@akasecurity/cli 0.8.2 → 0.9.0-rc1

package/dist/cli.js

@@ -755,21 +755,28 @@ import { createHash, randomUUID } from "crypto";
 import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
 import { join as join2, relative, sep } from "path";
 
+// ../packages/detections/src/escape-regexp.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
+
 // ../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
-    const haystack = caseSensitive ? text : text.toLowerCase();
     const spans = [];
     for (const kw of keywords) {
-      const needle = caseSensitive ? kw : kw.toLowerCase();
-      let idx = 0;
-      while (idx < haystack.length) {
-        const pos = haystack.indexOf(needle, idx);
-        if (pos === -1) break;
-        spans.push({ start: pos, end: pos + kw.length });
-        idx = pos + 1;
+      if (kw.length === 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
     }
     return spans;
@@ -777,7 +784,6 @@ var KeywordMatcher = class {
 };
 
 // ../packages/detections/src/matchers/regex.ts
-var MAX_MATCHES_PER_RULE = 1e4;
 var RegexMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
@@ -863,9 +869,6 @@ function registerPack(pack) {
 function getLoadedRules() {
   return [...packs.values()].flatMap((p) => p.rules);
 }
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function isCorroborated(candidate, candidates, text) {
   const req = candidate.rule.requiresNearby;
   if (!req) return true;
@@ -1098,6 +1101,10 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0009_findings_path_expression_index",
     sql: "-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan \u2014 previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"
+  },
+  {
+    tag: "0010_events_session_expression_index",
+    sql: "-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- \u2014 previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"
   }
 ];
 
@@ -1160,6 +1167,10 @@ function scopeFromAnswer(answer, now = Date.now()) {
   };
 }
 
+// ../packages/schema/src/identity.ts
+var PRODUCT_NAME = "AKA Security";
+var PRODUCT_TAGLINE = "We secure agent harnesses at the source.";
+
 // ../packages/schema/src/time.ts
 function isoToEpochMillis(iso) {
   return new Date(iso).getTime();
@@ -1254,12 +1265,15 @@ var defaultCostModel = {
 };
 
 // ../packages/schema/src/token/format.ts
+var COMPACT = new Intl.NumberFormat("en-US", {
+  notation: "compact",
+  maximumFractionDigits: 1
+});
+function compactNumber(n) {
+  return COMPACT.format(n);
+}
 function formatTokenCount(n) {
-  const abs = Math.abs(n);
-  if (abs < 1e3) return String(n);
-  if (abs < 1e6) return `${(n / 1e3).toFixed(1)}k`;
-  if (abs < 1e9) return `${(n / 1e6).toFixed(1)}M`;
-  return `${(n / 1e9).toFixed(1)}B`;
+  return compactNumber(n);
 }
 function formatUsd(value) {
   return value > 0 && value < 0.1 ? `$${value.toFixed(4)}` : `$${value.toFixed(2)}`;
@@ -15993,6 +16007,12 @@ var FindingInstance = external_exports.object({
   provider: FindingProvider,
   repo: external_exports.string(),
   file: external_exports.string(),
+  // Host tool that produced the scanned text (event metadata's toolName).
+  // Present whenever the capturing hook recorded one — including
+  // file-attributed captures (views prefer `file`); its display value is
+  // the location fallback ("via Bash") when no filePath exists. Absent for
+  // legacy rows and non-tool captures (prompts, worktree scans).
+  toolName: external_exports.string().optional(),
   // Effective action: override.action ?? actionTaken, translated to FindingAction.
   action: FindingAction,
   detectedAt: external_exports.iso.datetime(),
@@ -16049,6 +16069,9 @@ var ListGroupedFindingsQuery = external_exports.object({
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   q: external_exports.string().optional(),
+  // Scope to findings whose event carries this session id (the Activity page's
+  // session → findings drilldown). Findings without a session never match.
+  sessionId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -16060,7 +16083,13 @@ var ListGroupedFindingsResponse = external_exports.object({
   }),
   facets: FindingFacets,
   items: external_exports.array(FindingGroup),
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  // Present only on session-scoped queries (`sessionId` set): per ruleId, how
+  // many times that rule fired in the session's persisted transcript. Findings
+  // here are deduplicated to unique values while the transcript tally counts
+  // every firing, so the two numbers legitimately differ — this map lets a
+  // session-scoped view show both.
+  sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
 }).meta({ id: "ListGroupedFindingsResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
@@ -16468,6 +16497,10 @@ var ListActivitySessionsQuery = external_exports.object({
   from: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
   /** Upper bound on startedAt; omitted defaults to now. */
   to: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
+  /** Exclude zero-activity sessions — roots whose only recorded children are
+   * bookkeeping rows (hooks, config scans), typically background `claude`
+   * launches. Omitted = list everything. `z.stringbool()` per the note above. */
+  excludeEmpty: external_exports.stringbool().optional(),
   /** Page size, 1–100; out-of-range values are a 400. `z.coerce` — query params arrive as strings. */
   limit: external_exports.coerce.number().int().min(1).max(100).default(50),
   /** Opaque pagination cursor (most-recent first). */
@@ -16476,7 +16509,11 @@ var ListActivitySessionsQuery = external_exports.object({
 var ListActivitySessionsResponse = external_exports.object({
   items: external_exports.array(ActivitySessionSummary),
   /** `null` once the last page is reached. */
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  /** Zero-activity sessions matching the query's filters/range (whether or
+   * not `excludeEmpty` dropped them from `items`) — the count a UI toggle
+   * shows when collapsing them. */
+  emptyCount: external_exports.number().int().nonnegative()
 }).meta({ id: "ListActivitySessionsResponse" });
 var ListSessionEventsQuery = external_exports.object({
   /** Default 100, range 1–500. */
@@ -16511,6 +16548,12 @@ var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
   filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
   // Set (true) by the worktree scanner when the file is excluded by the
   // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
   // generated code can leak real secrets — but the provenance is recorded so
@@ -16842,7 +16885,10 @@ var ExceptionBundleEntry = DetectionException.pick({
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
 var KeywordMatcher2 = external_exports.object({
   type: external_exports.literal("keyword"),
-  keywords: external_exports.array(external_exports.string()).min(1),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
   caseSensitive: external_exports.boolean().default(false)
 });
 function isValidRegex(pattern, flags) {
@@ -17091,6 +17137,10 @@ var ListEventsResponse = external_exports.object({
   items: external_exports.array(Event),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListEventsResponse" });
+var IngestResponse = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+}).meta({ id: "IngestResponse" });
 var ListFindingsQuery = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
@@ -17480,6 +17530,7 @@ function buildFindingGroups(rows, opts = {}) {
         provider: toApiProvider(r.sourceTool),
         repo: r.repo,
         file: r.file,
+        ...r.toolName === void 0 ? {} : { toolName: r.toolName },
         action: toApiAction(effectiveDbAction),
         detectedAt: r.occurredAt,
         confidence: r.confidence,
@@ -17552,6 +17603,7 @@ function buildHaystack(g, extra) {
     g.id,
     ...g.instances.map((i) => i.repo),
     ...g.instances.map((i) => i.file),
+    ...g.instances.map((i) => i.toolName ? `via ${i.toolName}` : ""),
     ...g.instances.map((i) => i.id),
     ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
@@ -17818,6 +17870,74 @@ var ProjectFilesScan = external_exports.object({
   scannedAt: external_exports.string()
 });
 
+// ../packages/schema/src/zod/ranges.ts
+var TIME_RANGES = ["7d", "30d", "3m", "6m"];
+var TimeRange = external_exports.enum(TIME_RANGES).meta({ id: "TimeRange" });
+var DEFAULT_TIME_RANGE = "7d";
+var RANGE_DAYS = {
+  "7d": 7,
+  "30d": 30,
+  "3m": 90,
+  "6m": 180
+};
+var TIME_RANGE_OR_DEFAULT = TimeRange.catch(DEFAULT_TIME_RANGE);
+function parseTimeRange(value) {
+  return TIME_RANGE_OR_DEFAULT.parse(value);
+}
+
+// ../packages/schema/src/zod/remediation.ts
+var SecretFindingState = external_exports.enum(["still-valid", "unknown", "invalid"]);
+var MaskedFindingLocation = external_exports.object({
+  filePath: external_exports.string(),
+  span: Span.optional()
+}).strict();
+var MaskedSecretFinding = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  where: MaskedFindingLocation,
+  state: SecretFindingState,
+  observedAt: external_exports.iso.datetime().optional()
+}).strict();
+var RotationChecklistEntry = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  consolePath: external_exports.string(),
+  occurrenceSpread: external_exports.number().int().positive()
+}).strict();
+var RemediationOption = external_exports.enum([
+  "redact-rotation-checklist",
+  "redact-only",
+  "set-secret-redact",
+  "leave"
+]);
+var RemediationEntrySource = external_exports.enum(["first-run", "pre-push", "secret-scan"]);
+var RemediationEntryContext = external_exports.object({
+  entrySource: RemediationEntrySource
+}).strict();
+var RemediationOptionChoice = external_exports.object({
+  id: RemediationOption,
+  label: external_exports.string()
+});
+var BatchedRemediationDecision = external_exports.object({
+  kind: external_exports.literal("decision"),
+  entrySource: RemediationEntrySource,
+  secretCount: external_exports.number().int().positive(),
+  prompt: external_exports.string(),
+  options: external_exports.tuple([
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-rotation-checklist") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-only") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("set-secret-redact") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("leave") })
+  ])
+});
+var NoRemediationDecision = external_exports.object({
+  kind: external_exports.literal("no-decision")
+});
+var BatchedRemediation = external_exports.discriminatedUnion("kind", [
+  BatchedRemediationDecision,
+  NoRemediationDecision
+]);
+
 // ../packages/schema/src/zod/rule-test.ts
 var TestRulesRequest = external_exports.object({
   rules: external_exports.array(Rule).min(1).max(100),
@@ -17876,10 +17996,8 @@ var SeveritySummaryResponse = external_exports.object({
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });
-var SECURITY_RANGES = ["7d", "30d", "3m", "6m"];
-var SecurityRange = external_exports.enum(SECURITY_RANGES).meta({ id: "SecurityRange" });
 var SecurityRangeQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d")
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE)
 });
 var EnforcementActionKind = external_exports.enum(["blocked", "redacted", "warned"]).meta({ id: "EnforcementActionKind" });
 var EnforcementAction = external_exports.object({
@@ -17889,7 +18007,7 @@ var EnforcementAction = external_exports.object({
   delta: external_exports.number().int()
 }).meta({ id: "EnforcementAction" });
 var EnforcementActionsResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   // Sum of actions[].count in the window.
   total: external_exports.number().int().nonnegative(),
   // One entry per kind, always all three present (count may be 0).
@@ -17904,7 +18022,7 @@ var FindingsTimeseriesPoint = external_exports.object({
   medium: external_exports.number().int().nonnegative()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(FindingsTimeseriesPoint)
 }).meta({ id: "FindingsTimeseriesResponse" });
@@ -17919,7 +18037,7 @@ var MttrTrendPoint = external_exports.object({
   })
 }).meta({ id: "MttrTrendPoint" });
 var MttrTrendResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(MttrTrendPoint)
 }).meta({ id: "MttrTrendResponse" });
@@ -17946,11 +18064,11 @@ var TopSource = external_exports.object({
   findingsCount: external_exports.number().int().nonnegative()
 }).meta({ id: "TopSource" });
 var TopSourcesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   items: external_exports.array(TopSource)
 }).meta({ id: "TopSourcesResponse" });
 var TopSourcesQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d"),
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE),
   limit: external_exports.coerce.number().int().min(1).max(50).default(5),
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
@@ -17963,7 +18081,7 @@ var ScanCoverageProvider = external_exports.object({
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
 var ScanCoverageResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   providers: external_exports.array(ScanCoverageProvider)
 }).meta({ id: "ScanCoverageResponse" });
 var SubjectType = external_exports.enum(["repo", "user", "team", "policy", "share", "rule"]).meta({
@@ -18012,6 +18130,114 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../packages/schema/src/zod/setup-frame.ts
+var CalibrationCounts = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  important: external_exports.number().int().nonnegative(),
+  routine: external_exports.number().int().nonnegative()
+}).refine((c) => c.total === c.important + c.routine, {
+  message: "total must equal important + routine",
+  path: ["total"]
+});
+var FalsePositivePatternValue = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  valueFingerprint: external_exports.string(),
+  keyVersion: external_exports.number().int().nonnegative()
+});
+var FalsePositivePatternGroup = external_exports.object({
+  pattern: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  values: external_exports.array(FalsePositivePatternValue).min(1)
+});
+var CalibrationFindingKind = external_exports.object({
+  category: DetectionCategory,
+  count: external_exports.number().int().nonnegative(),
+  egress: external_exports.boolean()
+});
+var CalibrationFrame = external_exports.object({
+  counts: CalibrationCounts,
+  routineCategories: external_exports.array(DetectionCategory),
+  surfacedCategories: external_exports.array(DetectionCategory),
+  findingKinds: external_exports.array(CalibrationFindingKind),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId),
+  maskedFindings: external_exports.array(MaskedSecretFinding).optional(),
+  falsePositivePatterns: external_exports.array(FalsePositivePatternGroup).optional()
+});
+var CalibrationPreviewCategory = TriageCategoryRec.pick({
+  category: true,
+  genuineCount: true,
+  fpCount: true
+}).extend({
+  egress: external_exports.boolean()
+});
+var CalibrationPreview = external_exports.object({
+  categories: external_exports.array(CalibrationPreviewCategory),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId)
+});
+var CalibrationResult = external_exports.object({
+  frame: CalibrationFrame,
+  copy: external_exports.string()
+});
+var FirstRunCalibration = external_exports.enum(["scan", "floor"]);
+var SetupHandoffOption = external_exports.object({
+  id: external_exports.enum(["enter-remediation", "open-dashboard", "not-now"]),
+  label: external_exports.string()
+});
+var DashboardHandoffOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var ComposedRemediationOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("enter-remediation") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var SetupHandoffOffer = external_exports.object({
+  worthALook: external_exports.number().int().nonnegative(),
+  liveKeys: external_exports.number().int().nonnegative().optional(),
+  options: external_exports.union([DashboardHandoffOptions, ComposedRemediationOptions])
+}).refine(
+  (o) => o.options.some((opt) => opt.id === "enter-remediation") === (o.liveKeys ?? 0) > 0,
+  {
+    message: "the chain-entry option is present exactly when liveKeys > 0",
+    path: ["options"]
+  }
+).refine((o) => (o.liveKeys ?? 0) <= o.worthALook, {
+  message: "liveKeys is a subset of worthALook and cannot exceed it",
+  path: ["liveKeys"]
+});
+
 // ../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
@@ -18197,36 +18423,6 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
-// ../packages/schema/src/zod/triage.ts
-var TriageHit = external_exports.object({
-  ruleId: external_exports.string(),
-  category: DetectionCategory,
-  severity: Severity,
-  maskedMatch: external_exports.string(),
-  rawMatch: external_exports.string(),
-  context: external_exports.string(),
-  filePath: external_exports.string().optional(),
-  confidence: external_exports.number().min(0).max(1),
-  id: external_exports.string().optional(),
-  valueFingerprint: external_exports.string().optional(),
-  keyVersion: external_exports.number().int().nonnegative().optional()
-});
-var TriagePolicy = BuiltinPolicyId;
-var TriageCategoryRec = external_exports.object({
-  category: DetectionCategory,
-  action: TriagePolicy,
-  reasoning: external_exports.string(),
-  genuineCount: external_exports.number().int().nonnegative(),
-  fpCount: external_exports.number().int().nonnegative(),
-  // TriageHit ids judged false-positive in this category. fpCount must equal
-  // this array's length — enforced by the consumer, not this schema.
-  fpIds: external_exports.array(external_exports.string())
-});
-var TriageRecommendation = external_exports.object({
-  perCategory: external_exports.array(TriageCategoryRec),
-  notes: external_exports.string()
-});
-
 // ../packages/local-ops/src/fs-scan.ts
 var import_ignore = __toESM(require_ignore(), 1);
 var AKAIGNORE_FILENAME = ".akaignore";
@@ -18922,6 +19118,10 @@ var TIMELINE_COLUMNS = `
   json_extract(attributes, '$.internal') AS internal,
   json_extract(attributes, '$.flagged') AS flagged`;
 var SESSION_ROOT = `event_type = 'session'`;
+var HAS_ACTIVITY = `EXISTS (
+  SELECT 1 FROM audit_events c
+  WHERE c.root_session_id = audit_events.id
+    AND c.event_type NOT IN ('hook', 'config_scan'))`;
 var SqliteActivityRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -18935,7 +19135,8 @@ var SqliteActivityRepository = class {
     const sessionsToday = countScalar(
       this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`,
+           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?
+             AND ${HAS_ACTIVITY}`,
       [startMs, endMs]
     );
     const liveThreshold = this.now() - LIVE_ACTIVITY_WINDOW_MS;
@@ -19007,6 +19208,13 @@ var SqliteActivityRepository = class {
       );
       params.push(pattern, pattern, pattern, pattern, pattern, pattern);
     }
+    const emptyCount = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM audit_events
+        WHERE ${[...conditions, `NOT ${HAS_ACTIVITY}`].join(" AND ")}`,
+      params
+    );
+    if (query.excludeEmpty) conditions.push(HAS_ACTIVITY);
     if (cursor) {
       conditions.push("(started_at < ? OR (started_at = ? AND id < ?))");
       params.push(cursor.startedAtMs, cursor.startedAtMs, cursor.id);
@@ -19043,7 +19251,7 @@ var SqliteActivityRepository = class {
     );
     const last = page[page.length - 1];
     const nextCursor = hasMore && last ? encodeCursor({ startedAtMs: last.started_at, id: last.id }) : null;
-    return Promise.resolve({ items, nextCursor });
+    return Promise.resolve({ items, nextCursor, emptyCount });
   }
   getSession(sessionId) {
     const rootRow = getRow(
@@ -20349,9 +20557,43 @@ var SqliteFindingsRepository = class {
       }))
     );
   }
+  /** Live-enforced findings recorded for one session — a bare COUNT over the
+   * session-stamped events (served by idx_events_session_id), so the Activity
+   * page can label its findings link without the grouped pipeline. */
+  sessionFindingsCount(sessionId) {
+    if (!sessionId) return Promise.resolve(0);
+    return Promise.resolve(
+      countScalar(
+        this.db,
+        `SELECT count(*) AS n FROM findings f
+           JOIN events e ON e.id = f.event_id
+          WHERE json_extract(e.metadata, '$.sessionId') = :sessionId`,
+        { sessionId }
+      )
+    );
+  }
+  /** Per-rule transcript firing tally for one session — reads the OTHER finding
+   * store (inspection_findings, keyed to audit_events): every detection the
+   * transcript pass recorded, counted per firing rather than per unique value.
+   * Rides on session-scoped grouped responses so the findings view can
+   * reconcile the Activity page's tally with the deduped groups it lists. */
+  sessionFirings(sessionId) {
+    return Object.fromEntries(
+      countBy(
+        this.db,
+        `SELECT d.rule_id AS k, count(*) AS n
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+          WHERE e.root_session_id = :sessionId
+          GROUP BY d.rule_id`,
+        { sessionId }
+      )
+    );
+  }
   /**
-   * Grouped findings for the dashboard — joins findings⋈events (repo/file
-   * from event metadata), groups by ruleId, computes per-filter-excluded facets,
+   * Grouped findings for the dashboard — joins findings⋈events (repo/file/
+   * toolName from event metadata), groups by ruleId, computes per-filter-excluded facets,
    * applies the requested filters, and sorts by severity then recency. Filtering
    * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
    * reflect the full filtered set; `items` is the requested
@@ -20368,11 +20610,16 @@ var SqliteFindingsRepository = class {
    * rule is ever restated in SQL.
    */
   listGroupedFindings(query) {
-    const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "");
+    const sessionPredicate = query.sessionId ? `WHERE json_extract(e.metadata, '$.sessionId') = :sessionId` : "";
+    const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
+    const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
+      predicate: sessionPredicate,
+      params: sessionParams
+    });
     const rows = allRows(
       this.db.prepare(
         `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
-                occurred_at, source_tool, repo, file, kind, finding_key, latest_status
+                occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
          FROM (
            SELECT f.id AS id, f.rule_id AS rule_id, f.category AS category,
                   f.severity AS severity, f.masked_match AS masked_match,
@@ -20380,6 +20627,7 @@ var SqliteFindingsRepository = class {
                   e.occurred_at AS occurred_at, e.source_tool AS source_tool,
                   json_extract(e.metadata, '$.repo') AS repo,
                   json_extract(e.metadata, '$.filePath') AS file,
+                  json_extract(e.metadata, '$.toolName') AS tool_name,
                   e.kind AS kind, f.finding_key AS finding_key,
                   latest.status AS latest_status,
                   ROW_NUMBER() OVER (
@@ -20390,11 +20638,12 @@ var SqliteFindingsRepository = class {
              JOIN events e ON e.id = f.event_id
              LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
                ON latest.finding_key = f.finding_key
+             ${sessionPredicate}
          )
          WHERE rn <= :cap
          ORDER BY occurred_at DESC, id DESC`
       ),
-      { cap: PREVIEW_INSTANCES_PER_GROUP }
+      { cap: PREVIEW_INSTANCES_PER_GROUP, ...sessionParams }
     );
     const groupable = rows.map((r) => ({
       id: r.id,
@@ -20408,6 +20657,7 @@ var SqliteFindingsRepository = class {
       sourceTool: r.source_tool,
       repo: r.repo ?? "",
       file: r.file ?? "",
+      ...r.tool_name === null ? {} : { toolName: r.tool_name },
       status: deriveInstanceStatus(r)
     }));
     const allGroups = buildFindingGroups(groupable, { aggregates });
@@ -20426,7 +20676,13 @@ var SqliteFindingsRepository = class {
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
     const items = sorted.slice(0, limit);
-    return Promise.resolve({ totals, facets, items, nextCursor: null });
+    return Promise.resolve({
+      totals,
+      facets,
+      items,
+      nextCursor: null,
+      ...query.sessionId ? { sessionFirings: this.sessionFirings(query.sessionId) } : {}
+    });
   }
   /**
    * One row per rule_id, folding EVERY instance of the group into the values
@@ -20450,9 +20706,10 @@ var SqliteFindingsRepository = class {
    * would silently lose, so it is fetched only when the request actually
    * carries a `q`.
    */
-  groupAggregates(withSearchText) {
+  groupAggregates(withSearchText, scope) {
     const searchTextColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.metadata, '$.repo')) AS repos,
-           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files` : `, NULL AS repos, NULL AS files`;
+           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files,
+           group_concat(DISTINCT 'via ' || json_extract(e.metadata, '$.toolName')) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
     const rows = this.db.prepare(
       `SELECT f.rule_id AS rule_id,
                 count(*) AS instance_count,
@@ -20469,8 +20726,9 @@ var SqliteFindingsRepository = class {
            JOIN events e ON e.id = f.event_id
            LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
              ON latest.finding_key = f.finding_key
+          ${scope.predicate}
           GROUP BY f.rule_id`
-    ).all();
+    ).all(scope.params);
     return new Map(
       rows.map((r) => [
         r.rule_id,
@@ -20494,7 +20752,9 @@ var SqliteFindingsRepository = class {
           // Left undefined (not '') when unfetched, so buildFindingGroups can
           // tell "no q this request" from "a group with no repo/file at all"
           // and skip priming a haystack nothing will read.
-          ...withSearchText ? { searchText: [r.repos ?? "", r.files ?? ""].filter((s) => s !== "").join(" ") } : {}
+          ...withSearchText ? {
+            searchText: [r.repos ?? "", r.files ?? "", r.tool_names ?? ""].filter((s) => s !== "").join(" ")
+          } : {}
         }
       ])
     );
@@ -22230,7 +22490,6 @@ var SqliteScanLedgerRepository = class {
 // ../packages/persistence/src/repositories/security.ts
 var DAY_MS4 = 864e5;
 var SEVERITIES = ["critical", "high", "medium", "low"];
-var RANGE_DAYS = { "7d": 7, "30d": 30, "3m": 90, "6m": 180 };
 var ACTION_TO_KIND = {
   block: "blocked",
   redact: "redacted",
@@ -22245,8 +22504,14 @@ var SCAN_COVERAGE = [
   { provider: "copilot", coverage: 0, supported: false },
   { provider: "api", coverage: 0, supported: false }
 ];
+var GRANULARITY = {
+  "7d": "day",
+  "30d": "day",
+  "3m": "week",
+  "6m": "week"
+};
 function granularityFor(range) {
-  return range === "7d" || range === "30d" ? "day" : "week";
+  return GRANULARITY[range];
 }
 function startOfUtcDay2(ms) {
   return Math.floor(ms / DAY_MS4) * DAY_MS4;
@@ -23968,7 +24233,6 @@ var db_table_name_default = {
       "SELECT * FROM ",
       "SELECT COUNT(*) FROM ",
       "INSERT INTO ",
-      "UPDATE ",
       "DELETE FROM ",
       "CREATE TABLE ",
       "ALTER TABLE ",
@@ -25709,6 +25973,26 @@ function recordProjectInventory(db, target) {
   }
 }
 
+// ../packages/local-ops/src/self-exec.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+function isSea() {
+  try {
+    const sea = require2("node:sea");
+    return typeof sea.isSea === "function" ? sea.isSea() : false;
+  } catch {
+    return false;
+  }
+}
+function buildReinvocation(sea, execPath, entry, subcommand, extraArgs) {
+  if (sea) return { command: execPath, args: [subcommand, ...extraArgs] };
+  if (entry === void 0) return null;
+  return { command: execPath, args: [entry, subcommand, ...extraArgs] };
+}
+function reinvokeArgv(subcommand, extraArgs = []) {
+  return buildReinvocation(isSea(), process.execPath, process.argv[1], subcommand, extraArgs);
+}
+
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
@@ -25754,10 +26038,10 @@ function refreshCache(home) {
   });
 }
 function triggerBackgroundRefresh(home) {
-  const entry = process.argv[1];
-  if (!entry) return;
+  const reinvoke = reinvokeArgv("__update-refresh", ["--home", home]);
+  if (!reinvoke) return;
   try {
-    spawn(process.execPath, [entry, "__update-refresh", "--home", home], {
+    spawn(reinvoke.command, reinvoke.args, {
       detached: true,
       stdio: "ignore"
     }).unref();
@@ -26080,10 +26364,10 @@ function runCompletion(argv) {
 // src/commands/dashboard.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync8 } from "fs";
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
 import { dirname as dirname3, join as join14 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 import { parseArgs as parseArgs2 } from "util";
 
 // src/lib/open-url.ts
@@ -26099,8 +26383,11 @@ function openUrl(url2) {
 }
 
 // src/commands/dashboard.ts
-var require2 = createRequire(import.meta.url);
+var require3 = createRequire2(import.meta.url);
 var here = dirname3(fileURLToPath2(import.meta.url));
+function pkgBase() {
+  return isSea() ? dirname3(process.execPath) : join14(here, "..");
+}
 function isPortFree(port) {
   return new Promise((resolve2) => {
     const probe = createServer();
@@ -26151,16 +26438,17 @@ async function runDashboard(argv) {
     return;
   }
   refreshUpdateMirror(dataDir());
+  const base = pkgBase();
   const bundledServer = [
-    join14(here, "..", "web-ui", "server.js"),
-    join14(here, "..", "web-ui", "web-ui", "server.js")
+    join14(base, "web-ui", "server.js"),
+    join14(base, "web-ui", "web-ui", "server.js")
   ].find((p) => existsSync8(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
   }
-  const webUiDir = dirname3(require2.resolve("@akasecurity/web-ui/package.json"));
-  const nextBin = require2.resolve("next/dist/bin/next", { paths: [webUiDir] });
+  const webUiDir = dirname3(require3.resolve("@akasecurity/web-ui/package.json"));
+  const nextBin = require3.resolve("next/dist/bin/next", { paths: [webUiDir] });
   const startNext = () => {
     const child = spawn3(
       process.execPath,
@@ -26189,7 +26477,13 @@ async function runDashboard(argv) {
   });
 }
 function launchStandalone(serverJs, port, shouldOpen, url2) {
-  const child = spawn3(process.execPath, [serverJs], {
+  const reinvoke = reinvokeArgv("__dashboard-server", ["--server-js", serverJs]);
+  if (!reinvoke) {
+    process.stderr.write("aka dashboard: cannot resolve the CLI entry to launch the server.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const child = spawn3(reinvoke.command, reinvoke.args, {
     cwd: dirname3(serverJs),
     stdio: ["inherit", "pipe", "inherit"],
     // Inherit the parent env so the child server sees PATH etc.; PORT/HOSTNAME tell
@@ -26200,6 +26494,16 @@ function launchStandalone(serverJs, port, shouldOpen, url2) {
   onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
 }
+async function runDashboardServer(argv) {
+  const { values } = parseArgs2({ args: argv, options: { "server-js": { type: "string" } } });
+  const serverJs = values["server-js"];
+  if (serverJs === void 0 || serverJs === "") {
+    process.stderr.write("aka __dashboard-server: --server-js <path> is required\n");
+    process.exitCode = 1;
+    return;
+  }
+  await import(pathToFileURL(serverJs).href);
+}
 function onReadyOpen(child, shouldOpen, url2, banner) {
   process.stdout.write(banner);
   let opened = false;
@@ -27214,6 +27518,7 @@ Then run \`aka init\` to set up the local store.
 }
 
 // src/commands/init.ts
+var PLUGIN_OFFER_IDENTITY = `${PRODUCT_NAME} \u2014 ${PRODUCT_TAGLINE}`;
 async function runInit(argv) {
   const { values } = parseArgs6({
     args: argv,
@@ -27265,6 +27570,7 @@ async function offerPluginInstall(autoYes) {
     if (!process.stdin.isTTY) {
       out.write(
         `
+${PLUGIN_OFFER_IDENTITY}
 No Claude Code plugin detected. Install it via the marketplace:
   /plugin marketplace add ${agent.marketplaceSource ?? ""}
   /plugin install ${ref}
@@ -27273,8 +27579,11 @@ Or re-run \`aka init --yes\` to install it automatically.
       );
       return;
     }
-    if (!await confirm(`
-Install the AKA Claude Code plugin now (via the marketplace)? [y/N] `)) {
+    if (!await confirm(
+      `
+${PLUGIN_OFFER_IDENTITY}
+Install the ${PRODUCT_NAME} plugin for Claude Code now (via the marketplace)? [y/N] `
+    )) {
       out.write("Skipped. Install anytime with `aka plugins install claude-code`.\n");
       return;
     }
@@ -27397,19 +27706,15 @@ function runScan(argv) {
 // src/commands/stats.ts
 import { parseArgs as parseArgs8 } from "util";
 var DAY_MS5 = 864e5;
-var RANGE_DAYS2 = { "7d": 7, "30d": 30, "3m": 90, "6m": 180 };
-function parseRange(value) {
-  return SECURITY_RANGES.includes(value ?? "") ? value : "30d";
-}
 async function runStats(argv) {
   const { values } = parseArgs8({
     args: argv,
     options: { ...HOME_OPTION, range: { type: "string" } }
   });
   const home = homeBase(values.home);
-  const range = parseRange(values.range);
+  const range = parseTimeRange(values.range);
   const db = openLocalDatabase(dataDir(home));
-  const tokenFromMs = Date.now() - RANGE_DAYS2[range] * DAY_MS5;
+  const tokenFromMs = Date.now() - RANGE_DAYS[range] * DAY_MS5;
   const [health, severity, enforcement, packs2, recent, tokenReports] = await Promise.all([
     db.findings.healthSummary(),
     db.security.severitySummary(),
@@ -27432,7 +27737,7 @@ async function runStats(argv) {
 Enforcement (${range}): ${String(enforcement.total)} intercepted
 `);
   for (const a of enforcement.actions) {
-    const delta = a.delta === 0 ? "" : ` (${a.delta > 0 ? "+" : ""}${String(a.delta)} wk/wk)`;
+    const delta = a.delta === 0 ? "" : ` (${a.delta > 0 ? "+" : ""}${String(a.delta)} vs prior ${range})`;
     out.write(`  ${a.kind.padEnd(9)} ${String(a.count)}${delta}
 `);
   }
@@ -28249,9 +28554,19 @@ var COMMANDS = {
   // Hidden: the detached background refresh spawned by the passive update notice.
   "__update-refresh": (argv) => {
     refreshCache(homeFromArgv(argv));
-  }
-};
-var SKIP_NOTICE = /* @__PURE__ */ new Set(["update", "check-updates", "__update-refresh", "completion"]);
+  },
+  // Hidden: boots the bundled Next standalone server in-process (see dashboard.ts).
+  // `aka dashboard` spawns this so a SEA binary can serve the dashboard without
+  // exec-ing an external script. Returns the promise so main() awaits the boot.
+  "__dashboard-server": (argv) => runDashboardServer(argv)
+};
+var SKIP_NOTICE = /* @__PURE__ */ new Set([
+  "update",
+  "check-updates",
+  "__update-refresh",
+  "__dashboard-server",
+  "completion"
+]);
 var USAGE = `aka \u2014 AI Traffic Control (local-first, everything stays on your machine)
 
 Usage: aka <command> [options]