@akasecurity/ai-tc-claude-code 0.9.12 → 0.9.13

package/scripts/scan-worker.js

@@ -20533,7 +20533,17 @@ var UNPRICEABLE_PROVIDERS = Object.freeze([
   "gateway",
   "unknown",
   "cli",
-  "api"
+  "api",
+  // The browser extension's native host records these as `llm_call.provider`
+  // for a web-chat turn — the web tool id, deliberately never the vendor id
+  // (`openai`/`anthropic`) the session root carries. Subscription traffic
+  // burns rate-limit budget, not dollar credits, and listing them here is
+  // what keeps that true structurally: a later maintainer who wants to price
+  // web-chat traffic at API rates has to delete this entry first, and meet
+  // the reason on the way, rather than quietly adding one to
+  // PROVIDER_PLATFORM.
+  "chatgpt",
+  "claude-ai"
 ]);
 
 // ../../packages/schema/src/token/format.ts
@@ -20553,7 +20563,12 @@ var HARNESS = {
   ClaudeDesktop: "claudedesktop",
   ChatGpt: "chatgpt",
   ClaudeAi: "claudeai",
-  Api: "api"
+  Api: "api",
+  // Not a coding assistant a person drives — an in-process SDK embedded in an
+  // application, so it has no IDE/CLI/desktop/web surface of its own. Carries
+  // the same id as its SOURCE_TOOL counterpart, unlike every capture-side tool
+  // whose wire spelling differs from its display spelling.
+  AiTcSdk: "ai-tc-sdk"
 };
 var Harness = external_exports.enum(HARNESS).meta({ id: "Harness" });
 var SOURCE_TOOL = {
@@ -20569,9 +20584,15 @@ var SOURCE_TOOL = {
   // whose tool could not be identified both render through the read side's
   // miss path rather than as a harness of their own.
   Cli: "cli",
-  Unknown: "unknown"
+  Unknown: "unknown",
+  // The wire id an in-process, request-path SDK stamps on its own structural
+  // rows (`request_decision`) — never a capture of prompt/response/tool text,
+  // since the SDK sits in front of a model call rather than inside a coding
+  // assistant's own hook contract.
+  AiTcSdk: "ai-tc-sdk"
 };
 var SourceTool = external_exports.enum(SOURCE_TOOL).meta({ id: "SourceTool" });
+var WebSourceTool = SourceTool.extract(["ChatGpt", "ClaudeAi"]);
 var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ClaudeCode]: HARNESS.ClaudeCode,
   [SOURCE_TOOL.ClaudeDesktop]: HARNESS.ClaudeDesktop,
@@ -20580,7 +20601,12 @@ var TOOL_TO_HARNESS = {
   [SOURCE_TOOL.ChatGpt]: HARNESS.ChatGpt,
   [SOURCE_TOOL.Codex]: HARNESS.Codex,
   [SOURCE_TOOL.Antigravity]: HARNESS.Antigravity,
-  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi
+  [SOURCE_TOOL.ClaudeAi]: HARNESS.ClaudeAi,
+  // Wire and display id are the same string here, but the row still belongs:
+  // both vocabularies carry the `AiTcSdk` member, and the join is exactly
+  // their intersection — leaving a shared member out would read as an
+  // uninstrumented tool on both surfaces, which this one is not.
+  [SOURCE_TOOL.AiTcSdk]: HARNESS.AiTcSdk
 };
 
 // ../../packages/schema/src/zod/finding.ts
@@ -20614,7 +20640,8 @@ var FindingProvider = Harness.extract([
   "ClaudeAi",
   "Codex",
   "Antigravity",
-  "Api"
+  "Api",
+  "AiTcSdk"
 ]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
@@ -20988,18 +21015,41 @@ var AuditEventType = external_exports.enum([
   // 'tool_call' is the reconciler's structural row for every call, while
   // 'tool_use' exists only where a hook enforced against the arguments.
   "tool_use",
-  // One row per model REFUSAL: a switch onto a prohibited model that was
-  // denied, or a turn refused because the session was already running on one.
-  // A structural row like the ones above rather than a capture — it carries
-  // the model that was refused and nothing the user typed, because what is
-  // worth recording about a governance decision is the decision, and prompt
-  // text is the thing this product exists to keep from travelling.
+  // One row per model REFUSAL, across all four seams a prohibited model can be
+  // stopped at: a switch onto it, a turn already running on it, a subagent
+  // spawn asking for it, or a request-path refusal an embedded request-path
+  // SDK makes in-process before the call leaves the application. Which seam
+  // rides `attributes.refusal_seam`, never this member name. A structural row
+  // like the ones above rather than a capture — it carries the model that was
+  // refused and nothing the user typed, because what is worth recording about
+  // a governance decision is the decision, and prompt text is the thing this
+  // product exists to keep from travelling.
   "model_refusal",
+  // One row per request-path DECISION: a policy check an embedded request-path
+  // SDK performs in-process before a model call leaves the application, or
+  // against that call's non-streamed response. A structural row like
+  // 'model_refusal' rather than a capture — content-free in the same way:
+  // which side, which seam, what action and which field are decided rides
+  // `attributes`, never this member name, and the matched text itself never
+  // travels.
+  //
+  // A prohibited-model refusal on the request path is deliberately NOT this
+  // member: it stays 'model_refusal' with `refusal_seam: 'request'`, so it
+  // shares one bucket with the plugin's switch/turn/spawn refusals rather
+  // than splitting one governance concept across two event types. This
+  // member carries every OTHER request-path decision.
+  "request_decision",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
   // surface renders.
-  "config_scan"
+  "config_scan",
+  // One row per reported browser-extension capture status, hung off the web
+  // session root. The durable home of what one tab's network interception
+  // is doing — a write-through of the native host's in-memory tracker, so a
+  // second process (aka extension status) and a restarted host both have
+  // somewhere to read it back from.
+  "capture_status"
 ]).meta({ id: "AuditEventType" });
 var AttributeBag = external_exports.record(external_exports.string(), external_exports.unknown());
 var HostAttributes = external_exports.object({
@@ -21159,6 +21209,20 @@ var CaptureAttributes = external_exports.object({
   // repeated rather than referenced because a store reader opens this file.
   redact_degraded_to: ActionTaken.optional()
 }).catchall(external_exports.unknown());
+var CaptureStatusAttributes = external_exports.object({
+  source_tool: external_exports.string().optional(),
+  patched: external_exports.boolean().optional(),
+  live: external_exports.boolean().optional(),
+  blind: external_exports.boolean().optional(),
+  sends_seen_dom: external_exports.number().int().nonnegative().optional(),
+  exchanges_seen_net: external_exports.number().int().nonnegative().optional(),
+  parse_failures: external_exports.number().int().nonnegative().optional(),
+  unparsed_bodies: external_exports.number().int().nonnegative().optional(),
+  shape_misses: external_exports.array(external_exports.string()).optional(),
+  conversation_endpoints: external_exports.number().int().nonnegative().optional(),
+  closed: external_exports.boolean().optional(),
+  enforcement: external_exports.string().optional()
+}).catchall(external_exports.unknown());
 var ToolCallInspection = external_exports.object({
   ruleId: external_exports.string().min(1),
   ruleName: external_exports.string(),
@@ -22168,6 +22232,11 @@ var RemoteFailureKind = external_exports.enum([
   "rejected",
   "unreachable"
 ]);
+var ControlPlaneFailure = RemoteFailureKind.extract([
+  "unauthorized",
+  "forbidden",
+  "unreachable"
+]);
 var AttachDeviceRequest = external_exports.object({
   // This machine's own continuity id, so re-attaching ROTATES the credential
   // on one machine record instead of producing a second one. Client-minted
@@ -22590,7 +22659,12 @@ var EventMetadata = external_exports.object({
   // in — set by the browser extension's network capture so a stored `response`
   // row can be joined to the `llm_call` leaf describing the same turn. Absent
   // on every other capture path, which has no such id.
-  messageId: external_exports.string().optional(),
+  //
+  // Non-empty for the reason WebExchange.messageId is: it is the join key, and
+  // a blank one matches no `llm_call` leaf. That refusal reaches only the
+  // places an event is PARSED; the local write path types the event and parses
+  // nothing, which is why `toCaptureAttributes` omits a blank one separately.
+  messageId: external_exports.string().min(1).optional(),
   conversationId: external_exports.string().optional(),
   // How long THIS capture's inspection blocked its caller, in whole
   // milliseconds — the plugin's own added latency, NOT the LLM call it sat in
@@ -23190,6 +23264,18 @@ var HistorySyncConsent = external_exports.object({
   payloadVersion: external_exports.number().int().positive(),
   endpoint: external_exports.string()
 });
+var WebChatCaptureConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+var WebChatResponseCapture = external_exports.enum(["with-findings", "always", "never"]);
+var WebChatCapture = external_exports.object({
+  responses: WebChatResponseCapture.default("with-findings"),
+  account: external_exports.boolean().default(false),
+  // Absent until granted. Presence alone does not authorize anything — see
+  // isWebChatCaptureConsentValid.
+  consent: WebChatCaptureConsent.optional()
+});
 var BODY_RETENTION_DEFAULT_DAYS = 30;
 var BodyRetention = external_exports.object({
   enabled: external_exports.boolean().default(false),
@@ -23248,6 +23334,16 @@ var WorkspaceSettings = external_exports.object({
   // both widenings. Absent until granted, and a grant for a different endpoint
   // or an older payload no longer counts.
   historySyncConsent: HistorySyncConsent.optional(),
+  // What the browser extension may record from a web chat, and the grant that
+  // authorizes it. Absent until the user answers: recording something that was
+  // never recorded before is never an assumed grant on upgrade, so the whole
+  // block is optional rather than defaulted in. What an absent block means is
+  // webChatCaptureOf's answer, in one place.
+  //
+  // Enforcement is NOT gated on this. A machine that has never answered still
+  // blocks, redacts and warns on what a user sends; the grant covers what is
+  // written down.
+  webChatCapture: WebChatCapture.optional(),
   // Local body expiry (see BodyRetention). Off until switched on; expiring a
   // body never removes the row or its findings.
   bodyRetention: BodyRetention.default({
@@ -23605,12 +23701,14 @@ var RecommendedActionIdParam = external_exports.object({ id: external_exports.st
 // ../../packages/schema/src/zod/settings-action.ts
 var HistorySyncConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "HistorySyncConsentChoice" });
 var ModelJudgeConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "ModelJudgeConsentChoice" });
+var WebChatCaptureConsentChoice = external_exports.enum(["granted", "revoked", "unchanged"]).meta({ id: "WebChatCaptureConsentChoice" });
 var SaveSettingsInput = external_exports.object({
   historicalAccess: external_exports.string(),
   modelJudgeConsent: ModelJudgeConsentChoice,
   historySyncConsent: HistorySyncConsentChoice,
   vaultConsent: external_exports.string(),
   vaultInlineReveal: external_exports.string(),
+  webChatCaptureConsent: WebChatCaptureConsentChoice,
   // Widened to `string` like its neighbours rather than typed as
   // `RedactFallback`, on this module's own layering rule: shape here, VALUE at
   // the call site, so the domain check receives the type it was written for.
@@ -23779,11 +23877,24 @@ var WebExchange = external_exports.object({
   turnIndex: external_exports.number().int().nonnegative().optional(),
   toolCalls: external_exports.array(WebToolCall).default([]),
   // Absent when the adapter recovered no text. Capped by the caller at
-  // RESPONSE_TEXT_MAX_BYTES; `truncated` records that the cap was reached, so a
-  // short capture is never mistaken for a short reply.
+  // RESPONSE_TEXT_MAX_BYTES, so a short capture is never mistaken for a short
+  // reply.
   responseText: external_exports.string().optional(),
+  // The stored text is short of the reply. It does NOT say which of the two
+  // ceilings on this path cut it: the caller applies its own cap on the raw
+  // bytes it reads off the wire, which can be reached by a stream whose
+  // recovered text stays well under RESPONSE_TEXT_MAX_BYTES, and applies that
+  // one to the text. A reader cannot tell them apart, and nothing downstream
+  // should branch as though it could.
   truncated: external_exports.boolean().default(false)
 });
+var WebEnforcementState = external_exports.enum([
+  "watching",
+  "composer-only",
+  "button-only",
+  "unattached",
+  "unknown"
+]);
 var RESPONSE_TEXT_MAX_BYTES = 2 * 1024 * 1024;
 var WebCaptureStatus = external_exports.object({
   patched: external_exports.boolean(),
@@ -23795,8 +23906,39 @@ var WebCaptureStatus = external_exports.object({
   unparsedBodies: external_exports.number().int().nonnegative(),
   // The adapter-declared JSON key paths that were absent from a real payload —
   // the earliest signal that a site's contract moved.
-  shapeMisses: external_exports.array(external_exports.string()).default([])
-});
+  shapeMisses: external_exports.array(external_exports.string()).default([]),
+  // How many `kind: 'conversation'` endpoints the reporting tab's adapter
+  // compiled. Zero means this build declares none for the site, so observing
+  // nothing is the design rather than a fault — the one fact that separates a
+  // site nobody has surveyed yet from one whose contract moved. Defaulted so a
+  // build predating the field is read as declaring nothing rather than refused.
+  conversationEndpoints: external_exports.number().int().nonnegative().default(0),
+  // The document that sent this report is going away. The bridge sets it on
+  // its `pagehide` report and nowhere else.
+  //
+  // A property of the REPORT rather than of capture health, which is why
+  // nothing in `deriveWebCaptureState` reads it and why it stays out of the
+  // bridge's own report signature — a closing tab's last word must not be
+  // suppressed for carrying the same health as the report before it. What
+  // reads it is the per-site fold: a document that said it was unloading stops
+  // voting on the site's state, so the reload the `blind` remediation asks for
+  // can actually clear the verdict it was shown. A document that dies without
+  // sending one is covered by CAPTURE_STATUS_DOCUMENT_QUIET_MS instead.
+  //
+  // Defaulted so a build predating the field reads as a document that never
+  // said it was closing — which keeps it voting, the same as every report that
+  // is not a final one.
+  closed: external_exports.boolean().default(false),
+  // What the DOM enforcement path is doing, which none of the counters above
+  // can say: `sendsSeenDom` rises only once a send has COMPLETED, so a tab
+  // whose watcher never bound reports zero exactly like a tab nobody typed in.
+  // Defaulted to 'unknown' rather than 'watching' so a status from a build
+  // predating the field is not read as reporting a healthy one.
+  enforcement: WebEnforcementState.default("unknown")
+});
+var CAPTURE_STATUS_RECENCY_MS = 30 * 24 * 60 * 60 * 1e3;
+var CAPTURE_STATUS_RECENCY_DAYS = CAPTURE_STATUS_RECENCY_MS / (24 * 60 * 60 * 1e3);
+var CAPTURE_STATUS_DOCUMENT_QUIET_MS = 12 * 60 * 60 * 1e3;
 
 // ../../packages/detections/src/posture/config-posture.ts
 var RULE_VERSION = "1";
@@ -23855,6 +23997,56 @@ var CONFIG_POSTURE_RULES = [
   }
 ];
 
+// ../../packages/detections/src/posture/web-capture-posture.ts
+var RULE_VERSION2 = "1";
+var DRIFT_MIN_PARSE_FAILURES = 2;
+var WEB_CAPTURE_DRIFT_STATES = /* @__PURE__ */ new Set([
+  "blind",
+  "degraded"
+]);
+var WEB_CAPTURE_DRIFT_RULE = {
+  ruleId: "web-capture-drift",
+  version: RULE_VERSION2,
+  name: "Web chat capture is not reading the site",
+  category: "config",
+  severity: "medium",
+  definition: JSON.stringify({
+    kind: "web-capture-drift",
+    states: [...WEB_CAPTURE_DRIFT_STATES],
+    minParseFailures: DRIFT_MIN_PARSE_FAILURES
+  })
+};
+var STATIC_COPY = {
+  active: { headline: "turns are being observed on this site" },
+  unreported: {
+    // Says "recently" rather than "yet": the store read is bounded to
+    // CAPTURE_STATUS_RECENCY_MS, so this state covers a site nothing has ever
+    // reported for AND one whose last report has aged out. The two are the
+    // same fact to a reader — nobody has confirmed anything lately — and the
+    // copy may not claim the stronger of them.
+    headline: `no report in the last ${String(CAPTURE_STATUS_RECENCY_DAYS)} days \u2014 open the site in Chrome with the extension loaded`
+  },
+  standby: {
+    headline: "this build declares no endpoints for the site, so nothing is observed yet"
+  },
+  unpatched: {
+    // Says what the flags say and no more. `patched` is false both for a tap
+    // that installed and hooked neither transport and for one that never ran
+    // at all — a page reports the same status either way, so the copy may not
+    // assert one of them.
+    headline: "the page tap captured neither fetch nor XHR \u2014 it may not have installed; reload the extension at chrome://extensions"
+  },
+  idle: { headline: "watching; no turn has been observed yet" },
+  blind: {
+    headline: "messages were sent in the page that the network capture never saw",
+    remediation: "reload the tab. If it persists after `aka update` and reloading the extension at chrome://extensions, the site's send path has changed and needs a new extension build."
+  },
+  degraded: {
+    headline: "the site's payloads no longer carry the fields the extension reads",
+    remediation: "run `aka update`, then reload the extension at chrome://extensions. If it stays degraded after an update, the site's contract has changed and needs a new extension build."
+  }
+};
+
 // ../../packages/detections/src/security/redos-probe.ts
 var BUDGET_MS = 100;
 var EXPONENTIAL_UNITS = [