@prism-d1/cli 1.1.2 → 1.3.0

package/dist/assets/github-workflows/prism-agent-eval.yml

@@ -6,7 +6,8 @@
 #   - OIDC provider configured for GitHub Actions in your AWS account
 #   - IAM role with bedrock:InvokeModel and events:PutEvents permissions
 #   - Repository secret PRISM_METRICS_ROLE_ARN set to the OIDC role ARN
-#   - .prism/config.json committed to the repo (created by: bash prism-cli bootstrapper install-git-hooks)
+#   - .prism/config.json committed to the repo with a "team_id" key; add it by hand, e.g.
+#     {"team_id": "team-payments"} (prism-cli enable codewatch keeps existing keys in this file)
 #   - .prism/eval-harness/ installed (run: bash prism-cli bootstrapper install-eval-harness)
 #   - (Optional) Agent entry point supports --mock flag for dry-run execution
 

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -4,7 +4,8 @@
 #
 # Required setup:
 #   - Kiro API key stored as repository secret: KIRO_API_KEY
-#   - .kiro/steering/code-review.md in your repo (review rules)
+#   - .prism/review/rules.md (shared with the local pre-push review) or
+#     .kiro/steering/code-review.md in your repo (review rules)
 #   - (Optional) PRISM_METRICS_ROLE_ARN for EventBridge metrics emission
 #   - (Optional) AWS Continuum configured for security scanning
 #
@@ -236,6 +237,15 @@ jobs:
             exit 0
           fi
 
+          # Shared rule set: .prism/review/rules.md is the one source for this
+          # gate and the local pre-push review (prism-cli enable codewatch).
+          # kiro-cli loads rules from .kiro/steering/, so sync it in for this run.
+          if [ -f .prism/review/rules.md ]; then
+            mkdir -p .kiro/steering
+            cp .prism/review/rules.md .kiro/steering/code-review.md
+            echo "Review rules: .prism/review/rules.md"
+          fi
+
           # Get all changed source files in this PR
           FILES=$(git diff --name-only "${BASE_SHA}..${HEAD_SHA}" \
             | grep -E '\.(ts|js|py|go|java|rs|tsx|jsx)$' \
@@ -638,7 +648,7 @@ jobs:
 
             if [ -z "$CODE_REVIEW_ID" ]; then
               echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"
-              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "  Run 'prism-cli enable security' to create it manually."
               echo "scan_error=true" >> "$GITHUB_OUTPUT"
               echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0

package/dist/assets/gitlab-workflows/prism-eval-gate.yml

@@ -186,6 +186,14 @@ prism-eval-gate:
       elif [ -z "${BASE_SHA}" ] || [ -z "${HEAD_SHA}" ]; then
         echo "⚠️  Missing base/head SHA — review skipped."
       else
+        # Shared rule set (also used by the local pre-push review). kiro-cli
+        # loads rules from .kiro/steering/, so sync it in for this run.
+        if [ -f .prism/review/rules.md ]; then
+          mkdir -p .kiro/steering
+          cp .prism/review/rules.md .kiro/steering/code-review.md
+          echo "Review rules: .prism/review/rules.md"
+        fi
+
         FILES=$(git diff --name-only "${BASE_SHA}..${HEAD_SHA}" \
           | grep -E '\.(ts|js|py|go|java|rs|tsx|jsx)$' \
           | grep -vE '\.test\.|\.spec\.|__test__|_test\.' \

package/dist/assets/infra/bin/app.ts

@@ -6,6 +6,7 @@ import { AwsSolutionsChecks } from 'cdk-nag';
 import { MetricsPipelineStack } from '../lib/metrics-pipeline-stack';
 import { ApiStack } from '../lib/api-stack';
 import { DashboardStack } from '../lib/dashboard-stack';
+import { SecurityAgentStack } from '../lib/security-agent-stack';
 
 const app = new cdk.App();
 
@@ -14,43 +15,66 @@ const env: cdk.Environment = {
   region: process.env.CDK_DEFAULT_REGION ?? 'us-west-2',
 };
 
-const pipelineStack = new MetricsPipelineStack(app, 'PrismD1MetricsPipeline', {
-  env,
-  description: 'PRISM D1 Velocity - Core metrics event pipeline (EventBridge, DynamoDB)',
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'MetricsPipeline',
-  },
-});
-
-const apiStack = new ApiStack(app, 'PrismD1Api', {
-  env,
-  description: 'PRISM D1 Velocity - Metric ingestion and query API',
-  eventBus: pipelineStack.eventBus,
-  eventsTable: pipelineStack.eventsTable,
-  metadataTable: pipelineStack.metadataTable,
-  kmsKey: pipelineStack.kmsKey,
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'Api',
-  },
-});
-
-const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
-  env,
-  description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
-  productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
-  velocityWidgetArn: pipelineStack.velocityWidgetArn,
-  tags: {
-    'prism:project': 'PRISM',
-    'prism:domain': 'D1-Velocity',
-    'prism:component': 'Dashboard',
-  },
-});
-
-apiStack.addDependency(pipelineStack);
+// securityAgentStandalone=true builds ONLY PrismD1SecurityAgent: AWS Security
+// Agent without the metrics pipeline (what `prism-cli enable security` deploys
+// in an account that does not host it in the pipeline). It and
+// enableSecurityAgent=true (Security Agent inside PrismD1MetricsPipeline) use
+// the same resource and export names, so one account can only have one.
+const standalone = app.node.tryGetContext('securityAgentStandalone') === 'true';
+if (standalone && app.node.tryGetContext('enableSecurityAgent') === 'true') {
+  throw new Error('securityAgentStandalone=true and enableSecurityAgent=true are exclusive: Security Agent lives either in PrismD1SecurityAgent or in PrismD1MetricsPipeline, never both.');
+}
+
+if (standalone) {
+  new SecurityAgentStack(app, 'PrismD1SecurityAgent', {
+    env,
+    description: 'PRISM D1 Velocity - AWS Security Agent (standalone, without the metrics pipeline)',
+    kmsKeyArn: app.node.tryGetContext('securityAgentKmsKeyArn') as string | undefined,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'SecurityAgent',
+    },
+  });
+} else {
+  const pipelineStack = new MetricsPipelineStack(app, 'PrismD1MetricsPipeline', {
+    env,
+    description: 'PRISM D1 Velocity - Core metrics event pipeline (EventBridge, DynamoDB)',
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'MetricsPipeline',
+    },
+  });
+
+  const apiStack = new ApiStack(app, 'PrismD1Api', {
+    env,
+    description: 'PRISM D1 Velocity - Metric ingestion and query API',
+    eventBus: pipelineStack.eventBus,
+    eventsTable: pipelineStack.eventsTable,
+    metadataTable: pipelineStack.metadataTable,
+    kmsKey: pipelineStack.kmsKey,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'Api',
+    },
+  });
+
+  const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
+    env,
+    description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
+    productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
+    velocityWidgetArn: pipelineStack.velocityWidgetArn,
+    tags: {
+      'prism:project': 'PRISM',
+      'prism:domain': 'D1-Velocity',
+      'prism:component': 'Dashboard',
+    },
+  });
+
+  apiStack.addDependency(pipelineStack);
+}
 
 // Enable cdk-nag AWS Solutions checks on all stacks
 Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -24,6 +24,9 @@ import * as cognito from 'aws-cdk-lib/aws-cognito';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as kms from 'aws-cdk-lib/aws-kms';
 import * as logs from 'aws-cdk-lib/aws-logs';
+import * as events from 'aws-cdk-lib/aws-events';
+import * as targets from 'aws-cdk-lib/aws-events-targets';
+import * as iam from 'aws-cdk-lib/aws-iam';
 import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import { HttpJwtAuthorizer } from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
@@ -32,6 +35,7 @@ import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as path from 'path';
 import { Construct } from 'constructs';
 import { NagSuppressions } from 'cdk-nag';
+import { PRICES_KEY } from '../lambda/pricing/prices-key';
 
 /** codeburn sync fixed loopback callback ports (see codeburn src/sync/auth.ts). */
 const CODEBURN_CALLBACK_PORTS = [19876, 19877, 19878];
@@ -509,9 +513,101 @@ export class OtelCollectorConstruct extends Construct {
 
     props.aiUsageTable.grantReadWriteData(receiver);
     this.archiveBucket.grantPut(receiver);
+    // The LiteLLM price table the refresh Lambda maintains (pricing/price-source.ts).
+    // Exact key, read only. KMS decrypt comes from grantEncryptDecrypt below.
+    const pricesObjectArn = this.archiveBucket.arnForObjects(PRICES_KEY);
+    receiver.addToRolePolicy(new iam.PolicyStatement({
+      actions: ['s3:GetObject'],
+      resources: [pricesObjectArn],
+    }));
     props.kmsKey.grantEncryptDecrypt(receiver);
     this.receiverFunction = receiver;
 
+    // -------------------------------------------------------
+    // Price refresh + reprice — daily
+    // Keeps the receiver's LiteLLM fallback table current in S3, then
+    // corrects spans stored at $0 whose model has since been priced.
+    // See lib/lambda/pricing-refresh.ts.
+    //
+    // Deliberately NOT in the VPC: the PRISM VPC has no NAT gateway, and this
+    // function's one job that needs a network path is an HTTPS GET to
+    // raw.githubusercontent.com. It accepts no inbound traffic, and reaches
+    // only S3 and DynamoDB besides, both over their public endpoints with IAM.
+    // -------------------------------------------------------
+    const pricingRefresh = new lambda.Function(this, 'PricingRefresh', {
+      functionName: 'prism-d1-pricing-refresh',
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: 'pricing-refresh.handler',
+      code: lambda.Code.fromAsset(path.join(__dirname, '..', 'lambda'), {
+        bundling: {
+          image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+          command: [
+            'bash', '-c',
+            [
+              'npm init -y > /dev/null 2>&1',
+              'npm install --save @aws-sdk/client-dynamodb @aws-sdk/client-s3 esbuild > /dev/null 2>&1',
+              'npx esbuild pricing-refresh.ts --bundle --platform=node --target=node22 --outfile=/asset-output/pricing-refresh.js --external:@aws-sdk/*',
+            ].join(' && '),
+          ],
+          local: {
+            tryBundle(outputDir: string): boolean {
+              try {
+                const { execSync } = require('child_process');
+                execSync(
+                  `npx esbuild ${path.join(__dirname, '..', 'lambda', 'pricing-refresh.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'pricing-refresh.js')} --external:@aws-sdk/*`,
+                  { stdio: 'pipe' },
+                );
+                return true;
+              } catch {
+                return false;
+              }
+            },
+          },
+        },
+      }),
+      // A full-table scan plus, on the first run, a read of the raw archive to
+      // recover cache-token counts for spans stored before they were kept.
+      timeout: cdk.Duration.minutes(15),
+      memorySize: 1024,
+      environment: {
+        AI_USAGE_TABLE: props.aiUsageTable.tableName,
+        ARCHIVE_BUCKET: this.archiveBucket.bucketName,
+      },
+      logRetention: logs.RetentionDays.ONE_MONTH,
+      description: 'Daily: refresh the LiteLLM price table in S3, then reprice usage spans stored at $0',
+    });
+    props.aiUsageTable.grantReadWriteData(pricingRefresh);
+    // Read the raw archive (to recover cache-token counts), and read/write the
+    // one price-table object. No delete: an old table is only ever overwritten.
+    this.archiveBucket.grantRead(pricingRefresh, 'otlp/*');
+    pricingRefresh.addToRolePolicy(new iam.PolicyStatement({
+      actions: ['s3:GetObject', 's3:PutObject'],
+      resources: [pricesObjectArn],
+    }));
+    props.kmsKey.grantEncryptDecrypt(pricingRefresh);
+
+    new events.Rule(this, 'PricingRefreshSchedule', {
+      ruleName: 'prism-d1-pricing-refresh-daily',
+      description: 'Refresh LiteLLM prices and reprice $0 spans',
+      // 06:17 UTC: off the hour so it is not queued behind other schedules.
+      schedule: events.Schedule.cron({ minute: '17', hour: '6' }),
+      // No retry: a failed run already repriced what it could and the next day's
+      // run starts from the same state. Errors surface on the Lambda metric.
+      targets: [new targets.LambdaFunction(pricingRefresh, { retryAttempts: 0 })],
+    });
+
+    NagSuppressions.addResourceSuppressions(pricingRefresh, [
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'grantRead scopes S3 reads to the otlp/* prefix of the single archive bucket (raw OTLP batches, read to recover cache-token counts); grantReadWriteData adds the AI-usage table GSI index wildcard.',
+        appliesTo: [
+          'Action::s3:GetObject*', 'Action::s3:GetBucket*', 'Action::s3:List*',
+          { regex: '/^Resource::<OtelCollectorArchiveBucket.*\\.Arn>\\/otlp\\/\\*$/g' },
+          { regex: '/^Resource::<AiUsageTable.*\\.Arn>\\/index\\/\\*$/g' },
+        ],
+      },
+    ], true);
+
     // -------------------------------------------------------
     // CloudWatch Custom Widget: Developer Productivity
     // Invoked by CloudWatch dashboards with the VIEWING user's IAM creds

package/dist/assets/infra/lib/constructs/security-agent-construct.ts

@@ -168,6 +168,32 @@ export class SecurityAgentConstruct extends Construct {
       );
     }
 
+    // -------------------------------------------------------
+    // S3 Scan Bucket — stores repo ZIPs and diff files for
+    // API-triggered code reviews (diff scans from CI/CD) and
+    // threat models. Created before the agent space, which lists it.
+    // -------------------------------------------------------
+    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
+      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
+      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
+      // this bucket when creating the code review and cannot access a CMK it
+      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
+      // the bucket is private (BLOCK_ALL) and SSL-enforced.
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      enforceSSL: true,
+      versioned: false,
+      lifecycleRules: [
+        {
+          id: 'expire-scan-artifacts',
+          expiration: cdk.Duration.days(30),
+          enabled: true,
+        },
+      ],
+      removalPolicy: cdk.RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
     // Agent Space
     const agentSpace = new securityagent.CfnAgentSpace(this, 'AgentSpace', {
       name: props.agentSpaceName,
@@ -177,6 +203,9 @@ export class SecurityAgentConstruct extends Construct {
       }),
       awsResources: {
         iamRoles: [this.serviceRole.roleArn],
+        // create-threat-model refuses S3 sources and scope docs in a bucket the
+        // agent space does not list ("S3 bucket not found in agent instance S3 buckets").
+        s3Buckets: [this.scanBucket.bucketArn],
       },
       tags: [
         { key: 'prism:component', value: 'security-agent' },
@@ -210,7 +239,7 @@ export class SecurityAgentConstruct extends Construct {
 
     // Log group for pen test results (Security Agent writes to /aws/securityagent/<space>/pt-<id>)
     // Note: we do NOT set logGroupName to avoid conflicts with pre-existing log groups
-    // created by prism-cli securityagent setup or the Security Agent service itself.
+    // created by prism-cli enable security or the Security Agent service itself.
     const pentestLogGroup = logs.LogGroup.fromLogGroupName(
       this, 'PentestLogGroup',
       `/aws/securityagent/${props.agentSpaceName}`,
@@ -237,31 +266,6 @@ export class SecurityAgentConstruct extends Construct {
       });
     }
 
-    // -------------------------------------------------------
-    // S3 Scan Bucket — stores repo ZIPs and diff files for
-    // API-triggered code reviews (diff scans from CI/CD).
-    // -------------------------------------------------------
-    this.scanBucket = new s3.Bucket(this, 'ScanBucket', {
-      bucketName: `security-agent-scans-${cdk.Aws.ACCOUNT_ID}-${cdk.Aws.REGION}`,
-      // SSE-S3 (not the customer-managed KMS key): the Continuum service reads
-      // this bucket when creating the code review and cannot access a CMK it
-      // has no grant on. Artifacts here are ephemeral diffs (30-day lifecycle),
-      // the bucket is private (BLOCK_ALL) and SSL-enforced.
-      encryption: s3.BucketEncryption.S3_MANAGED,
-      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-      enforceSSL: true,
-      versioned: false,
-      lifecycleRules: [
-        {
-          id: 'expire-scan-artifacts',
-          expiration: cdk.Duration.days(30),
-          enabled: true,
-        },
-      ],
-      removalPolicy: cdk.RemovalPolicy.DESTROY,
-      autoDeleteObjects: true,
-    });
-
     // Grant Security Agent service role read access to the scan bucket
     this.scanBucket.grantRead(this.serviceRole);
 
@@ -298,10 +302,11 @@ export class SecurityAgentConstruct extends Construct {
     // Code Review resource — NOT created here in CDK.
     // CreateCodeReview requires assets.sourceCode pointing to
     // an existing ZIP of the repo (chicken-and-egg at deploy).
-    // Instead, `prism-cli securityagent setup` handles:
-    //   1. git archive → upload repo.zip to scan bucket
+    // Instead, `prism-cli enable security` (or the CI eval gate on its
+    // first run) handles, per repo:
+    //   1. git archive → upload repo/<repo-slug>/latest.zip to the scan bucket
     //   2. CreateCodeReview API call
-    //   3. Write code-review-id to SSM
+    //   3. Write /prism/continuum/code-review-id/<repo-slug> to SSM
     // The CDK only provisions the bucket + role + SSM scaffold.
     // -------------------------------------------------------
 
@@ -325,7 +330,7 @@ export class SecurityAgentConstruct extends Construct {
       tier: ssm.ParameterTier.STANDARD,
     });
 
-    // code-review-id is written by `prism-cli securityagent setup` (not CDK)
+    // code-review-id/<repo-slug> is written by `prism-cli enable security` (not CDK)
     // because CreateCodeReview needs an existing repo ZIP in S3 first.
 
     new ssm.StringParameter(this, 'ParamScanBucket', {

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -808,6 +808,33 @@ export class DashboardStack extends cdk.Stack {
         }),
       );
 
+      // --- Row 5: Tools the model invoked (codeburn ai.tools) ---
+      // Store-backed like the spend tiles: OTEL#TOOLDAY rollups are bucketed by
+      // the call's own day and keep full history, so a backfilled sync push is
+      // not cut off at CloudWatch's two-week window. Follows the Developer filter.
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'Tool Usage: Top Tools & MCP Servers',
+          width: 16,
+          height: 9,
+          params: { view: 'tool-usage-top', user: USER_TOKEN },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'Tool Calls / Day',
+          width: 8,
+          height: 9,
+          params: { view: 'tool-usage-trend', user: USER_TOKEN },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
       new cdk.CfnOutput(this, 'DevProductivityDashboardUrl', {
         value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity`,
         description: 'Developer Productivity Dashboard URL',