@akasecurity/cli 0.9.2 → 0.9.3

package/README.md

@@ -48,6 +48,10 @@ aka dashboard    # open the local web dashboard over your store
 
 Run `aka --help` for the full command list.
 
+### External subcommands
+
+Any other command dispatches, git-style, to an executable named `aka-<command>` on your PATH (POSIX only; built-ins always win). For example, with [aka-claude-tools](https://github.com/akasecurity/claude-tools) installed, `aka claude` launches the hardened Claude Code profile via its `aka-claude` launcher.
+
 ## The Claude Code plugin
 
 The CLI gives you the dashboard, store, and scanning. To actually **intercept** a Claude Code session you also need the AKA plugin, which installs from the Claude Code plugin marketplace (not npm). With the CLI installed:

package/dist/cli.js

@@ -18381,6 +18381,9 @@ var ExceptionBundleEntry = DetectionException.pick({
   useCount: true,
   conditions: true
 });
+function isMatchableUnder(keyVersion, key) {
+  return key.status === "present" && key.version === keyVersion;
+}
 
 // ../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
@@ -25500,11 +25503,22 @@ function purgeSampleData(db) {
 function linkHost(input, hostId) {
   return hostId ? { ...input, hostId } : input;
 }
+function closeQuietly(db) {
+  try {
+    db.close();
+  } catch {
+  }
+}
 function openWithPragmas(file2) {
   const db = new DatabaseSync(file2);
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA busy_timeout = 2000");
-  db.exec("PRAGMA foreign_keys = ON");
+  try {
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA busy_timeout = 2000");
+    db.exec("PRAGMA foreign_keys = ON");
+  } catch (err) {
+    closeQuietly(db);
+    throw err;
+  }
   return db;
 }
 function backupLegacyStore(file2) {
@@ -25516,43 +25530,80 @@ function backupLegacyStore(file2) {
   }
   return backup;
 }
+function openAndInitialize(file2) {
+  let db = openWithPragmas(file2);
+  try {
+    if (isForeignSqliteLineage(db)) {
+      db.close();
+      const backup = backupLegacyStore(file2);
+      db = openWithPragmas(file2);
+      akaWarn(
+        `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
+      );
+    }
+    applyMigrations(db, file2);
+    tightenPerms(file2);
+    const policies = new SqlitePoliciesRepository(db);
+    const installedPacks = new SqliteInstalledPacksRepository(db);
+    const repositories = {
+      events: new SqliteEventsRepository(db),
+      findings: new SqliteFindingsRepository(db),
+      policies,
+      installedPacks,
+      scanLedger: new SqliteScanLedgerRepository(db),
+      exceptions: new SqliteExceptionsRepository(db),
+      resolutions: new SqliteResolutionsRepository(db),
+      ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
+      security: new SqliteSecurityRepository(db),
+      detections: new SqliteDetectionsRepository(db),
+      shares: new SqliteSharesRepository(db),
+      policyCatalog: new SqlitePolicyCatalogRepository(installedPacks),
+      inventory: new SqliteInventoryRepository(db),
+      inventoryAssets: new SqliteInventoryAssetsRepository(db),
+      projectFiles: new SqliteProjectFilesRepository(db),
+      activity: new SqliteActivityRepository(db),
+      sourceProject: new SqliteSourceProjectRepository(db),
+      auditEvents: new SqliteAuditEventsRepository(db),
+      classifiedData: new SqliteClassifiedDataRepository(db),
+      inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
+      inspectionFindings: new SqliteInspectionFindingsRepository(db),
+      configInventory: new SqliteConfigInventoryRepository(db)
+    };
+    policies.seedDefaults();
+    return { db, ...repositories };
+  } catch (err) {
+    closeQuietly(db);
+    throw err;
+  }
+}
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
   const file2 = join2(dir, DB_FILENAME);
-  let db = openWithPragmas(file2);
-  if (isForeignSqliteLineage(db)) {
-    db.close();
-    const backup = backupLegacyStore(file2);
-    db = openWithPragmas(file2);
-    akaWarn(
-      `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
-    );
-  }
-  applyMigrations(db, file2);
-  tightenPerms(file2);
-  const events = new SqliteEventsRepository(db);
-  const findings = new SqliteFindingsRepository(db);
-  const policies = new SqlitePoliciesRepository(db);
-  const installedPacks = new SqliteInstalledPacksRepository(db);
-  const scanLedger = new SqliteScanLedgerRepository(db);
-  const exceptions = new SqliteExceptionsRepository(db);
-  const resolutions = new SqliteResolutionsRepository(db);
-  const ruleProbeCache = new SqliteRuleProbeCacheRepository(db);
-  const security = new SqliteSecurityRepository(db);
-  const detections = new SqliteDetectionsRepository(db);
-  const shares = new SqliteSharesRepository(db);
-  const policyCatalog = new SqlitePolicyCatalogRepository(installedPacks);
-  const inventory = new SqliteInventoryRepository(db);
-  const inventoryAssets = new SqliteInventoryAssetsRepository(db);
-  const projectFiles = new SqliteProjectFilesRepository(db);
-  const activity = new SqliteActivityRepository(db);
-  const sourceProject = new SqliteSourceProjectRepository(db);
-  const auditEvents = new SqliteAuditEventsRepository(db);
-  const classifiedData = new SqliteClassifiedDataRepository(db);
-  const inspectionDefinitions = new SqliteInspectionDefinitionsRepository(db);
-  const inspectionFindings = new SqliteInspectionFindingsRepository(db);
-  const configInventory = new SqliteConfigInventoryRepository(db);
-  policies.seedDefaults();
+  const {
+    db,
+    events,
+    findings,
+    policies,
+    installedPacks,
+    scanLedger,
+    exceptions,
+    resolutions,
+    ruleProbeCache,
+    security,
+    detections,
+    shares,
+    policyCatalog,
+    inventory,
+    inventoryAssets,
+    projectFiles,
+    activity,
+    sourceProject,
+    auditEvents,
+    classifiedData,
+    inspectionDefinitions,
+    inspectionFindings,
+    configInventory
+  } = openAndInitialize(file2);
   function recordCapture(event, detected) {
     failOpenTransaction(db, () => {
       const sessionId = event.metadata?.sessionId;
@@ -25764,8 +25815,9 @@ function computeFindingKey(input) {
 
 // ../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
@@ -25789,6 +25841,46 @@ function parseKeyFile(raw) {
   }
   return { version: version2, material: bytes };
 }
+var KEY_VERSION_TABLES = ["exceptions", "blocked_detections"];
+var SQLITE_ERROR = 1;
+var FLOOR_BUSY_TIMEOUT_MS = 250;
+var FloorUnreadableError = class extends Error {
+  code = "floor-unreadable";
+  constructor(cause) {
+    super(
+      `cannot read the stored fingerprint key versions: ${cause instanceof Error ? cause.message : String(cause)}`,
+      { cause }
+    );
+    this.name = "FloorUnreadableError";
+  }
+};
+function storedKeyVersionFloor(dataDir2) {
+  const file2 = join3(dataDir2, DB_FILENAME);
+  if (!existsSync3(file2)) return 0;
+  let db;
+  try {
+    db = new DatabaseSync2(file2, { readOnly: true });
+    db.exec(`PRAGMA busy_timeout = ${String(FLOOR_BUSY_TIMEOUT_MS)}`);
+    let floor = 0;
+    for (const table of KEY_VERSION_TABLES) {
+      try {
+        const row = getRow(
+          db.prepare(`SELECT MAX(key_version) AS v FROM ${table}`)
+        );
+        floor = Math.max(floor, row?.v ?? 0);
+      } catch (err) {
+        if (err.errcode !== SQLITE_ERROR) {
+          throw new FloorUnreadableError(err);
+        }
+      }
+    }
+    return floor;
+  } catch (err) {
+    throw err instanceof FloorUnreadableError ? err : new FloorUnreadableError(err);
+  } finally {
+    db?.close();
+  }
+}
 function writeKeyFile(dataDir2, key) {
   ensureDataDirSync(dataDir2);
   const file2 = keyFilePath(dataDir2);
@@ -25813,18 +25905,27 @@ function loadOrCreateFingerprintKey(dataDir2) {
     tightenFile(keyFilePath(dataDir2));
     return existing;
   }
-  return writeKeyFile(dataDir2, { version: 1, material: randomBytes(KEY_MATERIAL_BYTES) });
+  return writeKeyFile(dataDir2, {
+    version: storedKeyVersionFloor(dataDir2) + 1,
+    material: randomBytes(KEY_MATERIAL_BYTES)
+  });
 }
 function rotateFingerprintKey(dataDir2) {
   const existing = readFingerprintKey(dataDir2);
   return writeKeyFile(dataDir2, {
-    version: (existing?.version ?? 0) + 1,
+    version: Math.max(existing?.version ?? 0, storedKeyVersionFloor(dataDir2)) + 1,
     material: randomBytes(KEY_MATERIAL_BYTES)
   });
 }
 function fingerprintValue(key, raw) {
   return createHmac("sha256", key.material).update(raw, "utf8").digest("hex");
 }
+function isCurrentKeyVersion(key, keyVersion) {
+  return isMatchableUnder(keyVersion, keyStateOf(key));
+}
+function keyStateOf(key) {
+  return key === null ? { status: "absent" } : { status: "present", version: key.version };
+}
 
 // ../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
@@ -25870,11 +25971,11 @@ function readJson(file2) {
 }
 
 // ../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
 import { join as join6 } from "path";
 
 // ../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { join as join7 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
@@ -27933,7 +28034,7 @@ function bundledDetections() {
 }
 
 // ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, statSync } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, statSync } from "fs";
 import { basename, dirname as dirname2, isAbsolute, join as join8, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
@@ -27972,7 +28073,7 @@ function resolveHeadRoot(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync5(join8(dir, ".git"))) return dir;
+    if (existsSync6(join8(dir, ".git"))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -27990,7 +28091,7 @@ function resolveGitContext(root) {
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
   const gitdir = isAbsolute(target) ? target : join8(root, target);
-  if (existsSync5(join8(gitdir, "config"))) {
+  if (existsSync6(join8(gitdir, "config"))) {
     return { configPath: join8(gitdir, "config"), headRoot: root };
   }
   const commonRaw = safeRead(join8(gitdir, "commondir"))?.trim();
@@ -28084,7 +28185,7 @@ function resolveNonGitProject(startDir, recognizeMarker) {
 
 // ../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
 import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
@@ -28186,7 +28287,7 @@ function resolveProjectFiles(cwd) {
         const fullPath = join11(dir, entry.name);
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
-          if (existsSync6(join11(fullPath, ".git"))) continue;
+          if (existsSync7(join11(fullPath, ".git"))) continue;
           if (visit3(fullPath, dirLayers)) return true;
           continue;
         }
@@ -28489,7 +28590,7 @@ function reinvokeArgv(subcommand, extraArgs = []) {
 
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { join as join14 } from "path";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 function cachePath(home) {
@@ -28497,7 +28598,7 @@ function cachePath(home) {
 }
 function readCache(home) {
   const path = cachePath(home);
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
     const raw = JSON.parse(readFileSync9(path, "utf8"));
     if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
@@ -28507,7 +28608,7 @@ function readCache(home) {
   }
 }
 function writeCache(home, cache) {
-  if (!existsSync7(dataDir(home))) return;
+  if (!existsSync8(dataDir(home))) return;
   try {
     writeFileSync5(cachePath(home), `${JSON.stringify(cache, null, 2)}
 `);
@@ -28672,7 +28773,7 @@ function commandsHelp() {
 }
 
 // src/commands/check-updates.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { parseArgs } from "util";
 
 // src/lib/args.ts
@@ -28703,7 +28804,7 @@ function runCheckUpdates(argv) {
     out.write(`${String(ups.length)} update(s) available \u2014 run \`aka update\` to apply.
 `);
   }
-  if (existsSync8(dataDir(home))) {
+  if (existsSync9(dataDir(home))) {
     const notifiedPluginIds = readCache(home)?.notifiedPluginIds ?? [];
     writeCache(home, { checkedAt: Date.now(), report, notifiedPluginIds });
   }
@@ -28857,7 +28958,7 @@ function runCompletion(argv) {
 
 // src/commands/dashboard.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
 import { dirname as dirname5, join as join15 } from "path";
@@ -28937,7 +29038,7 @@ async function runDashboard(argv) {
   const bundledServer = [
     join15(base, "web-ui", "server.js"),
     join15(base, "web-ui", "web-ui", "server.js")
-  ].find((p) => existsSync9(p));
+  ].find((p) => existsSync10(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
@@ -28956,7 +29057,7 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync9(join15(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync10(join15(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
@@ -29473,10 +29574,29 @@ function printGranted(io, ex) {
 `
   );
 }
-function blockedLine(entry) {
-  return `${entry.reference}  ${entry.maskedValue}  ${entry.ruleId}  ${formatRelative(entry.blockedAt)}`;
+function blockedLine(entry, key) {
+  const line = `${entry.reference}  ${entry.maskedValue}  ${entry.ruleId}  ${formatRelative(entry.blockedAt)}`;
+  return isCurrentKeyVersion(key, entry.keyVersion) ? line : `${line}  [not approvable: recorded under key v${String(entry.keyVersion)}]`;
+}
+function keyAccessHint(err, dir) {
+  const code = err?.code;
+  if (code === "floor-unreadable") {
+    return `The local store could not be read, and a key minted without it could reuse a version already in use \u2014 fix the store first (${dir}/aka.db).`;
+  }
+  return typeof code === "string" ? `Check the permissions on ${dir}/exception.key \u2014 do not delete it, that invalidates every existing grant.` : `Delete ${dir}/exception.key to start fresh \u2014 grants written under it already cannot match.`;
+}
+function readKeyForApprove(dir) {
+  try {
+    return readFingerprintKey(dir);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`cannot read the fingerprint key: ${message}
+${keyAccessHint(err, dir)}`, {
+      cause: err
+    });
+  }
 }
-async function pickBlocked(entries, selector, io, dir) {
+async function pickBlocked(entries, selector, io, key) {
   if (selector !== void 0) {
     const matches = entries.filter(
       (e) => e.reference.startsWith(selector) || e.maskedValue === selector
@@ -29489,10 +29609,14 @@ async function pickBlocked(entries, selector, io, dir) {
         `the selector matches ${String(matches.length)} recent blocks \u2014 run 'aka exception approve' bare to pick from the list`
       );
     }
-    const key = loadOrCreateFingerprintKey(dir);
+    if (key === null) {
+      throw new Error(
+        `no blocked detection matches that reference, and matching by value needs the fingerprint key \u2014 none exists on this machine`
+      );
+    }
     const fingerprint = fingerprintValue(key, selector);
     const byValue = entries.filter(
-      (e) => e.keyVersion === key.version && e.valueFingerprint === fingerprint
+      (e) => isCurrentKeyVersion(key, e.keyVersion) && e.valueFingerprint === fingerprint
     );
     const newest = byValue[0];
     if (newest) {
@@ -29511,20 +29635,20 @@ async function pickBlocked(entries, selector, io, dir) {
   const only = entries[0];
   if (entries.length === 1 && only) {
     io.out(`Approving the only recent block:
-  ${blockedLine(only)}
+  ${blockedLine(only, key)}
 `);
     return only;
   }
   if (!io.isInteractive) {
     io.err(`Blocked in the last 30 minutes:
 `);
-    for (const entry of entries) io.err(`  ${blockedLine(entry)}
+    for (const entry of entries) io.err(`  ${blockedLine(entry, key)}
 `);
     throw new Error("pass the reference to approve: aka exception approve <reference>");
   }
   io.out("Blocked in the last 30 minutes:\n");
   entries.forEach((entry, i) => {
-    io.out(`  ${String(i + 1)}) ${blockedLine(entry)}
+    io.out(`  ${String(i + 1)}) ${blockedLine(entry, key)}
 `);
   });
   const answer = await io.ask(`Which one? [1-${String(entries.length)}]: `);
@@ -29556,7 +29680,13 @@ To pre-authorize a value instead: aka exception add --rule <ruleId>
       return;
     }
     const selector = positionals[0]?.trim();
-    const entry = await pickBlocked(entries, selector === "" ? void 0 : selector, io, dir);
+    const key = readKeyForApprove(dir);
+    const entry = await pickBlocked(entries, selector === "" ? void 0 : selector, io, key);
+    if (!isCurrentKeyVersion(key, entry.keyVersion)) {
+      throw new Error(
+        key === null ? `cannot approve ${entry.reference}: the fingerprint key file is missing, so the fingerprint recorded for it can no longer be matched \u2014 trigger the detection again` : `cannot approve ${entry.reference}: it was blocked under fingerprint key v${String(entry.keyVersion)} and the key is now v${String(key.version)}, so a grant from it could never match \u2014 trigger the detection again`
+      );
+    }
     const { scope, reason } = await resolveScopeAndReason(values, io);
     if (scope.scope === "permanent") {
       await confirmPermanent(io, entry.maskedValue, values.yes === true);
@@ -29869,11 +29999,8 @@ written under the old key simply stop matching. They remain listed for audit.
       version2 = rotateFingerprintKey(dir).version;
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      throw new Error(
-        `cannot rotate: ${message}
-Delete ${dir}/exception.key to start fresh \u2014 grants written under it already cannot match.`,
-        { cause: err }
-      );
+      throw new Error(`cannot rotate: ${message}
+${keyAccessHint(err, dir)}`, { cause: err });
     }
     io.out(
       `Fingerprint key rotated \u2014 new key version v${String(version2)}.
@@ -29907,13 +30034,13 @@ async function runException(argv, io = terminalPrompter()) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync11, statSync as statSync7 } from "fs";
+import { existsSync as existsSync12, statSync as statSync7 } from "fs";
 import { join as join16 } from "path";
 import * as readline from "readline/promises";
 import { parseArgs as parseArgs6 } from "util";
 
 // src/commands/plugins.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { parseArgs as parseArgs5 } from "util";
 function runPlugins(argv) {
   const [sub, ...rest] = argv;
@@ -29930,7 +30057,7 @@ async function listPlugins(argv) {
   const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
   const active = /* @__PURE__ */ new Set();
-  if (existsSync10(dbPath(home))) {
+  if (existsSync11(dbPath(home))) {
     const db = openLocalDatabase(dataDir(home));
     try {
       const recent = await db.findings.recentFindings({ limit: 1e3 });
@@ -30041,7 +30168,7 @@ async function runInit(argv) {
   const settings = settingsDir(home);
   ensureLayoutDirSync(settings);
   const settingsFile = join16(settings, "settings.json");
-  const settingsCreated = !existsSync11(settingsFile);
+  const settingsCreated = !existsSync12(settingsFile);
   if (settingsCreated) {
     writeOwnerOnlyFileSync(
       settingsFile,
@@ -31069,7 +31196,50 @@ function applyPluginUpdate2(status) {
   return ok;
 }
 
-// src/cli.ts
+// src/lib/external-dispatch.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { constants } from "os";
+function commandOnPath(command) {
+  const probe = spawnSync2("/bin/sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", command], {
+    stdio: "ignore"
+  });
+  return probe.status === 0;
+}
+function isExternalCommandName(name) {
+  return /^[a-z][a-z0-9-]*$/.test(name);
+}
+function shouldDispatchExternal(command, isBuiltin) {
+  return !isBuiltin && isExternalCommandName(command);
+}
+function externalDispatchSupported(platform2 = process.platform) {
+  return platform2 !== "win32";
+}
+function signalExitCode(signal) {
+  const number4 = signal ? constants.signals[signal] : void 0;
+  return number4 === void 0 ? 1 : 128 + number4;
+}
+function dispatchExternal(command, argv, deps = {}) {
+  const spawn4 = deps.spawn ?? spawnSync2;
+  const platform2 = deps.platform ?? process.platform;
+  const exists = deps.exists ?? commandOnPath;
+  if (!externalDispatchSupported(platform2)) return { found: false, status: 1 };
+  const target = `aka-${command}`;
+  const result = spawn4(target, argv, { stdio: "inherit" });
+  if (result.error) {
+    if (result.error.code === "ENOENT" && !exists(target)) return { found: false, status: 1 };
+    process.stderr.write(`aka: ${target}: ${result.error.message}
+`);
+    return { found: true, status: 1 };
+  }
+  if (result.status === null) {
+    if (result.signal) process.stderr.write(`aka: ${target}: terminated by ${result.signal}
+`);
+    return { found: true, status: signalExitCode(result.signal) };
+  }
+  return { found: true, status: result.status };
+}
+
+// src/main.ts
 var COMMANDS = {
   init: runInit,
   scan: runScan,
@@ -31106,7 +31276,9 @@ Usage: aka <command> [options]
 
 Commands:
 ${commandsHelp()}
-
+${externalDispatchSupported() ? `
+Anything else runs an external 'aka-<command>' from your PATH (so 'aka claude' runs aka-claude).
+` : ""}
 Options:
   --home <dir>        Use an alternate AKA home (default: ~/.aka)
   --no-update-check   Skip the post-command "updates available" notice
@@ -31122,8 +31294,7 @@ function homeFromArgv(argv) {
   }
   return homeBase(void 0);
 }
-async function main() {
-  const argv = process.argv.slice(2);
+async function main(argv = process.argv.slice(2), dispatchDeps = {}) {
   if (argv[0] === "-v" || argv[0] === "--version" || argv[0] === "version") {
     process.stdout.write(`${cliVersion() ?? "unknown"}
 `);
@@ -31136,7 +31307,14 @@ async function main() {
   }
   const noUpdateCheck = rawRest.includes("--no-update-check");
   const rest = rawRest.filter((a) => a !== "--no-update-check");
-  const handler = COMMANDS[command];
+  const handler = Object.hasOwn(COMMANDS, command) ? COMMANDS[command] : void 0;
+  if (shouldDispatchExternal(command, handler !== void 0)) {
+    const external = dispatchExternal(command, rawRest, dispatchDeps);
+    if (external.found) {
+      process.exitCode = external.status;
+      return;
+    }
+  }
   if (!handler) {
     process.stderr.write(`aka: unknown command '${command}'
 
@@ -31152,6 +31330,8 @@ ${USAGE}`);
     }
   }
 }
+
+// src/cli.ts
 main().catch((err) => {
   process.stderr.write(`aka: ${err instanceof Error ? err.message : String(err)}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/cli",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "AI Traffic Control — local-first CLI to inspect and govern AI agent traffic on your machine",
   "license": "Apache-2.0",
   "repository": {
@@ -41,12 +41,12 @@
     "typescript": "^5.8.0",
     "vitest": "^4.1.10",
     "@akasecurity/dashboard-ui": "0.8.0",
-    "@akasecurity/eslint-config": "0.8.0",
+    "@akasecurity/detections": "0.8.0",
     "@akasecurity/local-ops": "0.8.0",
+    "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/plugin-sdk": "0.8.0",
-    "@akasecurity/schema": "0.8.0",
-    "@akasecurity/detections": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
+    "@akasecurity/schema": "0.8.0",
     "@akasecurity/web-ui": "0.8.0"
   },
   "scripts": {

package/web-ui/web-ui/.next/BUILD_ID

@@ -1 +1 @@
-mAOCejrDqkMoDfzjWr6qu
+X_Z1LZQpnGXTuZXKkv4Vb