@cdot65/prisma-airs-cli 4.4.0 → 5.0.0

package/dist/cli/index.js

@@ -9,18 +9,22 @@ import {
   SdkPromptSetService,
   SdkRedTeamService,
   SdkRuntimeService,
+  collectRuntimeDailyReport,
   computeMetrics,
   getOrCreateManagementClient,
   inspectConfig,
   loadConfig,
   readBackupDir,
   readBackupFile,
+  renderRuntimeReportHtml,
+  renderRuntimeReportMarkdown,
   resolveConfigFilePath,
   resolveOutputDir,
   sanitizeFilename,
   validateTopic,
-  writeBackupFile
-} from "../chunk-LF6JPUA4.js";
+  writeBackupFile,
+  writeReportFile
+} from "../chunk-IRLIFMGQ.js";
 
 // src/cli/index.ts
 import "dotenv/config";
@@ -39,8 +43,8 @@ function installProcessGuards() {
 }
 
 // src/cli/program.ts
+import { randomUUID as randomUUID6 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
-import { homedir } from "os";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
@@ -222,6 +226,17 @@ var SdkAiGatewayService = class {
 };
 
 // src/config/client-options.ts
+function managementClientOptions(config) {
+  return {
+    clientId: config.mgmtClientId,
+    clientSecret: config.mgmtClientSecret,
+    tsgId: config.mgmtTsgId,
+    apiEndpoint: config.mgmtEndpoint,
+    dashboardEndpoint: config.mgmtDashboardEndpoint ?? "https://api.apps.paloaltonetworks.com/aisec",
+    tokenEndpoint: config.mgmtTokenEndpoint,
+    dlpEndpoint: config.dlpEndpoint
+  };
+}
 function runtimeInitOptions(config) {
   return {
     apiKey: config.airsApiKey,
@@ -331,8 +346,8 @@ function displayValue(value) {
   return typeof value === "object" ? JSON.stringify(value) : String(value);
 }
 function csvCell(value) {
-  const text = displayValue(value);
-  return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+  const text2 = displayValue(value);
+  return /[",\r\n]/.test(text2) ? `"${text2.replace(/"/g, '""')}"` : text2;
 }
 function markdownCell(value) {
   return displayValue(value).replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
@@ -1373,33 +1388,33 @@ function renderMsScanList(scans, format = "pretty") {
   }
   console.log();
 }
-function renderMsScanDetail(scan, format = "pretty") {
+function renderMsScanDetail(scan2, format = "pretty") {
   if (format !== "pretty") {
-    structuredDetail("scan", scan, format, () => void 0);
+    structuredDetail("scan", scan2, format, () => void 0);
     return;
   }
   ui.section("Scan Detail:");
   const pairs = [
-    ["UUID", scan.uuid],
-    ["Outcome", stateColor(scan.evalOutcome)(scan.evalOutcome)]
+    ["UUID", scan2.uuid],
+    ["Outcome", stateColor(scan2.evalOutcome)(scan2.evalOutcome)]
   ];
-  if (scan.modelUri) pairs.push(["Model URI", scan.modelUri]);
-  pairs.push(["Origin", scan.scanOrigin]);
-  pairs.push(["Source", scan.sourceType]);
-  pairs.push(["Group", scan.securityGroupName]);
-  pairs.push(["Created", scan.createdAt]);
-  pairs.push(["Updated", scan.updatedAt]);
-  if (scan.evalSummary) {
-    const { rulesPassed, rulesFailed, totalRules } = scan.evalSummary;
+  if (scan2.modelUri) pairs.push(["Model URI", scan2.modelUri]);
+  pairs.push(["Origin", scan2.scanOrigin]);
+  pairs.push(["Source", scan2.sourceType]);
+  pairs.push(["Group", scan2.securityGroupName]);
+  pairs.push(["Created", scan2.createdAt]);
+  pairs.push(["Updated", scan2.updatedAt]);
+  if (scan2.evalSummary) {
+    const { rulesPassed, rulesFailed, totalRules } = scan2.evalSummary;
     pairs.push([
       "Rules",
       `${chalk7.green(`${rulesPassed} passed`)}  ${chalk7.red(`${rulesFailed} failed`)}  / ${totalRules} total`
     ]);
   }
   ui.keyValue(pairs);
-  if (scan.labels.length > 0) {
+  if (scan2.labels.length > 0) {
     ui.section("Labels:");
-    ui.keyValue(scan.labels.map((l) => [l.key, l.value]));
+    ui.keyValue(scan2.labels.map((l) => [l.key, l.value]));
   }
   console.log();
 }
@@ -2084,9 +2099,9 @@ function renderPromptList(prompts, format = "pretty") {
   ui.section("Prompts:");
   for (const p of prompts) {
     const status = p.active ? chalk8.green("active") : chalk8.dim("inactive");
-    const text = p.prompt.length > 80 ? `${p.prompt.substring(0, 77)}...` : p.prompt;
+    const text2 = p.prompt.length > 80 ? `${p.prompt.substring(0, 77)}...` : p.prompt;
     console.log(`  ${chalk8.dim(p.uuid)}  ${status}`);
-    console.log(`    ${text}`);
+    console.log(`    ${text2}`);
     if (p.goal) console.log(`    ${chalk8.dim(`Goal: ${p.goal}`)}`);
   }
   console.log();
@@ -2900,54 +2915,6 @@ function renderDeploymentProfileList(profiles, format = "pretty") {
   }
   console.log();
 }
-function renderScanLogList(results, pageToken, format = "pretty") {
-  if (results.length === 0) {
-    if (format === "pretty") ui.emptyList("scan logs");
-    else console.log(formatOutput([], [], format));
-    return;
-  }
-  if (format !== "pretty") {
-    const rows = results.map((r) => ({
-      scanId: r.scan_id ?? "",
-      timestamp: r.received_ts ?? r.timestamp ?? "",
-      action: r.action ?? r.verdict ?? "",
-      profile: r.profile_name ?? "",
-      app: r.app_name ?? ""
-    }));
-    console.log(
-      formatOutput(
-        rows,
-        [
-          { key: "scanId", label: "Scan ID" },
-          { key: "timestamp", label: "Timestamp" },
-          { key: "action", label: "Action" },
-          { key: "profile", label: "Profile" },
-          { key: "app", label: "App" }
-        ],
-        format
-      )
-    );
-    return;
-  }
-  ui.section(`Scan Logs (${results.length} results):`);
-  for (const r of results) {
-    const action = r.action ?? r.verdict;
-    const app = r.app_name;
-    const profile = r.profile_name;
-    const ts2 = r.received_ts ?? r.timestamp;
-    const scanId = r.scan_id;
-    const actionColor = action === "block" ? chalk9.red : chalk9.green;
-    if (scanId) ui.dim(scanId);
-    console.log(
-      `    ${ts2 ? chalk9.dim(ts2) : ""}  ${action ? actionColor(action) : ""}  ${profile ? `[${profile}]` : ""}  ${app ?? ""}`
-    );
-  }
-  if (pageToken) {
-    console.log();
-    ui.dim(`Page token: ${pageToken}`);
-  }
-  console.log();
-}
 
 // src/cli/confirm.ts
 async function confirmOrAbort(message, force, options = {}) {
@@ -3085,8 +3052,8 @@ function registerAiGatewayInference(parent) {
         process.once("SIGINT", interrupt);
         process.once("SIGTERM", interrupt);
         process.stdout.on("error", outputError);
-        const write = (text) => new Promise((resolve2, reject) => {
-          process.stdout.write(text, (error) => error ? reject(error) : resolve2());
+        const write = (text2) => new Promise((resolve4, reject) => {
+          process.stdout.write(text2, (error) => error ? reject(error) : resolve4());
         });
         const requestOptions = { signal: controller.signal };
         const result = kind === "chat" ? await client.createChatCompletion(
@@ -3105,16 +3072,16 @@ function registerAiGatewayInference(parent) {
             if (format === "json") await write(`${JSON.stringify(event)}
 `);
             else {
-              const text = responseText(event);
-              if (text) await write(text);
+              const text2 = responseText(event);
+              if (text2) await write(text2);
             }
             if ("type" in event && (event.type === "response.failed" || event.type === "response.incomplete"))
               throw new Error(`Gateway generation ended with ${event.type}`);
           }
           if (format === "pretty") await write("\n");
         } else {
-          const text = format === "yaml" ? dump3(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
-          await write(`${text}
+          const text2 = format === "yaml" ? dump3(result, { noRefs: true }).trimEnd() : format === "pretty" && kind !== "embeddings" ? responseText(result) : JSON.stringify(result, null, 2);
+          await write(`${text2}
 `);
           if ("status" in result && (result.status === "failed" || result.status === "incomplete"))
             throw new Error(`Gateway generation ended with ${result.status}`);
@@ -3184,6 +3151,7 @@ import {
 import { dirname, join } from "path";
 var AIRS_DOMAINS = [
   "api.sase.paloaltonetworks.com",
+  "api.apps.paloaltonetworks.com",
   "service.api.aisecurity.paloaltonetworks.com",
   "auth.apps.paloaltonetworks.com",
   "api.dlp.paloaltonetworks.com"
@@ -3197,7 +3165,7 @@ function isAirsUrl(url) {
   }
 }
 var MASK = "***";
-var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|^key$/i;
+var SENSITIVE_KEY_PATTERN = /token|secret|password|passwd|credential|authorization|cookie|api[-_]?key|client[-_]?auth|auth[-_]?code|^key$/i;
 function isSensitiveKey(key) {
   return SENSITIVE_KEY_PATTERN.test(key);
 }
@@ -3236,28 +3204,6 @@ function redactUrl(url) {
     return url;
   }
 }
-function pruneDebugLogs(dir, keep) {
-  let files;
-  try {
-    files = readdirSync(dir).filter((f) => f.startsWith("debug-api-") && f.endsWith(".jsonl"));
-  } catch {
-    return;
-  }
-  const byAge = files.map((f) => {
-    const path3 = join(dir, f);
-    try {
-      return { path: path3, mtime: statSync(path3).mtimeMs };
-    } catch {
-      return null;
-    }
-  }).filter((e) => e !== null).sort((a, b) => b.mtime - a.mtime);
-  for (const { path: path3 } of byAge.slice(keep)) {
-    try {
-      unlinkSync(path3);
-    } catch {
-    }
-  }
-}
 function headersToRecord(headers) {
   if (!headers) return {};
   if (typeof headers === "object" && "forEach" in headers && typeof headers.forEach === "function") {
@@ -3272,11 +3218,9 @@ function headersToRecord(headers) {
   }
   return headers;
 }
-var KEEP_DEBUG_LOGS = 10;
 function installDebugLogger(logPath) {
   mkdirSync(dirname(logPath), { recursive: true, mode: 448 });
-  writeFileSync(logPath, "", { encoding: "utf8", mode: 384 });
-  pruneDebugLogs(dirname(logPath), KEEP_DEBUG_LOGS);
+  writeFileSync(logPath, "", { encoding: "utf8", mode: 384, flag: "wx" });
   const originalFetch = globalThis.fetch;
   globalThis.fetch = async function debugFetch(input, init2) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -3289,16 +3233,18 @@ function installDebugLogger(logPath) {
     if (!isAirsUrl(url) && !inference) {
       return originalFetch(input, init2);
     }
+    const dashboard = /\/v1\/mgmt\/(dashboard\/|reports\/scancontent(?:\?|$))/.test(url);
     const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
     const reqHeaders = redactHeaders(rawHeaders);
     const loggedUrl = redactUrl(url);
     let reqBody;
-    if (inference) reqBody = "[BODY OMITTED]";
+    if (inference || dashboard) reqBody = "[BODY OMITTED]";
     else if (init2?.body) {
       try {
         reqBody = redactDeep(JSON.parse(String(init2.body)));
       } catch {
-        reqBody = String(init2.body);
+        const contentType = new Headers(rawHeaders).get("content-type") ?? "";
+        reqBody = contentType.includes("application/x-www-form-urlencoded") ? redactDeep(Object.fromEntries(new URLSearchParams(String(init2.body)))) : "[NON-JSON BODY OMITTED]";
       }
     }
     const ts2 = (/* @__PURE__ */ new Date()).toISOString();
@@ -3309,7 +3255,7 @@ function installDebugLogger(logPath) {
     try {
       response = await originalFetch(input, init2);
     } catch (err) {
-      error = inference ? "Runtime request failed" : err instanceof Error ? err.message : String(err);
+      error = inference ? "Runtime request failed" : "Request failed";
       const entry2 = JSON.stringify({
         timestamp: ts2,
         durationMs: Date.now() - startMs,
@@ -3325,16 +3271,16 @@ function installDebugLogger(logPath) {
     response.headers.forEach((v, k) => {
       resHeaders[k] = v;
     });
-    if (inference || response.headers.get("content-type")?.includes("text/event-stream")) {
+    if (inference || dashboard || response.headers.get("content-type")?.includes("text/event-stream")) {
       resBody = "[BODY OMITTED]";
     } else {
       const clone = response.clone();
       try {
-        const text = await clone.text();
+        const text2 = await clone.text();
         try {
-          resBody = redactDeep(JSON.parse(text));
+          resBody = redactDeep(JSON.parse(text2));
         } catch {
-          resBody = text;
+          resBody = "[NON-JSON BODY OMITTED]";
         }
       } catch {
         resBody = "<unreadable>";
@@ -3389,8 +3335,8 @@ function addWriteOutput(command) {
 async function readGatewayRequest(path3) {
   let parsed;
   try {
-    const text = await readFile2(path3, "utf8");
-    parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text) : JSON.parse(text);
+    const text2 = await readFile2(path3, "utf8");
+    parsed = path3.endsWith(".yaml") || path3.endsWith(".yml") ? load(text2) : JSON.parse(text2);
   } catch (error) {
     throw new CliUsageError(
       `Unable to parse --file '${path3}' as JSON or YAML: ${error instanceof Error ? error.message : String(error)}`
@@ -3605,9 +3551,9 @@ function parseBooleanOption(value) {
   throw new CliUsageError("Expected true or false");
 }
 function parseIntegerOption(value) {
-  const text = String(value);
-  if (!/^-?(0|[1-9]\d*)$/.test(text)) throw new CliUsageError("Expected an integer");
-  const parsed = Number(text);
+  const text2 = String(value);
+  if (!/^-?(0|[1-9]\d*)$/.test(text2)) throw new CliUsageError("Expected an integer");
+  const parsed = Number(text2);
   if (!Number.isSafeInteger(parsed)) throw new CliUsageError("Expected a safe integer");
   return parsed;
 }
@@ -3651,14 +3597,14 @@ function parseModelBindingsOption(value) {
 }
 function parseCapabilityBindingsOption(value) {
   return repeatableValues(value).map((raw) => {
-    const [identity, enabled] = splitKeyValue(raw, "type:name");
-    const separator = identity.indexOf(":");
-    if (separator <= 0 || separator === identity.length - 1) {
+    const [identity2, enabled] = splitKeyValue(raw, "type:name");
+    const separator = identity2.indexOf(":");
+    if (separator <= 0 || separator === identity2.length - 1) {
       throw new CliUsageError("Expected type:name=enabled");
     }
     return {
-      type: identity.slice(0, separator),
-      name: identity.slice(separator + 1),
+      type: identity2.slice(0, separator),
+      name: identity2.slice(separator + 1),
       enabled: parseBooleanOption(enabled)
     };
   });
@@ -3679,12 +3625,12 @@ function parseAssignment(raw, forceString) {
   const separator = raw.indexOf("=");
   if (separator <= 0) throw new CliUsageError("Expected path=value");
   const path3 = raw.slice(0, separator);
-  const text = raw.slice(separator + 1);
-  if (forceString) return [path3, text];
+  const text2 = raw.slice(separator + 1);
+  if (forceString) return [path3, text2];
   try {
-    return [path3, JSON.parse(text)];
+    return [path3, JSON.parse(text2)];
   } catch {
-    return [path3, text];
+    return [path3, text2];
   }
 }
 function schemaMessage(error) {
@@ -4608,11 +4554,11 @@ function addWindowOptions(command) {
   );
 }
 function windowFrom(opts) {
-  const window = { workspaceSlug: opts.workspace };
-  if (opts.start) window.start = parseNamedDate2(opts.start, "--start");
-  else window.days = parsePositiveInteger2(opts.days ?? "7", "--days");
-  if (opts.end) window.end = parseNamedDate2(opts.end, "--end");
-  return window;
+  const window2 = { workspaceSlug: opts.workspace };
+  if (opts.start) window2.start = parseNamedDate2(opts.start, "--start");
+  else window2.days = parsePositiveInteger2(opts.days ?? "7", "--days");
+  if (opts.end) window2.end = parseNamedDate2(opts.end, "--end");
+  return window2;
 }
 function parsePositiveInteger2(value, flag) {
   try {
@@ -5350,8 +5296,8 @@ async function withTimeout(promise, ms) {
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve2) => {
-        timer = setTimeout(() => resolve2(TIMED_OUT), ms);
+      new Promise((resolve4) => {
+        timer = setTimeout(() => resolve4(TIMED_OUT), ms);
       })
     ]);
   } finally {
@@ -5621,12 +5567,12 @@ function hasBin(bin) {
   }
 }
 function run(bin, args, label) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve4, reject) => {
     const child = spawn(bin, args, { stdio: "inherit" });
     child.on("error", (err) => reject(new Error(`Failed to start ${bin}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) reject(new Error(`${label} failed with exit code ${code}`));
-      else resolve2();
+      else resolve4();
     });
   });
 }
@@ -5947,8 +5893,8 @@ function registerModelSecurityCommand(program) {
       const fmt = opts.output;
       if (fmt === "pretty") renderModelSecurityHeader();
       const service = await createService2();
-      const scan = await service.getScan(uuid);
-      renderMsScanDetail(scan, fmt);
+      const scan2 = await service.getScan(uuid);
+      renderMsScanDetail(scan2, fmt);
     } catch (err) {
       fail(err);
     }
@@ -5958,9 +5904,9 @@ function registerModelSecurityCommand(program) {
       renderModelSecurityHeader();
       const service = await createService2();
       const config = JSON.parse(fs.readFileSync(opts.config, "utf-8"));
-      const scan = await service.createScan(config);
-      ui.success(`Scan created: ${scan.uuid}`);
-      renderMsScanDetail(scan);
+      const scan2 = await service.createScan(config);
+      ui.success(`Scan created: ${scan2.uuid}`);
+      renderMsScanDetail(scan2);
     } catch (err) {
       fail(err);
     }
@@ -7439,7 +7385,7 @@ function registerRedteamCommand(program) {
 }
 
 // src/cli/commands/runtime.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as fs5 from "fs";
 import { readFile as readFile10 } from "fs/promises";
 import { basename as basename3, dirname as dirname3, join as join3, resolve as resolvePath } from "path";
@@ -7507,7 +7453,7 @@ function buildDataProtection(flags) {
     const dld = { action: flags.dlpAction };
     const profiles = parseList(flags.dlpProfiles);
     if (profiles) {
-      dld.member = profiles.map((text) => ({ text }));
+      dld.member = profiles.map((text2) => ({ text: text2 }));
     }
     if (flags.maskDataInline != null) {
       dld["mask-data-inline"] = flags.maskDataInline;
@@ -8994,6 +8940,320 @@ function registerCleanupCommand(parent) {
   });
 }
 
+// src/cli/commands/runtime-dashboard.ts
+import { lstat } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { dump as dump5 } from "js-yaml";
+function integer2(value, name, minimum = 0) {
+  const n = Number(value);
+  if (!/^\d+$/.test(String(value)) || !Number.isSafeInteger(n) || n < minimum)
+    throw new CliUsageError(`${name} must be a safe integer >= ${minimum}`);
+  return n;
+}
+function text(value, name) {
+  if (typeof value !== "string" || !value.trim()) throw new CliUsageError(`${name} is required`);
+  return value;
+}
+function window(opts) {
+  return {
+    timeInterval: integer2(opts.interval, "--interval", 1),
+    timeUnit: text(opts.unit, "--unit")
+  };
+}
+function identity(opts) {
+  return {
+    sessionId: text(opts.sessionId, "--session-id"),
+    appId: text(opts.appId, "--app-id"),
+    appName: text(opts.appName, "--app-name"),
+    ...window(opts)
+  };
+}
+function scan(opts) {
+  return {
+    scanId: text(opts.scanId, "--scan-id"),
+    scanSubReqId: integer2(opts.scanSubReqId, "--scan-sub-req-id")
+  };
+}
+function timeOptions(command, interval = "1", unit = "day") {
+  return command.option("--interval <n>", "Look-back interval", interval).option("--unit <unit>", "API time unit (windows are deployment-dependent)", unit);
+}
+function pageOptions(command) {
+  return command.option("--limit <n>", "Items per page", "25").option("--offset <n>", "Item offset", "0");
+}
+function sessionOptions(command) {
+  return timeOptions(
+    command.requiredOption("--session-id <id>", "Session identity").requiredOption("--app-id <id>", "Application identity").requiredOption("--app-name <name>", "Exact dashboard application name"),
+    "30",
+    "days"
+  );
+}
+function scanOptions(command) {
+  return command.requiredOption("--scan-id <id>", "Scan identity").requiredOption("--scan-sub-req-id <n>", "Sub-request index, including zero");
+}
+function registerRuntimeDashboardCommands(runtime) {
+  const dashboard = runtime.command("dashboard").description("SCM application summaries and daily telemetry (OAuth)");
+  const sessions = runtime.command("sessions").description("Verified SCM session inventory and drill-down (OAuth)");
+  function register6(command, prepare) {
+    command.option("--output <format>", "Output format: pretty, json, yaml").action(async (opts) => {
+      try {
+        const read = prepare(opts);
+        const format = await resolveOutput(command, opts, {
+          allowed: ["pretty", "json", "yaml"]
+        });
+        if (command.name() === "scan-content") {
+          if (Boolean(opts.showContent) === Boolean(opts.outputFile))
+            throw new CliUsageError(
+              "Scan content requires exactly one of --show-content or --output-file <new-path>"
+            );
+          if (opts.outputFile) {
+            const path3 = resolve2(text(opts.outputFile, "--output-file"));
+            const existing = await lstat(path3).catch((error) => {
+              if (error.code !== "ENOENT") throw error;
+              return void 0;
+            });
+            if (existing) throw new Error("Destination exists");
+          }
+        }
+        const config = await loadConfig();
+        const client = getOrCreateManagementClient({
+          ...managementClientOptions(config),
+          numRetries: 0
+        });
+        const result = await read(client.dashboard);
+        const output = format === "yaml" ? dump5(result, { noRefs: true, lineWidth: -1 }).trimEnd() : JSON.stringify(result, null, 2);
+        if (command.name() === "scan-content" && opts.outputFile) {
+          await writeReportFile(resolve2(String(opts.outputFile)), `${output}
+`);
+          ui.status("Scan content exported to the requested private file (0600).");
+        } else console.log(output);
+      } catch (error) {
+        if (error instanceof CliUsageError) usageError(error.message);
+        const status = error?.statusCode;
+        ui.error(
+          `Dashboard operation failed${typeof status === "number" && status >= 400 && status <= 599 ? ` (HTTP ${status})` : ""}. Check credentials, query options, and any output destination. No existing file is overwritten.`
+        );
+        process.exitCode = 1;
+      }
+    });
+  }
+  register6(
+    pageOptions(
+      timeOptions(
+        dashboard.command("applications").description("One page of application activity")
+      )
+    ),
+    (opts) => {
+      const interval = integer2(opts.interval, "--interval", 1);
+      const unit = text(opts.unit, "--unit");
+      if (![1, 7, 30, 60].includes(interval) || !["day", "days", "hour"].includes(unit))
+        throw new CliUsageError(
+          "Application overview supports interval 1/7/30/60 and unit day/days/hour"
+        );
+      const query = {
+        timeInterval: interval,
+        timeUnit: unit,
+        limit: integer2(opts.limit, "--limit", 1),
+        offset: integer2(opts.offset, "--offset")
+      };
+      return (client) => client.applicationsOverview(query);
+    }
+  );
+  for (const [name, method] of [
+    ["application", "application"],
+    ["application-violations", "applicationViolationBreakdown"]
+  ]) {
+    register6(
+      timeOptions(
+        dashboard.command(name).requiredOption("--app-id <id>", "Application identity").requiredOption("--app-name <name>", "Exact dashboard application name"),
+        "30",
+        "days"
+      ),
+      (opts) => {
+        const interval = integer2(opts.interval, "--interval", 1);
+        if (![7, 30, 60].includes(interval) || opts.unit !== "days")
+          throw new CliUsageError("Application detail requires 7, 30, or 60 days");
+        const query = {
+          appId: text(opts.appId, "--app-id"),
+          appName: text(opts.appName, "--app-name"),
+          timeInterval: interval,
+          timeUnit: "days"
+        };
+        return (client) => client[method](query);
+      }
+    );
+  }
+  for (const [name, method, days] of [
+    ["top-applications", "topApplicationsViolations", false],
+    ["violations-trend", "applicationsViolationsTrend", false],
+    ["apps-list", "appsList", true]
+  ]) {
+    register6(
+      timeOptions(dashboard.command(name), days ? "30" : "1", days ? "days" : "day"),
+      (opts) => {
+        const query = window(opts);
+        return (client) => client[method](query);
+      }
+    );
+  }
+  register6(timeOptions(sessions.command("chart")), (opts) => {
+    const query = window(opts);
+    return (client) => client.sessionsChart(query);
+  });
+  register6(
+    pageOptions(
+      timeOptions(
+        sessions.command("list").description("Session entries; --all walks pages with completeness checks")
+      )
+    ).option("--all", "Walk all pages (up to 100 pages)").option("--max <n>", "Item cap with --all; 0 removes item cap", "10000"),
+    (opts) => {
+      const query = {
+        ...window(opts),
+        limit: integer2(opts.limit, "--limit", 1),
+        offset: integer2(opts.offset, "--offset")
+      };
+      const maximum = integer2(opts.max, "--max");
+      return async (client) => {
+        const items = [];
+        const seen = /* @__PURE__ */ new Set();
+        let expectedTotal;
+        let offset = query.offset;
+        for (let pageIndex = 0; pageIndex < 100; pageIndex++) {
+          const page = await client.sessionsOverview({ ...query, offset });
+          if (!opts.all) {
+            ui.status(
+              `Returned ${page.items.length} of ${page.pagination.total_items ?? "unknown"} sessions; this is one page.`
+            );
+            return page.items;
+          }
+          const total = page.pagination.total_items;
+          if (!Number.isSafeInteger(total) || total < 0 || page.pagination.skip !== offset || page.pagination.limit !== query.limit || page.items.length > query.limit || expectedTotal !== void 0 && total !== expectedTotal)
+            throw new Error("Unstable pagination");
+          expectedTotal = total;
+          for (const item of page.items) {
+            const key = JSON.stringify([
+              item.application_id,
+              item.application_name,
+              item.session_id
+            ]);
+            if (seen.has(key)) throw new Error("Overlapping session pages");
+            seen.add(key);
+            items.push(item);
+          }
+          offset += page.items.length;
+          if (offset > total || page.items.length === 0 && offset < total)
+            throw new Error("Incomplete inventory");
+          if (maximum > 0 && items.length > maximum) {
+            ui.status("Session item cap reached; output is partial.");
+            process.exitCode = 1;
+            return items.slice(0, maximum);
+          }
+          if (offset === total) {
+            ui.status(
+              `Retrieved ${items.length} sessions from offset ${query.offset}; pagination complete.`
+            );
+            return items;
+          }
+          if (maximum > 0 && items.length === maximum) {
+            ui.status("Session item cap reached; output is partial.");
+            process.exitCode = 1;
+            return items;
+          }
+        }
+        ui.status("Session page cap reached; output is partial.");
+        process.exitCode = 1;
+        return items;
+      };
+    }
+  );
+  register6(pageOptions(sessionOptions(sessions.command("get"))), (opts) => {
+    const query = {
+      ...identity(opts),
+      limit: integer2(opts.limit, "--limit", 1),
+      offset: integer2(opts.offset, "--offset")
+    };
+    return (client) => client.session(query);
+  });
+  register6(scanOptions(sessionOptions(sessions.command("transaction"))), (opts) => {
+    const query = { ...identity(opts), ...scan(opts) };
+    return (client) => client.sessionTransaction(query);
+  });
+  register6(
+    scanOptions(
+      sessions.command("scan-content").description("Explicit sensitive scan-content read; never automatically fetched")
+    ).option("--show-content", "Explicitly display stored content on stdout").option("--output-file <path>", "Private new file for stored content (no overwrite)"),
+    (opts) => {
+      const query = scan(opts);
+      return (client) => client.scanContent(query);
+    }
+  );
+}
+
+// src/cli/commands/runtime-report.ts
+import { lstat as lstat2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import { randomUUID as randomUUID4 } from "crypto";
+function registerRuntimeReportCommand(runtime) {
+  const command = runtime.command("report").description("Generate a daily AI Runtime Security environment dashboard (read-only)").option("--output <format>", "Deliverable format: html or markdown (default: html)").option(
+    "--output-file <path>",
+    "Destination (default: new timestamped file in CWD); - for stdout; never overwrite"
+  ).option("--title <text>", "Report title", "Daily environment report").option("--max-pages <n>", "Page budget per source, 1\u2013100 (25 sessions/page)", "40").option("--strict", "Exit 1 after writing if any source is incomplete").addHelpText(
+    "after",
+    examples(
+      "airs runtime report --output-file ./airs-daily.html",
+      "airs runtime report --output markdown --output-file ./airs-daily.md",
+      "airs runtime report",
+      "airs runtime report --strict --max-pages 20 --output-file - > daily.html"
+    )
+  ).action(async (opts) => {
+    const format = opts.output ?? command.parent?.parent?.opts().output ?? "html";
+    if (format !== "html" && format !== "markdown")
+      usageError("Report output must be html or markdown");
+    const maxPages = Number(opts.maxPages);
+    if (!/^[1-9]\d*$/.test(opts.maxPages) || !Number.isSafeInteger(maxPages) || maxPages > 100)
+      usageError("--max-pages must be an integer from 1 to 100");
+    if (typeof opts.title !== "string" || !opts.title.trim() || opts.title.length > 240)
+      usageError("--title must contain 1\u2013240 characters");
+    if (opts.outputFile !== void 0 && !opts.outputFile.trim())
+      usageError("--output-file cannot be empty");
+    const defaultName = `airs-runtime-report-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}-${randomUUID4().slice(0, 8)}.${format === "html" ? "html" : "md"}`;
+    const outputPath = opts.outputFile === "-" ? void 0 : resolve3(opts.outputFile ?? defaultName);
+    try {
+      if (outputPath) {
+        const existing = await lstat2(outputPath).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+          return void 0;
+        });
+        if (existing) throw new Error("Output already exists");
+      }
+      const config = await loadConfig();
+      const client = getOrCreateManagementClient({
+        ...managementClientOptions(config),
+        numRetries: 0
+      });
+      ui.status("Collecting daily runtime activity and current configuration (read-only)...");
+      const report = await collectRuntimeDailyReport(client, { title: opts.title, maxPages });
+      const rendered = format === "html" ? renderRuntimeReportHtml(report) : renderRuntimeReportMarkdown(report);
+      if (outputPath) {
+        await writeReportFile(outputPath, rendered);
+        ui.status(`Report \u2192 ${outputPath.replace(/[\p{Cc}\p{Cf}]/gu, "_")} (mode 0600)`);
+      } else {
+        await new Promise(
+          (done, reject) => process.stdout.write(rendered, (error) => error ? reject(error) : done())
+        );
+      }
+      const incomplete = report.sources.filter((source) => source.status !== "complete").length;
+      if (incomplete)
+        ui.status(`${incomplete} source(s) incomplete; review the evidence section.`);
+      if (report.health === "unknown" || opts.strict && incomplete > 0) process.exitCode = 1;
+    } catch {
+      ui.error(
+        "Report generation failed. Verify Management API configuration and a writable, new output path. Existing files are never overwritten."
+      );
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/cli/commands/topics-apply.ts
 async function applyTopicToProfile(mgmt, input) {
   const allTopics = await mgmt.listTopics();
@@ -9242,14 +9502,14 @@ async function evalTopic(scanner, profileName, topicName, cases, concurrency = 5
     throw new Error(`scanBatch returned ${scanResults.length} results for ${cases.length} prompts`);
   }
   const testResults = cases.map((testCase, i) => {
-    const scan = scanResults[i];
+    const scan2 = scanResults[i];
     return {
       testCase,
-      actualTriggered: scan.triggered,
-      scanAction: scan.action,
-      scanId: scan.scanId,
-      reportId: scan.reportId,
-      correct: testCase.expectedTriggered === scan.triggered
+      actualTriggered: scan2.triggered,
+      scanAction: scan2.action,
+      scanId: scan2.scanId,
+      reportId: scan2.reportId,
+      correct: testCase.expectedTriggered === scan2.triggered
     };
   });
   const metrics = computeMetrics(testResults);
@@ -9446,7 +9706,7 @@ function completedBulkResults(state) {
 }
 async function writeBulkResults(outputPath, results) {
   await fs5.promises.mkdir(dirname3(outputPath), { recursive: true });
-  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID4()}`;
+  const temporary = `${outputPath}.tmp-${process.pid}-${randomUUID5()}`;
   try {
     await fs5.promises.writeFile(temporary, SdkRuntimeService.formatResultsCsv(results), {
       encoding: "utf-8",
@@ -9472,15 +9732,12 @@ function parsePositiveInteger3(value, optionName2) {
 }
 async function createMgmtService() {
   const config = await loadConfig();
-  return new SdkManagementService({
-    clientId: config.mgmtClientId,
-    clientSecret: config.mgmtClientSecret,
-    tsgId: config.mgmtTsgId,
-    tokenEndpoint: config.mgmtTokenEndpoint
-  });
+  return new SdkManagementService(managementClientOptions(config));
 }
 function registerRuntimeCommand(program) {
   const runtime = program.command("runtime").description("Runtime prompt scanning against AIRS profiles");
+  registerRuntimeReportCommand(runtime);
+  registerRuntimeDashboardCommands(runtime);
   const apiKeys = runtime.command("api-keys").description("Manage AIRS API keys");
   const apiKeysList = registerListFlags(apiKeys.command("list"), { dialect: "offset" }).description("List API keys").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml").action(async (opts) => {
     try {
@@ -10139,26 +10396,14 @@ function registerRuntimeCommand(program) {
       fail(err);
     }
   });
-  const scanLogs = runtime.command("scan-logs").description("Query AIRS scan logs");
-  const scanLogsQuery = scanLogs.command("query").description("Query scan logs").requiredOption("--interval <n>", "Time interval").requiredOption("--unit <unit>", "Time unit (hours)").option("--filter <filter>", "Filter: all, benign, threat", "all").option("--limit <n>", "Max results per page (API page size)", "50").option("--offset <n>", "Starting offset \u2014 rounds down to a page boundary", "0").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
+  const scanLogs = runtime.command("scan-logs").description("BROKEN legacy retrieval \u2014 under refactor; use runtime sessions");
+  const scanLogsQuery = scanLogs.command("query").description("Unavailable legacy query; use runtime sessions list").requiredOption("--interval <n>", "Time interval").requiredOption("--unit <unit>", "Time unit (hours)").option("--filter <filter>", "Filter: all, benign, threat", "all").option("--limit <n>", "Max results per page (API page size)", "50").option("--offset <n>", "Starting offset \u2014 rounds down to a page boundary", "0").option("--output <format>", "Output format: pretty, table, markdown, csv, json, yaml");
   registerPageAliases(scanLogsQuery, { sizeFlag: "--page-size", sizeKey: "pageSize" });
-  scanLogsQuery.action(async (opts) => {
-    try {
-      const { page, size } = resolvePageParams(scanLogsQuery, opts, { indexBase: 1 });
-      const fmt = await resolveOutput(scanLogsQuery, opts);
-      if (fmt === "pretty") renderRuntimeConfigHeader();
-      const service = await createMgmtService();
-      const result = await service.queryScanLogs({
-        timeInterval: Number.parseInt(opts.interval, 10),
-        timeUnit: opts.unit,
-        pageNumber: page ?? 1,
-        pageSize: size ?? 50,
-        filter: opts.filter
-      });
-      renderScanLogList(result.results, result.pageToken, fmt);
-    } catch (err) {
-      fail(err);
-    }
+  scanLogsQuery.action(() => {
+    ui.error(
+      "Legacy scan-logs retrieval is broken and under refactor. Empty results do not mean no activity. Use airs runtime sessions list --interval 1 --unit day --output json, or airs runtime report."
+    );
+    process.exitCode = 1;
   });
   const topics = runtime.command("topics").description("Manage AIRS custom topics and guardrail generation");
   registerApplyCommand(topics);
@@ -10306,7 +10551,12 @@ function buildProgram() {
   program.hook("preAction", async (_thisCommand, actionCommand) => {
     const root = actionCommand.optsWithGlobals?.() ?? _thisCommand.opts();
     setQuiet(Boolean(root.quiet));
-    if (READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
+    const isRuntimeReport = actionCommand.name() === "report" && actionCommand.parent?.name() === "runtime";
+    if (isRuntimeReport && (root.debug || /^(1|true|yes|on)$/i.test(process.env.PANW_AI_SEC_DEBUG?.trim() ?? "")))
+      usageError(
+        "Disable --debug and PANW_AI_SEC_DEBUG for environment reports to avoid persisting sensitive traffic content"
+      );
+    if (!isRuntimeReport && READ_COMMAND_NAMES.has(actionCommand.name()) && actionCommand.options.some((option) => option.long === "--output")) {
       try {
         const format = await resolveOutput(actionCommand, actionCommand.opts());
         actionCommand.setOptionValueWithSource("output", format, "implied");
@@ -10315,8 +10565,18 @@ function buildProgram() {
       }
     }
     if (root.debug) {
-      const logPath = join4(homedir(), ".prisma-airs", `debug-api-${Date.now()}.jsonl`);
-      installDebugLogger(logPath);
+      const logPath = join4(
+        process.cwd(),
+        `debug-api-${Date.now()}-${randomUUID6().slice(0, 8)}.jsonl`
+      );
+      try {
+        installDebugLogger(logPath);
+      } catch {
+        ui.error(
+          "Cannot create the debug log in the current working directory. Run from a writable directory or omit --debug."
+        );
+        process.exit(1);
+      }
       ui.status(`Debug: API log \u2192 ${logPath}`);
     }
   });