@prism-d1/cli 1.1.2 → 1.3.0

package/dist/src/security/cfn-diff.js

@@ -0,0 +1,112 @@
+/**
+ * Resource-level diff between the deployed CloudFormation template and the
+ * one `cdk synth` produced, used for the summary shown before confirmation.
+ *
+ * `cdk diff` is still run (its full text goes to a file the summary points
+ * at), but its output is human-oriented and changes between CDK versions, so
+ * the summary is computed from the two templates directly. It answers what the
+ * confirmation needs: how many resources are added, changed or removed, which
+ * of those touch IAM, network or public endpoints, and whether any of them are
+ * the Security Agent resources at all.
+ */
+/**
+ * Construct path prefixes (after the stack name) that make up the Security
+ * Agent feature. The auto-delete provider is a stack-level singleton CDK adds
+ * for the scan bucket's autoDeleteObjects; measured on a real synth, it is
+ * the only thing enableSecurityAgent adds outside the SecurityAgent construct.
+ */
+export const SECURITY_AGENT_PATHS = ['SecurityAgent/', 'ContinuumCiPolicy/', 'Custom::S3AutoDeleteObjectsCustomResourceProvider/'];
+const IGNORED_TYPES = new Set(['AWS::CDK::Metadata']);
+export function categorize(type) {
+    if (/^AWS::IAM::/.test(type) || /^AWS::(S3::BucketPolicy|KMS::Key|KMS::Grant|Lambda::Permission|SQS::QueuePolicy|SNS::TopicPolicy|Events::EventBusPolicy)$/.test(type))
+        return 'iam';
+    if (/^AWS::EC2::(SecurityGroup|SecurityGroupIngress|SecurityGroupEgress|VPC|Subnet|InternetGateway|NatGateway|EIP|Route|RouteTable|VPCEndpoint|NetworkAcl)/.test(type))
+        return 'network';
+    if (/^AWS::(ApiGateway::|ApiGatewayV2::|ElasticLoadBalancing|ElasticLoadBalancingV2::|CloudFront::|Lambda::Url$|Cognito::UserPoolDomain$|AppSync::)/.test(type))
+        return 'endpoint';
+    return 'other';
+}
+function cdkPath(r, stackName) {
+    const p = r?.Metadata?.['aws:cdk:path'];
+    if (typeof p !== 'string')
+        return '';
+    return p.startsWith(stackName + '/') ? p.slice(stackName.length + 1) : p;
+}
+function comparable(r) {
+    return JSON.stringify({ t: r.Type, p: r.Properties ?? null, d: r.DependsOn ?? null, c: r.Condition ?? null });
+}
+/** `deployed` is null when the stack does not exist yet. */
+/** `isFeature` decides which resources belong to Security Agent; default: SECURITY_AGENT_PATHS. */
+export function diffTemplates(deployed, synthesized, stackName, isFeature = (path) => SECURITY_AGENT_PATHS.some((p) => path.startsWith(p))) {
+    const before = deployed?.Resources ?? {};
+    const after = synthesized.Resources ?? {};
+    const changes = [];
+    const add = (logicalId, r, change) => {
+        if (IGNORED_TYPES.has(r.Type))
+            return;
+        const path = cdkPath(r, stackName) || logicalId;
+        changes.push({
+            logicalId, type: r.Type, path, change, category: categorize(r.Type),
+            securityAgent: isFeature(path),
+        });
+    };
+    for (const [id, r] of Object.entries(after)) {
+        if (!(id in before))
+            add(id, r, 'add');
+        else if (comparable(before[id]) !== comparable(r))
+            add(id, r, 'modify');
+    }
+    for (const [id, r] of Object.entries(before))
+        if (!(id in after))
+            add(id, r, 'remove');
+    changes.sort((a, b) => a.path.localeCompare(b.path));
+    const counts = { add: 0, modify: 0, remove: 0 };
+    for (const c of changes)
+        counts[c.change]++;
+    return {
+        newStack: deployed === null,
+        changes,
+        counts,
+        touchesSecurityAgent: changes.some((c) => c.securityAgent),
+        deployedHasSecurityAgent: Object.values(before).some((r) => r.Type === 'AWS::SecurityAgent::AgentSpace'),
+    };
+}
+const SIGN = { add: '+', modify: '~', remove: '-' };
+const HEADINGS = {
+    iam: 'IAM and resource policies',
+    network: 'Security groups and network',
+    endpoint: 'Public endpoints (API Gateway, load balancers, CloudFront, Cognito domains, function URLs)',
+    other: 'Other resources',
+};
+/** Lines for the summary. Every IAM, network and endpoint change is listed by name; other resources are counted by type. */
+export function formatDiff(d, stackName) {
+    const L = [];
+    const { add, modify, remove } = d.counts;
+    L.push(`Stack ${stackName}${d.newStack ? ' (new stack)' : ''}: ${add} to add, ${modify} to change, ${remove} to remove`);
+    if (!d.changes.length) {
+        L.push('  No changes.');
+        return L;
+    }
+    for (const cat of ['iam', 'network', 'endpoint']) {
+        const items = d.changes.filter((c) => c.category === cat);
+        L.push(`  ${HEADINGS[cat]}:${items.length ? '' : ' none'}`);
+        for (const c of items)
+            L.push(`    ${SIGN[c.change]} ${c.type}  ${c.path}`);
+    }
+    const other = d.changes.filter((c) => c.category === 'other');
+    if (other.length) {
+        L.push(`  ${HEADINGS.other}:`);
+        const groups = new Map();
+        for (const c of other)
+            groups.set(`${SIGN[c.change]} ${c.type}`, (groups.get(`${SIGN[c.change]} ${c.type}`) ?? 0) + 1);
+        for (const [k, n] of [...groups].sort())
+            L.push(`    ${k}${n > 1 ? ` x${n}` : ''}`);
+    }
+    if (remove)
+        L.push(`  WARNING: ${remove} resource(s) would be REMOVED. If your stack was deployed with extra context (for example -c skipVpc=true), pass the same values with --context.`);
+    const outside = d.changes.filter((c) => !c.securityAgent).length;
+    if (!d.newStack && outside)
+        L.push(`  ${outside} of these changes are outside the Security Agent resources (the local infra code differs from what is deployed).`);
+    return L;
+}
+//# sourceMappingURL=cfn-diff.js.map

package/dist/src/security/cfn-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfn-diff.js","sourceRoot":"","sources":["../../../src/security/cfn-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqCH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,oDAAoD,CAAC,CAAC;AAEnI,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEtD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2HAA2H,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrL,IAAI,uJAAuJ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzL,IAAI,gJAAgJ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACnL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,CAA0B,EAAE,SAAiB;IAC5D,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,CAAc;IAChC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;AAChH,CAAC;AAED,4DAA4D;AAC5D,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAAE,WAAwB,EAAE,SAAiB,EACzE,YAAuC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAErG,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,CAAc,EAAE,MAAkB,EAAE,EAAE;QACpE,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,aAAa,EAAE,SAAS,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC;YAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;aAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5C,OAAO;QACL,QAAQ,EAAE,QAAQ,KAAK,IAAI;QAC3B,OAAO;QACP,MAAM;QACN,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC1D,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gCAAgC,CAAC;KACzG,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAA+B,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChF,MAAM,QAAQ,GAA6B;IACzC,GAAG,EAAE,2BAA2B;IAChC,OAAO,EAAE,6BAA6B;IACtC,QAAQ,EAAE,4FAA4F;IACtG,KAAK,EAAE,iBAAiB;CACzB,CAAC;AAEF,4HAA4H;AAC5H,MAAM,UAAU,UAAU,CAAC,CAAe,EAAE,SAAiB;IAC3D,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,YAAY,MAAM,eAAe,MAAM,YAAY,CAAC,CAAC;IACzH,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAe,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvH,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;YAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAM;QAAE,CAAC,CAAC,IAAI,CAAC,cAAc,MAAM,kJAAkJ,CAAC,CAAC;IAC3L,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACjE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,kHAAkH,CAAC,CAAC;IACnK,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/security/errors.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Turns AWS CLI failures into messages a developer can act on.
+ *
+ * Three cases get their own wording because the raw CLI output does not say
+ * what to do: no usable credentials, an AWS CLI too old to know the
+ * `securityagent` commands, and an AccessDenied (which API, and which IAM
+ * action it needed). Everything printed goes through redact() first, so a
+ * credential that ends up in an error string is never echoed.
+ */
+/** First AWS CLI release with the Security Agent code review commands (matches the CI eval gate's check). */
+export declare const MIN_AWS_CLI: readonly [2, 36];
+export declare const MIN_AWS_CLI_TEXT: string;
+export declare const NO_CREDENTIALS_MESSAGE = "Failed to get account ID. Check your AWS credentials.";
+/** Removes anything shaped like an AWS credential from text before it is printed. */
+export declare function redact(text: string): string;
+/** The IAM action an `aws <service> <command>` call needs, derived from the argv. */
+export declare function permissionFor(args: string[]): string;
+export type AwsErrorKind = 'no-credentials' | 'access-denied' | 'old-cli' | 'other';
+export interface ExplainedError {
+    kind: AwsErrorKind;
+    /** One or more lines, already redacted. */
+    message: string;
+}
+/**
+ * Explains a failed `aws` call. `args` is the argv that failed (without
+ * --region/--profile), `stderr` what the CLI printed, `cliVersion` the
+ * `aws --version` output when known.
+ */
+export declare function explainAwsError(args: string[], stderr: string, cliVersion?: string | null): ExplainedError;
+/**
+ * Lines for an error that is not one of ours (not an Abort): a failed npm or
+ * cdk run, a JSON parse, a git or file-system error. One redacted `Error:`
+ * line, at most one hint, and the redacted stack only with PRISM_DEBUG=1.
+ *
+ * Only `message`, `code`, `syscall` and `stack` are read. A child-process
+ * error also carries `cmd`, `spawnargs`, `envPairs`, `stdout` and `stderr`,
+ * which can hold full command lines and the environment; those are never read.
+ */
+export declare function describeUnexpectedError(e: unknown, env?: NodeJS.ProcessEnv): string[];
+/** Parses `aws --version` ("aws-cli/2.36.19 Python/...") and checks it against MIN_AWS_CLI. */
+export declare function cliVersionOk(versionText: string | null): {
+    ok: boolean;
+    version: string | null;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/security/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,6GAA6G;AAC7G,eAAO,MAAM,WAAW,kBAAmB,CAAC;AAC5C,eAAO,MAAM,gBAAgB,QAA8B,CAAC;AAE5D,eAAO,MAAM,sBAAsB,0DAA0D,CAAC;AAM9F,qFAAqF;AACrF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK3C;AAUD,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAIpD;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAyB1G;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAqBlG;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAMhG"}

package/dist/src/security/errors.js

@@ -0,0 +1,116 @@
+/**
+ * Turns AWS CLI failures into messages a developer can act on.
+ *
+ * Three cases get their own wording because the raw CLI output does not say
+ * what to do: no usable credentials, an AWS CLI too old to know the
+ * `securityagent` commands, and an AccessDenied (which API, and which IAM
+ * action it needed). Everything printed goes through redact() first, so a
+ * credential that ends up in an error string is never echoed.
+ */
+/** First AWS CLI release with the Security Agent code review commands (matches the CI eval gate's check). */
+export const MIN_AWS_CLI = [2, 36];
+export const MIN_AWS_CLI_TEXT = `v${MIN_AWS_CLI.join('.')}`;
+export const NO_CREDENTIALS_MESSAGE = 'Failed to get account ID. Check your AWS credentials.';
+const CREDENTIAL_ERRORS = /Unable to locate credentials|could not be found|ExpiredToken|InvalidClientTokenId|SignatureDoesNotMatch|Token has expired|The SSO session|NoCredentialProviders|Error loading SSO Token|security token included in the request is (invalid|expired)/i;
+const ACCESS_DENIED = /AccessDenied|UnauthorizedOperation|not authorized to perform|UnauthorizedException/i;
+const UNKNOWN_COMMAND = /invalid choice/i;
+/** Removes anything shaped like an AWS credential from text before it is printed. */
+export function redact(text) {
+    return text
+        .replace(/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, '[redacted access key]')
+        .replace(/(aws_secret_access_key|aws_session_token|SecretAccessKey|SessionToken)(["']?\s*[:=]\s*["']?)[^\s"',}]+/gi, '$1$2[redacted]')
+        .replace(/(X-Amz-Security-Token|X-Amz-Signature|X-Amz-Credential)=[^&\s"']+/gi, '$1=[redacted]');
+}
+/** `list-agent-spaces` -> `ListAgentSpaces`. */
+function pascal(cmd) {
+    return cmd.split('-').map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join('');
+}
+const SERVICE_PREFIX = { s3api: 's3', s3: 's3' };
+const S3_ACTIONS = { 'head-object': 's3:GetObject', 'put-object': 's3:PutObject', cp: 's3:PutObject' };
+/** The IAM action an `aws <service> <command>` call needs, derived from the argv. */
+export function permissionFor(args) {
+    const [service = '', command = ''] = args;
+    if (service === 's3api' || service === 's3')
+        return S3_ACTIONS[command] ?? `s3:${pascal(command)}`;
+    return `${SERVICE_PREFIX[service] ?? service}:${pascal(command)}`;
+}
+/**
+ * Explains a failed `aws` call. `args` is the argv that failed (without
+ * --region/--profile), `stderr` what the CLI printed, `cliVersion` the
+ * `aws --version` output when known.
+ */
+export function explainAwsError(args, stderr, cliVersion) {
+    const raw = redact((stderr || '').trim());
+    const lastLine = raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+    if (UNKNOWN_COMMAND.test(raw)) {
+        return {
+            kind: 'old-cli',
+            message: `This AWS CLI does not have "aws ${args.slice(0, 2).join(' ')}". prism-cli enable security needs AWS CLI ${MIN_AWS_CLI_TEXT} or later`
+                + `${cliVersion ? ` (found ${cliVersion.split(/\s+/)[0]})` : ''}. Install it from https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html`,
+        };
+    }
+    if (CREDENTIAL_ERRORS.test(raw)) {
+        return {
+            kind: 'no-credentials',
+            message: `${NO_CREDENTIALS_MESSAGE}\n  ${lastLine}\n  Configure them with "aws configure" or "aws sso login", or pass --profile <name>.`,
+        };
+    }
+    if (ACCESS_DENIED.test(raw)) {
+        const op = /when calling the (\w+) operation/.exec(raw)?.[1] ?? pascal(args[1] || '');
+        const action = /not authorized to perform:?\s+([\w-]+:[\w*]+)/.exec(raw)?.[1] ?? permissionFor(args);
+        return {
+            kind: 'access-denied',
+            message: `AccessDenied: ${op} (aws ${args.slice(0, 2).join(' ')}) was refused. The caller needs the IAM permission ${action}.\n  ${lastLine}`,
+        };
+    }
+    return { kind: 'other', message: `aws ${args.slice(0, 2).join(' ')} failed: ${lastLine}` };
+}
+/**
+ * Lines for an error that is not one of ours (not an Abort): a failed npm or
+ * cdk run, a JSON parse, a git or file-system error. One redacted `Error:`
+ * line, at most one hint, and the redacted stack only with PRISM_DEBUG=1.
+ *
+ * Only `message`, `code`, `syscall` and `stack` are read. A child-process
+ * error also carries `cmd`, `spawnargs`, `envPairs`, `stdout` and `stderr`,
+ * which can hold full command lines and the environment; those are never read.
+ */
+export function describeUnexpectedError(e, env = process.env) {
+    const err = e instanceof Error ? e : new Error(String(e));
+    const extra = err;
+    const code = typeof extra.code === 'string' ? extra.code : '';
+    const syscall = typeof extra.syscall === 'string' ? extra.syscall : '';
+    const firstLine = redact(err.message || String(e)).split('\n').map((l) => l.trim()).find(Boolean) || 'unknown error';
+    const lines = [`Error: ${firstLine}`];
+    const msg = err.message || '';
+    let hint = '';
+    // Most specific first: a parse or fs error whose message merely contains a
+    // path like cdk.out/... or .git/... must not get the cdk or git hint.
+    const spawned = syscall.startsWith('spawn');
+    if (/Command failed: npm\b|\bnpm (ERR|error)\b/.test(msg))
+        hint = 'Installing the CDK app dependencies failed: check network access to the npm registry and that Node.js 22 is installed, then re-run.';
+    else if (err instanceof SyntaxError || /\bJSON\b/.test(msg))
+        hint = 'A CDK template or an AWS response was not valid JSON; re-run, and report it if it repeats.';
+    else if (syscall && code && !spawned)
+        hint = `File system error (${code} during ${syscall}): check the path exists and is writable.`;
+    else if (/(^|[\s:'"])cdk\b(?![.-])/.test(msg))
+        hint = 'The CDK step failed: re-run with --dry-run to see the synth output, and check that the account is CDK-bootstrapped.';
+    else if (/(^|[\s:'"])git\b(?![.-])/.test(msg))
+        hint = 'A git command failed: run prism-cli enable security from inside the repository.';
+    else if (syscall && code)
+        hint = `Could not start a program (${code} during ${syscall}): check it is installed and on PATH.`;
+    if (hint)
+        lines.push(`  ${hint}`);
+    if (env.PRISM_DEBUG === '1' && err.stack)
+        lines.push(redact(err.stack));
+    return lines;
+}
+/** Parses `aws --version` ("aws-cli/2.36.19 Python/...") and checks it against MIN_AWS_CLI. */
+export function cliVersionOk(versionText) {
+    const m = /aws-cli\/(\d+)\.(\d+)\.(\d+)/.exec(versionText || '');
+    if (!m)
+        return { ok: true, version: null }; // unknown: let the first securityagent call decide
+    const [maj, min] = [Number(m[1]), Number(m[2])];
+    const ok = maj > MIN_AWS_CLI[0] || (maj === MIN_AWS_CLI[0] && min >= MIN_AWS_CLI[1]);
+    return { ok, version: `${m[1]}.${m[2]}.${m[3]}` };
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/security/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,EAAE,CAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAE5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,uDAAuD,CAAC;AAE9F,MAAM,iBAAiB,GAAG,sPAAsP,CAAC;AACjR,MAAM,aAAa,GAAG,qFAAqF,CAAC;AAC5G,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,qFAAqF;AACrF,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,OAAO,CAAC,8BAA8B,EAAE,uBAAuB,CAAC;SAChE,OAAO,CAAC,0GAA0G,EAAE,gBAAgB,CAAC;SACrI,OAAO,CAAC,qEAAqE,EAAE,eAAe,CAAC,CAAC;AACrG,CAAC;AAED,gDAAgD;AAChD,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,cAAc,GAA2B,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACzE,MAAM,UAAU,GAA2B,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;AAE/H,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAC1C,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACnG,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACpE,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,MAAc,EAAE,UAA0B;IACxF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC;IAC/F,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,8CAA8C,gBAAgB,WAAW;kBAC3I,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iGAAiG;SACnK,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,sBAAsB,OAAO,QAAQ,uFAAuF;SACzI,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QACrG,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,iBAAiB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sDAAsD,MAAM,QAAQ,QAAQ,EAAE;SAC9I,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAU,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAoD,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,qIAAqI,CAAC;SACnM,IAAI,GAAG,YAAY,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,4FAA4F,CAAC;SAC5J,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,GAAG,sBAAsB,IAAI,WAAW,OAAO,2CAA2C,CAAC;SAChI,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,qHAAqH,CAAC;SACvK,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,iFAAiF,CAAC;SACnI,IAAI,OAAO,IAAI,IAAI;QAAE,IAAI,GAAG,8BAA8B,IAAI,WAAW,OAAO,uCAAuC,CAAC;IAC7H,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,WAA0B;IACrD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,mDAAmD;IAC/F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACpD,CAAC"}

package/dist/src/security/marker.d.ts

@@ -0,0 +1,46 @@
+import type { RunResult } from '../utils/exec.js';
+export declare const MARKER_PATH = ".prism/security.local.json";
+export interface SecurityMarker {
+    agentSpaceId: string;
+    applicationId: string;
+    codeReviewId: string;
+    region: string;
+    account: string;
+    setupAt: string;
+}
+/** Only `.prism/security.local.json`, never the legacy config.json block. */
+export declare function readLocalMarker(repoRoot: string): SecurityMarker | null;
+/** The marker and where it came from: the local file first, else the legacy `security` block. */
+export declare function readSecurityMarkerWithSource(repoRoot: string): {
+    marker: SecurityMarker;
+    source: 'local' | 'legacy';
+} | null;
+/** The marker, or null when it is absent or incomplete. */
+export declare function readSecurityMarker(repoRoot: string): SecurityMarker | null;
+/**
+ * Removes only the `security` key from `.prism/config.json`, keeping every
+ * other key, its order, the indent and the trailing newline. Returns true when
+ * the key was there.
+ */
+export declare function removeLegacyBlock(repoRoot: string): boolean;
+export interface MarkerWrite {
+    path: string;
+    /** False when the file already held the same ids (setupAt is then kept). */
+    wrote: boolean;
+    /** A legacy `security` block was removed from `.prism/config.json`. */
+    migrated: boolean;
+}
+/**
+ * Writes `.prism/security.local.json`. setupAt is kept when nothing else
+ * changed, so a re-run that changes nothing leaves the file as it was. A
+ * legacy block in `.prism/config.json` is removed after the new file is written.
+ */
+export declare function writeSecurityMarker(repoRoot: string, m: Omit<SecurityMarker, 'setupAt'>, now: Date): MarkerWrite;
+/**
+ * Makes sure git ignores the marker in this clone, without touching the repo's
+ * .gitignore: when `git check-ignore` says it is not ignored, the path is added
+ * to `info/exclude` (resolved with `git rev-parse --git-path`, so linked
+ * worktrees use the right file). Returns the exclude file when it was changed.
+ */
+export declare function ensureMarkerIgnored(repoRoot: string, git: (args: string[]) => RunResult): string | null;
+//# sourceMappingURL=marker.d.ts.map

package/dist/src/security/marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.d.ts","sourceRoot":"","sources":["../../../src/security/marker.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,eAAO,MAAM,WAAW,+BAA+B,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAEvE;AAMD,iGAAiG;AACjG,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAK5H;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAE1E;AAQD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS3D;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,WAAW,CAchH;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAS,GAAG,MAAM,GAAG,IAAI,CAUvG"}

package/dist/src/security/marker.js

@@ -0,0 +1,120 @@
+/**
+ * The local record that `prism-cli enable security` finished in this repo:
+ * `.prism/security.local.json`. Ids, account and region only, never a secret.
+ * It is per developer and never committed (`.prism/config.json` stays safe to
+ * commit for the team reviewer). The dashboard's Security Agent row reads it,
+ * so the dashboard stays credential-free.
+ *
+ * Earlier versions wrote the same block as `security` inside
+ * `.prism/config.json`. Readers fall back to it, and the next successful
+ * `enable security` run moves it here.
+ */
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { CONFIG_PATH, readPrismConfig } from '../codewatch/config.js';
+export const MARKER_PATH = '.prism/security.local.json';
+const REQUIRED = ['agentSpaceId', 'codeReviewId', 'region', 'account'];
+function parseMarker(s) {
+    if (!s || typeof s !== 'object')
+        return null;
+    for (const k of REQUIRED)
+        if (typeof s[k] !== 'string' || !s[k])
+            return null;
+    return {
+        agentSpaceId: s.agentSpaceId, applicationId: typeof s.applicationId === 'string' ? s.applicationId : '',
+        codeReviewId: s.codeReviewId, region: s.region, account: s.account,
+        setupAt: typeof s.setupAt === 'string' ? s.setupAt : '',
+    };
+}
+/** Only `.prism/security.local.json`, never the legacy config.json block. */
+export function readLocalMarker(repoRoot) {
+    return readLocal(repoRoot);
+}
+function readLocal(repoRoot) {
+    try {
+        return parseMarker(JSON.parse(readFileSync(resolve(repoRoot, MARKER_PATH), 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+/** The marker and where it came from: the local file first, else the legacy `security` block. */
+export function readSecurityMarkerWithSource(repoRoot) {
+    const local = readLocal(repoRoot);
+    if (local)
+        return { marker: local, source: 'local' };
+    const legacy = parseMarker(readPrismConfig(repoRoot).security);
+    return legacy ? { marker: legacy, source: 'legacy' } : null;
+}
+/** The marker, or null when it is absent or incomplete. */
+export function readSecurityMarker(repoRoot) {
+    return readSecurityMarkerWithSource(repoRoot)?.marker ?? null;
+}
+/** The indent a JSON file uses (its first indented line), so a rewrite keeps the look. */
+function detectIndent(text) {
+    const m = /\n([ \t]+)"/.exec(text);
+    return m ? m[1] : 2;
+}
+/**
+ * Removes only the `security` key from `.prism/config.json`, keeping every
+ * other key, its order, the indent and the trailing newline. Returns true when
+ * the key was there.
+ */
+export function removeLegacyBlock(repoRoot) {
+    const p = resolve(repoRoot, CONFIG_PATH);
+    let text;
+    let cfg;
+    try {
+        text = readFileSync(p, 'utf8');
+        cfg = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg) || !('security' in cfg))
+        return false;
+    delete cfg.security;
+    writeFileSync(p, JSON.stringify(cfg, null, detectIndent(text)) + (text.endsWith('\n') ? '\n' : ''));
+    return true;
+}
+/**
+ * Writes `.prism/security.local.json`. setupAt is kept when nothing else
+ * changed, so a re-run that changes nothing leaves the file as it was. A
+ * legacy block in `.prism/config.json` is removed after the new file is written.
+ */
+export function writeSecurityMarker(repoRoot, m, now) {
+    const p = resolve(repoRoot, MARKER_PATH);
+    const prev = readSecurityMarkerWithSource(repoRoot);
+    const pm = prev?.marker;
+    const same = !!pm && pm.agentSpaceId === m.agentSpaceId && pm.applicationId === m.applicationId
+        && pm.codeReviewId === m.codeReviewId && pm.region === m.region && pm.account === m.account && !!pm.setupAt;
+    let wrote = false;
+    if (!(same && prev.source === 'local')) {
+        mkdirSync(dirname(p), { recursive: true });
+        writeFileSync(p, JSON.stringify({ ...m, setupAt: same ? pm.setupAt : now.toISOString() }, null, 2) + '\n');
+        wrote = !same;
+    }
+    const migrated = removeLegacyBlock(repoRoot);
+    return { path: p, wrote, migrated };
+}
+/**
+ * Makes sure git ignores the marker in this clone, without touching the repo's
+ * .gitignore: when `git check-ignore` says it is not ignored, the path is added
+ * to `info/exclude` (resolved with `git rev-parse --git-path`, so linked
+ * worktrees use the right file). Returns the exclude file when it was changed.
+ */
+export function ensureMarkerIgnored(repoRoot, git) {
+    if (git(['-C', repoRoot, 'check-ignore', '-q', MARKER_PATH]).ok)
+        return null;
+    const r = git(['-C', repoRoot, 'rev-parse', '--path-format=absolute', '--git-path', 'info/exclude']);
+    if (!r.ok || !r.stdout)
+        return null;
+    const exclude = r.stdout.trim();
+    const text = existsSync(exclude) ? readFileSync(exclude, 'utf8') : '';
+    if (text.split('\n').some((l) => l.trim() === MARKER_PATH || l.trim() === `/${MARKER_PATH}`))
+        return null;
+    mkdirSync(dirname(exclude), { recursive: true });
+    appendFileSync(exclude, `${text && !text.endsWith('\n') ? '\n' : ''}# prism-cli enable security: per-developer record, never committed\n${MARKER_PATH}\n`);
+    return exclude;
+}
+//# sourceMappingURL=marker.js.map

package/dist/src/security/marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.js","sourceRoot":"","sources":["../../../src/security/marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEtE,MAAM,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAWxD,MAAM,QAAQ,GAA6B,CAAC,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEjG,SAAS,WAAW,CAAC,CAAM;IACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QACvG,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;QAClE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QAAC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACtH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAChE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACvF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,OAAO,GAAG,CAAC,QAAQ,CAAC;IACpB,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,CAAkC,EAAE,GAAS;IACjG,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;WAC1F,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;IAC9G,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC,CAAC,IAAI,IAAI,IAAK,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5G,KAAK,GAAG,CAAC,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,GAAkC;IACtF,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1G,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,uEAAuE,WAAW,IAAI,CAAC,CAAC;IAC3J,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/security/pentest-dockerfile.d.ts

@@ -0,0 +1,8 @@
+import { type RepoCtx } from './setup.js';
+import type { PentestApp } from './pentest.js';
+/** Short, CFN-safe run id from the repo name plus a base36 timestamp. */
+export declare function runSlug(repo: RepoCtx, now: number): string;
+export declare function dockerfileApp(opts: {
+    profile?: string;
+}): PentestApp;
+//# sourceMappingURL=pentest-dockerfile.d.ts.map

package/dist/src/security/pentest-dockerfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest-dockerfile.d.ts","sourceRoot":"","sources":["../../../src/security/pentest-dockerfile.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAyC,MAAM,cAAc,CAAC;AAwBtF,yEAAyE;AACzE,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAkGpE"}