@akasecurity/cli 0.9.14 → 0.9.15

package/web-ui/web-ui/dist/scan-worker.js

@@ -603,6 +603,82 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../packages/detections/src/format-chars.ts
+var HAS_FORMAT_CHAR = new RegExp("\\p{Cf}", "u");
+var FORMAT_CHAR_GLOBAL = new RegExp("\\p{Cf}", "gu");
+function normalizeFormatChars(text) {
+  if (!HAS_FORMAT_CHAR.test(text)) return void 0;
+  const normalizedParts = [];
+  const segments = [];
+  let cursor = 0;
+  let normLength = 0;
+  for (const match of text.matchAll(FORMAT_CHAR_GLOBAL)) {
+    const matchStart = match.index;
+    if (matchStart > cursor) {
+      const length = matchStart - cursor;
+      normalizedParts.push(text.slice(cursor, matchStart));
+      segments.push({ normStart: normLength, origStart: cursor, length });
+      normLength += length;
+    }
+    cursor = matchStart + match[0].length;
+  }
+  if (cursor < text.length) {
+    const length = text.length - cursor;
+    normalizedParts.push(text.slice(cursor));
+    segments.push({ normStart: normLength, origStart: cursor, length });
+  }
+  return { normalized: normalizedParts.join(""), segments };
+}
+function segmentAt(segments, normPos) {
+  let lo = 0;
+  let hi = segments.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    const segment = segments[mid];
+    if (segment !== void 0 && normPos >= segment.normStart + segment.length) {
+      lo = mid + 1;
+    } else {
+      hi = mid;
+    }
+  }
+  const found = segments[lo];
+  if (found === void 0) {
+    throw new Error(`normPos ${String(normPos)} has no covering segment`);
+  }
+  return found;
+}
+function mapSpanToOriginal(span, normalization) {
+  const { segments } = normalization;
+  const startSegment = segmentAt(segments, span.start);
+  const start = startSegment.origStart + (span.start - startSegment.normStart);
+  const endSegment = segmentAt(segments, span.end - 1);
+  const end = endSegment.origStart + (span.end - 1 - endSegment.normStart) + 1;
+  return { start, end };
+}
+function normalizedOffset(origPos, segments) {
+  let lo = 0;
+  let hi = segments.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    const segment = segments[mid];
+    if (segment !== void 0 && segment.origStart + segment.length <= origPos) {
+      lo = mid + 1;
+    } else {
+      hi = mid;
+    }
+  }
+  const found = segments[Math.min(lo, segments.length - 1)];
+  if (found === void 0) return 0;
+  return found.normStart + Math.min(Math.max(0, origPos - found.origStart), found.length);
+}
+function mapSpanToNormalized(span, normalization) {
+  const { segments } = normalization;
+  return {
+    start: normalizedOffset(span.start, segments),
+    end: normalizedOffset(span.end, segments)
+  };
+}
+
 // ../packages/detections/src/regex-cache.ts
 var singles = /* @__PURE__ */ new WeakMap();
 var keywordLists = /* @__PURE__ */ new WeakMap();
@@ -761,29 +837,35 @@ function passesPostValidators(rule, value) {
 function getLoadedRules() {
   return [...packs.values()].flatMap((p) => p.rules);
 }
-function isCorroborated(candidate, candidates, text) {
+function spansOverlap(a, b) {
+  return a.start < b.end && a.end > b.start;
+}
+function isCorroborated(candidate, candidates, text, normalization) {
   const req = candidate.rule.requiresNearby;
   if (!req) return true;
   const halfWindow = req.windowChars;
-  const { start, end } = candidate.match.span;
-  const winStart = start - halfWindow;
-  const winEnd = end + halfWindow;
+  const ns = candidate.normSpan;
+  const winStart = ns.start - halfWindow;
+  const winEnd = ns.end + halfWindow;
   const categories = req.categories;
   const ruleIds = req.ruleIds;
   if (categories?.length || ruleIds?.length) {
     for (const other of candidates) {
       if (other === candidate) continue;
-      const os = other.match.span;
-      if (os.end < winStart || os.start > winEnd) continue;
-      if (other.match.ruleId !== candidate.match.ruleId && categories?.includes(other.match.category)) {
-        return true;
+      if (other.normSpan.end < winStart || other.normSpan.start > winEnd) continue;
+      const relevant = other.match.ruleId !== candidate.match.ruleId && categories?.includes(other.match.category) === true || ruleIds?.includes(other.match.ruleId) === true;
+      if (!relevant) continue;
+      if (other.match.ruleId === candidate.match.ruleId && spansOverlap(other.match.span, candidate.match.span)) {
+        continue;
       }
-      if (ruleIds?.includes(other.match.ruleId)) return true;
+      return true;
     }
   }
   const labels = req.labels;
   if (labels && labels.length > 0) {
-    const haystack = text.slice(Math.max(0, winStart), winEnd);
+    const { start, end } = candidate.match.span;
+    const haystack = text.slice(Math.max(0, start - halfWindow), end + halfWindow);
+    const normalizedHaystack = normalization === void 0 ? void 0 : normalization.normalized.slice(Math.max(0, winStart), winEnd);
     for (const re of memoizedRegExpList(
       "label",
       req,
@@ -792,29 +874,20 @@ function isCorroborated(candidate, candidates, text) {
         return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
       })
     )) {
-      if (re?.test(haystack)) return true;
+      if (!re) continue;
+      if (re.test(haystack)) return true;
+      if (normalizedHaystack !== void 0 && re.test(normalizedHaystack)) return true;
     }
   }
   return false;
 }
-function extensionOf(filePath) {
-  const base = filePath.slice(Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\")) + 1);
-  const dot = base.lastIndexOf(".");
-  return dot > 0 ? base.slice(dot).toLowerCase() : void 0;
-}
-function ruleApplies(rule, extension) {
-  if (!rule.appliesTo || extension === void 0) return true;
-  return rule.appliesTo.extensions.some((e) => e.toLowerCase() === extension);
-}
-function scan(text, rules, context) {
-  const ruleset2 = rules ?? getLoadedRules();
-  const extension = context?.filePath ? extensionOf(context.filePath) : void 0;
+function buildCandidates(matchText, ruleset2, extension) {
   const candidates = [];
   for (const rule of ruleset2) {
     if (!ruleApplies(rule, extension)) continue;
-    const spans = MATCHERS[rule.matcher.type](text, rule);
+    const spans = MATCHERS[rule.matcher.type](matchText, rule);
     for (const span of spans) {
-      const rawMatch = text.slice(span.start, span.end);
+      const rawMatch = matchText.slice(span.start, span.end);
       if (!passesPostValidators(rule, rawMatch)) continue;
       candidates.push({
         rule,
@@ -825,10 +898,31 @@ function scan(text, rules, context) {
           span,
           rawMatch,
           confidence: 0.9
-        }
+        },
+        // In `matchText`'s own coordinates, which is the normalized text for
+        // a normalized-pass candidate and so already right; an original-pass
+        // candidate on the slow path is re-derived by withNormalizedSpan.
+        normSpan: span
       });
     }
   }
+  return candidates;
+}
+function mapCandidateToOriginal(candidate, normalization, text) {
+  const span = mapSpanToOriginal(candidate.match.span, normalization);
+  return {
+    rule: candidate.rule,
+    match: { ...candidate.match, span, rawMatch: text.slice(span.start, span.end) },
+    // Deliberately NOT remapped: `normSpan` is the span the primitive match
+    // was found at in the normalized text, which is exactly the coordinate
+    // space windows are measured in. See the `Candidate` comment.
+    normSpan: candidate.normSpan
+  };
+}
+function withNormalizedSpan(candidate, normalization) {
+  return { ...candidate, normSpan: mapSpanToNormalized(candidate.match.span, normalization) };
+}
+function gate(candidates, text, normalization) {
   const findings = [];
   for (const candidate of candidates) {
     const req = candidate.rule.requiresNearby;
@@ -836,7 +930,7 @@ function scan(text, rules, context) {
       findings.push(candidate.match);
       continue;
     }
-    if (!isCorroborated(candidate, candidates, text)) continue;
+    if (!isCorroborated(candidate, candidates, text, normalization)) continue;
     const boost = req.confidenceBoost;
     findings.push(
       boost ? { ...candidate.match, confidence: Math.min(0.99, candidate.match.confidence + boost) } : candidate.match
@@ -844,6 +938,81 @@ function scan(text, rules, context) {
   }
   return findings;
 }
+function closeRegion(open2, text) {
+  const span = { start: open2.start, end: open2.end };
+  return {
+    ruleId: open2.ruleId,
+    category: open2.category,
+    severity: open2.severity,
+    span,
+    rawMatch: text.slice(span.start, span.end),
+    confidence: open2.confidence
+  };
+}
+function mergeOverlappingSameRule(findings, text) {
+  if (findings.length === 0) return findings;
+  const groups = /* @__PURE__ */ new Map();
+  const ruleOrder = [];
+  for (const finding of findings) {
+    const group = groups.get(finding.ruleId);
+    if (group) {
+      group.push(finding);
+    } else {
+      groups.set(finding.ruleId, [finding]);
+      ruleOrder.push(finding.ruleId);
+    }
+  }
+  const merged = [];
+  for (const ruleId of ruleOrder) {
+    const group = groups.get(ruleId) ?? [];
+    const sorted = [...group].sort(
+      (a, b) => a.span.start - b.span.start || a.span.end - b.span.end
+    );
+    let open2;
+    for (const finding of sorted) {
+      if (open2 && finding.span.start < open2.end) {
+        open2.end = Math.max(open2.end, finding.span.end);
+        open2.confidence = Math.max(open2.confidence, finding.confidence);
+        continue;
+      }
+      if (open2) merged.push(closeRegion(open2, text));
+      open2 = {
+        start: finding.span.start,
+        end: finding.span.end,
+        confidence: finding.confidence,
+        ruleId: finding.ruleId,
+        category: finding.category,
+        severity: finding.severity
+      };
+    }
+    if (open2) merged.push(closeRegion(open2, text));
+  }
+  return merged;
+}
+function extensionOf(filePath) {
+  const base = filePath.slice(Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\")) + 1);
+  const dot = base.lastIndexOf(".");
+  return dot > 0 ? base.slice(dot).toLowerCase() : void 0;
+}
+function ruleApplies(rule, extension) {
+  if (!rule.appliesTo || extension === void 0) return true;
+  return rule.appliesTo.extensions.some((e) => e.toLowerCase() === extension);
+}
+function scan(text, rules, context) {
+  const ruleset2 = rules ?? getLoadedRules();
+  const extension = context?.filePath ? extensionOf(context.filePath) : void 0;
+  const normalization = normalizeFormatChars(text);
+  const originalCandidates = buildCandidates(text, ruleset2, extension);
+  if (!normalization) return gate(originalCandidates, text, void 0);
+  const pooledOriginal = originalCandidates.map(
+    (candidate) => withNormalizedSpan(candidate, normalization)
+  );
+  const normalizedCandidates = buildCandidates(normalization.normalized, ruleset2, extension).map(
+    (candidate) => mapCandidateToOriginal(candidate, normalization, text)
+  );
+  const findings = gate([...pooledOriginal, ...normalizedCandidates], text, normalization);
+  return mergeOverlappingSameRule(findings, text);
+}
 
 // ../packages/schema/src/exception-scope.ts
 var MINUTE_MS = 6e4;
@@ -22977,7 +23146,29 @@ var StorePosturePlugin = external_exports.object({
    */
   policyBundleVersion: external_exports.string().max(200).nullable(),
   /** Epoch millis, on the CLIENT clock, of that fetch. */
-  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  /**
+   * The newest version the host's own install record holds for this plugin —
+   * what is on disk. After an update it leads `version` (the running copy) by
+   * one launch. Null when no usable version can be read: no install record
+   * (a plugin run from a checkout), no entry with a valid version, or every
+   * such entry names an `installPath` that no longer exists; OPTIONAL, not
+   * required, so a build that predates the member keeps getting its 200.
+   * Bounded like `version`.
+   */
+  installedVersion: external_exports.string().max(64).nullable().optional(),
+  /**
+   * The local-store schema version this running build migrates a store to:
+   * the number of store migrations it carries, the count it stamps into
+   * `PRAGMA user_version`. A snapshot whose `schemaVersion` is above it
+   * usually describes a store a newer build migrated. It is a hint, not a
+   * verdict: the stamp is write-only, so a store whose count ran past this
+   * build's while this build knows every migration in its ledger reads above
+   * it too, which is why describeStoreSkew decides skew on ledger tags and
+   * never on the count. OPTIONAL for the same reason as `installedVersion`;
+   * bounded like `schemaVersion`.
+   */
+  buildSchemaVersion: external_exports.number().int().min(0).max(MAX_INT4).optional()
 }).meta({ id: "StorePosturePlugin" });
 var StorePostureSnapshot = external_exports.object({
   deviceId: external_exports.guid(),
@@ -23956,10 +24147,15 @@ var ParsedPointer = external_exports.object({
 });
 var VaultEntry = external_exports.object({
   pointerId: external_exports.string(),
-  // The keyed HMAC of the raw value under `exception.key`, and the epoch it was
-  // derived under. This is what a reveal-to-model grant matches on, and it rotates
-  // independently of the vault encryption key below.
+  // The keyed HMAC of the EXACT raw bytes under `exception.key`, and the epoch it
+  // was derived under. The vault's own dedupe key: a value and its invisibly
+  // padded twin are two rows. It rotates independently of the vault encryption
+  // key below. Never matched against an exception or grant.
   valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  // The same HMAC over the raw with invisible padding removed: the identity a
+  // reveal-to-model grant and every exception match on. Shared by a value and
+  // its padded twin.
+  valueIdentityFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
   fingerprintKeyVersion: external_exports.number().int().positive(),
   // The vault-key epoch this row's ciphertext was sealed under.
   keyVersion: external_exports.number().int().positive(),
@@ -24401,10 +24597,18 @@ var SeveritySummaryItem = external_exports.object({
   count: external_exports.number().int().nonnegative(),
   // Resolution-aware breakdown (optional, additive). Populated once findings
   // carry lifecycle state: `caught` = handled in-flight (enforced); `openAtRest`
-  // = still open with no in-flight enforcement (needs remediation). Absent on the
-  // legacy count-only response until the resolution feature lands.
+  // = still open with no in-flight enforcement (needs remediation); `dismissed`
+  // = closed by a human judgement rather than a fix — visible, but not counted as
+  // needing remediation. The three are disjoint. Absent on the legacy count-only
+  // response until the resolution feature lands.
   caught: external_exports.number().int().nonnegative().optional(),
-  openAtRest: external_exports.number().int().nonnegative().optional()
+  openAtRest: external_exports.number().int().nonnegative().optional(),
+  dismissed: external_exports.number().int().nonnegative().optional(),
+  // The two halves of `caught`, for a reader that wants them apart: `handled` =
+  // in-flight findings an enforcement action already contained; `resolved` =
+  // at-rest findings closed out by fixing them. `handled + resolved === caught`.
+  handled: external_exports.number().int().nonnegative().optional(),
+  resolved: external_exports.number().int().nonnegative().optional()
 }).meta({ id: "SeveritySummaryItem" });
 var SeveritySummaryResponse = external_exports.object({
   // Sum of bySeverity[].count.
@@ -24412,6 +24616,9 @@ var SeveritySummaryResponse = external_exports.object({
   // Findings still open at rest (sum of bySeverity[].openAtRest). Optional and
   // additive — absent on the legacy response until the resolution feature lands.
   needsRemediation: external_exports.number().int().nonnegative().optional(),
+  // Findings a user dismissed (sum of bySeverity[].dismissed). Excluded from
+  // needsRemediation, and kept visible here so an accepted risk is not erased.
+  dismissed: external_exports.number().int().nonnegative().optional(),
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });

package/web-ui/web-ui/package.json

@@ -23,7 +23,7 @@
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
     "@fontsource-variable/space-grotesk": "^5.3.0",
-    "next": "^15.5.25",
+    "next": "^15.5.26",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "server-only": "^0.0.1"
@@ -37,11 +37,11 @@
     "@types/react-dom": "^19.3.0",
     "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^9.39.5",
-    "jsdom": "~30.0.1",
+    "jsdom": "~30.1.1",
     "tailwindcss": "^4.3.3",
     "tsup": "^8.0.0",
     "typescript": "^5.8.0",
-    "typescript-eslint": "^8.70.0",
+    "typescript-eslint": "^8.70.1",
     "vitest": "^4.1.11"
   }
 }