@akasecurity/ai-tc-claude-code 0.9.2 → 0.9.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/plugin.json +1 -1
- package/package.json +3 -3
- package/scripts/apply-suppressions.js +94 -45
- package/scripts/backfill.js +139 -47
- package/scripts/filescan.js +141 -49
- package/scripts/firstrun.js +93 -44
- package/scripts/intro.js +6 -5
- package/scripts/onboard.js +93 -44
- package/scripts/post-tool-use.js +139 -47
- package/scripts/pre-tool-use.js +139 -47
- package/scripts/query.js +93 -44
- package/scripts/reconcile.js +95 -46
- package/scripts/remediate.js +139 -47
- package/scripts/session-start.js +96 -47
- package/scripts/start-light.js +6 -5
- package/scripts/statusline.js +93 -44
- package/scripts/stop.js +7 -6
- package/scripts/user-prompt-submit.js +139 -47
package/scripts/session-start.js
CHANGED
|
@@ -495,7 +495,7 @@ var require_ignore = __commonJS({
|
|
|
495
495
|
import { readFileSync as readFileSync8 } from "fs";
|
|
496
496
|
|
|
497
497
|
// ../../packages/plugin-sdk/src/config.ts
|
|
498
|
-
import { existsSync as
|
|
498
|
+
import { existsSync as existsSync4 } from "fs";
|
|
499
499
|
import { join as join6 } from "path";
|
|
500
500
|
|
|
501
501
|
// ../../packages/persistence/src/database.ts
|
|
@@ -23492,11 +23492,22 @@ function purgeSampleData(db) {
|
|
|
23492
23492
|
function linkHost(input, hostId) {
|
|
23493
23493
|
return hostId ? { ...input, hostId } : input;
|
|
23494
23494
|
}
|
|
23495
|
+
function closeQuietly(db) {
|
|
23496
|
+
try {
|
|
23497
|
+
db.close();
|
|
23498
|
+
} catch {
|
|
23499
|
+
}
|
|
23500
|
+
}
|
|
23495
23501
|
function openWithPragmas(file2) {
|
|
23496
23502
|
const db = new DatabaseSync(file2);
|
|
23497
|
-
|
|
23498
|
-
|
|
23499
|
-
|
|
23503
|
+
try {
|
|
23504
|
+
db.exec("PRAGMA journal_mode = WAL");
|
|
23505
|
+
db.exec("PRAGMA busy_timeout = 2000");
|
|
23506
|
+
db.exec("PRAGMA foreign_keys = ON");
|
|
23507
|
+
} catch (err) {
|
|
23508
|
+
closeQuietly(db);
|
|
23509
|
+
throw err;
|
|
23510
|
+
}
|
|
23500
23511
|
return db;
|
|
23501
23512
|
}
|
|
23502
23513
|
function backupLegacyStore(file2) {
|
|
@@ -23508,43 +23519,80 @@ function backupLegacyStore(file2) {
|
|
|
23508
23519
|
}
|
|
23509
23520
|
return backup;
|
|
23510
23521
|
}
|
|
23522
|
+
function openAndInitialize(file2) {
|
|
23523
|
+
let db = openWithPragmas(file2);
|
|
23524
|
+
try {
|
|
23525
|
+
if (isForeignSqliteLineage(db)) {
|
|
23526
|
+
db.close();
|
|
23527
|
+
const backup = backupLegacyStore(file2);
|
|
23528
|
+
db = openWithPragmas(file2);
|
|
23529
|
+
akaWarn(
|
|
23530
|
+
`Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
|
|
23531
|
+
);
|
|
23532
|
+
}
|
|
23533
|
+
applyMigrations(db, file2);
|
|
23534
|
+
tightenPerms(file2);
|
|
23535
|
+
const policies = new SqlitePoliciesRepository(db);
|
|
23536
|
+
const installedPacks = new SqliteInstalledPacksRepository(db);
|
|
23537
|
+
const repositories = {
|
|
23538
|
+
events: new SqliteEventsRepository(db),
|
|
23539
|
+
findings: new SqliteFindingsRepository(db),
|
|
23540
|
+
policies,
|
|
23541
|
+
installedPacks,
|
|
23542
|
+
scanLedger: new SqliteScanLedgerRepository(db),
|
|
23543
|
+
exceptions: new SqliteExceptionsRepository(db),
|
|
23544
|
+
resolutions: new SqliteResolutionsRepository(db),
|
|
23545
|
+
ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
|
|
23546
|
+
security: new SqliteSecurityRepository(db),
|
|
23547
|
+
detections: new SqliteDetectionsRepository(db),
|
|
23548
|
+
shares: new SqliteSharesRepository(db),
|
|
23549
|
+
policyCatalog: new SqlitePolicyCatalogRepository(installedPacks),
|
|
23550
|
+
inventory: new SqliteInventoryRepository(db),
|
|
23551
|
+
inventoryAssets: new SqliteInventoryAssetsRepository(db),
|
|
23552
|
+
projectFiles: new SqliteProjectFilesRepository(db),
|
|
23553
|
+
activity: new SqliteActivityRepository(db),
|
|
23554
|
+
sourceProject: new SqliteSourceProjectRepository(db),
|
|
23555
|
+
auditEvents: new SqliteAuditEventsRepository(db),
|
|
23556
|
+
classifiedData: new SqliteClassifiedDataRepository(db),
|
|
23557
|
+
inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
|
|
23558
|
+
inspectionFindings: new SqliteInspectionFindingsRepository(db),
|
|
23559
|
+
configInventory: new SqliteConfigInventoryRepository(db)
|
|
23560
|
+
};
|
|
23561
|
+
policies.seedDefaults();
|
|
23562
|
+
return { db, ...repositories };
|
|
23563
|
+
} catch (err) {
|
|
23564
|
+
closeQuietly(db);
|
|
23565
|
+
throw err;
|
|
23566
|
+
}
|
|
23567
|
+
}
|
|
23511
23568
|
function openLocalDatabase(dir) {
|
|
23512
23569
|
ensureDataDirSync(dir);
|
|
23513
23570
|
const file2 = join(dir, DB_FILENAME);
|
|
23514
|
-
|
|
23515
|
-
|
|
23516
|
-
|
|
23517
|
-
|
|
23518
|
-
|
|
23519
|
-
|
|
23520
|
-
|
|
23521
|
-
|
|
23522
|
-
|
|
23523
|
-
|
|
23524
|
-
|
|
23525
|
-
|
|
23526
|
-
|
|
23527
|
-
|
|
23528
|
-
|
|
23529
|
-
|
|
23530
|
-
|
|
23531
|
-
|
|
23532
|
-
|
|
23533
|
-
|
|
23534
|
-
|
|
23535
|
-
|
|
23536
|
-
|
|
23537
|
-
|
|
23538
|
-
|
|
23539
|
-
const projectFiles = new SqliteProjectFilesRepository(db);
|
|
23540
|
-
const activity = new SqliteActivityRepository(db);
|
|
23541
|
-
const sourceProject = new SqliteSourceProjectRepository(db);
|
|
23542
|
-
const auditEvents = new SqliteAuditEventsRepository(db);
|
|
23543
|
-
const classifiedData = new SqliteClassifiedDataRepository(db);
|
|
23544
|
-
const inspectionDefinitions = new SqliteInspectionDefinitionsRepository(db);
|
|
23545
|
-
const inspectionFindings = new SqliteInspectionFindingsRepository(db);
|
|
23546
|
-
const configInventory = new SqliteConfigInventoryRepository(db);
|
|
23547
|
-
policies.seedDefaults();
|
|
23571
|
+
const {
|
|
23572
|
+
db,
|
|
23573
|
+
events,
|
|
23574
|
+
findings,
|
|
23575
|
+
policies,
|
|
23576
|
+
installedPacks,
|
|
23577
|
+
scanLedger,
|
|
23578
|
+
exceptions,
|
|
23579
|
+
resolutions,
|
|
23580
|
+
ruleProbeCache,
|
|
23581
|
+
security,
|
|
23582
|
+
detections,
|
|
23583
|
+
shares,
|
|
23584
|
+
policyCatalog,
|
|
23585
|
+
inventory,
|
|
23586
|
+
inventoryAssets,
|
|
23587
|
+
projectFiles,
|
|
23588
|
+
activity,
|
|
23589
|
+
sourceProject,
|
|
23590
|
+
auditEvents,
|
|
23591
|
+
classifiedData,
|
|
23592
|
+
inspectionDefinitions,
|
|
23593
|
+
inspectionFindings,
|
|
23594
|
+
configInventory
|
|
23595
|
+
} = openAndInitialize(file2);
|
|
23548
23596
|
function recordCapture(event, detected) {
|
|
23549
23597
|
failOpenTransaction(db, () => {
|
|
23550
23598
|
const sessionId = event.metadata?.sessionId;
|
|
@@ -23749,8 +23797,9 @@ import { createHash as createHash3 } from "crypto";
|
|
|
23749
23797
|
|
|
23750
23798
|
// ../../packages/persistence/src/fingerprint.ts
|
|
23751
23799
|
import { createHmac, randomBytes } from "crypto";
|
|
23752
|
-
import { readFileSync } from "fs";
|
|
23800
|
+
import { existsSync as existsSync2, readFileSync } from "fs";
|
|
23753
23801
|
import { join as join2 } from "path";
|
|
23802
|
+
import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
|
|
23754
23803
|
var KEY_FILENAME = "exception.key";
|
|
23755
23804
|
var KEY_MATERIAL_BYTES = 32;
|
|
23756
23805
|
function keyFilePath(dataDir2) {
|
|
@@ -23844,13 +23893,13 @@ function readJson(file2) {
|
|
|
23844
23893
|
}
|
|
23845
23894
|
|
|
23846
23895
|
// ../../packages/persistence/src/warn-era-cap.ts
|
|
23847
|
-
import { existsSync as
|
|
23896
|
+
import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
|
|
23848
23897
|
import { join as join5 } from "path";
|
|
23849
23898
|
var MARKER = "warn-era-capped";
|
|
23850
23899
|
function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
|
|
23851
23900
|
if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
|
|
23852
23901
|
const marker = join5(dataDir2, MARKER);
|
|
23853
|
-
if (
|
|
23902
|
+
if (existsSync3(marker)) return { capped: 0, skipped: "already-run" };
|
|
23854
23903
|
const capped = db.policies.capCategoryActions();
|
|
23855
23904
|
writeFileSync2(marker, `${new Date(Date.now()).toISOString()}
|
|
23856
23905
|
`, { mode: DATA_FILE_MODE });
|
|
@@ -23910,7 +23959,7 @@ function loadConfig(base = defaultDataDir()) {
|
|
|
23910
23959
|
try {
|
|
23911
23960
|
ensureLayoutDirSync(base);
|
|
23912
23961
|
const settingsFile = join6(settingsDir(base), "settings.json");
|
|
23913
|
-
if (
|
|
23962
|
+
if (existsSync4(settingsFile)) tightenFile(settingsFile);
|
|
23914
23963
|
} catch {
|
|
23915
23964
|
}
|
|
23916
23965
|
migrateLegacyLayout(base);
|
|
@@ -26998,7 +27047,7 @@ function maskText(text) {
|
|
|
26998
27047
|
}
|
|
26999
27048
|
|
|
27000
27049
|
// ../../packages/plugin-sdk/src/repo.ts
|
|
27001
|
-
import { existsSync as
|
|
27050
|
+
import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
|
|
27002
27051
|
import { basename as basename2, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
|
|
27003
27052
|
function resolveRepoIdentity(cwd) {
|
|
27004
27053
|
try {
|
|
@@ -27072,7 +27121,7 @@ function resolveWorktreeGitdir(root, dotGitFile) {
|
|
|
27072
27121
|
function findGitRoot(start) {
|
|
27073
27122
|
let dir = start;
|
|
27074
27123
|
for (; ; ) {
|
|
27075
|
-
if (
|
|
27124
|
+
if (existsSync5(join7(dir, ".git"))) return dir;
|
|
27076
27125
|
const parent = dirname(dir);
|
|
27077
27126
|
if (parent === dir) return void 0;
|
|
27078
27127
|
dir = parent;
|
|
@@ -27090,7 +27139,7 @@ function resolveGitContext(root) {
|
|
|
27090
27139
|
const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
|
|
27091
27140
|
if (!target) return void 0;
|
|
27092
27141
|
const gitdir = isAbsolute(target) ? target : join7(root, target);
|
|
27093
|
-
if (
|
|
27142
|
+
if (existsSync5(join7(gitdir, "config"))) {
|
|
27094
27143
|
return { configPath: join7(gitdir, "config"), headRoot: root };
|
|
27095
27144
|
}
|
|
27096
27145
|
const commonRaw = safeRead(join7(gitdir, "commondir"))?.trim();
|
|
@@ -27680,7 +27729,7 @@ import { basename as basename4, dirname as dirname2, sep as sep3 } from "path";
|
|
|
27680
27729
|
|
|
27681
27730
|
// ../../packages/plugin-sdk/src/project-files.ts
|
|
27682
27731
|
var import_ignore = __toESM(require_ignore(), 1);
|
|
27683
|
-
import { existsSync as
|
|
27732
|
+
import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
|
|
27684
27733
|
import { basename as basename5, join as join10, relative, sep as sep4 } from "path";
|
|
27685
27734
|
var SKIP_DIRS = /* @__PURE__ */ new Set([
|
|
27686
27735
|
".git",
|
|
@@ -27782,7 +27831,7 @@ function resolveProjectFiles(cwd) {
|
|
|
27782
27831
|
const fullPath = join10(dir, entry.name);
|
|
27783
27832
|
if (entry.isDirectory()) {
|
|
27784
27833
|
if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
|
|
27785
|
-
if (
|
|
27834
|
+
if (existsSync6(join10(fullPath, ".git"))) continue;
|
|
27786
27835
|
if (visit2(fullPath, dirLayers)) return true;
|
|
27787
27836
|
continue;
|
|
27788
27837
|
}
|
package/scripts/start-light.js
CHANGED
|
@@ -492,7 +492,7 @@ var require_ignore = __commonJS({
|
|
|
492
492
|
});
|
|
493
493
|
|
|
494
494
|
// ../../packages/plugin-sdk/src/config.ts
|
|
495
|
-
import { existsSync as
|
|
495
|
+
import { existsSync as existsSync4 } from "fs";
|
|
496
496
|
import { join as join6 } from "path";
|
|
497
497
|
|
|
498
498
|
// ../../packages/persistence/src/database.ts
|
|
@@ -17249,8 +17249,9 @@ import { createHash as createHash3 } from "crypto";
|
|
|
17249
17249
|
|
|
17250
17250
|
// ../../packages/persistence/src/fingerprint.ts
|
|
17251
17251
|
import { createHmac, randomBytes } from "crypto";
|
|
17252
|
-
import { readFileSync } from "fs";
|
|
17252
|
+
import { existsSync as existsSync2, readFileSync } from "fs";
|
|
17253
17253
|
import { join as join2 } from "path";
|
|
17254
|
+
import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
|
|
17254
17255
|
|
|
17255
17256
|
// ../../packages/persistence/src/local-layout.ts
|
|
17256
17257
|
import { renameSync as renameSync3 } from "fs";
|
|
@@ -17263,7 +17264,7 @@ import { readFileSync as readFileSync2 } from "fs";
|
|
|
17263
17264
|
import { join as join4 } from "path";
|
|
17264
17265
|
|
|
17265
17266
|
// ../../packages/persistence/src/warn-era-cap.ts
|
|
17266
|
-
import { existsSync as
|
|
17267
|
+
import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
|
|
17267
17268
|
import { join as join5 } from "path";
|
|
17268
17269
|
|
|
17269
17270
|
// ../../packages/plugin-sdk/src/provider-env.ts
|
|
@@ -17998,7 +17999,7 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
|
|
|
17998
17999
|
);
|
|
17999
18000
|
|
|
18000
18001
|
// ../../packages/plugin-sdk/src/repo.ts
|
|
18001
|
-
import { existsSync as
|
|
18002
|
+
import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
|
|
18002
18003
|
import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
|
|
18003
18004
|
|
|
18004
18005
|
// ../../packages/plugin-sdk/src/events.ts
|
|
@@ -18017,7 +18018,7 @@ import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
|
|
|
18017
18018
|
|
|
18018
18019
|
// ../../packages/plugin-sdk/src/project-files.ts
|
|
18019
18020
|
var import_ignore = __toESM(require_ignore(), 1);
|
|
18020
|
-
import { existsSync as
|
|
18021
|
+
import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
|
|
18021
18022
|
import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
|
|
18022
18023
|
|
|
18023
18024
|
// ../../packages/plugin-sdk/src/runtime.ts
|
package/scripts/statusline.js
CHANGED
|
@@ -492,7 +492,7 @@ var require_ignore = __commonJS({
|
|
|
492
492
|
});
|
|
493
493
|
|
|
494
494
|
// ../../packages/plugin-sdk/src/config.ts
|
|
495
|
-
import { existsSync as
|
|
495
|
+
import { existsSync as existsSync4 } from "fs";
|
|
496
496
|
import { join as join6 } from "path";
|
|
497
497
|
|
|
498
498
|
// ../../packages/persistence/src/database.ts
|
|
@@ -23372,11 +23372,22 @@ function purgeSampleData(db) {
|
|
|
23372
23372
|
function linkHost(input, hostId) {
|
|
23373
23373
|
return hostId ? { ...input, hostId } : input;
|
|
23374
23374
|
}
|
|
23375
|
+
function closeQuietly(db) {
|
|
23376
|
+
try {
|
|
23377
|
+
db.close();
|
|
23378
|
+
} catch {
|
|
23379
|
+
}
|
|
23380
|
+
}
|
|
23375
23381
|
function openWithPragmas(file2) {
|
|
23376
23382
|
const db = new DatabaseSync(file2);
|
|
23377
|
-
|
|
23378
|
-
|
|
23379
|
-
|
|
23383
|
+
try {
|
|
23384
|
+
db.exec("PRAGMA journal_mode = WAL");
|
|
23385
|
+
db.exec("PRAGMA busy_timeout = 2000");
|
|
23386
|
+
db.exec("PRAGMA foreign_keys = ON");
|
|
23387
|
+
} catch (err) {
|
|
23388
|
+
closeQuietly(db);
|
|
23389
|
+
throw err;
|
|
23390
|
+
}
|
|
23380
23391
|
return db;
|
|
23381
23392
|
}
|
|
23382
23393
|
function backupLegacyStore(file2) {
|
|
@@ -23388,43 +23399,80 @@ function backupLegacyStore(file2) {
|
|
|
23388
23399
|
}
|
|
23389
23400
|
return backup;
|
|
23390
23401
|
}
|
|
23402
|
+
function openAndInitialize(file2) {
|
|
23403
|
+
let db = openWithPragmas(file2);
|
|
23404
|
+
try {
|
|
23405
|
+
if (isForeignSqliteLineage(db)) {
|
|
23406
|
+
db.close();
|
|
23407
|
+
const backup = backupLegacyStore(file2);
|
|
23408
|
+
db = openWithPragmas(file2);
|
|
23409
|
+
akaWarn(
|
|
23410
|
+
`Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
|
|
23411
|
+
);
|
|
23412
|
+
}
|
|
23413
|
+
applyMigrations(db, file2);
|
|
23414
|
+
tightenPerms(file2);
|
|
23415
|
+
const policies = new SqlitePoliciesRepository(db);
|
|
23416
|
+
const installedPacks = new SqliteInstalledPacksRepository(db);
|
|
23417
|
+
const repositories = {
|
|
23418
|
+
events: new SqliteEventsRepository(db),
|
|
23419
|
+
findings: new SqliteFindingsRepository(db),
|
|
23420
|
+
policies,
|
|
23421
|
+
installedPacks,
|
|
23422
|
+
scanLedger: new SqliteScanLedgerRepository(db),
|
|
23423
|
+
exceptions: new SqliteExceptionsRepository(db),
|
|
23424
|
+
resolutions: new SqliteResolutionsRepository(db),
|
|
23425
|
+
ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
|
|
23426
|
+
security: new SqliteSecurityRepository(db),
|
|
23427
|
+
detections: new SqliteDetectionsRepository(db),
|
|
23428
|
+
shares: new SqliteSharesRepository(db),
|
|
23429
|
+
policyCatalog: new SqlitePolicyCatalogRepository(installedPacks),
|
|
23430
|
+
inventory: new SqliteInventoryRepository(db),
|
|
23431
|
+
inventoryAssets: new SqliteInventoryAssetsRepository(db),
|
|
23432
|
+
projectFiles: new SqliteProjectFilesRepository(db),
|
|
23433
|
+
activity: new SqliteActivityRepository(db),
|
|
23434
|
+
sourceProject: new SqliteSourceProjectRepository(db),
|
|
23435
|
+
auditEvents: new SqliteAuditEventsRepository(db),
|
|
23436
|
+
classifiedData: new SqliteClassifiedDataRepository(db),
|
|
23437
|
+
inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
|
|
23438
|
+
inspectionFindings: new SqliteInspectionFindingsRepository(db),
|
|
23439
|
+
configInventory: new SqliteConfigInventoryRepository(db)
|
|
23440
|
+
};
|
|
23441
|
+
policies.seedDefaults();
|
|
23442
|
+
return { db, ...repositories };
|
|
23443
|
+
} catch (err) {
|
|
23444
|
+
closeQuietly(db);
|
|
23445
|
+
throw err;
|
|
23446
|
+
}
|
|
23447
|
+
}
|
|
23391
23448
|
function openLocalDatabase(dir) {
|
|
23392
23449
|
ensureDataDirSync(dir);
|
|
23393
23450
|
const file2 = join(dir, DB_FILENAME);
|
|
23394
|
-
|
|
23395
|
-
|
|
23396
|
-
|
|
23397
|
-
|
|
23398
|
-
|
|
23399
|
-
|
|
23400
|
-
|
|
23401
|
-
|
|
23402
|
-
|
|
23403
|
-
|
|
23404
|
-
|
|
23405
|
-
|
|
23406
|
-
|
|
23407
|
-
|
|
23408
|
-
|
|
23409
|
-
|
|
23410
|
-
|
|
23411
|
-
|
|
23412
|
-
|
|
23413
|
-
|
|
23414
|
-
|
|
23415
|
-
|
|
23416
|
-
|
|
23417
|
-
|
|
23418
|
-
|
|
23419
|
-
const projectFiles = new SqliteProjectFilesRepository(db);
|
|
23420
|
-
const activity = new SqliteActivityRepository(db);
|
|
23421
|
-
const sourceProject = new SqliteSourceProjectRepository(db);
|
|
23422
|
-
const auditEvents = new SqliteAuditEventsRepository(db);
|
|
23423
|
-
const classifiedData = new SqliteClassifiedDataRepository(db);
|
|
23424
|
-
const inspectionDefinitions = new SqliteInspectionDefinitionsRepository(db);
|
|
23425
|
-
const inspectionFindings = new SqliteInspectionFindingsRepository(db);
|
|
23426
|
-
const configInventory = new SqliteConfigInventoryRepository(db);
|
|
23427
|
-
policies.seedDefaults();
|
|
23451
|
+
const {
|
|
23452
|
+
db,
|
|
23453
|
+
events,
|
|
23454
|
+
findings,
|
|
23455
|
+
policies,
|
|
23456
|
+
installedPacks,
|
|
23457
|
+
scanLedger,
|
|
23458
|
+
exceptions,
|
|
23459
|
+
resolutions,
|
|
23460
|
+
ruleProbeCache,
|
|
23461
|
+
security,
|
|
23462
|
+
detections,
|
|
23463
|
+
shares,
|
|
23464
|
+
policyCatalog,
|
|
23465
|
+
inventory,
|
|
23466
|
+
inventoryAssets,
|
|
23467
|
+
projectFiles,
|
|
23468
|
+
activity,
|
|
23469
|
+
sourceProject,
|
|
23470
|
+
auditEvents,
|
|
23471
|
+
classifiedData,
|
|
23472
|
+
inspectionDefinitions,
|
|
23473
|
+
inspectionFindings,
|
|
23474
|
+
configInventory
|
|
23475
|
+
} = openAndInitialize(file2);
|
|
23428
23476
|
function recordCapture(event, detected) {
|
|
23429
23477
|
failOpenTransaction(db, () => {
|
|
23430
23478
|
const sessionId = event.metadata?.sessionId;
|
|
@@ -23629,8 +23677,9 @@ import { createHash as createHash3 } from "crypto";
|
|
|
23629
23677
|
|
|
23630
23678
|
// ../../packages/persistence/src/fingerprint.ts
|
|
23631
23679
|
import { createHmac, randomBytes } from "crypto";
|
|
23632
|
-
import { readFileSync } from "fs";
|
|
23680
|
+
import { existsSync as existsSync2, readFileSync } from "fs";
|
|
23633
23681
|
import { join as join2 } from "path";
|
|
23682
|
+
import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
|
|
23634
23683
|
var KEY_FILENAME = "exception.key";
|
|
23635
23684
|
var KEY_MATERIAL_BYTES = 32;
|
|
23636
23685
|
function keyFilePath(dataDir2) {
|
|
@@ -23724,13 +23773,13 @@ function readJson(file2) {
|
|
|
23724
23773
|
}
|
|
23725
23774
|
|
|
23726
23775
|
// ../../packages/persistence/src/warn-era-cap.ts
|
|
23727
|
-
import { existsSync as
|
|
23776
|
+
import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
|
|
23728
23777
|
import { join as join5 } from "path";
|
|
23729
23778
|
var MARKER = "warn-era-capped";
|
|
23730
23779
|
function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
|
|
23731
23780
|
if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
|
|
23732
23781
|
const marker = join5(dataDir2, MARKER);
|
|
23733
|
-
if (
|
|
23782
|
+
if (existsSync3(marker)) return { capped: 0, skipped: "already-run" };
|
|
23734
23783
|
const capped = db.policies.capCategoryActions();
|
|
23735
23784
|
writeFileSync2(marker, `${new Date(Date.now()).toISOString()}
|
|
23736
23785
|
`, { mode: DATA_FILE_MODE });
|
|
@@ -23790,7 +23839,7 @@ function loadConfig(base = defaultDataDir()) {
|
|
|
23790
23839
|
try {
|
|
23791
23840
|
ensureLayoutDirSync(base);
|
|
23792
23841
|
const settingsFile = join6(settingsDir(base), "settings.json");
|
|
23793
|
-
if (
|
|
23842
|
+
if (existsSync4(settingsFile)) tightenFile(settingsFile);
|
|
23794
23843
|
} catch {
|
|
23795
23844
|
}
|
|
23796
23845
|
migrateLegacyLayout(base);
|
|
@@ -26551,7 +26600,7 @@ function bundledDetections() {
|
|
|
26551
26600
|
}
|
|
26552
26601
|
|
|
26553
26602
|
// ../../packages/plugin-sdk/src/repo.ts
|
|
26554
|
-
import { existsSync as
|
|
26603
|
+
import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
|
|
26555
26604
|
import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
|
|
26556
26605
|
|
|
26557
26606
|
// ../../packages/plugin-sdk/src/events.ts
|
|
@@ -26570,7 +26619,7 @@ import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
|
|
|
26570
26619
|
|
|
26571
26620
|
// ../../packages/plugin-sdk/src/project-files.ts
|
|
26572
26621
|
var import_ignore = __toESM(require_ignore(), 1);
|
|
26573
|
-
import { existsSync as
|
|
26622
|
+
import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
|
|
26574
26623
|
import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
|
|
26575
26624
|
|
|
26576
26625
|
// ../../packages/plugin-sdk/src/runtime.ts
|
package/scripts/stop.js
CHANGED
|
@@ -492,7 +492,7 @@ var require_ignore = __commonJS({
|
|
|
492
492
|
});
|
|
493
493
|
|
|
494
494
|
// ../../packages/plugin-sdk/src/config.ts
|
|
495
|
-
import { existsSync as
|
|
495
|
+
import { existsSync as existsSync4 } from "fs";
|
|
496
496
|
import { join as join6 } from "path";
|
|
497
497
|
|
|
498
498
|
// ../../packages/persistence/src/database.ts
|
|
@@ -17279,8 +17279,9 @@ import { createHash as createHash3 } from "crypto";
|
|
|
17279
17279
|
|
|
17280
17280
|
// ../../packages/persistence/src/fingerprint.ts
|
|
17281
17281
|
import { createHmac, randomBytes } from "crypto";
|
|
17282
|
-
import { readFileSync } from "fs";
|
|
17282
|
+
import { existsSync as existsSync2, readFileSync } from "fs";
|
|
17283
17283
|
import { join as join2 } from "path";
|
|
17284
|
+
import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
|
|
17284
17285
|
|
|
17285
17286
|
// ../../packages/persistence/src/local-layout.ts
|
|
17286
17287
|
import { renameSync as renameSync3 } from "fs";
|
|
@@ -17341,7 +17342,7 @@ function readJson(file2) {
|
|
|
17341
17342
|
}
|
|
17342
17343
|
|
|
17343
17344
|
// ../../packages/persistence/src/warn-era-cap.ts
|
|
17344
|
-
import { existsSync as
|
|
17345
|
+
import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
|
|
17345
17346
|
import { join as join5 } from "path";
|
|
17346
17347
|
|
|
17347
17348
|
// ../../packages/plugin-sdk/src/provider-env.ts
|
|
@@ -17397,7 +17398,7 @@ function loadConfig(base = defaultDataDir()) {
|
|
|
17397
17398
|
try {
|
|
17398
17399
|
ensureLayoutDirSync(base);
|
|
17399
17400
|
const settingsFile = join6(settingsDir(base), "settings.json");
|
|
17400
|
-
if (
|
|
17401
|
+
if (existsSync4(settingsFile)) tightenFile(settingsFile);
|
|
17401
17402
|
} catch {
|
|
17402
17403
|
}
|
|
17403
17404
|
migrateLegacyLayout(base);
|
|
@@ -18133,7 +18134,7 @@ var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].m
|
|
|
18133
18134
|
);
|
|
18134
18135
|
|
|
18135
18136
|
// ../../packages/plugin-sdk/src/repo.ts
|
|
18136
|
-
import { existsSync as
|
|
18137
|
+
import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
|
|
18137
18138
|
import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
|
|
18138
18139
|
|
|
18139
18140
|
// ../../packages/plugin-sdk/src/events.ts
|
|
@@ -18152,7 +18153,7 @@ import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
|
|
|
18152
18153
|
|
|
18153
18154
|
// ../../packages/plugin-sdk/src/project-files.ts
|
|
18154
18155
|
var import_ignore = __toESM(require_ignore(), 1);
|
|
18155
|
-
import { existsSync as
|
|
18156
|
+
import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
|
|
18156
18157
|
import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
|
|
18157
18158
|
|
|
18158
18159
|
// ../../packages/plugin-sdk/src/runtime.ts
|