@prism-d1/cli 1.1.2 → 1.3.0

package/dist/src/dashboard/repos.js

@@ -0,0 +1,111 @@
+/**
+ * Which repositories the dashboard shows.
+ *
+ * Default: every git repo under the user's home directory (3 levels deep),
+ * wherever the dashboard is started from, whether or not codewatch is set up
+ * in it -- a repo without codewatch is shown as missing. A repo is any
+ * directory with `.git`, as a directory or as a file (linked worktrees and
+ * submodules). The repo containing the working directory is listed first. `--root` moves the
+ * scan. Everything goes through discoverRepos() so a registry could be added
+ * later as one more source.
+ */
+import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+/**
+ * Directory names never descended into. Hidden names (leading `.`) are skipped
+ * separately, which covers `.git`, `.cache`, `.venv` and the like.
+ */
+export const SKIP_DIRS = new Set(['node_modules', 'Library', 'build', 'dist', 'target', 'venv', '__pycache__', 'cdk.out']);
+export const DEFAULT_SCAN_DEPTH = 3;
+export const MAX_REPOS = 200;
+/** Hard cap on directories listed, so an unusually wide home cannot stall the page. */
+export const MAX_DIRS_VISITED = 20_000;
+export function gitToplevel(cwd) {
+    const r = spawnSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    return r.status === 0 && r.stdout.trim() ? r.stdout.trim() : null;
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+function isDir(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Git repos under `root`, at most `depth` levels below it. `.git` may be a
+ * directory or a file (a linked worktree's or submodule's pointer).
+ *
+ * - The walk stops at any git repo: nothing inside a repo is scanned, so
+ *   nested repos and big working trees are skipped.
+ * - Hidden directories and SKIP_DIRS are never entered.
+ * - Symlinks are not followed (Dirent.isDirectory() is false for a link).
+ * - An unreadable directory is skipped, not an error.
+ * - `root` itself is never treated as a repo, so a home directory kept under
+ *   git (dotfiles) does not end the scan before it starts.
+ */
+export function scanForRepos(root, depth = DEFAULT_SCAN_DEPTH) {
+    const repos = [];
+    let visited = 0;
+    let truncated = false;
+    const walk = (dir, level) => {
+        if (truncated)
+            return;
+        if (level > 0 && existsSync(join(dir, '.git'))) {
+            repos.push({ name: basename(dir), path: real(dir), current: false, hasPrism: isDir(join(dir, '.prism')) });
+            if (repos.length >= MAX_REPOS)
+                truncated = true;
+            return;
+        }
+        if (level >= depth)
+            return;
+        if (++visited > MAX_DIRS_VISITED) {
+            truncated = true;
+            return;
+        }
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const e of entries) {
+            if (!e.isDirectory() || e.name.startsWith('.') || SKIP_DIRS.has(e.name))
+                continue;
+            walk(join(dir, e.name), level + 1);
+        }
+    };
+    walk(resolve(root), 0);
+    return { repos, visited, truncated };
+}
+export function discoverRepos(opts) {
+    const t0 = Date.now();
+    const top = gitToplevel(opts.cwd);
+    const currentRepo = top ? real(top) : null;
+    const scannedRoot = resolve(opts.root || opts.home || homedir());
+    const out = [];
+    if (currentRepo) {
+        out.push({ name: basename(currentRepo), path: currentRepo, current: true, hasPrism: isDir(join(currentRepo, '.prism')) });
+    }
+    if (!isDir(scannedRoot)) {
+        return { repos: out, scannedRoot, currentRepo, scanMs: Date.now() - t0, truncated: false, error: `scan root is not a directory: ${scannedRoot}` };
+    }
+    const scan = scanForRepos(scannedRoot);
+    for (const r of scan.repos)
+        if (r.path !== currentRepo)
+            out.push(r);
+    return { repos: out, scannedRoot, currentRepo, scanMs: Date.now() - t0, truncated: scan.truncated, error: null };
+}
+//# sourceMappingURL=repos.js.map

package/dist/src/dashboard/repos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repos.js","sourceRoot":"","sources":["../../../src/dashboard/repos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY/C;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAC7B,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnI,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC;QAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACnE,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAK,GAAG,kBAAkB;IACnE,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QAC1C,IAAI,SAAS;YAAE,OAAO;QACtB,IAAI,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3G,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,KAAK;YAAE,OAAO;QAC3B,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/D,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAqBD,MAAM,UAAU,aAAa,CAAC,IAAqB;IACjD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,WAAW,EAAE,EAAE,CAAC;IACpJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACnH,CAAC"}

package/dist/src/dashboard/security.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The Security findings panel: the cached `security-review` results that
+ * `prism-cli security code-review` and `security findings` write to
+ * .prism/results/. Local files only; no AWS calls.
+ */
+import { type PrismResult } from '../codewatch/results.js';
+export declare const MAX_PANEL_FINDINGS = 50;
+/** A pending record older than this is marked `stale?`: results are local, so the dashboard cannot know the job's real state. */
+export declare const PENDING_STALE_MS: number;
+export declare const PENDING_HINT = "prism-cli security findings";
+export interface SecurityFindingRow {
+    risk_level: string;
+    title: string;
+    file: string;
+    line: number | null;
+    cwe: string | null;
+}
+export interface SecurityRepoRow {
+    name: string;
+    path: string;
+    current: boolean;
+    job_id: string;
+    job_status: string;
+    status: PrismResult['status'];
+    scope: string;
+    started_at: string;
+    finished_at: string;
+    counts: Record<string, number>;
+    findings: SecurityFindingRow[];
+    truncated: boolean;
+    reason: string | null;
+    /** Started by code-review, no verdict recorded yet. */
+    pending: boolean;
+    /** Pending for longer than PENDING_STALE_MS: the job most likely finished and nobody fetched it. */
+    stale: boolean;
+}
+/** A pentest runs for hours, so its pending record goes stale later than a review's. */
+export declare const PENTEST_PENDING_STALE_MS: number;
+export declare const PENTEST_HINT = "prism-cli security pentest --status";
+export interface SecurityPentestFindingRow {
+    risk_level: string;
+    title: string;
+    confidence: string | null;
+}
+export interface SecurityPentestRow {
+    name: string;
+    path: string;
+    current: boolean;
+    job_id: string;
+    job_status: string;
+    status: PrismResult['status'];
+    target_host: string;
+    started_at: string;
+    finished_at: string;
+    counts: Record<string, number>;
+    findings: SecurityPentestFindingRow[];
+    truncated: boolean;
+    reason: string | null;
+    overview: string | null;
+    /** The last teardown left the stack up; --cleanup retries it. */
+    teardown_failed: {
+        at: string;
+        reason: string;
+    } | null;
+    pending: boolean;
+    stale: boolean;
+}
+export interface SecurityPanel {
+    /** One row per repo with a cached code-review result, newest job first. */
+    repos: SecurityRepoRow[];
+    /** One row per repo with a cached penetration-test result, newest job first. */
+    pentests: SecurityPentestRow[];
+    hint: string;
+    /** Shown on a pending repo: how to fetch the job's results. */
+    pending_hint: string;
+    /** Shown on a pending pentest: how to refresh it. */
+    pentest_hint: string;
+    /** One row per repo with a cached threat model, current repo first. */
+    threat_models: ThreatModelRow[];
+    /** Shown on a pending threat model: how to fetch its threats. */
+    threats_hint: string;
+}
+/** Threats shown per repo; the rest are in the result file and `prism-cli security threats`. */
+export declare const MAX_PANEL_THREATS = 5;
+export declare const THREATS_HINT = "prism-cli security threats";
+export interface ThreatModelRow {
+    name: string;
+    path: string;
+    current: boolean;
+    job_id: string;
+    job_status: string;
+    status: PrismResult['status'];
+    commit: string | null;
+    started_at: string;
+    finished_at: string;
+    counts: Record<string, number>;
+    scope_docs: string[];
+    /** The system overview's first paragraph. */
+    overview: string;
+    threats: {
+        severity: string;
+        title: string;
+        stride: string[];
+    }[];
+    /** Threats beyond MAX_PANEL_THREATS. */
+    more: number;
+    reason: string | null;
+    pending: boolean;
+    stale: boolean;
+}
+/**
+ * The latest job of a repo. Two files can hold the same job (code-review
+ * writes it with its scope, `security findings` again without); the one that
+ * knows its scope wins, then the newest write. A pending record is completed
+ * in place, but should a verdict for the same job exist elsewhere, it wins.
+ */
+export declare function latestSecurityReview(results: PrismResult[]): PrismResult | null;
+/**
+ * The latest pentest job of a repo. Like latestSecurityReview: newest write per
+ * job, but a completed record for a job wins over its pending record.
+ */
+export declare function latestPentest(results: PrismResult[]): PrismResult | null;
+export declare function collectSecurity(repos: {
+    name: string;
+    path: string;
+    current: boolean;
+}[], read?: (root: string) => PrismResult[], now?: Date): SecurityPanel;
+/** The newest threat model job of a repo; for one job, a verdict wins over a pending record. */
+export declare function latestThreatModel(results: PrismResult[]): PrismResult | null;
+//# sourceMappingURL=security.d.ts.map

package/dist/src/dashboard/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/dashboard/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGxE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,iIAAiI;AACjI,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AACnD,eAAO,MAAM,YAAY,gCAAgC,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAEhI,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,QAAqB,CAAC;AAC3D,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,MAAM,WAAW,yBAAyB;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAE3G,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iEAAiE;IACjE,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,gFAAgF;IAChF,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,aAAa,EAAE,cAAc,EAAE,CAAC;IAChC,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,YAAY,+BAA+B,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACjE,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAgB/E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAexE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,EAAgB,EAAE,GAAG,GAAE,IAAiB,GAAG,aAAa,CA6CrL;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,GAAG,IAAI,CAU5E"}

package/dist/src/dashboard/security.js

@@ -0,0 +1,144 @@
+/**
+ * The Security findings panel: the cached `security-review` results that
+ * `prism-cli security code-review` and `security findings` write to
+ * .prism/results/. Local files only; no AWS calls.
+ */
+import { readResults } from '../codewatch/results.js';
+import { firstParagraph } from '../security/threat-model.js';
+export const MAX_PANEL_FINDINGS = 50;
+/** A pending record older than this is marked `stale?`: results are local, so the dashboard cannot know the job's real state. */
+export const PENDING_STALE_MS = 2 * 60 * 60 * 1000;
+export const PENDING_HINT = 'prism-cli security findings';
+/** A pentest runs for hours, so its pending record goes stale later than a review's. */
+export const PENTEST_PENDING_STALE_MS = 6 * 60 * 60 * 1000;
+export const PENTEST_HINT = 'prism-cli security pentest --status';
+/** Threats shown per repo; the rest are in the result file and `prism-cli security threats`. */
+export const MAX_PANEL_THREATS = 5;
+export const THREATS_HINT = 'prism-cli security threats';
+const RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
+/**
+ * The latest job of a repo. Two files can hold the same job (code-review
+ * writes it with its scope, `security findings` again without); the one that
+ * knows its scope wins, then the newest write. A pending record is completed
+ * in place, but should a verdict for the same job exist elsewhere, it wins.
+ */
+export function latestSecurityReview(results) {
+    const byJob = new Map();
+    for (const r of results) {
+        if (r.kind !== 'security-review' || !r.security?.job_id)
+            continue;
+        const prev = byJob.get(r.security.job_id);
+        if (prev && (prev.status === 'pending') !== (r.status === 'pending')) {
+            if (prev.status === 'pending')
+                byJob.set(r.security.job_id, r);
+            continue;
+        }
+        const better = !prev || (prev.security.scope === 'unknown' && r.security.scope !== 'unknown')
+            || (prev.security.scope === r.security.scope && r.finished_at > prev.finished_at)
+            || (r.security.scope !== 'unknown' && r.finished_at > prev.finished_at);
+        if (better)
+            byJob.set(r.security.job_id, r);
+    }
+    const all = [...byJob.values()].sort((a, b) => b.started_at.localeCompare(a.started_at));
+    return all[0] ?? null;
+}
+/**
+ * The latest pentest job of a repo. Like latestSecurityReview: newest write per
+ * job, but a completed record for a job wins over its pending record.
+ */
+export function latestPentest(results) {
+    const byJob = new Map();
+    for (const r of results) {
+        // A run that never started a job (the app never became healthy) has no job id but may still have a stack up.
+        const key = r.kind === 'security-pentest' ? (r.pentest?.job_id || r.pentest?.stack) : null;
+        if (!key)
+            continue;
+        const prev = byJob.get(key);
+        if (prev && (prev.status === 'pending') !== (r.status === 'pending')) {
+            if (prev.status === 'pending')
+                byJob.set(key, r);
+            continue;
+        }
+        if (!prev || r.finished_at > prev.finished_at)
+            byJob.set(key, r);
+    }
+    const all = [...byJob.values()].sort((a, b) => b.started_at.localeCompare(a.started_at));
+    return all[0] ?? null;
+}
+export function collectSecurity(repos, read = readResults, now = new Date()) {
+    const rows = [];
+    const pentests = [];
+    for (const repo of repos) {
+        const all = read(repo.path);
+        const r = latestSecurityReview(all);
+        if (r && r.security) {
+            const findings = [...(r.findings || [])]
+                .sort((a, b) => (RANK[b.risk_level || ''] ?? 0) - (RANK[a.risk_level || ''] ?? 0) || a.file.localeCompare(b.file))
+                .map((f) => ({ risk_level: f.risk_level || f.severity.toUpperCase(), title: f.title || f.message, file: f.file, line: f.line, cwe: f.cwe ?? null }));
+            rows.push({
+                name: repo.name, path: repo.path, current: repo.current,
+                job_id: r.security.job_id, job_status: r.security.job_status, status: r.status, scope: r.security.scope,
+                started_at: r.started_at, finished_at: r.finished_at, counts: r.security.counts || {},
+                findings: findings.slice(0, MAX_PANEL_FINDINGS), truncated: findings.length > MAX_PANEL_FINDINGS, reason: r.reason ?? null,
+                pending: r.status === 'pending',
+                stale: r.status === 'pending' && now.getTime() - Date.parse(r.started_at) > PENDING_STALE_MS,
+            });
+        }
+        const p = latestPentest(all);
+        if (p && p.pentest) {
+            const pf = [...(p.findings || [])]
+                .sort((a, b) => (RANK[b.risk_level || ''] ?? 0) - (RANK[a.risk_level || ''] ?? 0) || (a.title || '').localeCompare(b.title || ''))
+                .map((f) => ({ risk_level: f.risk_level || f.severity.toUpperCase(), title: f.title || f.message, confidence: f.confidence ?? null }));
+            pentests.push({
+                name: repo.name, path: repo.path, current: repo.current,
+                job_id: p.pentest.job_id, job_status: p.pentest.job_status, status: p.status,
+                target_host: p.pentest.target_host, started_at: p.started_at, finished_at: p.finished_at,
+                counts: p.pentest.counts || {}, findings: pf.slice(0, MAX_PANEL_FINDINGS), truncated: pf.length > MAX_PANEL_FINDINGS,
+                reason: p.reason ?? null, overview: p.pentest.overview ?? null,
+                teardown_failed: p.pentest.teardown_failed ?? null,
+                pending: p.status === 'pending',
+                stale: p.status === 'pending' && now.getTime() - Date.parse(p.started_at) > PENTEST_PENDING_STALE_MS,
+            });
+        }
+    }
+    rows.sort((a, b) => Number(b.current) - Number(a.current) || b.started_at.localeCompare(a.started_at));
+    const tms = [];
+    for (const repo of repos) {
+        const r = latestThreatModel(read(repo.path));
+        if (r)
+            tms.push(threatModelRow(repo, r, now));
+    }
+    tms.sort((a, b) => Number(b.current) - Number(a.current) || b.started_at.localeCompare(a.started_at));
+    pentests.sort((a, b) => Number(b.current) - Number(a.current) || b.started_at.localeCompare(a.started_at));
+    return { repos: rows, pentests, hint: 'prism-cli security code-review', pending_hint: PENDING_HINT, pentest_hint: PENTEST_HINT, threat_models: tms, threats_hint: THREATS_HINT };
+}
+/** The newest threat model job of a repo; for one job, a verdict wins over a pending record. */
+export function latestThreatModel(results) {
+    const byJob = new Map();
+    for (const r of results) {
+        if (r.kind !== 'security-threat-model' || !r.threat_model?.job_id)
+            continue;
+        const prev = byJob.get(r.threat_model.job_id);
+        const better = !prev || (prev.status === 'pending' && r.status !== 'pending')
+            || ((prev.status === 'pending') === (r.status === 'pending') && r.finished_at > prev.finished_at);
+        if (better)
+            byJob.set(r.threat_model.job_id, r);
+    }
+    return [...byJob.values()].sort((a, b) => b.started_at.localeCompare(a.started_at))[0] ?? null;
+}
+function threatModelRow(repo, r, now) {
+    const t = r.threat_model;
+    const threats = [...(r.findings || [])]
+        .sort((a, b) => (RANK[b.risk_level || ''] ?? 0) - (RANK[a.risk_level || ''] ?? 0))
+        .map((f) => ({ severity: f.risk_level || f.severity.toUpperCase(), title: f.title || f.message, stride: f.stride || [] }));
+    return {
+        name: repo.name, path: repo.path, current: repo.current,
+        job_id: t.job_id, job_status: t.job_status, status: r.status, commit: r.commit,
+        started_at: r.started_at, finished_at: r.finished_at, counts: t.counts || {}, scope_docs: t.scope_docs || [],
+        overview: firstParagraph(t.system_overview),
+        threats: threats.slice(0, MAX_PANEL_THREATS), more: Math.max(0, threats.length - MAX_PANEL_THREATS), reason: r.reason ?? null,
+        pending: r.status === 'pending',
+        stale: r.status === 'pending' && now.getTime() - Date.parse(r.started_at) > PENDING_STALE_MS,
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/src/dashboard/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/dashboard/security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAoB,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,iIAAiI;AACjI,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAwB1D,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAyClE,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAwBzD,MAAM,IAAI,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;eACzF,CAAC,IAAI,CAAC,QAAS,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;eAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,6GAA6G;QAC7G,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAyD,EAAE,OAAwC,WAAW,EAAE,MAAY,IAAI,IAAI,EAAE;IACpK,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACjH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACvJ,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACvD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK;gBACvG,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;gBACrF,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,GAAG,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;gBAC1H,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS;gBAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,gBAAgB;aAC7F,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;iBACjI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACzI,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACvD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;gBAC5E,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;gBACxF,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,GAAG,kBAAkB;gBACpH,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI;gBAC9D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,IAAI;gBAClD,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS;gBAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,wBAAwB;aACrG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvG,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACtG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3G,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACnL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM;YAAE,SAAS;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;eACxE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACpG,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjG,CAAC;AAED,SAAS,cAAc,CAAC,IAAsD,EAAE,CAAc,EAAE,GAAS;IACvG,MAAM,CAAC,GAAG,CAAC,CAAC,YAAa,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;SACjF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7H,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;QACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;QAC9E,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;QAC5G,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QAC7H,OAAO,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,gBAAgB;KAC7F,CAAC;AACJ,CAAC"}

package/dist/src/dashboard/server.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Loopback-only HTTP server for `prism-cli dashboard`.
+ *
+ * Access control, all enforced on every request:
+ *   - bound to 127.0.0.1 only (the host is a constant, not an option);
+ *   - a per-run 256-bit random token, accepted once from `/?token=` and
+ *     exchanged for an HttpOnly, SameSite=Strict cookie, then required as that
+ *     cookie on every request (compared in constant time);
+ *   - the Host header must be 127.0.0.1:<port> or localhost:<port>, which
+ *     defeats DNS rebinding (a rebound name arrives with its own Host);
+ *   - GET only, read-only routes, no CORS headers, strict CSP.
+ *
+ * Why a minted token and not a platform auth mechanism: the server is
+ * reachable only from this machine, the audience is the developer running it,
+ * and the CLI ships as public sample code, so it uses the loopback-plus-token
+ * pattern native to local developer tools (Jupyter, VS Code server) rather
+ * than any hosted identity provider. It must never be bound beyond loopback.
+ */
+import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import { type ScanReport } from './report.js';
+export declare const BIND_HOST = "127.0.0.1";
+export declare function newToken(): string;
+export declare function cookieName(port: number): string;
+export interface HandlerOptions {
+    token: string;
+    /** Read at request time: the real port is known only after listen(). */
+    getPort: () => number;
+    getPayload: () => Promise<unknown>;
+    /**
+     * Looks a report up by result id among the dashboard's repos. The id is
+     * matched against directory listings only; it is never turned into a path.
+     */
+    getReport?: (id: string) => Promise<ScanReport | null>;
+}
+export declare function createHandler(opts: HandlerOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export interface RunningServer {
+    server: Server;
+    port: number;
+    token: string;
+    url: string;
+    close: () => Promise<void>;
+}
+/** Starts the server on 127.0.0.1. `port` 0 (default) picks a free port. */
+export declare function startServer(opts: {
+    port?: number;
+    token?: string;
+    getPayload: () => Promise<unknown>;
+    getReport?: (id: string) => Promise<ScanReport | null>;
+}): Promise<RunningServer>;
+/** Memoises the payload for `ttlMs` and shares one in-flight build between requests. */
+export declare function cachedPayload(build: () => Promise<unknown>, ttlMs?: number): () => Promise<unknown>;
+//# sourceMappingURL=server.d.ts.map

package/dist/src/dashboard/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjG,OAAO,EAA0C,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtF,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAqCD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACxD;AAKD,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,IAClC,KAAK,eAAe,EAAE,KAAK,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC,CAwDxE;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBvL;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAWnG"}

package/dist/src/dashboard/server.js

@@ -0,0 +1,163 @@
+/**
+ * Loopback-only HTTP server for `prism-cli dashboard`.
+ *
+ * Access control, all enforced on every request:
+ *   - bound to 127.0.0.1 only (the host is a constant, not an option);
+ *   - a per-run 256-bit random token, accepted once from `/?token=` and
+ *     exchanged for an HttpOnly, SameSite=Strict cookie, then required as that
+ *     cookie on every request (compared in constant time);
+ *   - the Host header must be 127.0.0.1:<port> or localhost:<port>, which
+ *     defeats DNS rebinding (a rebound name arrives with its own Host);
+ *   - GET only, read-only routes, no CORS headers, strict CSP.
+ *
+ * Why a minted token and not a platform auth mechanism: the server is
+ * reachable only from this machine, the audience is the developer running it,
+ * and the CLI ships as public sample code, so it uses the loopback-plus-token
+ * pattern native to local developer tools (Jupyter, VS Code server) rather
+ * than any hosted identity provider. It must never be bound beyond loopback.
+ */
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { renderPage } from './page.js';
+import { renderReportHtml, renderReportMarkdown } from './report.js';
+export const BIND_HOST = '127.0.0.1';
+export function newToken() {
+    return randomBytes(32).toString('base64url');
+}
+export function cookieName(port) {
+    // Cookies are scoped by host, not port: two dashboards on different ports
+    // would otherwise overwrite each other's cookie.
+    return `prism_dash_${port}`;
+}
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+function readCookie(req, name) {
+    const raw = req.headers.cookie;
+    if (!raw)
+        return null;
+    for (const part of raw.split(';')) {
+        const i = part.indexOf('=');
+        if (i > 0 && part.slice(0, i).trim() === name)
+            return part.slice(i + 1).trim();
+    }
+    return null;
+}
+function baseHeaders(nonce) {
+    const csp = nonce
+        ? `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`
+        : "default-src 'none'; frame-ancestors 'none'";
+    return {
+        'Content-Security-Policy': csp,
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY',
+        'Referrer-Policy': 'no-referrer',
+        'Cache-Control': 'no-store',
+        'Cross-Origin-Resource-Policy': 'same-origin',
+    };
+}
+function send(res, status, type, body, extra = {}, nonce) {
+    res.writeHead(status, { ...baseHeaders(nonce), 'Content-Type': type, ...extra });
+    res.end(body);
+}
+/** /report/<id> or /report/<id>.md; anything else (slashes, dots, %-escapes) does not match. */
+const REPORT_ROUTE = /^\/report\/([A-Za-z0-9_-]{1,120})(\.md)?$/;
+export function createHandler(opts) {
+    return async (req, res) => {
+        try {
+            const port = opts.getPort();
+            const host = String(req.headers.host || '').toLowerCase();
+            if (host !== `${BIND_HOST}:${port}` && host !== `localhost:${port}`) {
+                return send(res, 403, 'text/plain; charset=utf-8', 'Forbidden: unexpected Host header\n');
+            }
+            if (req.method !== 'GET') {
+                return send(res, 405, 'text/plain; charset=utf-8', 'Method Not Allowed\n', { Allow: 'GET' });
+            }
+            const url = new URL(req.url || '/', `http://${BIND_HOST}:${port}`);
+            const name = cookieName(port);
+            const cookie = readCookie(req, name);
+            const cookieOk = cookie !== null && safeEqual(cookie, opts.token);
+            // First load: exchange the URL token for the cookie, then drop it from the URL.
+            const qToken = url.searchParams.get('token');
+            if (url.pathname === '/' && qToken !== null) {
+                if (!safeEqual(qToken, opts.token))
+                    return send(res, 401, 'text/plain; charset=utf-8', 'Unauthorized\n');
+                return send(res, 303, 'text/plain; charset=utf-8', 'See Other\n', {
+                    Location: '/',
+                    'Set-Cookie': `${name}=${opts.token}; HttpOnly; SameSite=Strict; Path=/`,
+                });
+            }
+            if (!cookieOk) {
+                return send(res, 401, 'text/plain; charset=utf-8', 'Unauthorized: open the URL printed by prism-cli dashboard\n');
+            }
+            if (url.pathname === '/') {
+                const nonce = randomBytes(16).toString('base64');
+                return send(res, 200, 'text/html; charset=utf-8', renderPage(nonce), {}, nonce);
+            }
+            if (url.pathname === '/api/data') {
+                const payload = await opts.getPayload();
+                return send(res, 200, 'application/json; charset=utf-8', JSON.stringify(payload));
+            }
+            const m = REPORT_ROUTE.exec(url.pathname);
+            if (m && opts.getReport) {
+                const report = await opts.getReport(m[1]);
+                if (!report)
+                    return send(res, 404, 'text/plain; charset=utf-8', 'Report not found\n');
+                if (m[2]) {
+                    return send(res, 200, 'text/markdown; charset=utf-8', renderReportMarkdown(report), {
+                        'Content-Disposition': `attachment; filename="codewatch-report-${m[1]}.md"`,
+                    });
+                }
+                const nonce = randomBytes(16).toString('base64');
+                return send(res, 200, 'text/html; charset=utf-8', renderReportHtml(report, { nonce, links: { back: '/', markdown: `/report/${m[1]}.md` } }), {}, nonce);
+            }
+            return send(res, 404, 'text/plain; charset=utf-8', 'Not Found\n');
+        }
+        catch (e) {
+            if (!res.headersSent)
+                send(res, 500, 'text/plain; charset=utf-8', 'Internal Server Error\n');
+            else
+                res.end();
+            process.stderr.write(`prism dashboard: request failed: ${e?.message || e}\n`);
+        }
+    };
+}
+/** Starts the server on 127.0.0.1. `port` 0 (default) picks a free port. */
+export function startServer(opts) {
+    const token = opts.token || newToken();
+    let port = 0;
+    const server = createServer(createHandler({ token, getPort: () => port, getPayload: opts.getPayload, getReport: opts.getReport }));
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 0, BIND_HOST, () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string' || addr.address !== BIND_HOST) {
+                server.close();
+                return reject(new Error(`refusing to serve: bound to ${JSON.stringify(addr)}, expected ${BIND_HOST}`));
+            }
+            port = addr.port;
+            resolve({
+                server, port, token,
+                url: `http://${BIND_HOST}:${port}/?token=${token}`,
+                close: () => new Promise((r) => server.close(() => r())),
+            });
+        });
+    });
+}
+/** Memoises the payload for `ttlMs` and shares one in-flight build between requests. */
+export function cachedPayload(build, ttlMs = 30_000) {
+    let at = 0;
+    let pending = null;
+    let value;
+    return () => {
+        if (value !== undefined && Date.now() - at < ttlMs)
+            return Promise.resolve(value);
+        if (!pending) {
+            pending = build().then((v) => { value = v; at = Date.now(); return v; }).finally(() => { pending = null; });
+        }
+        return pending;
+    };
+}
+//# sourceMappingURL=server.js.map