@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.1

package/dist/1505.index.js

@@ -1,151 +0,0 @@
-export const id = 1505;
-export const ids = [1505];
-export const modules = {
-
-/***/ 61505:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   computeRuntimeAssurance: () => (/* binding */ computeRuntimeAssurance)
-/* harmony export */ });
-/* unused harmony export RUNTIME_STATUS_VALUES */
-// runtime-assurance.js — PRD "Runtime-Corroborated Security Twin" P0-8
-// (Runtime Assurance). A pure aggregation over already-loaded observation
-// imports and an already-computed `correlateObservations` result — never
-// re-reads a file, never re-runs the match ladder. Honest by construction:
-// the one rule this module exists to enforce is that a MISSING or STALE
-// telemetry source can never collapse into "no runtime risk" — the
-// `runtimeStatus` field is always exactly one of `'complete'`, `'partial'`,
-// or `'unavailable'`, and `'unavailable'` is the answer whenever no
-// observation store was consulted at all, never a silent empty report.
-//
-// `parseFailures` is always reported as 0, with an explicit note why:
-// `dataflow observations import` REFUSES the whole import the moment any
-// record fails to parse or validate (AC-29 clause 5) — a failed import is
-// never persisted, so there is no on-disk history of parse failures for
-// this module to read. This is a real, disclosed limitation, not a false
-// "zero failures ever happened" claim.
-
-const RUNTIME_STATUS_VALUES = Object.freeze(['complete', 'partial', 'unavailable']);
-
-function _isPlainObject(v) {
-  return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
-
-function _maxIso(list) {
-  let best = null;
-  let bestT = -Infinity;
-  for (const s of list) {
-    const t = Date.parse(s);
-    if (Number.isFinite(t) && t > bestT) { bestT = t; best = s; }
-  }
-  return best;
-}
-
-function _minIso(list) {
-  let best = null;
-  let bestT = Infinity;
-  for (const s of list) {
-    const t = Date.parse(s);
-    if (Number.isFinite(t) && t < bestT) { bestT = t; best = s; }
-  }
-  return best;
-}
-
-/**
- * `computeRuntimeAssurance(opts) -> RuntimeAssurance`
- *
- * `opts`:
- *   - `importRecords`: the `ObservationImport[]` read back from the store
- *     (`loadObservationImports`), or `null`/`undefined` when the store was
- *     never consulted at all (mirrors `correlateObservations`'s own
- *     `observations === null` convention).
- *   - `correlation`: the `CorrelationResult` from `correlateObservations`
- *     for the SAME graph/observations/window this call is reporting on.
- *   - `now`: an ISO-8601 string (defaults to `new Date().toISOString()`,
- *     injectable for deterministic tests).
- *   - `staleAfterHours`: how old the most recent observed event can be
- *     before freshness is reported stale (default 24 * 30 = 720, i.e. 30
- *     days — telemetry windows in this package's own fixtures/CLI default
- *     to month-long exports, so a 30-day staleness bar is the honest
- *     "this is still describing roughly the current system" line, not an
- *     arbitrary short window).
- *
- * Never throws.
- */
-function computeRuntimeAssurance(opts) {
-  const o = opts && typeof opts === 'object' ? opts : {};
-  const now = typeof o.now === 'string' && Number.isFinite(Date.parse(o.now)) ? o.now : new Date().toISOString();
-  const staleAfterHours = Number.isFinite(o.staleAfterHours) ? o.staleAfterHours : 720;
-
-  const importRecords = Array.isArray(o.importRecords) ? o.importRecords : null;
-  const correlation = _isPlainObject(o.correlation) ? o.correlation : null;
-
-  const base = {
-    runtimeStatus: 'unavailable',
-    telemetryWindow: { start: null, end: null },
-    freshness: { lastObservedAt: null, lastImportedAt: null, staleHours: null, stale: true },
-    parseFailures: 0,
-    parseFailuresNote: 'A failed import is refused in full and never persisted (AC-29 clause 5) — '
-      + 'this count reflects the import store, not the history of every attempt. Check `runtime ingest`\'s '
-      + 'own exit code/stderr at import time for parse failures.',
-    mappingPercentage: null,
-    unmatchedObservationCount: 0,
-    totalObservationCount: 0,
-    missingTelemetry: true,
-    limitations: [],
-  };
-
-  // No store was ever consulted — the honest 'unavailable' case, never a
-  // fabricated empty-but-fine report.
-  if (importRecords === null || importRecords.length === 0 || !correlation || correlation.evaluated !== true) {
-    base.limitations.push(
-      'No runtime observation import exists for this scan — runtimeStatus is \'unavailable\', never \'complete\' '
-      + 'or a silent absence of risk. Import telemetry with `runtime ingest` before relying on this report.',
-    );
-    return base;
-  }
-
-  const windowStart = _minIso(importRecords.map((r) => r?.windowStart));
-  const windowEnd = _maxIso(importRecords.map((r) => r?.windowEnd));
-  base.telemetryWindow = { start: windowStart, end: windowEnd };
-  base.missingTelemetry = false;
-
-  const allObservations = importRecords.flatMap((r) => (Array.isArray(r?.observations) ? r.observations : []));
-  const total = allObservations.length;
-  const unmatched = allObservations.filter((obs) => obs && obs.matchMethod === 'unmatched').length;
-  base.totalObservationCount = total;
-  base.unmatchedObservationCount = unmatched;
-  base.mappingPercentage = total > 0 ? Math.round(((total - unmatched) / total) * 10000) / 100 : null;
-
-  const lastObservedAt = _maxIso(allObservations.map((obs) => obs?.lastObservedAt));
-  const lastImportedAt = _maxIso(importRecords.map((r) => r?.importedAt));
-  base.freshness.lastObservedAt = lastObservedAt;
-  base.freshness.lastImportedAt = lastImportedAt;
-  if (lastObservedAt !== null) {
-    const ageMs = Date.parse(now) - Date.parse(lastObservedAt);
-    const ageHours = Math.round((ageMs / 3600000) * 100) / 100;
-    base.freshness.staleHours = ageHours;
-    base.freshness.stale = ageHours > staleAfterHours;
-  }
-
-  if (total === 0) {
-    base.limitations.push('The import store exists but carries zero observation records.');
-  }
-  if (unmatched > 0) {
-    base.limitations.push(`${unmatched} of ${total} imported observation(s) never matched any graph node (matchMethod 'unmatched') — these contribute no corroboration to any flow.`);
-  }
-  if (base.freshness.stale) {
-    base.limitations.push(`The most recent observed event is ${base.freshness.staleHours} hour(s) old (beyond the ${staleAfterHours}-hour staleness bar) — this twin may no longer describe current production behavior.`);
-  }
-
-  const complete = total > 0 && unmatched === 0 && !base.freshness.stale;
-  base.runtimeStatus = complete ? 'complete' : 'partial';
-
-  return base;
-}
-
-
-/***/ })
-
-};

package/dist/1557.index.js

@@ -1,293 +0,0 @@
-export const id = 1557;
-export const ids = [1557];
-export const modules = {
-
-/***/ 51557:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   analyzeTranscript: () => (/* binding */ analyzeTranscript),
-/* harmony export */   formatCacheReport: () => (/* binding */ formatCacheReport),
-/* harmony export */   renderCacheStatusLine: () => (/* binding */ renderCacheStatusLine)
-/* harmony export */ });
-/* unused harmony export _internal */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(48161);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
-// Prompt-cache economics — turn Claude Code's own transcript usage into a
-// dollarized report: how much prompt caching saved, how much was wasted on
-// avoidable cache misses, and what invalidated the cache.
-//
-// Source of truth: the Claude Code transcript at
-//   ~/.claude/projects/<enc>/<session>.jsonl
-// where <enc> is CLAUDE_PROJECT_DIR with `/` and `.` replaced by `-`. Each
-// assistant turn carries `message.usage` with input/output/cache_read/
-// cache_creation token counts (and a 5m/1h write split). We price those against
-// per-model rates to compute real economics — no estimates, no network.
-//
-// Pure compute on parsed records; only `locateTranscript`/`parseTranscriptUsage`
-// touch the filesystem. ESM (scanner tree). A trimmed CJS twin lives at
-// hooks/lib/transcript.js for the CJS hooks; test/cache-economics.test.js asserts
-// the two agree.
-
-
-
-
-// Cents-scale money formatter (fmtUsd in risk-dollars.js targets five-figure
-// breach costs and won't round sub-dollar values).
-function money(n) {
-  const v = Number(n) || 0;
-  return Math.abs(v) >= 1 ? `$${v.toFixed(2)}` : `$${v.toFixed(4)}`;
-}
-
-// Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
-const MODEL_RATES = {
-  fable:   { label: 'Fable 5',    in: 10, out: 50 },
-  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
-  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
-  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
-  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
-};
-const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
-const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
-const CACHE_WRITE_1H_MULT = 2.0; // 1-hour cache write ≈ 2× input
-const TTL_MS = 5 * 60 * 1000;
-
-// Map any model string to a rate family. Returns null for unpriceable models
-// (e.g. "<synthetic>" sidechain/compaction turns) so they're skipped.
-function rateFor(model) {
-  if (typeof model !== 'string') return null;
-  const s = model.toLowerCase();
-  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
-  if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
-  if (s.includes('opus')) return MODEL_RATES.opus;
-  return null;
-}
-
-// ── Transcript discovery + parse ─────────────────────────────────────────────
-
-function encodeProjectDir(dir) {
-  return String(dir).replace(/[/.]/g, '-');
-}
-
-// Locate the session transcript. Prefer an explicit (hook-provided) path; else
-// derive the project's transcript dir and take the most-recently-modified jsonl.
-function locateTranscript({ transcriptPath, projectDir } = {}) {
-  try {
-    if (transcriptPath && node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(transcriptPath)) return transcriptPath;
-  } catch { /* fall through */ }
-  try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.homedir(), '.claude', 'projects', encodeProjectDir(projectDir || process.cwd()));
-    if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(dir)) return null;
-    const files = node_fs__WEBPACK_IMPORTED_MODULE_0__.readdirSync(dir)
-      .filter(f => f.endsWith('.jsonl'))
-      .map(f => ({ f: node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, f), m: node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, f)).mtimeMs }))
-      .sort((a, b) => b.m - a.m);
-    return files.length ? files[0].f : null;
-  } catch { return null; }
-}
-
-// Parse a transcript jsonl into per-assistant-turn usage records. Skips lines
-// that aren't priceable assistant turns.
-function parseTranscriptUsage(jsonlPath) {
-  let raw;
-  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(jsonlPath, 'utf8'); } catch { return []; }
-  const records = [];
-  for (const line of raw.split('\n')) {
-    const t = line.trim();
-    if (!t) continue;
-    let o;
-    try { o = JSON.parse(t); } catch { continue; }
-    if (o.type !== 'assistant') continue;
-    const msg = o.message;
-    const u = msg && msg.usage;
-    if (!u || !msg.model || !rateFor(msg.model)) continue;
-    const cc = u.cache_creation || {};
-    records.push({
-      model: msg.model,
-      input: u.input_tokens || 0,
-      output: u.output_tokens || 0,
-      cacheRead: u.cache_read_input_tokens || 0,
-      cacheCreate: u.cache_creation_input_tokens || 0,
-      cacheCreate5m: cc.ephemeral_5m_input_tokens || 0,
-      cacheCreate1h: cc.ephemeral_1h_input_tokens || 0,
-      ts: o.timestamp ? Date.parse(o.timestamp) : null,
-    });
-  }
-  return records;
-}
-
-// ── Pure economics ───────────────────────────────────────────────────────────
-
-function writeCostUsd(r, inRate) {
-  const m5 = r.cacheCreate5m || 0, m1 = r.cacheCreate1h || 0;
-  if (m5 + m1 > 0) return (m5 * CACHE_WRITE_MULT + m1 * CACHE_WRITE_1H_MULT) * inRate;
-  return (r.cacheCreate || 0) * CACHE_WRITE_MULT * inRate; // breakdown absent
-}
-
-// Aggregate economics over parsed records.
-function computeCacheEconomics(records) {
-  let turns = 0, inTok = 0, outTok = 0, cacheRead = 0, cacheCreate = 0;
-  let actualUsd = 0, uncachedUsd = 0, writePremiumUsd = 0;
-  const perModel = {};
-
-  for (const r of records) {
-    const rate = rateFor(r.model);
-    if (!rate) continue;
-    turns++;
-    const inRate = rate.in / 1e6, outRate = rate.out / 1e6;
-
-    const readCost = r.cacheRead * inRate * CACHE_READ_MULT;
-    const writeCost = writeCostUsd(r, inRate);
-    const inCost = r.input * inRate;
-    const outCost = r.output * outRate;
-    const turnActual = readCost + writeCost + inCost + outCost;
-    // What this turn would have cost with NO caching: every input-side token full price.
-    const turnUncached = (r.cacheRead + r.cacheCreate + r.input) * inRate + outCost;
-
-    actualUsd += turnActual;
-    uncachedUsd += turnUncached;
-    writePremiumUsd += writeCost - (r.cacheCreate * inRate); // the >1× premium paid to cache
-
-    inTok += r.input; outTok += r.output; cacheRead += r.cacheRead; cacheCreate += r.cacheCreate;
-
-    const key = rate.label;
-    const pm = perModel[key] || (perModel[key] = { turns: 0, actualUsd: 0, cacheRead: 0, inputSide: 0 });
-    pm.turns++; pm.actualUsd += turnActual; pm.cacheRead += r.cacheRead;
-    pm.inputSide += r.cacheRead + r.cacheCreate + r.input;
-  }
-
-  const inputSide = cacheRead + cacheCreate + inTok;
-  return {
-    turns,
-    tokens: { input: inTok, output: outTok, cacheRead, cacheCreate },
-    actualUsd,
-    uncachedUsd,
-    savedUsd: uncachedUsd - actualUsd,         // net $ caching saved (can dip negative early)
-    writePremiumUsd,                            // $ invested establishing caches
-    cacheHitRatio: inputSide ? cacheRead / inputSide : 0,
-    costPerTurnUsd: turns ? actualUsd / turns : 0,
-    perModel,
-  };
-}
-
-// Attribute cache drops: a turn that re-ingests a large prefix cold after a warm
-// prior turn. Cause = model-switch | cache-expired | prefix-change.
-function detectInvalidators(records) {
-  const leaks = [];
-  const MIN_WARM = 2000;
-  for (let i = 1; i < records.length; i++) {
-    const prev = records[i - 1], cur = records[i];
-    const prevWarm = prev.cacheRead + prev.input + prev.cacheCreate;
-    if (prevWarm < MIN_WARM) continue;
-    const curFresh = cur.input + cur.cacheCreate;
-    const coldish = cur.cacheRead < prevWarm * 0.25 && curFresh > prevWarm * 0.5;
-    if (!coldish) continue;
-
-    let cause;
-    if (cur.model !== prev.model) cause = 'model-switch';
-    else if (cur.ts && prev.ts && (cur.ts - prev.ts) > TTL_MS) cause = 'cache-expired';
-    else cause = 'prefix-change';
-
-    const rate = rateFor(cur.model);
-    const inRate = rate ? rate.in / 1e6 : 0;
-    // Extra paid vs. having kept the prefix as a cheap cache read.
-    const wastedUsd = prevWarm * inRate * (1 - CACHE_READ_MULT);
-    leaks.push({ turn: i, cause, wastedUsd, model: cur.model });
-  }
-  return leaks;
-}
-
-// Convenience: locate → parse → compute → detect. Returns { ok:false } when no
-// transcript is available.
-function analyzeTranscript(opts = {}) {
-  const transcript = locateTranscript(opts);
-  if (!transcript) return { ok: false, reason: 'no-transcript' };
-  const records = parseTranscriptUsage(transcript);
-  if (!records.length) return { ok: false, reason: 'no-priceable-turns', transcript };
-  return {
-    ok: true,
-    transcript,
-    metrics: computeCacheEconomics(records),
-    leaks: detectInvalidators(records),
-  };
-}
-
-// ── Report formatting ────────────────────────────────────────────────────────
-
-const CAUSE_LABEL = {
-  'model-switch': 'model switch (cache is model-scoped)',
-  'cache-expired': 'cache expired (gap > 5-min TTL)',
-  'prefix-change': 'prefix changed (system prompt / tools / context edit)',
-};
-
-// F6 — one-line HUD for a Claude Code statusLine command (mirrors
-// watch-mode.js renderStatusLine). Takes the metrics from computeCacheEconomics.
-function renderCacheStatusLine(metrics) {
-  if (!metrics || !metrics.turns) return 'agentic-security: no session cost yet';
-  const hit = Math.round(metrics.cacheHitRatio * 100);
-  return `agentic-security: ${money(metrics.actualUsd)} · ${hit}% cached · ${money(metrics.costPerTurnUsd)}/turn`;
-}
-
-function formatCacheReport(result) {
-  if (!result.ok) {
-    return result.reason === 'no-transcript'
-      ? 'agentic-security: no Claude Code transcript found for this project yet.'
-      : 'agentic-security: transcript has no priceable model turns yet.';
-  }
-  const m = result.metrics;
-  const lines = [];
-  lines.push('');
-  lines.push('  Prompt-cache economics — this session');
-  lines.push(`  ${result.turns ?? m.turns} model turns\n`);
-  lines.push(`  cache hit ratio     ${(m.cacheHitRatio * 100).toFixed(1)}%  (input-side tokens served from cache)`);
-  lines.push(`  spent               ${money(m.actualUsd)}   (~${money(m.costPerTurnUsd)}/turn)`);
-  lines.push(`  ▶ saved by caching  ${money(m.savedUsd)}   vs. ${money(m.uncachedUsd)} with no cache`);
-  lines.push(`  invested in caches  ${money(m.writePremiumUsd)}   (write premium over base input)`);
-  lines.push('');
-  lines.push('  tokens: '
-    + `${m.tokens.cacheRead.toLocaleString()} cached-read · `
-    + `${m.tokens.cacheCreate.toLocaleString()} cache-write · `
-    + `${m.tokens.input.toLocaleString()} fresh-in · `
-    + `${m.tokens.output.toLocaleString()} out`);
-
-  const models = Object.keys(m.perModel);
-  if (models.length > 1) {
-    lines.push('\n  by model:');
-    for (const k of models.sort()) {
-      const pm = m.perModel[k];
-      const hr = pm.inputSide ? (pm.cacheRead / pm.inputSide * 100).toFixed(0) : '0';
-      lines.push(`    ${k.padEnd(12)} ${pm.turns} turns · ${money(pm.actualUsd)} · ${hr}% cached`);
-    }
-  }
-
-  if (result.leaks && result.leaks.length) {
-    const wasted = result.leaks.reduce((s, l) => s + l.wastedUsd, 0);
-    lines.push(`\n  ⚠ cache leaks (${result.leaks.length}, ~${money(wasted)} wasted re-ingesting context):`);
-    const byCause = {};
-    for (const l of result.leaks) {
-      (byCause[l.cause] || (byCause[l.cause] = { n: 0, usd: 0 })).n++;
-      byCause[l.cause].usd += l.wastedUsd;
-    }
-    for (const c of Object.keys(byCause).sort()) {
-      lines.push(`    · ${byCause[c].n}× ${CAUSE_LABEL[c] || c} — ~${money(byCause[c].usd)}`);
-    }
-    lines.push('    Keep one model + a stable system prompt within a working window to avoid these.');
-  } else {
-    lines.push('\n  ✓ no cache leaks detected — your context stayed warm.');
-  }
-  lines.push('');
-  return lines.join('\n');
-}
-
-// Test surface (underscore export is exempt from the dead-module gate).
-const _internal = {
-  MODEL_RATES, CACHE_READ_MULT, CACHE_WRITE_MULT, CACHE_WRITE_1H_MULT,
-  rateFor, locateTranscript, parseTranscriptUsage, computeCacheEconomics, detectInvalidators,
-};
-
-
-/***/ })
-
-};