@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.8

package/scripts/onboard.js

@@ -491,10 +491,9 @@ var require_ignore = __commonJS({
   }
 });
 
-// ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID10 } from "crypto";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
+// ../../packages/persistence/src/control-plane-credential.ts
+import { chmodSync as chmodSync2, lstatSync as lstatSync2, readFileSync, rmSync as rmSync2, statSync } from "fs";
+import { join } from "path";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
@@ -16198,6 +16197,124 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
@@ -18517,42 +18634,6 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
-// ../../packages/persistence/src/ids.ts
-import { createHash } from "crypto";
-function sha256Hex(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
-}
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
-}
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
-}
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
-}
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
-}
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
-}
-var NO_SESSION = "no_session";
-var NO_PATH = "no_path";
-function captureId(sessionId, contentHash, filePath = null) {
-  return sha256Hex(
-    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
-  );
-}
-
-// ../../packages/persistence/src/internal/snapshot.ts
-import { randomUUID } from "crypto";
-import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
-import { basename, dirname, join } from "path";
-
 // ../../packages/persistence/src/paths.ts
 import {
   chmodSync,
@@ -18621,7 +18702,46 @@ function writeOwnerOnlyFileSync(file2, data) {
   tightenFile(file2);
 }
 
+// ../../packages/persistence/src/database.ts
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join3, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/persistence/src/ids.ts
+import { createHash } from "crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+}
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+var NO_SESSION = "no_session";
+var NO_PATH = "no_path";
+function captureId(sessionId, contentHash, filePath = null) {
+  return sha256Hex(
+    canonicalIdentity(["capture", sessionId ?? NO_SESSION, contentHash, filePath ?? NO_PATH])
+  );
+}
+
 // ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join2 } from "path";
 function backupPath(file2, tag) {
   return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
 }
@@ -18631,15 +18751,15 @@ var STAGED_NAME_SUFFIX = `.bak${SNAPSHOT_STAGING_SUFFIX}`;
 var SNAPSHOT_STAGING_COPY = "copy";
 function createSnapshotStaging(backup) {
   const stage = `${backup}${SNAPSHOT_STAGING_SUFFIX}`;
-  rmSync2(stage, { recursive: true, force: true });
+  rmSync3(stage, { recursive: true, force: true });
   mkdirOwnerOnlySync(stage);
   tightenDir(stage);
-  return { stage, copy: join(stage, SNAPSHOT_STAGING_COPY) };
+  return { stage, copy: join2(stage, SNAPSHOT_STAGING_COPY) };
 }
 function idleMs(entry) {
-  for (const candidate of [join(entry, SNAPSHOT_STAGING_COPY), entry]) {
+  for (const candidate of [join2(entry, SNAPSHOT_STAGING_COPY), entry]) {
     try {
-      return Date.now() - statSync(candidate).mtimeMs;
+      return Date.now() - statSync2(candidate).mtimeMs;
     } catch {
     }
   }
@@ -18656,11 +18776,11 @@ function reapStalePartials(file2) {
   }
   for (const name of entries) {
     if (!name.startsWith(prefix) || !name.endsWith(STAGED_NAME_SUFFIX)) continue;
-    const staging = join(dir, name);
+    const staging = join2(dir, name);
     try {
       const idle = idleMs(staging);
       if (idle !== null && idle > STALE_PARTIAL_MS) {
-        rmSync2(staging, { recursive: true, force: true });
+        rmSync3(staging, { recursive: true, force: true });
       }
     } catch {
     }
@@ -18674,13 +18794,13 @@ function snapshotStore(db, backup) {
     renameSync2(copy, backup);
   } catch (error51) {
     try {
-      rmSync2(stage, { recursive: true, force: true });
+      rmSync3(stage, { recursive: true, force: true });
     } catch {
     }
     throw error51;
   }
   try {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   } catch {
   }
 }
@@ -18695,7 +18815,7 @@ function moveStoreAside(file2, backup) {
         renameSync2(sidecar, moved);
         undo.push([moved, sidecar]);
       } catch {
-        rmSync2(sidecar, { force: true });
+        rmSync3(sidecar, { force: true });
       }
     }
   } catch (error51) {
@@ -18711,14 +18831,14 @@ function moveStoreAside(file2, backup) {
 }
 function discardStore(file2, backup) {
   try {
-    rmSync2(file2, { force: true });
+    rmSync3(file2, { force: true });
     for (const sidecar of dbSidecars(file2)) {
-      rmSync2(sidecar, { force: true });
+      rmSync3(sidecar, { force: true });
     }
   } catch (error51) {
     if (existsSync(file2)) {
       try {
-        rmSync2(backup, { force: true });
+        rmSync3(backup, { force: true });
       } catch {
       }
     }
@@ -18950,10 +19070,31 @@ function applyMigrations(db, file2) {
     if (drained) applyLegacyDropMigration(db, file2);
   }
 }
+function readLegacyTables(db) {
+  let holdsRows = false;
+  const marks = [];
+  for (const table2 of ["events", "findings"]) {
+    try {
+      const row = db.prepare(`SELECT count(*) AS n, ifnull(max(rowid), -1) AS hi FROM ${table2}`).get();
+      if (row === void 0) {
+        holdsRows = true;
+        marks.push(`${table2}:unreadable`);
+        continue;
+      }
+      if (row.n > 0) holdsRows = true;
+      marks.push(`${table2}:${String(row.n)}:${String(row.hi)}`);
+    } catch {
+      holdsRows = true;
+      marks.push(`${table2}:unreadable`);
+    }
+  }
+  return { holdsRows, mark: marks.join("|") };
+}
 function applyLegacyDropMigration(db, file2) {
   const migration = SQLITE_MIGRATIONS.find((m) => m.tag === LEGACY_DROP_MIGRATION_TAG);
   if (!migration) return;
-  if (file2) {
+  const before = file2 === void 0 ? void 0 : readLegacyTables(db);
+  if (file2 !== void 0 && before?.holdsRows === true) {
     try {
       backupBeforeLegacyDrop(db, file2);
     } catch (error51) {
@@ -18967,6 +19108,12 @@ function applyLegacyDropMigration(db, file2) {
       () => {
         const alreadyDropped = db.prepare("SELECT 1 FROM migration_ledger WHERE tag = ?").get(migration.tag);
         if (alreadyDropped) return;
+        if (before !== void 0 && readLegacyTables(db).mark !== before.mark) {
+          akaWarn(
+            "legacy events/findings rows changed after the pre-drop snapshot decision; deferring the drop so the next open can copy them first."
+          );
+          return;
+        }
         for (const statement of splitStatements(migration.sql)) {
           db.exec(statement);
         }
@@ -25188,7 +25335,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join2(dir, DB_FILENAME);
+  const file2 = join3(dir, DB_FILENAME);
   reapStalePartials(file2);
   const {
     db,
@@ -25424,9 +25571,9 @@ import {
   closeSync,
   existsSync as existsSync2,
   openSync,
-  readFileSync,
-  rmSync as rmSync3,
-  statSync as statSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync4,
+  statSync as statSync3,
   writeFileSync as writeFileSync2
 } from "fs";
 import { hostname as hostname3 } from "os";
@@ -25460,7 +25607,7 @@ function lockPathFor(file2) {
 function readLockBody(lock) {
   let raw;
   try {
-    raw = readFileSync(lock, "utf8");
+    raw = readFileSync2(lock, "utf8");
   } catch {
     return null;
   }
@@ -25491,7 +25638,7 @@ function directoryAcceptsCreates(lock) {
     return false;
   } finally {
     try {
-      rmSync3(probe, { force: true });
+      rmSync4(probe, { force: true });
     } catch {
     }
   }
@@ -25524,7 +25671,7 @@ function tryAcquire(lock, file2) {
       closeSync(fd);
     } catch {
     }
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
     return null;
   }
   try {
@@ -25536,7 +25683,7 @@ function tryAcquire(lock, file2) {
 function isAbandoned(body, lock, staleMs) {
   if (!body) {
     try {
-      return Date.now() - statSync2(lock).mtimeMs >= staleMs;
+      return Date.now() - statSync3(lock).mtimeMs >= staleMs;
     } catch {
       return false;
     }
@@ -25560,13 +25707,13 @@ function breakIfStale(lock, staleMs) {
   }
   try {
     if (!existsSync2(lock) || !isAbandoned(readLockBody(lock), lock, staleMs)) return false;
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
     return true;
   } catch {
     return false;
   } finally {
     try {
-      rmSync3(breaker, { force: true });
+      rmSync4(breaker, { force: true });
     } catch {
     }
   }
@@ -25574,8 +25721,8 @@ function breakIfStale(lock, staleMs) {
 var BREAKER_ABANDONED_MS = 1e4;
 function reapAbandonedBreaker(breaker) {
   try {
-    if (Date.now() - statSync2(breaker).mtimeMs >= BREAKER_ABANDONED_MS) {
-      rmSync3(breaker, { force: true });
+    if (Date.now() - statSync3(breaker).mtimeMs >= BREAKER_ABANDONED_MS) {
+      rmSync4(breaker, { force: true });
     }
   } catch {
   }
@@ -25586,7 +25733,7 @@ function abandonWindow(staleMs) {
 function release(lock, token) {
   try {
     if (readLockBody(lock)?.token !== token) return;
-    rmSync3(lock, { force: true });
+    rmSync4(lock, { force: true });
   } catch {
   }
 }
@@ -25637,26 +25784,26 @@ import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function defaultDataDir() {
-  return join4(homedir(), ".aka");
+  return join5(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join4(base, "settings");
+  return join5(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join4(base, "data");
+  return join5(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join4(dataDir(base), "aka.db");
+  return join5(dataDir(base), "aka.db");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -25669,8 +25816,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join4(dest, name);
-      renameSync3(join4(base, name), moved);
+      const moved = join5(dest, name);
+      renameSync3(join5(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -25678,7 +25825,7 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/managed-settings.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { posix, win32 } from "path";
 function managedSettingsPaths(platform2 = process.platform) {
   if (platform2 === "darwin") {
@@ -25696,7 +25843,7 @@ function readManagedSettings(paths = managedSettingsPaths()) {
   for (const path of paths) {
     let text;
     try {
-      text = readFileSync3(path, "utf8");
+      text = readFileSync4(path, "utf8");
     } catch {
       continue;
     }
@@ -25755,14 +25902,14 @@ function lockedAmong(context, requested) {
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join6 } from "path";
 var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
   return overlayManagedSettings(readUserSettings(base), readManagedSettings());
 }
 function readUserSettings(base) {
-  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
+  const record2 = readJson(join6(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -25827,7 +25974,7 @@ function withoutManagedKeys(applied, managed, pinned, touched) {
 function applyOnboarding(answers2, base = defaultDataDir(), managedOverride) {
   const dir = settingsDir(base);
   ensureDataDirSync(dir);
-  const file2 = join5(dir, SETTINGS_FILENAME);
+  const file2 = join6(dir, SETTINGS_FILENAME);
   const managedSettings = managedOverride === void 0 ? readManagedSettings() : managedOverride;
   const managed = managedContextOf(managedSettings);
   return withFileLock(file2, () => {
@@ -25856,13 +26003,17 @@ function applyOnboarding(answers2, base = defaultDataDir(), managedOverride) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync4(file2, "utf8");
+    text = readFileSync5(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/store-symlinks.ts
+import { existsSync as existsSync4, lstatSync as lstatSync3, readlinkSync, realpathSync, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join7, resolve } from "path";
+
 // ../../packages/persistence/src/vault/crypto.ts
 import {
   createCipheriv,
@@ -25875,20 +26026,20 @@ import {
 // ../../packages/persistence/src/vault/key-provider.ts
 import { execFileSync } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync2, readFileSync as readFileSync5, renameSync as renameSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { chmodSync as chmodSync3, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync5, statSync as statSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/vault/vault.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
 
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join7(dataDir2, MARKER);
-  if (existsSync4(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join9(dataDir2, MARKER);
+  if (existsSync5(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
   writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
@@ -25896,8 +26047,8 @@ function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
 }
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env.ts
 var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
@@ -25951,8 +26102,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join8(settingsDir(base), "settings.json");
-    if (existsSync5(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join10(settingsDir(base), "settings.json");
+    if (existsSync6(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -25975,9 +26126,9 @@ function resolveProviderSafe(resolveProviderFn) {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, join as join10 } from "path";
+import { basename as basename3, join as join12 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -26735,32 +26886,32 @@ var CPU_CORROBORATION_SHARE = 0.2;
 var CORROBORATION_FLOOR_MS = BUDGET_MS * CPU_CORROBORATION_SHARE;
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join11, sep as sep2 } from "path";
 
 // ../../packages/plugin-sdk/src/events.ts
 import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-sdk/src/isolated-scan.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/ignore-layers.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname4, platform, release as release2 } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
-import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync3 } from "fs";
+import { basename as basename4, dirname as dirname4, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/posture.ts
 function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
@@ -26773,8 +26924,8 @@ function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
 }
 
 // ../../packages/plugin-sdk/src/project-files.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4 } from "fs";
-import { basename as basename5, join as join13 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "fs";
+import { basename as basename5, join as join15 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -26809,8 +26960,8 @@ import { randomUUID as randomUUID14 } from "crypto";
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { mkdirSync as mkdirSync3, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join16 } from "path";
 
 // ../../packages/setup-wizard/src/onboard-posture.ts
 function parsePosture(json2) {
@@ -26833,7 +26984,7 @@ function parsePosture(json2) {
 
 // ../../packages/setup-wizard/src/remediation/rotation-checklist.ts
 import { writeFileSync as writeFileSync7 } from "fs";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 
 // ../../packages/setup-wizard/src/triage/merge.ts
 var RANK = Object.fromEntries(
@@ -26841,9 +26992,9 @@ var RANK = Object.fromEntries(
 );
 
 // ../../packages/setup-wizard/src/triage/plan-file.ts
-import { mkdtempSync, readFileSync as readFileSync10, rmdirSync, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync11, rmdirSync, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename6, dirname as dirname4, join as join16 } from "path";
+import { basename as basename6, dirname as dirname5, join as join18 } from "path";
 var SuppressionEntrySchema = external_exports.object({
   ruleId: external_exports.string(),
   category: DetectionCategory,