@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.8

package/scripts/apply-suppressions.js

@@ -492,15 +492,14 @@ var require_ignore = __commonJS({
 });
 
 // src/apply-suppressions.ts
-import { existsSync as existsSync9, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
 import { userInfo } from "os";
-import { dirname as dirname6, join as join18 } from "path";
+import { dirname as dirname7, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
+// ../../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync2, statSync } from "fs";
+import { join } from "path";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
@@ -16204,6 +16203,124 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -18522,42 +18639,6 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
-}
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
-}
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
-}
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
-}
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
-}
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
-}
-var NO_SESSION = "no_session";
-var NO_PATH = "no_path";
-function captureId(sessionId, contentHash, filePath = null) {
-  return sha256Hex(
-    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
-  );
-}
-
-// ../../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname, join } from "path";
-
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -18606,7 +18687,46 @@ function tightenPerms(file2) {
   for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
 }
 
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
+
 // ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join2 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
@@ -18616,15 +18736,15 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync2(stage, { recursive: true, force: true });
+  rmSync3(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
-  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+  return { stage, copy: join2(stage, SNAPSHOT_STAGING_COPY) };
 }
 function idleMs(entry) {
-  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+  for (const candidate of [join2(entry, SNAPSHOT_STAGING_COPY), entry]) {
     try {
-      return Date.now() - statSync(candidate).mtimeMs;
+      return Date.now() - statSync2(candidate).mtimeMs;
     } catch {
     }
   }
@@ -18641,11 +18761,11 @@ function reapStalePartials(file2) {
   }
   for (const name of entries) {
     if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
-    const staging = join(dir, name);
+    const staging = join2(dir, name);
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync2(staging, { recursive: true, force: true });
+        rmSync3(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -18659,13 +18779,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(stage, { recursive: true, force: true });
+      rmSync3(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
   try {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -18680,7 +18800,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync2(sidecar, { force: true });
+        rmSync3(sidecar, { force: true });
       }
     }
   } catch (error51) {
@@ -18696,14 +18816,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync2(file2, { force: true });
+    rmSync3(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync2(sidecar, { force: true });
+      rmSync3(sidecar, { force: true });
     }
   } catch (error51) {
     if (existsSync(file2)) {
       try {
-        rmSync2(backup, { force: true });
+        rmSync3(backup, { force: true });
       } catch {
       }
     }
@@ -18935,10 +19055,31 @@ function applyMigrations(db, file2) {
     if (drained) applyLegacyDropMigration(db, file2);
   }
 }
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table2 of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table2}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table2}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table2}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table2}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
 function applyLegacyDropMigration(db, file2) {
   const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
   if (!migration) return;
-  if (file2) {
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
     try {
       backupBeforeLegacyDrop(db, file2);
     } catch (error51) {
@@ -18952,6 +19093,12 @@ function applyLegacyDropMigration(db, file2) {
       () => {
         const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
         if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
         for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
@@ -25173,7 +25320,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join2(dir, DB_FILENAME);
+  const file2 = join3(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -25409,9 +25556,9 @@ import {
   closeSync,
   existsSync as existsSync2,
   openSync,
-  readFileSync,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -25422,26 +25569,26 @@ import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir(), ".aka");
+  return join5(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -25454,8 +25601,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join4(dest, name);
-      renameSync3(join4(base, name), moved);
+      const moved = join5(dest, name);
+      renameSync3(join5(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -25463,7 +25610,7 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -25481,7 +25628,7 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
@@ -25528,14 +25675,14 @@ function overlayManagedSettings(settings, managed, now = () => /* @__PURE__ */ n
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -25546,13 +25693,17 @@ function readUserSettings(base) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync4(file2, "utf8");
+    text = readFileSync5(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync4, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join7, resolve } from "path";
+
 // ../../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -25565,19 +25716,19 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -25631,8 +25782,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join8(settingsDir(base), "settings.json");
-    if (existsSync5(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join10(settingsDir(base), "settings.json");
+    if (existsSync6(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -25655,9 +25806,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join10 } from "path";
+import { basename as basename3, join as join12 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -27347,10 +27498,10 @@ var localhost_ref_default = {
   severity: "low",
   matcher: {
     type: "regex",
-    pattern: "\\b(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1)\\b",
+    pattern: "(?<![A-Za-z0-9_])(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|(?<![A-Za-z0-9_]\\[)::1(?!:|\\.[0-9]))(?![A-Za-z0-9_])",
     flags: "g"
   },
-  examples: ["localhost", "127.0.0.1"]
+  examples: ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
 };
 
 // ../../rules/core-code-context/stack-trace.json
@@ -28692,32 +28843,32 @@ function maskText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join11, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
-import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/posture.ts
 function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
@@ -28730,8 +28881,8 @@ function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
 }
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join13 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -28848,12 +28999,12 @@ async function applySetupTriageSuppressions(entries, writer, opts) {
 }
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/setup-wizard/src/remediation/rotation-checklist.ts
 import { writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 
 // ../../packages/setup-wizard/src/triage/dedupe.ts
 function dedupeKey(hit) {
@@ -28908,12 +29059,12 @@ function deriveFalsePositivePatterns(hits, rec, plan) {
 }
 
 // ../../packages/setup-wizard/src/triage/gate-display.ts
-function findContext(entry, join19) {
-  const byFingerprint = join19.find(
+function findContext(entry, join21) {
+  const byFingerprint = join21.find(
     (j) => j.valueFingerprint !== void 0 && j.valueFingerprint === entry.valueFingerprint
   );
   if (byFingerprint) return byFingerprint.maskedContext;
-  const byRuleAndMask = join19.find(
+  const byRuleAndMask = join21.find(
     (j) => j.ruleId === entry.ruleId && j.maskedMatch === entry.maskedValue
   );
   return byRuleAndMask?.maskedContext;
@@ -28984,13 +29135,13 @@ function renderShowcase(showcase) {
 
 ${blocks.join("\n\n")}`;
 }
-function renderSuppressionGate(entries, join19) {
+function renderSuppressionGate(entries, join21) {
   if (entries.length === 0) {
     return "No false-positive suppressions to confirm \u2014 nothing will be written.";
   }
   const header = entries.length === 1 ? "This looks like a false positive \u2014 take a look before I suppress it:" : `These ${String(entries.length)} look like false positives \u2014 take a look before I suppress them:`;
   const blocks = entries.map((entry, i) => {
-    const context = findContext(entry, join19);
+    const context = findContext(entry, join21);
     const lines = [
       `${String(i + 1)}. ${entry.ruleId} [${entry.category}]`,
       `   value:   ${entry.maskedValue}`,
@@ -29076,9 +29227,9 @@ function mergeRecommendations(verdicts) {
 }
 
 // ../../packages/setup-wizard/src/triage/plan-file.ts
-import { mkdtempSync, readFileSync as readFileSync10, rmdirSync, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync11, rmdirSync, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename6, dirname as dirname4, join as join16 } from "path";
+import { basename as basename6, dirname as dirname5, join as join18 } from "path";
 var SuppressionEntrySchema = external_exports.object({
   ruleId: external_exports.string(),
   category: DetectionCategory,
@@ -29133,19 +29284,19 @@ function serializePlan(plan, current) {
 function writePlanFile(plan, current, rawValues, deps = {}) {
   const serialized = serializePlan(plan, current);
   assertRawFree(serialized, rawValues);
-  const dir = (deps.mkTempDir ?? (() => mkdtempSync(join16(tmpdir(), "aka-plan-"))))();
-  const path = join16(dir, "setup-plan.json");
+  const dir = (deps.mkTempDir ?? (() => mkdtempSync(join18(tmpdir(), "aka-plan-"))))();
+  const path = join18(dir, "setup-plan.json");
   writeFileSync8(path, serialized, { encoding: "utf8", mode: 384 });
   return path;
 }
 function readPlanFile(path) {
-  const text = readFileSync10(path, "utf8");
+  const text = readFileSync11(path, "utf8");
   const json2 = JSON.parse(text);
   return PersistedPlanSchema.parse(json2);
 }
 function deletePlanFile(path) {
-  rmSync5(path, { force: true });
-  const dir = dirname4(path);
+  rmSync6(path, { force: true });
+  const dir = dirname5(path);
   if (!basename6(dir).startsWith("aka-plan-")) return;
   try {
     rmdirSync(dir);
@@ -29213,8 +29364,8 @@ function buildJoinEntries(hits) {
 }
 
 // ../../packages/setup-wizard/src/triage/resolve.ts
-function resolveSuppressions(rec, join19) {
-  const byId = new Map(join19.map((e) => [e.id, e]));
+function resolveSuppressions(rec, join21) {
+  const byId = new Map(join21.map((e) => [e.id, e]));
   const entries = [];
   const skipped = [];
   for (const cat of rec.perCategory) {
@@ -29316,7 +29467,7 @@ function parseTriageStream(text) {
   return { hits, status: "complete" };
 }
 function planTriageWriteback(hits, rec) {
-  const join19 = buildJoinEntries(hits);
+  const join21 = buildJoinEntries(hits);
   const rawValues = hits.map((h) => h.rawMatch);
   const skipped = [];
   const posture = {};
@@ -29356,7 +29507,7 @@ function planTriageWriteback(hits, rec) {
   }
   const { entries, skipped: resolveSkips } = resolveSuppressions(
     { perCategory: safeCategories, notes: rec.notes },
-    join19
+    join21
   );
   skipped.push(...resolveSkips);
   let notes = rec.notes;
@@ -29366,7 +29517,7 @@ function planTriageWriteback(hits, rec) {
     if (err instanceof RawEgressError) notes = SCRUBBED_NOTES;
     else throw err;
   }
-  return { entries, posture, showcase, join: join19, notes, skipped };
+  return { entries, posture, showcase, join: join21, notes, skipped };
 }
 function recommendedPosture(evidence) {
   return { ...severityFloorPosture(), ...evidence };
@@ -29635,9 +29786,9 @@ function parseRecommendation(text) {
 
 // src/triage/judge.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync11, rmSync as rmSync6 } from "fs";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname5, join as join17 } from "path";
+import { dirname as dirname6, join as join19 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../packages/plugin-sdk/src/bare-command.ts
@@ -29728,8 +29879,8 @@ function planBareCommand(command, args, deps = {}) {
     return { file: command, args, options: {}, viaShell: false, resolved: void 0 };
   }
   const home = deps.home ?? homedir3();
-  const resolve = deps.resolve ?? resolveWindowsCommand;
-  const resolved = resolve(command, deps.env, home);
+  const resolve2 = deps.resolve ?? resolveWindowsCommand;
+  const resolved = resolve2(command, deps.env, home);
   if (resolved !== void 0 && isDirectlyExecutable(resolved)) {
     return { file: resolved, args, options: { cwd: home }, viaShell: false, resolved };
   }
@@ -29748,8 +29899,8 @@ function planBareCommand(command, args, deps = {}) {
 }
 
 // src/triage/judge.ts
-var TRIAGE_DIR = dirname5(fileURLToPath2(import.meta.url));
-var DEFAULT_RUBRIC_PATH = join17(
+var TRIAGE_DIR = dirname6(fileURLToPath2(import.meta.url));
+var DEFAULT_RUBRIC_PATH = join19(
   TRIAGE_DIR,
   "..",
   "..",
@@ -29786,7 +29937,7 @@ function judgeEnv(platform2 = process.platform) {
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
   };
   if (platform2 === "darwin") {
-    env.CLAUDE_CONFIG_DIR = mkdtempSync2(join17(tmpdir2(), "aka-judge-cfg-"));
+    env.CLAUDE_CONFIG_DIR = mkdtempSync2(join19(tmpdir2(), "aka-judge-cfg-"));
   }
   return env;
 }
@@ -29821,7 +29972,7 @@ function runJudge(hits, deps) {
   if (typeof deps.spawn !== "function") {
     throw new TypeError("runJudge requires deps.spawn \u2014 there is no live-spawn fallback");
   }
-  const rubric = deps.loadRubric?.() ?? readFileSync11(DEFAULT_RUBRIC_PATH, "utf8");
+  const rubric = deps.loadRubric?.() ?? readFileSync12(DEFAULT_RUBRIC_PATH, "utf8");
   const hitsJsonl = hits.map((h) => JSON.stringify(toJudgePayload(h))).join("\n");
   const fullPrompt = `${rubric}
 
@@ -29845,7 +29996,7 @@ ${hitsJsonl}
   } finally {
     if (platform2 === "darwin" && env.CLAUDE_CONFIG_DIR) {
       try {
-        rmSync6(env.CLAUDE_CONFIG_DIR, { recursive: true, force: true });
+        rmSync7(env.CLAUDE_CONFIG_DIR, { recursive: true, force: true });
       } catch {
       }
     }
@@ -30090,11 +30241,11 @@ function resolveCreatedBy() {
   }
 }
 function loadRubric() {
-  const here = dirname6(fileURLToPath4(import.meta.url));
-  const shipped = join18(here, "triage-rubric.md");
-  if (existsSync9(shipped)) return readFileSync12(shipped, "utf8");
-  return readFileSync12(
-    join18(here, "..", "..", "..", "packages", "setup-wizard", "assets", "triage-rubric.md"),
+  const here = dirname7(fileURLToPath4(import.meta.url));
+  const shipped = join20(here, "triage-rubric.md");
+  if (existsSync10(shipped)) return readFileSync13(shipped, "utf8");
+  return readFileSync13(
+    join20(here, "..", "..", "..", "packages", "setup-wizard", "assets", "triage-rubric.md"),
     "utf8"
   );
 }
@@ -30104,7 +30255,7 @@ async function main() {
     argv,
     // fd 0 = stdin; the wizard pipes `backfill.js --triage` into this on preview.
     // Called only on the preview path — the confirm path never reads a stream.
-    readStream: (streamPath) => streamPath !== void 0 ? readFileSync12(streamPath, "utf8") : readFileSync12(0, "utf8"),
+    readStream: (streamPath) => streamPath !== void 0 ? readFileSync13(streamPath, "utf8") : readFileSync13(0, "utf8"),
     runJudge: (hits) => runJudge(hits, { spawn: spawnClaude, loadRubric }),
     // The distinct model-judge egress consent, read from settings.json. When it
     // is absent or stale the preview skips the judge instead of sending findings