@knowttl/artium-axi 0.0.19 → 0.0.20

package/README.md

@@ -169,10 +169,20 @@ Administrators can opt in to the single read-only `security hunting query` comma
 Hunting accepts exactly one UTF-8 plain-text upload named `query.kql`, at most 64 KiB, through `artium-axi mg-axi security hunting query --file query.kql`.
 See [client input handling](docs/client-reference.md#command-surface-and-subcommands) for local file paths and upload restrictions.
 Queries must use the upstream restricted read-only KQL subset.
+Hunting parses KQL before the read-only allowlist and upstream authentication; syntax errors return positioned diagnostics without query excerpts or quoted literals.
+Parsing does not check tables, columns, types or permissions; recognized Graph 400 errors expose only the error class and line/column, while unknown error shapes remain opaque.
 The existing mg-axi role grant is required; other security commands remain unavailable.
 See [Graph credential setup](docs/tool-credentials.md#microsoft-graph) for hunting permissions and consent; tenant acceptance remains unverified.
 
+Azure Resource Graph and Log Analytics queries parse KQL before upstream authentication or requests, returning positioned syntax diagnostics and query excerpts on failure.
+Successful parsing does not validate tables, columns, functions, permissions or service-specific restrictions.
+
 Falcon investigation reads include detection lineage, process details and trees, existing sandbox reports, FileVantage changes and device-control policy details.
+NG-SIEM `search start` checks CQL structure before upstream authentication, reporting code, line, column and token class without echoing query text; function names, fields and semantics remain unchecked, and ambiguous syntax passes.
+Rejected searches preserve redacted server diagnostics, completed searches include server warnings when present, and `search start --wait` advises when the normalized filter differs.
+
+Vectra `host show` and `entity show --type host`, plus the matching raw host reads, retain every returned API field under `host`, separate from CLI metadata.
+Use `--full` on host/entity detail commands for complete returned text; secret redaction still applies, and upstream omissions cannot be restored.
 
 Vectra supports selected QUX/RUX writes for detection close/open and mark-fixed, host/account close, key assets, tags, notes (including bulk notes), assignments and outcomes, triage labels and rules, groups and membership, proxies, threat feeds, internal-network settings, syslog/Kafka, notification destinations and Match, subject to deployment support in the [reviewed inventory](tools/inventories/vectra-axi.json).
 User, role, API-client and credential administration remains blocked.

package/bin/artium-axi.mjs

@@ -20748,7 +20748,7 @@ import { resolve } from "node:path";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.19",
+  version: "0.0.20",
   private: true,
   license: "MIT",
   type: "module",
@@ -21236,17 +21236,18 @@ var falcon_axi_default = {
   generatedBy: "scripts/falcon-inventory.mjs",
   tool: "falcon-axi",
   repository: "https://github.com/knowttl/falcon-axi.git",
-  tag: "v0.7.4",
-  commit: "bca4a08c71beb415e3fabb37443aea8ad61bc08c",
-  version: "0.7.4",
+  tag: "v0.8.0",
+  commit: "4ba25f373a5c4df46506bdd0d306fa3ef205d965",
+  version: "0.8.0",
   distribution: {
-    filename: "falcon_axi-0.7.4-py3-none-any.whl",
-    sha256: "bce4cfb033fd6537eb8a518fe3286799884f6b7a5ef95faffc347ac6c336d28e",
-    provenance: "https://pypi.org/integrity/falcon-axi/0.7.4/falcon_axi-0.7.4-py3-none-any.whl/provenance"
+    filename: "falcon_axi-0.8.0-py3-none-any.whl",
+    sha256: "8aad289fd58847cb6555f46b8e930c5904d6afda34a7b2e6965cdd60c8df06a4",
+    provenance: "https://pypi.org/integrity/falcon-axi/0.8.0/falcon_axi-0.8.0-py3-none-any.whl/provenance"
   },
+  skillSha256: "5d5fd1cd57ff1da68e37448c93fce57236f76448ec9a10984c01ea7300c6a8e0",
   parser: {
     path: "falcon_axi/cli.py",
-    sha256: "ef29404b26da085b96ace7ba1f708e928eb40c7aa99e071807d5003a3421b0cd",
+    sha256: "9b3d42e3c00b3d302948e8937c6295bbdde9cb80384ebef253f9b8a077454909",
     aliases: {},
     shortFlags: {},
     repeats: "last value wins",
@@ -22972,10 +22973,11 @@ var falcon_axi_default = {
 var vectra_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "vectra-axi",
-  version: "0.1.9",
-  integrity: "sha512-GUl24JV8lErGjZliTHcb6BcjjdpJhrzbbB8cBekKE6dM3b5ph9i9EteJHFRWUuGpnEPlVEPeu7X3l33V9DGKwQ==",
+  version: "0.1.10",
+  integrity: "sha512-X7yttDlwpQJW/j0eNox5vLf7nWlFejXjtaq90N7ezJ+ACNqEFspODrwQ/mYqbXFnqjpIugQnhSGcnaI8YNMeLw==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "e7fe728c58d41a9ddd554b15c29de281dd06c2d7e6a6b044e43d75fb001aa53d",
+  packageManifestSha256: "3f4d4e3ec1b37690087e3c8850ffd5390574e6686cafbd723fb01f83b775ea97",
+  skillSha256: "58978bfd2468e9fac8d17644df1de46768572b1cd9a719a9eec64cdcb547ff9c",
   environment: [
     {
       name: "VECTRA_AXI_CONFIG",
@@ -23275,7 +23277,7 @@ var vectra_axi_default = {
     },
     source: {
       path: "dist/src/catalogue.js",
-      sha256: "e49354f34c86cd986d9cc166fc33f3c0423ab8eaa8044621131351c8f297e834"
+      sha256: "02e2443a4b6d6aef9faae51e0c4418c0c565ac5b0f73969a34a4c33a110bfabf"
     }
   },
   flags: [
@@ -23755,7 +23757,8 @@ var vectra_axi_default = {
         help: "boolean",
         profile: "value",
         config: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -23807,7 +23810,8 @@ var vectra_axi_default = {
         profile: "value",
         config: "value",
         type: "value",
-        id: "value"
+        id: "value",
+        full: "boolean"
       }
     },
     {
@@ -25027,10 +25031,11 @@ var vectra_axi_default = {
 var az_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "az-axi",
-  version: "0.1.12",
-  integrity: "sha512-xPhoFLQ8XWjWqLR2e80apWA1pkCqQcFZ5r5V7XW+uj0zXKaO9RHfjG7gsxkrMa44jWqWLiU8ssZxWZPl6uj8KQ==",
+  version: "0.1.13",
+  integrity: "sha512-qltNokGPKFvUxFxNVf25gV2jtgw9MpxT5k6Zlbhz0b/Y5pvbc04SpORpUurDZNXE7runLZZhoBmm38qXcA3M7Q==",
   parserEvidence: "Installed pinned catalogue exports, provisional until adapter acceptance",
-  packageManifestSha256: "2d829dc31fd552a154b439ad40c39ff8fd53b35527d8134a0dd18f4ffab09334",
+  packageManifestSha256: "dc09976ff76cdda672ba89f0a7689c39873a86a19213d46687c2a9af861d3ed2",
+  skillSha256: "8a5bc0e8866ca55add8399376784a19e81671e6d036d10815e55b3c473540080",
   environment: [
     {
       name: "AZ_AXI_CONFIG",
@@ -25289,11 +25294,11 @@ var az_axi_default = {
   tokenResourceSources: [
     {
       path: "dist/lib/registry.js",
-      sha256: "67a29a57b906ee0a17dc0bf917123308ee2d160ef43106f5d15bf73f8cb874d3"
+      sha256: "dc1eb46c43aa5232b58acfb1d174fe2728491a3a6da28fa3cca27fed79494efd"
     },
     {
       path: "dist/lib/client.js",
-      sha256: "322f09655f302f8f4292cbb6317ad192854ed412376ce9041126b25e24ed27ed"
+      sha256: "156af240155e71c051a6a2f0c4235d51acaf3633d7a249736ff3b24ed541d2b6"
     },
     {
       path: "dist/lib/principals.js",
@@ -25317,7 +25322,7 @@ var az_axi_default = {
     },
     {
       path: "dist/commands/logs.js",
-      sha256: "f3c0112c4be7a8996163d323bd9945950ab1a212eae2cc42af044388adc77199"
+      sha256: "1cfd781bd88e13ba1c70537263220c6bdd6932586e53edd6fc22fc75202bd938"
     },
     {
       path: "dist/commands/doctor.js",
@@ -29745,10 +29750,11 @@ var az_axi_default = {
 var mg_axi_default = {
   generatedBy: "scripts/upstream-inventory.mjs",
   tool: "mg-axi",
-  version: "0.1.12",
-  integrity: "sha512-TBt2y2rpfn8oi4YOq95uIo43RTsV/iOc0xFa3e3YCjhqd/ZL/y2is+7W0+B5/g1sdwb95yJbcU1eqeJEzmKJ5g==",
+  version: "0.1.13",
+  integrity: "sha512-V9f/H1xISbn1ar3ARVnYvtT4NDUDRgvhCkrnQd6lqNdj1MeQjF4JESS6PA6hY3epXKrqE+g/2nCfgJV1JDmDTQ==",
   parserEvidence: "Installed pinned catalogue exports",
-  packageManifestSha256: "e686938dd356bffe87d9884d656a139b91e7eb6d62370f6aba3b5fd14283fb45",
+  packageManifestSha256: "2357d6568740146d05a0ad67fb8e0be3c871261726d3cf110fed83e216001dc9",
+  skillSha256: "98ff12e741b04592afae76853a00f572940dee6edf0e868d2ccba04a742b24ad",
   environment: [
     {
       name: "MG_AXI_CONFIG"
@@ -29910,7 +29916,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       },
       {
         path: "dist/profiles.js",
@@ -29988,7 +29994,7 @@ var mg_axi_default = {
       },
       {
         path: "dist/cli.js",
-        sha256: "613fc3ac4870e5538d2c53b0760244c7e3bb3837fa3d97c1b89b7916c557af44"
+        sha256: "723f00e5031068211b541ee43447fb559833bea924c91131e0d074349d5b9a4e"
       }
     ]
   },
@@ -44081,19 +44087,19 @@ var commands = {
   "tenable-axi": {
     usage: "artium-axi tenable-axi [<args>]",
     purpose: "Investigate Tenable One with managed API keys.",
-    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked."],
+    flags: ["Writes and export jobs are off by default and require administrator-enabled operations, preview, --execute and exact --confirm. Downloads are blocked.", "Declared file flags accept - to read stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path."],
     example: "artium-axi tenable-axi card list --limit 1"
   },
   "hybrid-axi": {
     usage: "artium-axi hybrid-axi [<args>]",
     purpose: "Investigate Hybrid Analysis with a managed API key.",
-    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", transferWarning],
+    flags: ["Submissions, YARA mutations, consuming matches and four reviewed archive downloads are off by default and selected independently by an administrator. Native preview, --execute and exact --confirm remain required. Use artium-axi download --help for authenticated CLI verified saving.", "--body-file - reads stdin to EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass a local file path.", transferWarning],
     example: "artium-axi hybrid-axi quota"
   },
   "az-axi": {
     usage: "artium-axi az-axi [<args>]",
     purpose: "Run Azure commands with your managed identity.",
-    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
+    flags: ["Arguments after az-axi are forwarded upstream, including --help.", "Query commands read non-terminal stdin to EOF only without a file, positional query or query flag. api reads stdin only without --body, --body-file or --data; method/path are not body sources. The pinned upstream accepts --body, not --data.", "Tool stdin must reach EOF within 5 s; otherwise INVALID_INPUT. Close stdin or pass --file for queries, --body or --body-file for api."],
     example: "artium-axi az-axi sub list"
   },
   "mg-axi": {
@@ -44380,9 +44386,12 @@ ${executableBlock}
 // src/cli/input.ts
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";
-async function readBounded(stream, limit) {
+async function readBounded(stream, limit, stdinAlternative) {
   const chunks = [];
   let bytes = 0;
+  const deadline = stdinAlternative === void 0 ? void 0 : setTimeout(() => {
+    stream.destroy(new ArtiumError("INVALID_INPUT", `no stdin EOF after 5 s; close stdin or pass ${stdinAlternative}`));
+  }, 5e3);
   try {
     for await (const chunk of stream) {
       const buffer = Buffer.from(chunk);
@@ -44393,6 +44402,8 @@ async function readBounded(stream, limit) {
   } catch (error62) {
     if (error62 instanceof ArtiumError) throw error62;
     throw new ArtiumError("INVALID_INPUT", "Tool input could not be read.", "Check the local input file or stdin.");
+  } finally {
+    clearTimeout(deadline);
   }
   return Buffer.concat(chunks);
 }
@@ -44411,7 +44422,7 @@ async function toolInput(tool, original) {
       const equals = args[index].indexOf("=");
       const path = equals < 0 ? args[++index] : args[index].slice(equals + 1);
       if (path === "-" && (tool === "tenable-axi" || tool === "hybrid-axi" && flag === "--body-file")) {
-        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes)).toString("utf8");
+        input2.stdin = (await readBounded(process.stdin, inputLimits.stdinBytes, flag)).toString("utf8");
         continue;
       }
       if (!path || path === "-") throw new ArtiumError("UNSUPPORTED_INPUT", "A file flag requires a local file path.");
@@ -44436,20 +44447,22 @@ async function toolInput(tool, original) {
     }
     const route = az_axi_default.commands.find((route2) => ["rg query", "logs query", "api"].includes(route2.handlerCommand) && route2.command.split(" ").every((word, index) => args[leading + index] === word));
     let positional = false;
+    let explicitInput = false;
     if (route) {
       for (let index = leading + route.command.split(" ").length; index < args.length; index++) {
         const token = args[index];
         if (token === "--") {
-          positional = index + 1 < args.length;
+          positional ||= index + 1 < args.length;
           break;
         }
         if (!token.startsWith("-") || token === "-") {
           positional = true;
-          break;
+          continue;
         }
         const raw = token.slice(token.startsWith("--") ? 2 : 1).split("=")[0];
         const expanded = token.startsWith("--") ? raw : route.shortFlags[raw] ?? raw;
         const name = route.flagAliases[expanded] ?? expanded;
+        if ((route.handlerCommand === "api" ? ["body", "body-file", "data"] : ["graph-query", "analytics-query"]).includes(name)) explicitInput = true;
         const kind = route.flags[name];
         if (token.includes("=") || !kind) continue;
         if (kind === "boolean") {
@@ -44462,8 +44475,8 @@ async function toolInput(tool, original) {
         }
       }
     }
-    if (tool === "az-axi" && route && !input2.files?.length && !positional && !process.stdin.isTTY) {
-      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes);
+    if (tool === "az-axi" && route && !input2.files?.length && !explicitInput && (route.handlerCommand === "api" || !positional) && !process.stdin.isTTY) {
+      const stdin = await readBounded(process.stdin, inputLimits.stdinBytes, route.handlerCommand === "api" ? "--data (supported body flag: --body)" : "--file");
       if (stdin.length) input2.stdin = stdin.toString("utf8");
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowttl/artium-axi",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "Client CLI and embedded skill for the Artium managed tools server.",
   "license": "MIT",
   "type": "module",