
+  // Present whenever the capturing hook recorded one — including
+  // file-attributed captures (views prefer `file`); its display value is
+  // the location fallback ("via Bash") when no filePath exists. Absent for
+  // legacy rows and non-tool captures (prompts, worktree scans).
+  toolName: external_exports.string().optional(),
   // Effective action: override.action ?? actionTaken, translated to FindingAction.
   action: FindingAction,
   detectedAt: external_exports.iso.datetime(),
@@ -15180,6 +15192,9 @@ var ListGroupedFindingsQuery = external_exports.object({
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   q: external_exports.string().optional(),
+  // Scope to findings whose event carries this session id (the Activity page's
+  // session → findings drilldown). Findings without a session never match.
+  sessionId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15191,7 +15206,13 @@ var ListGroupedFindingsResponse = external_exports.object({
   }),
   facets: FindingFacets,
   items: external_exports.array(FindingGroup),
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  // Present only on session-scoped queries (`sessionId` set): per ruleId, how
+  // many times that rule fired in the session's persisted transcript. Findings
+  // here are deduplicated to unique values while the transcript tally counts
+  // every firing, so the two numbers legitimately differ — this map lets a
+  // session-scoped view show both.
+  sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
 }).meta({ id: "ListGroupedFindingsResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
@@ -15589,6 +15610,10 @@ var ListActivitySessionsQuery = external_exports.object({
   from: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
   /** Upper bound on startedAt; omitted defaults to now. */
   to: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
+  /** Exclude zero-activity sessions — roots whose only recorded children are
+   * bookkeeping rows (hooks, config scans), typically background `claude`
+   * launches. Omitted = list everything. `z.stringbool()` per the note above. */
+  excludeEmpty: external_exports.stringbool().optional(),
   /** Page size, 1–100; out-of-range values are a 400. `z.coerce` — query params arrive as strings. */
   limit: external_exports.coerce.number().int().min(1).max(100).default(50),
   /** Opaque pagination cursor (most-recent first). */
@@ -15597,7 +15622,11 @@ var ListActivitySessionsQuery = external_exports.object({
 var ListActivitySessionsResponse = external_exports.object({
   items: external_exports.array(ActivitySessionSummary),
   /** `null` once the last page is reached. */
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  /** Zero-activity sessions matching the query's filters/range (whether or
+   * not `excludeEmpty` dropped them from `items`) — the count a UI toggle
+   * shows when collapsing them. */
+  emptyCount: external_exports.number().int().nonnegative()
 }).meta({ id: "ListActivitySessionsResponse" });
 var ListSessionEventsQuery = external_exports.object({
   /** Default 100, range 1–500. */
@@ -15632,6 +15661,12 @@ var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
   filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
   // Set (true) by the worktree scanner when the file is excluded by the
   // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
   // generated code can leak real secrets — but the provenance is recorded so
@@ -15963,7 +15998,10 @@ var ExceptionBundleEntry = DetectionException.pick({
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
-  keywords: external_exports.array(external_exports.string()).min(1),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
   caseSensitive: external_exports.boolean().default(false)
 });
 function isValidRegex(pattern, flags) {
@@ -16205,6 +16243,10 @@ var ListEventsResponse = external_exports.object({
   items: external_exports.array(Event),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListEventsResponse" });
+var IngestResponse = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+}).meta({ id: "IngestResponse" });
 var ListFindingsQuery = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
@@ -16528,6 +16570,65 @@ var ProjectFilesScan = external_exports.object({
   scannedAt: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/ranges.ts
+var TIME_RANGES = ["7d", "30d", "3m", "6m"];
+var TimeRange = external_exports.enum(TIME_RANGES).meta({ id: "TimeRange" });
+var DEFAULT_TIME_RANGE = "7d";
+var TIME_RANGE_OR_DEFAULT = TimeRange.catch(DEFAULT_TIME_RANGE);
+
+// ../../packages/schema/src/zod/remediation.ts
+var SecretFindingState = external_exports.enum(["still-valid", "unknown", "invalid"]);
+var MaskedFindingLocation = external_exports.object({
+  filePath: external_exports.string(),
+  span: Span.optional()
+}).strict();
+var MaskedSecretFinding = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  where: MaskedFindingLocation,
+  state: SecretFindingState,
+  observedAt: external_exports.iso.datetime().optional()
+}).strict();
+var RotationChecklistEntry = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  consolePath: external_exports.string(),
+  occurrenceSpread: external_exports.number().int().positive()
+}).strict();
+var RemediationOption = external_exports.enum([
+  "redact-rotation-checklist",
+  "redact-only",
+  "set-secret-redact",
+  "leave"
+]);
+var RemediationEntrySource = external_exports.enum(["first-run", "pre-push", "secret-scan"]);
+var RemediationEntryContext = external_exports.object({
+  entrySource: RemediationEntrySource
+}).strict();
+var RemediationOptionChoice = external_exports.object({
+  id: RemediationOption,
+  label: external_exports.string()
+});
+var BatchedRemediationDecision = external_exports.object({
+  kind: external_exports.literal("decision"),
+  entrySource: RemediationEntrySource,
+  secretCount: external_exports.number().int().positive(),
+  prompt: external_exports.string(),
+  options: external_exports.tuple([
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-rotation-checklist") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-only") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("set-secret-redact") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("leave") })
+  ])
+});
+var NoRemediationDecision = external_exports.object({
+  kind: external_exports.literal("no-decision")
+});
+var BatchedRemediation = external_exports.discriminatedUnion("kind", [
+  BatchedRemediationDecision,
+  NoRemediationDecision
+]);
+
 // ../../packages/schema/src/zod/rule-test.ts
 var TestRulesRequest = external_exports.object({
   rules: external_exports.array(Rule).min(1).max(100),
@@ -16586,10 +16687,8 @@ var SeveritySummaryResponse = external_exports.object({
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });
-var SECURITY_RANGES = ["7d", "30d", "3m", "6m"];
-var SecurityRange = external_exports.enum(SECURITY_RANGES).meta({ id: "SecurityRange" });
 var SecurityRangeQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d")
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE)
 });
 var EnforcementActionKind = external_exports.enum(["blocked", "redacted", "warned"]).meta({ id: "EnforcementActionKind" });
 var EnforcementAction = external_exports.object({
@@ -16599,7 +16698,7 @@ var EnforcementAction = external_exports.object({
   delta: external_exports.number().int()
 }).meta({ id: "EnforcementAction" });
 var EnforcementActionsResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   // Sum of actions[].count in the window.
   total: external_exports.number().int().nonnegative(),
   // One entry per kind, always all three present (count may be 0).
@@ -16614,7 +16713,7 @@ var FindingsTimeseriesPoint = external_exports.object({
   medium: external_exports.number().int().nonnegative()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(FindingsTimeseriesPoint)
 }).meta({ id: "FindingsTimeseriesResponse" });
@@ -16629,7 +16728,7 @@ var MttrTrendPoint = external_exports.object({
   })
 }).meta({ id: "MttrTrendPoint" });
 var MttrTrendResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(MttrTrendPoint)
 }).meta({ id: "MttrTrendResponse" });
@@ -16656,11 +16755,11 @@ var TopSource = external_exports.object({
   findingsCount: external_exports.number().int().nonnegative()
 }).meta({ id: "TopSource" });
 var TopSourcesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   items: external_exports.array(TopSource)
 }).meta({ id: "TopSourcesResponse" });
 var TopSourcesQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d"),
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE),
   limit: external_exports.coerce.number().int().min(1).max(50).default(5),
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
@@ -16673,7 +16772,7 @@ var ScanCoverageProvider = external_exports.object({
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
 var ScanCoverageResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   providers: external_exports.array(ScanCoverageProvider)
 }).meta({ id: "ScanCoverageResponse" });
 var SubjectType = external_exports.enum(["repo", "user", "team", "policy", "share", "rule"]).meta({
@@ -16722,6 +16821,114 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../../packages/schema/src/zod/setup-frame.ts
+var CalibrationCounts = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  important: external_exports.number().int().nonnegative(),
+  routine: external_exports.number().int().nonnegative()
+}).refine((c) => c.total === c.important + c.routine, {
+  message: "total must equal important + routine",
+  path: ["total"]
+});
+var FalsePositivePatternValue = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  valueFingerprint: external_exports.string(),
+  keyVersion: external_exports.number().int().nonnegative()
+});
+var FalsePositivePatternGroup = external_exports.object({
+  pattern: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  values: external_exports.array(FalsePositivePatternValue).min(1)
+});
+var CalibrationFindingKind = external_exports.object({
+  category: DetectionCategory,
+  count: external_exports.number().int().nonnegative(),
+  egress: external_exports.boolean()
+});
+var CalibrationFrame = external_exports.object({
+  counts: CalibrationCounts,
+  routineCategories: external_exports.array(DetectionCategory),
+  surfacedCategories: external_exports.array(DetectionCategory),
+  findingKinds: external_exports.array(CalibrationFindingKind),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId),
+  maskedFindings: external_exports.array(MaskedSecretFinding).optional(),
+  falsePositivePatterns: external_exports.array(FalsePositivePatternGroup).optional()
+});
+var CalibrationPreviewCategory = TriageCategoryRec.pick({
+  category: true,
+  genuineCount: true,
+  fpCount: true
+}).extend({
+  egress: external_exports.boolean()
+});
+var CalibrationPreview = external_exports.object({
+  categories: external_exports.array(CalibrationPreviewCategory),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId)
+});
+var CalibrationResult = external_exports.object({
+  frame: CalibrationFrame,
+  copy: external_exports.string()
+});
+var FirstRunCalibration = external_exports.enum(["scan", "floor"]);
+var SetupHandoffOption = external_exports.object({
+  id: external_exports.enum(["enter-remediation", "open-dashboard", "not-now"]),
+  label: external_exports.string()
+});
+var DashboardHandoffOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var ComposedRemediationOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("enter-remediation") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var SetupHandoffOffer = external_exports.object({
+  worthALook: external_exports.number().int().nonnegative(),
+  liveKeys: external_exports.number().int().nonnegative().optional(),
+  options: external_exports.union([DashboardHandoffOptions, ComposedRemediationOptions])
+}).refine(
+  (o) => o.options.some((opt) => opt.id === "enter-remediation") === (o.liveKeys ?? 0) > 0,
+  {
+    message: "the chain-entry option is present exactly when liveKeys > 0",
+    path: ["options"]
+  }
+).refine((o) => (o.liveKeys ?? 0) <= o.worthALook, {
+  message: "liveKeys is a subset of worthALook and cannot exceed it",
+  path: ["liveKeys"]
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
@@ -16861,36 +17068,6 @@ var ExportSharesQuery = external_exports.object({
   kind: external_exports.array(DestinationKind).optional()
 });
 
-// ../../packages/schema/src/zod/triage.ts
-var TriageHit = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  maskedMatch: external_exports.string(),
-  rawMatch: external_exports.string(),
-  context: external_exports.string(),
-  filePath: external_exports.string().optional(),
-  confidence: external_exports.number().min(0).max(1),
-  id: external_exports.string().optional(),
-  valueFingerprint: external_exports.string().optional(),
-  keyVersion: external_exports.number().int().nonnegative().optional()
-});
-var TriagePolicy = BuiltinPolicyId;
-var TriageCategoryRec = external_exports.object({
-  category: DetectionCategory,
-  action: TriagePolicy,
-  reasoning: external_exports.string(),
-  genuineCount: external_exports.number().int().nonnegative(),
-  fpCount: external_exports.number().int().nonnegative(),
-  // TriageHit ids judged false-positive in this category. fpCount must equal
-  // this array's length — enforced by the consumer, not this schema.
-  fpIds: external_exports.array(external_exports.string())
-});
-var TriageRecommendation = external_exports.object({
-  perCategory: external_exports.array(TriageCategoryRec),
-  notes: external_exports.string()
-});
-
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 
@@ -17078,21 +17255,28 @@ import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as s
 import { homedir as homedir2 } from "os";
 import { basename as basename2, join as join7 } from "path";
 
+// ../../packages/detections/src/escape-regexp.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
+
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
-    const haystack = caseSensitive ? text : text.toLowerCase();
     const spans = [];
     for (const kw of keywords) {
-      const needle = caseSensitive ? kw : kw.toLowerCase();
-      let idx = 0;
-      while (idx < haystack.length) {
-        const pos = haystack.indexOf(needle, idx);
-        if (pos === -1) break;
-        spans.push({ start: pos, end: pos + kw.length });
-        idx = pos + 1;
+      if (kw.length === 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
     }
     return spans;
@@ -17100,7 +17284,6 @@ var KeywordMatcher2 = class {
 };
 
 // ../../packages/detections/src/matchers/regex.ts
-var MAX_MATCHES_PER_RULE = 1e4;
 var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];

package/scripts/triage-rubric.md

@@ -1,6 +1,6 @@
 # AKA setup-wizard triage prompt (draft — validation harness artifact)
 
-You are the AKA Control Plane setup wizard's inline triage step. You have just
+You are the AKA Security setup wizard's inline triage step. You have just
 scanned a workspace (working tree and/or history) and detected a set of raw
 hits — matches from AKA's deterministic regex detection rules, shown to you
 with their real (unmasked) value and surrounding context so you can judge them
@@ -66,7 +66,8 @@ one** fenced JSON block containing a `TriageRecommendation`:
       "action": "block",
       "reasoning": "one or two sentences, no negative framing of the FPs",
       "genuineCount": 2,
-      "fpCount": 2
+      "fpCount": 2,
+      "fpIds": ["3", "17"]
     }
   ],
   "notes": ""
@@ -78,6 +79,13 @@ one** fenced JSON block containing a `TriageRecommendation`:
 - `action` must be exactly one of `monitor`, `warn`, `redact`, `block`.
 - `genuineCount` and `fpCount` are your counts of genuine vs. false-positive
   hits you identified within that category (both required, both ≥ 0).
+- `fpIds` (required) lists the `id` of every hit in that category you judged a
+  false positive. **Copy each `id` verbatim from the hit you are describing** —
+  they are stable identifiers assigned by the scanner, not positions in the
+  input. Do not renumber them, do not start from 1, and never emit an `id` that
+  is not present in the hits you were given: ids you were not shown belong to
+  other hits, and naming one would silence a detection you never examined.
+  `fpCount` must equal `fpIds.length`.
 - `notes` is optional free text (empty string if nothing to add) for anything
   that doesn't fit a single category — e.g. cross-category observations.
 - The fenced ```json block must be the last thing in your reply and must