@akasecurity/ai-tc-claude-code 0.9.1 → 0.9.3

package/scripts/start-light.js

@@ -491,9 +491,13 @@ var require_ignore = __commonJS({
   }
 });
 
+// ../../packages/plugin-sdk/src/config.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join6 } from "path";
+
 // ../../packages/persistence/src/database.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { existsSync, renameSync, rmSync } from "fs";
+import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
 import { join, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
@@ -15182,7 +15186,12 @@ var FindingFacets = external_exports.object({
   severity: external_exports.array(FindingFacetItem),
   subtype: external_exports.array(FindingFacetItem),
   provider: external_exports.array(FindingFacetItem),
-  action: external_exports.array(FindingFacetItem)
+  action: external_exports.array(FindingFacetItem),
+  // Counts by the group's derived status. The SQLite store derives a status
+  // for every instance, so every group lands in a bucket; a status-less
+  // group (possible only for callers whose rows carry no statuses) is
+  // counted under no value.
+  status: external_exports.array(FindingFacetItem)
 }).meta({ id: "FindingFacets" });
 var ListGroupedFindingsQuery = external_exports.object({
   // NOTE: severity filters by Severity (critical/high/medium/low), not by
@@ -15191,6 +15200,10 @@ var ListGroupedFindingsQuery = external_exports.object({
   subtype: external_exports.array(external_exports.string()).optional(),
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
+  // Matches a group's DERIVED status (see FindingGroup.status), not its
+  // individual instances' — so a filtered group's Status column always reads
+  // one of the requested values.
+  status: external_exports.array(FindingStatus).optional(),
   q: external_exports.string().optional(),
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
@@ -15371,6 +15384,33 @@ var ToolCallAttributes = external_exports.object({
   parent_uuid: external_exports.string().optional(),
   run_key: external_exports.string().optional()
 }).catchall(external_exports.unknown());
+var CaptureAttributes = external_exports.object({
+  // The harness/tool that produced the capture (`claude-code`, `cli`, …). A
+  // column on the legacy `events` table; here it rides the bag because a
+  // capture-typed audit row has no equivalent column of its own.
+  source_tool: external_exports.string().optional(),
+  file_path: external_exports.string().optional(),
+  repo: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch') —
+  // gives a non-file capture a display location ("via Bash") when file_path
+  // is absent. The tool NAME only, never its arguments/output.
+  tool_name: external_exports.string().optional(),
+  // Presence-only provenance flag: set when the file is excluded by the
+  // repo's .gitignore. Omitted (not false) for tracked files.
+  gitignored: external_exports.boolean().optional(),
+  // Set ONLY when the capture is a COMPLETE file snapshot (a worktree scan
+  // reading from disk), never a partial fragment (a hook-captured edit).
+  whole_file: external_exports.boolean().optional(),
+  // Distributed-tracing correlation: `correlation_id` ties the capture back to
+  // the request that produced it; `trace_id` is the originating span's W3C
+  // trace id when telemetry is enabled.
+  correlation_id: external_exports.uuid().optional(),
+  trace_id: external_exports.string().regex(/^[0-9a-f]{32}$/).optional(),
+  // Ids of the detection exceptions that downgraded findings in this capture
+  // to 'allow' — the enforcement audit trail's link back to the grant that
+  // authorized the bypass.
+  exception_ids: external_exports.array(external_exports.guid()).optional()
+}).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
   ruleName: external_exports.string(),
@@ -15457,7 +15497,18 @@ var InspectionFindingInput = external_exports.object({
   span: Span,
   maskedMatch: external_exports.string(),
   actionTaken: ActionTaken,
-  confidence: external_exports.number().min(0).max(1)
+  confidence: external_exports.number().min(0).max(1),
+  // Stable, content-addressed key correlating this finding across re-detections
+  // — mirrors the legacy `findings.finding_key` (uq_inspection_findings_key is
+  // its unique index). Optional: only an at-rest/re-scannable finding carries
+  // one; an in-flight capture (prompt/response) has nothing to re-detect
+  // against and leaves it unset, so every insert is a fresh row.
+  findingKey: external_exports.string().optional(),
+  // The ORIGINAL detection time, preserved across a later re-detection of the
+  // same findingKey — mirrors the legacy `findings.first_detected_at`.
+  // Optional: when omitted, the writer derives it from the referenced audit
+  // event's startedAt on first insert (see SqliteInspectionFindingsRepository).
+  firstDetectedAt: external_exports.iso.datetime().optional()
 });
 var InventoryContext = external_exports.object({
   host: InventoryInput.optional(),
@@ -15656,6 +15707,7 @@ var ActivityOverviewResponse = external_exports.object({
 
 // ../../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
+var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
@@ -16145,6 +16197,12 @@ var PolicyBundle = external_exports.object({
   // on-disk caches — that omit the field still parse; consumers read
   // `bundle.exceptions ?? []`.
   exceptions: external_exports.array(ExceptionBundleEntry).optional(),
+  // Installed pack version, keyed by ruleId, for rules in `rules` that came
+  // from a versioned installed pack. Optional so older backends — and older
+  // on-disk caches — that omit the field still parse; consumers fall back to
+  // the rule's own spec version. NOT the bundle version above — see
+  // installedRuleset's ruleVersions for the source of truth.
+  ruleVersions: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
@@ -16749,10 +16807,14 @@ var PatchInstalledPackRequest = external_exports.object({
 }).meta({ id: "PatchInstalledPackRequest" });
 
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 3;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
+var ModelJudgeConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  payloadVersion: external_exports.number().int().positive()
+});
 var WorkspaceSettings = external_exports.object({
   specVersion: external_exports.number().int().positive().default(WORKSPACE_SETTINGS_SPEC_VERSION),
   // Settings files written by earlier releases may carry the retired 'attached'
@@ -16768,7 +16830,12 @@ var WorkspaceSettings = external_exports.object({
   // Shares writes.
   dataSharesInPlace: external_exports.boolean().default(true),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
-  onboardedAt: external_exports.iso.datetime().optional()
+  onboardedAt: external_exports.iso.datetime().optional(),
+  // Records that the user consented to sending findings to the model API for
+  // the /aka:setup judge, along with the payload-shape version they agreed to.
+  // Absent until granted; a stale payloadVersion means the consent no longer
+  // covers the current payload and must be re-granted.
+  modelJudgeConsent: ModelJudgeConsent.optional()
 });
 
 // ../../packages/schema/src/zod/project-files.ts
@@ -17147,7 +17214,7 @@ var SetupHandoffOffer = external_exports.object({
 import { createHash } from "crypto";
 
 // ../../packages/persistence/src/paths.ts
-import { chmodSync, mkdirSync } from "fs";
+import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
 
 // ../../packages/persistence/src/repositories/activity.ts
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -17177,23 +17244,27 @@ import { randomUUID as randomUUID6 } from "crypto";
 // ../../packages/persistence/src/repositories/shares.ts
 import { randomUUID as randomUUID7 } from "crypto";
 
+// ../../packages/persistence/src/finding-key.ts
+import { createHash as createHash3 } from "crypto";
+
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { chmodSync as chmodSync2, readFileSync, renameSync as renameSync2, writeFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync } from "fs";
 import { join as join2 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync2, renameSync as renameSync3 } from "fs";
-import { chmod, mkdir } from "fs/promises";
+import { renameSync as renameSync3 } from "fs";
+import { mkdir } from "fs/promises";
 import { homedir } from "os";
 import { join as join3 } from "path";
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync2, renameSync as renameSync4, writeFileSync as writeFileSync2 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { join as join4 } from "path";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
 import { join as join5 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
@@ -17217,7 +17288,7 @@ var ProviderEnvSchema = external_exports.object(providerEnvShape);
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join7 } from "path";
+import { basename as basename2, join as join8 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -17928,21 +17999,18 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
 );
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash3, randomUUID as randomUUID9 } from "crypto";
-
-// ../../packages/plugin-sdk/src/finding-key.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join9 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
@@ -17950,8 +18018,8 @@ import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
-import { basename as basename4, join as join9, relative, sep as sep4 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
@@ -17960,8 +18028,8 @@ import { randomUUID as randomUUID10 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 
 // src/onboard-posture.ts
 function parsePosture(json2) {