@knowttl/artium-axi 0.0.16 → 0.0.17

package/README.md

@@ -163,7 +163,13 @@ Artium's authenticated setup fetches managed skills; a standalone skill installe
 All tools start disabled; write access defaults to off.
 Administrator capability alone grants no tool access; upstream permissions remain an additional boundary.
 
-Microsoft Graph supports the `entra` pack only; the bundled upstream `security hunting query` command for Defender XDR advanced hunting is unavailable through Artium.
+Microsoft Graph defaults to the `entra` pack.
+Administrators can opt in to the single read-only `security hunting query` command for Defender XDR advanced hunting with `enabledPacks: ["entra", "security"]` in the managed tool settings.
+Hunting accepts exactly one UTF-8 plain-text upload named `query.kql`, at most 64 KiB, through `artium-axi mg-axi security hunting query --file query.kql`.
+See [client input handling](docs/client-reference.md#command-surface-and-subcommands) for local file paths and upload restrictions.
+Queries must use the upstream restricted read-only KQL subset.
+The existing mg-axi role grant is required; other security commands remain unavailable.
+See [Graph credential setup](docs/tool-credentials.md#microsoft-graph) for hunting permissions and consent; tenant acceptance remains unverified.
 
 Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
 

package/bin/artium-axi.mjs

@@ -20191,10 +20191,14 @@ var nativeSettingsSchemas = {
   "awx-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
   "ldap-axi": external_exports.strictObject({}),
   "ado-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
-  "mg-axi": external_exports.strictObject({ preview: external_exports.boolean().optional(), writes: external_exports.strictObject({
-    allowWrites: external_exports.boolean(),
-    operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
-  }).optional() }),
+  "mg-axi": external_exports.strictObject({
+    enabledPacks: external_exports.array(external_exports.enum(["entra", "security"])).min(1).max(2).refine((packs) => packs.includes("entra") && new Set(packs).size === packs.length).optional(),
+    preview: external_exports.boolean().optional(),
+    writes: external_exports.strictObject({
+      allowWrites: external_exports.boolean(),
+      operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
+    }).optional()
+  }),
   "falcon-axi": external_exports.strictObject({
     allowWrites: external_exports.boolean().optional(),
     rtr: falconRtrSettingsSchema.optional(),
@@ -20744,7 +20748,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.16",
+  version: "0.0.17",
   private: true,
   license: "MIT",
   type: "module",
@@ -29837,7 +29841,8 @@ var mg_axi_default = {
       "home",
       "doctor",
       "entra",
-      "api get"
+      "api get",
+      "security hunting query"
     ],
     example: [
       "entra",
@@ -29937,11 +29942,12 @@ var mg_axi_default = {
       "home",
       "doctor",
       "entra",
-      "api get"
+      "api get",
+      "security hunting query"
     ],
     inputs: {
       stdin: "cursor - only",
-      files: "unsupported",
+      files: "security hunting query only: one UTF-8 query.kql upload, at most 64 KiB; fixed runner leaf name",
       cursor: "opaque token or stdin; never a path",
       api: "reviewed GET routes only; pinned Graph destination and operation gates retained"
     },
@@ -29956,7 +29962,8 @@ var mg_axi_default = {
     ],
     knownOutputScanValues: [
       "clientSecret and trimmed clientSecret",
-      "privateKey and normalized PEM"
+      "privateKey and normalized PEM",
+      "hunting query text"
     ],
     outputScanLimit: "Upstream-minted Graph tokens and assertions are not available during prepare; live redaction remains unverified.",
     resources: {
@@ -44372,8 +44379,9 @@ async function toolInput(tool, original) {
   const args = [...original];
   const input2 = {};
   let totalFileBytes = 0;
-  if ((tool === "az-axi" || tool === "hybrid-axi") && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
-    const fileFlags = tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
+  const hunting = tool === "mg-axi" && args.slice(0, 3).join(" ") === "security hunting query";
+  if ((tool === "az-axi" || tool === "hybrid-axi" || hunting) && !args.some((arg) => ["--help", "-h", "--version", "-v", "-V"].includes(arg))) {
+    const fileFlags = hunting ? ["file"] : tool === "hybrid-axi" ? hybrid_axi_default.adapterBoundary.inputFileFlags : az_axi_default.adapterBoundary.inputFileFlags;
     for (let index = 0; index < args.length; index++) {
       if (args[index] === "--") break;
       const [flag] = args[index].split("=");
@@ -44385,10 +44393,11 @@ async function toolInput(tool, original) {
         continue;
       }
       if (!path || path === "-") throw new ArtiumError("UNSUPPORTED_INPUT", "A file flag requires a local file path.");
-      const name = basename(path);
+      if (hunting && (path.split(/[\\/]/).includes("..") || input2.files?.length)) throw new ArtiumError("INVALID_INPUT");
+      const name = hunting ? "query.kql" : basename(path);
       if (input2.files?.some((file2) => file2.name === name)) throw new ArtiumError("INVALID_INPUT", "Upload file names must be distinct.");
       if ((input2.files?.length ?? 0) >= inputLimits.files) throw new ArtiumError("INVALID_INPUT", "Too many upload files.");
-      const content = await readBounded(createReadStream(path), inputLimits.fileBytes);
+      const content = await readBounded(createReadStream(path), hunting ? 65536 : inputLimits.fileBytes);
       totalFileBytes += content.length;
       if (totalFileBytes > inputLimits.totalFileBytes) throw new ArtiumError("INVALID_INPUT", "Uploads exceed the total byte limit.");
       input2.files ??= [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",