@prism-d1/cli 1.1.2 → 1.3.0

package/dist/assets/infra/lib/security-agent-resources.ts

@@ -0,0 +1,136 @@
+/**
+ * The Security Agent resources and the CI access to them, shared by the two
+ * places they can live:
+ *
+ * - PrismD1MetricsPipeline, with context enableSecurityAgent=true (the
+ *   original layout; existing accounts keep it);
+ * - PrismD1SecurityAgent, the standalone stack (context
+ *   securityAgentStandalone=true), for accounts that want Security Agent
+ *   without the metrics pipeline.
+ *
+ * Construct ids are relative to the given scope, so the pipeline's logical ids
+ * are unchanged by moving this code here. Both layouts use the same fixed names
+ * (role, managed policy, bucket, SSM parameters, exports), so CloudFormation
+ * refuses a second copy in the same account and region.
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+
+export function addSecurityAgentResources(scope: Construct, kmsKey: kms.IKey): SecurityAgentConstruct {
+  const securityAgent = new SecurityAgentConstruct(scope, 'SecurityAgent', {
+    agentSpaceName: 'prism-d1-security',
+    description: 'PRISM D1 Continuum space for design review, code review, and pen testing',
+    kmsKey: kmsKey,
+    codeRemediationStrategy: 'DISABLED',
+    tags: {
+      'prism:pillar': 'security',
+    },
+  });
+
+  // Grant GitHub OIDC roles access to scan bucket and Continuum APIs.
+  // The OIDC role is created by `prism-cli bootstrapper setup-github-oidc`
+  // with name pattern prism-d1-github-oidc-*.
+  securityAgent.scanBucket.addToResourcePolicy(
+    new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      principals: [new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:root`)],
+      actions: ['s3:PutObject', 's3:GetObject'],
+      resources: [securityAgent.scanBucket.arnForObjects('*')],
+      conditions: {
+        ArnLike: {
+          'aws:PrincipalArn': `arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/prism-d1-github-oidc-*`,
+        },
+      },
+    }),
+  );
+
+  // Create a managed policy for Continuum scan API access.
+  // Attached to the OIDC role by the bootstrapper setup script.
+  const continuumCiPolicy = new iam.ManagedPolicy(scope, 'ContinuumCiPolicy', {
+    managedPolicyName: 'prism-d1-continuum-ci-scan',
+    description: 'Grants GitHub Actions workflows access to Continuum diff scan APIs and SSM config',
+    statements: [
+      new iam.PolicyStatement({
+        sid: 'ContinuumScanAPIs',
+        effect: iam.Effect.ALLOW,
+        actions: [
+          'securityagent:StartCodeReviewJob',
+          'securityagent:BatchGetCodeReviewJobs',
+          'securityagent:BatchGetCodeReviewJobTasks',
+          'securityagent:ListFindings',
+          'securityagent:BatchGetFindings',
+          'securityagent:CreateCodeReview',
+          'securityagent:ListCodeReviews',
+        ],
+        resources: [
+          `arn:aws:securityagent:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:agent-space/*`,
+        ],
+      }),
+      new iam.PolicyStatement({
+        sid: 'PassRoleForCodeReview',
+        effect: iam.Effect.ALLOW,
+        actions: ['iam:PassRole'],
+        resources: [securityAgent.serviceRole.roleArn],
+        conditions: {
+          StringEquals: { 'iam:PassedToService': 'securityagent.amazonaws.com' },
+        },
+      }),
+      new iam.PolicyStatement({
+        sid: 'ScanBucketWrite',
+        effect: iam.Effect.ALLOW,
+        actions: ['s3:PutObject', 's3:GetObject', 's3:ListBucket'],
+        resources: [
+          securityAgent.scanBucket.bucketArn,
+          securityAgent.scanBucket.arnForObjects('*'),
+        ],
+      }),
+      new iam.PolicyStatement({
+        sid: 'KMSForScanBucket',
+        effect: iam.Effect.ALLOW,
+        actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+        resources: [kmsKey.keyArn],
+      }),
+      new iam.PolicyStatement({
+        sid: 'SSMReadConfig',
+        effect: iam.Effect.ALLOW,
+        actions: ['ssm:GetParameter', 'ssm:GetParameters', 'ssm:PutParameter'],
+        resources: [
+          `arn:aws:ssm:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:parameter/prism/continuum/*`,
+        ],
+      }),
+    ],
+  });
+
+  NagSuppressions.addResourceSuppressions(
+    continuumCiPolicy,
+    [
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'Agent space ID is dynamic; wildcard scoped to securityagent service resources only',
+        appliesTo: [`Resource::arn:aws:securityagent:<AWS::Region>:<AWS::AccountId>:agent-space/*`],
+      },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'Scan bucket objects include dynamic diff filenames (SHA-based); wildcard on objects only',
+        appliesTo: ['Resource::<SecurityAgentScanBucketB752F4A9.Arn>/*'],
+      },
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'SSM parameters under /prism/continuum/ are all non-sensitive config values (IDs and bucket names)',
+        appliesTo: ['Resource::arn:aws:ssm:<AWS::Region>:<AWS::AccountId>:parameter/prism/continuum/*'],
+      },
+    ],
+    true,
+  );
+
+  new cdk.CfnOutput(scope, 'ContinuumCiPolicyArn', {
+    value: continuumCiPolicy.managedPolicyArn,
+    description: 'Attach this policy to your GitHub OIDC role for Continuum CI scans',
+  });
+
+  return securityAgent;
+}

package/dist/assets/infra/lib/security-agent-stack.ts

@@ -0,0 +1,69 @@
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import { Construct } from 'constructs';
+import { NagSuppressions } from 'cdk-nag';
+import { SecurityAgentConstruct } from './constructs/security-agent-construct';
+import { addSecurityAgentResources } from './security-agent-resources';
+
+export interface SecurityAgentStackProps extends cdk.StackProps {
+  /**
+   * ARN of an existing KMS key to encrypt the agent space with. Its key policy
+   * must already allow securityagent.amazonaws.com to encrypt and decrypt; an
+   * imported key's policy cannot be changed from here. Default: a new key.
+   */
+  kmsKeyArn?: string;
+}
+
+/**
+ * PrismD1SecurityAgent: AWS Security Agent for PRISM without the metrics
+ * pipeline. Same resources, names and exports as the pipeline's
+ * enableSecurityAgent=true path, plus its own KMS key. Only for accounts that
+ * do not host Security Agent in PrismD1MetricsPipeline; the fixed resource
+ * and export names make CloudFormation refuse a second copy.
+ *
+ * Not here: the security-agent-processor and remediation tracker Lambdas,
+ * which read the pipeline's tables and stay in PrismD1MetricsPipeline.
+ */
+export class SecurityAgentStack extends cdk.Stack {
+  public readonly securityAgent: SecurityAgentConstruct;
+
+  constructor(scope: Construct, id: string, props: SecurityAgentStackProps = {}) {
+    super(scope, id, props);
+
+    let key: kms.IKey;
+    if (props.kmsKeyArn) {
+      key = kms.Key.fromKeyArn(this, 'SecurityAgentKey', props.kmsKeyArn);
+    } else {
+      // The same grants the pipeline's PrismDataKey gives Security Agent.
+      const k = new kms.Key(this, 'SecurityAgentKey', {
+        alias: 'alias/prism-d1-security-agent-key',
+        description: 'Encryption key for the PRISM D1 Security Agent space',
+        enableKeyRotation: true,
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+      });
+      k.grantEncryptDecrypt(new iam.ServicePrincipal('securityagent.amazonaws.com'));
+      k.addToResourcePolicy(new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        principals: [new iam.ServicePrincipal('logs.amazonaws.com')],
+        actions: ['kms:Encrypt', 'kms:Decrypt', 'kms:GenerateDataKey*', 'kms:DescribeKey'],
+        resources: ['*'],
+        conditions: {
+          ArnLike: {
+            'kms:EncryptionContext:aws:logs:arn': `arn:aws:logs:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:log-group:/aws/securityagent/*`,
+          },
+        },
+      }));
+      key = k;
+    }
+
+    this.securityAgent = addSecurityAgentResources(this, key);
+
+    // The pipeline stack carries the same suppression stack-wide.
+    NagSuppressions.addStackSuppressions(this, [{
+      id: 'AwsSolutions-IAM5',
+      reason: 'CDK KMS grant generates kms:GenerateDataKey* and kms:ReEncrypt* wildcard actions which are required for envelope encryption',
+      appliesTo: ['Action::kms:GenerateDataKey*', 'Action::kms:ReEncrypt*'],
+    }]);
+  }
+}

package/dist/assets/infra/package.json

@@ -11,7 +11,10 @@
     "diff": "cdk diff",
     "check:metrics": "tsx scripts/check-metric-coverage.ts",
     "check:attribution": "tsx scripts/check-attribution-contract.ts",
-    "check:transitions": "tsx scripts/check-commit-transitions.ts"
+    "check:transitions": "tsx scripts/check-commit-transitions.ts",
+    "check:pricing": "tsx scripts/check-pricing.ts",
+    "check:tools": "tsx scripts/check-tool-usage.ts",
+    "pricing:snapshot": "tsx scripts/refresh-pricing-snapshot.ts"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.170.0",

package/dist/assets/metric-hooks/prepare-commit-msg

@@ -6,7 +6,9 @@
 # (Linux/macOS/Windows Git Bash) with NO dependency on jq, bc, sed, or grep -P.
 # Token tracking powered by codeburn / prism-cli.
 #
-# Installation: prism-cli bootstrapper install-git-hooks
+# RETIRED: no command installs this hook any more. `prism-cli enable codewatch`
+# (and its deprecated alias `bootstrapper install-git-hooks`) removes it when found.
+# Kept for reference only.
 
 set -uo pipefail
 

package/dist/assets/pentest-cdk/bin/app.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import * as cdk from 'aws-cdk-lib';
+import { PentestTargetStack } from '../lib/pentest-target-stack';
+
+const app = new cdk.App();
+const slug = String(app.node.tryGetContext('slug') || '');
+if (!slug) throw new Error('pentest-cdk: context "slug" is required (the adapter sets it)');
+// The adapter addresses this stack by the same name (PrismPentest-<slug>).
+new PentestTargetStack(app, `PrismPentest-${slug}`, {
+  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: process.env.CDK_DEFAULT_REGION },
+  description: 'prism-cli security pentest target: private VPC + Fargate + internal ALB (temporary)',
+});

package/dist/assets/pentest-cdk/cdk.json

@@ -0,0 +1,7 @@
+{
+  "app": "npx ts-node --prefer-ts-exts bin/app.ts",
+  "context": {
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/core:checkSecretUsage": true
+  }
+}

package/dist/assets/pentest-cdk/lib/pentest-target-stack.ts

@@ -0,0 +1,206 @@
+/**
+ * The temporary pentest TARGET environment, deployed per run by
+ * `prism-cli security pentest` (dockerfile adapter). Generalized from the
+ * hand-run spike stack (removed once this replaced it); see
+ * docs/DESIGN-prism-cli-pentest.md. Test target: cli/test/fixtures/pentest-sample.
+ *
+ * Private VPC only: private isolated subnets, no public subnet, no internet
+ * gateway, no NAT, no 0.0.0.0/0 ingress anywhere. The app runs on Fargate
+ * behind an INTERNAL ALB; the pentest agent's ENI reaches it over local VPC
+ * routing. VPC endpoints (ECR api+dkr, S3 gateway, CloudWatch Logs) let Fargate
+ * run with no internet path.
+ *
+ * Context (all from `cdk -c key=value`, set by the adapter):
+ *   slug        run id; names the stack's resources and the private zone
+ *   appDir      absolute path to the Docker build context -> image asset
+ *   dockerfile  Dockerfile path relative to appDir (default: Dockerfile)
+ *   port        container port the app listens on
+ *   healthPath  ALB health-check path
+ *   zoneName    private hosted-zone name (host is app.<zoneName>)
+ *   ttlHours    hours from synth for the prism:expires-at tag
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as ecrAssets from 'aws-cdk-lib/aws-ecr-assets';
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as route53 from 'aws-cdk-lib/aws-route53';
+import * as targets from 'aws-cdk-lib/aws-route53-targets';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import { Construct } from 'constructs';
+
+const ALB_PORT = 80;
+
+/** A JSON context value (the adapter passes env, secrets and actor ARNs this way); absent = fallback. */
+function ctxJson<T>(scope: Construct, key: string, fallback: T): T {
+  const v = scope.node.tryGetContext(key);
+  if (v === undefined || v === null || v === '') return fallback;
+  return (typeof v === 'string' ? JSON.parse(v) : v) as T;
+}
+
+/** A Secrets Manager ARN with its random 6-character suffix is complete; without it, partial. */
+const isCompleteSecretArn = (arn: string) => /-[A-Za-z0-9]{6}$/.test(arn);
+
+function ctxStr(scope: Construct, key: string, fallback?: string): string {
+  const v = scope.node.tryGetContext(key);
+  if (v === undefined || v === null || v === '') {
+    if (fallback !== undefined) return fallback;
+    throw new Error(`pentest-cdk: required context "${key}" is not set`);
+  }
+  return String(v);
+}
+
+export class PentestTargetStack extends cdk.Stack {
+  constructor(scope: Construct, id: string, props: cdk.StackProps) {
+    super(scope, id, props);
+
+    const slug = ctxStr(this, 'slug');
+    const appDir = ctxStr(this, 'appDir');
+    const port = Number(ctxStr(this, 'port', '8080'));
+    const healthPath = ctxStr(this, 'healthPath', '/health');
+    const zoneName = ctxStr(this, 'zoneName', `${slug}.prism.internal`);
+    const ttlHours = Number(ctxStr(this, 'ttlHours', '24'));
+    const logGroupName = `/aws/securityagent/prism-pentest-${slug}`;
+
+    cdk.Tags.of(this).add('prism:purpose', 'pentest');
+    cdk.Tags.of(this).add('prism:pentest-run', slug);
+    cdk.Tags.of(this).add('prism:expires-at', new Date(Date.now() + ttlHours * 3_600_000).toISOString());
+
+    // --- Network: private isolated subnets only (no IGW, no NAT) ---------
+    const vpc = new ec2.Vpc(this, 'Vpc', {
+      ipAddresses: ec2.IpAddresses.cidr('10.80.0.0/16'),
+      maxAzs: 2,
+      natGateways: 0,
+      subnetConfiguration: [{ name: 'private', subnetType: ec2.SubnetType.PRIVATE_ISOLATED, cidrMask: 24 }],
+      restrictDefaultSecurityGroup: true,
+    });
+    const privateSubnets = { subnetType: ec2.SubnetType.PRIVATE_ISOLATED };
+
+    const sg = (name: string, description: string) => new ec2.SecurityGroup(this, name, { vpc, description, allowAllOutbound: false });
+    const agentSg = sg('AgentSg', 'Pentest agent ENI: may reach the internal ALB on 80 only');
+    const albSg = sg('AlbSg', 'Internal ALB: accepts the pentest agent only');
+    const appSg = sg('AppSg', 'App tasks: accept the ALB only');
+    const endpointSg = sg('EndpointSg', 'VPC interface endpoints: accept the app tasks only');
+
+    agentSg.addEgressRule(albSg, ec2.Port.tcp(ALB_PORT), 'to the internal ALB');
+    albSg.addIngressRule(agentSg, ec2.Port.tcp(ALB_PORT), 'from the pentest agent');
+    appSg.addEgressRule(endpointSg, ec2.Port.tcp(443), 'to VPC interface endpoints');
+    endpointSg.addIngressRule(appSg, ec2.Port.tcp(443), 'from the app tasks');
+
+    vpc.addGatewayEndpoint('S3', { service: ec2.GatewayVpcEndpointAwsService.S3, subnets: [privateSubnets] });
+    const s3PrefixList = ec2.PrefixList.fromLookup(this, 'S3PrefixList', { prefixListName: `com.amazonaws.${this.region}.s3` });
+    appSg.addEgressRule(ec2.Peer.prefixList(s3PrefixList.prefixListId), ec2.Port.tcp(443), 'to S3 (ECR image layers)');
+
+    const appEnv = ctxJson<Record<string, string>>(this, 'env', {});
+    const appSecrets = ctxJson<Record<string, string>>(this, 'secrets', {});
+    const actorSecrets = ctxJson<string[]>(this, 'actorSecrets', []);
+    const actorLambdas = ctxJson<string[]>(this, 'actorLambdas', []);
+
+    const endpoints: [string, ec2.InterfaceVpcEndpointAwsService][] = [
+      ['EcrApi', ec2.InterfaceVpcEndpointAwsService.ECR],
+      ['EcrDkr', ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER],
+      ['Logs', ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS],
+    ];
+    // With no internet path, a task reads its secrets at start through this endpoint.
+    if (Object.keys(appSecrets).length) endpoints.push(['SecretsManager', ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER]);
+    for (const [cid, service] of endpoints) {
+      vpc.addInterfaceEndpoint(cid, { service, subnets: privateSubnets, securityGroups: [endpointSg], open: false, privateDnsEnabled: true });
+    }
+
+    // --- App: Fargate behind an internal ALB -----------------------------
+    // dockerfile: path relative to appDir (the build context); may be in a subfolder.
+    const dockerfile = ctxStr(this, 'dockerfile', 'Dockerfile');
+    const image = new ecrAssets.DockerImageAsset(this, 'Image', { directory: appDir, file: dockerfile, platform: ecrAssets.Platform.LINUX_AMD64 });
+    const appLogs = new logs.LogGroup(this, 'AppLogs', { retention: logs.RetentionDays.ONE_WEEK, removalPolicy: cdk.RemovalPolicy.DESTROY });
+    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });
+    const task = new ecs.FargateTaskDefinition(this, 'Task', {
+      cpu: 256, memoryLimitMiB: 512,
+      runtimePlatform: { cpuArchitecture: ecs.CpuArchitecture.X86_64, operatingSystemFamily: ecs.OperatingSystemFamily.LINUX },
+    });
+    task.addContainer('app', {
+      image: ecs.ContainerImage.fromDockerImageAsset(image),
+      portMappings: [{ containerPort: port }],
+      environment: { ...appEnv, PORT: String(port) },
+      // Injected by ECS at task start; the execution role is granted read on exactly these secrets.
+      secrets: Object.fromEntries(Object.entries(appSecrets).map(([name, arn], i) => [name, ecs.Secret.fromSecretsManager(
+        isCompleteSecretArn(arn) ? secretsmanager.Secret.fromSecretCompleteArn(this, `AppSecret${i}`, arn) : secretsmanager.Secret.fromSecretPartialArn(this, `AppSecret${i}`, arn),
+      )])),
+      logging: ecs.LogDrivers.awsLogs({ logGroup: appLogs, streamPrefix: 'app' }),
+    });
+    const service = new ecs.FargateService(this, 'Service', {
+      cluster, taskDefinition: task, desiredCount: 1, minHealthyPercent: 100,
+      assignPublicIp: false, vpcSubnets: privateSubnets, securityGroups: [appSg], circuitBreaker: { rollback: true },
+    });
+
+    const alb = new elbv2.ApplicationLoadBalancer(this, 'Alb', {
+      vpc, internetFacing: false, vpcSubnets: privateSubnets, securityGroup: albSg, dropInvalidHeaderFields: true,
+    });
+    const listener = alb.addListener('Http', { port: ALB_PORT, protocol: elbv2.ApplicationProtocol.HTTP, open: false });
+    // Faster than the 5 x 30s default, so a new task turns healthy in ~20s; the
+    // command waits for a healthy target before starting the pentest.
+    const targetGroup = listener.addTargets('App', {
+      port, protocol: elbv2.ApplicationProtocol.HTTP, targets: [service],
+      healthCheck: { path: healthPath, interval: cdk.Duration.seconds(10), timeout: cdk.Duration.seconds(5), healthyThresholdCount: 2, unhealthyThresholdCount: 3 },
+      deregistrationDelay: cdk.Duration.seconds(10),
+    });
+
+    // --- Private hostname -------------------------------------------------
+    const zone = new route53.PrivateHostedZone(this, 'Zone', { zoneName, vpc });
+    new route53.ARecord(this, 'AppRecord', { zone, recordName: 'app', target: route53.RecordTarget.fromAlias(new targets.LoadBalancerTarget(alb)) });
+
+    // --- Source zip bucket and agent log group ---------------------------
+    const source = new s3.Bucket(this, 'Source', {
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL, encryption: s3.BucketEncryption.S3_MANAGED,
+      enforceSSL: true, removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true,
+    });
+    const agentLogs = new logs.LogGroup(this, 'AgentLogs', { logGroupName, retention: logs.RetentionDays.ONE_WEEK, removalPolicy: cdk.RemovalPolicy.DESTROY });
+
+    // --- Pentest service role (scoped ENI permissions; spike-confirmed) ---
+    const subnetArns = vpc.isolatedSubnets.map((s) => this.formatArn({ service: 'ec2', resource: 'subnet', resourceName: s.subnetId }));
+    const agentSgArn = this.formatArn({ service: 'ec2', resource: 'security-group', resourceName: agentSg.securityGroupId });
+    const eniArn = this.formatArn({ service: 'ec2', resource: 'network-interface', resourceName: '*' });
+
+    const role = new iam.Role(this, 'ServiceRole', {
+      assumedBy: new iam.ServicePrincipal('securityagent.amazonaws.com', { conditions: { StringEquals: { 'aws:SourceAccount': this.account } } }),
+      description: 'prism-cli security pentest: Security Agent service role for one private VPC pentest',
+    });
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: 'DescribeNetwork',
+      actions: ['ec2:DescribeDhcpOptions', 'ec2:DescribeNetworkInterfaces', 'ec2:DescribeNetworkInterfaceAttribute', 'ec2:DescribeSubnets', 'ec2:DescribeSecurityGroups', 'ec2:DescribeVpcs'],
+      resources: ['*'],
+    }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniCreateScoped', actions: ['ec2:CreateNetworkInterface'], resources: [eniArn, agentSgArn, ...subnetArns] }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniManageScoped', actions: ['ec2:ModifyNetworkInterfaceAttribute', 'ec2:DeleteNetworkInterface'], resources: [eniArn, agentSgArn], conditions: { StringEquals: { 'ec2:Vpc': vpc.vpcArn } } }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'EniPermission', actions: ['ec2:CreateNetworkInterfacePermission'], resources: [eniArn], conditions: { ArnEquals: { 'ec2:Subnet': subnetArns } } }));
+    // Logs: create/describe the configured group (spike: PREFLIGHT fails CLIENT_ERROR without CreateLogGroup on the group ARN).
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'LogsGroup', actions: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', 'logs:DescribeLogStreams'], resources: [
+      // logGroupArn already ends in ':*', which does NOT match the bare group ARN
+      // CreateLogGroup is authorized against (the spike's second PREFLIGHT failure).
+      this.formatArn({ service: 'logs', resource: 'log-group', resourceName: logGroupName, arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME }),
+      agentLogs.logGroupArn,
+    ] }));
+    role.addToPolicy(new iam.PolicyStatement({ sid: 'LogsDescribe', actions: ['logs:DescribeLogGroups'], resources: ['*'] }));
+    source.grantRead(role);
+    // Test actors (.prism/pentest.json "actors"): the agent reads their credentials with this role.
+    actorSecrets.forEach((arn, i) => (isCompleteSecretArn(arn)
+      ? secretsmanager.Secret.fromSecretCompleteArn(this, `ActorSecret${i}`, arn)
+      : secretsmanager.Secret.fromSecretPartialArn(this, `ActorSecret${i}`, arn)).grantRead(role));
+    if (actorLambdas.length) role.addToPolicy(new iam.PolicyStatement({ sid: 'ActorCredentials', actions: ['lambda:InvokeFunction'], resources: actorLambdas }));
+
+    const out = (oid: string, value: string) => new cdk.CfnOutput(this, oid, { value });
+    out('VpcArn', vpc.vpcArn);
+    out('SubnetArns', cdk.Fn.join(',', subnetArns));
+    out('AgentSecurityGroupArn', agentSgArn);
+    out('AlbDnsName', alb.loadBalancerDnsName);
+    out('PrivateHost', `app.${zoneName}`);
+    out('ServiceRoleArn', role.roleArn);
+    out('SourceBucket', source.bucketName);
+    out('AgentLogGroup', agentLogs.logGroupName);
+    out('TargetGroupArn', targetGroup.targetGroupArn);
+    out('AppLogGroup', appLogs.logGroupName);
+    out('ExpiresAt', new Date(Date.now() + ttlHours * 3_600_000).toISOString());
+  }
+}

package/dist/assets/pentest-cdk/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "prism-pentest-target-cdk",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "cdk": "cdk"
+  },
+  "dependencies": {
+    "aws-cdk-lib": "^2.265.0",
+    "constructs": "^10.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "aws-cdk": "^2.1000.0",
+    "ts-node": "^10.9.2",
+    "typescript": "~5.6.0"
+  }
+}

package/dist/assets/pentest-cdk/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["bin/**/*.ts", "lib/**/*.ts"]
+}

package/dist/src/codewatch/config.d.ts

@@ -0,0 +1,17 @@
+export declare const CONFIG_PATH = ".prism/config.json";
+export declare const RULES_PATH = ".prism/review/rules.md";
+export declare const GITLEAKS_BASELINE_PATH = ".prism/gitleaks-baseline.json";
+export declare const GITLEAKS_CONFIG_PATH = ".gitleaks.toml";
+/** Per-clone override of the team's reviewer choice: `git config prism.reviewer claude`. */
+export declare const REVIEWER_GIT_CONFIG_KEY = "prism.reviewer";
+export declare const DEFAULT_REVIEW_TIMEOUT_SECONDS = 300;
+export interface EvalConfig {
+    reviewer?: string;
+    model?: string;
+    timeout_seconds?: number;
+}
+export declare function readPrismConfig(repoRoot: string): Record<string, any>;
+export declare function readEvalConfig(repoRoot: string): EvalConfig;
+/** Merges `patch` into the `eval` block, keeping every other key in the file. */
+export declare function writeEvalConfig(repoRoot: string, patch: EvalConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/codewatch/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/codewatch/config.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,UAAU,2BAA2B,CAAC;AACnD,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AACtE,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AACxD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CASrE;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAG3D;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAMzE"}

package/dist/src/codewatch/config.js

@@ -0,0 +1,40 @@
+/**
+ * `.prism/config.json` access for codewatch (the local git-hook gate).
+ *
+ * The file is shared with other PRISM installers (team_id etc.) and is usually
+ * committed, so reads tolerate any shape and writes merge rather than replace.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+export const CONFIG_PATH = '.prism/config.json';
+export const RULES_PATH = '.prism/review/rules.md';
+export const GITLEAKS_BASELINE_PATH = '.prism/gitleaks-baseline.json';
+export const GITLEAKS_CONFIG_PATH = '.gitleaks.toml';
+/** Per-clone override of the team's reviewer choice: `git config prism.reviewer claude`. */
+export const REVIEWER_GIT_CONFIG_KEY = 'prism.reviewer';
+export const DEFAULT_REVIEW_TIMEOUT_SECONDS = 300;
+export function readPrismConfig(repoRoot) {
+    const p = resolve(repoRoot, CONFIG_PATH);
+    if (!existsSync(p))
+        return {};
+    try {
+        const v = JSON.parse(readFileSync(p, 'utf8'));
+        return v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function readEvalConfig(repoRoot) {
+    const e = readPrismConfig(repoRoot).eval;
+    return e && typeof e === 'object' ? e : {};
+}
+/** Merges `patch` into the `eval` block, keeping every other key in the file. */
+export function writeEvalConfig(repoRoot, patch) {
+    const p = resolve(repoRoot, CONFIG_PATH);
+    const cfg = readPrismConfig(repoRoot);
+    cfg.eval = { ...(cfg.eval && typeof cfg.eval === 'object' ? cfg.eval : {}), ...patch };
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify(cfg, null, 2) + '\n');
+}
+//# sourceMappingURL=config.js.map

package/dist/src/codewatch/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/codewatch/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACxD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAQlD,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACzC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAiB;IACjE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IACvF,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/codewatch/gitleaks.d.ts

@@ -0,0 +1,49 @@
+import { type Finding, type PrismResult } from './results.js';
+/**
+ * Starter gitleaks config, written only when the repo has none.
+ *
+ * The secret-scan step in the workflow runs with or without this file --
+ * gitleaks ships usable defaults. What the defaults do not know is which
+ * credential-shaped strings in THIS repo are deliberate, so the first PR that
+ * touches a test fixture fails the gate on a fake key. A team that hits that
+ * with no obvious place to record the exception tends to delete the gate rather
+ * than tune it, so the tuning surface ships up front and is documented inline.
+ *
+ * `useDefault = true` is what keeps this additive: without it, declaring a
+ * config REPLACES the entire default ruleset and the gate silently stops
+ * detecting anything it does not name explicitly.
+ */
+export declare const GITLEAKS_STARTER_CONFIG = "# gitleaks configuration for the PRISM eval gate.\n#\n# The gate scans only the commits a PR introduces, so anything flagged here is\n# something this PR added. Two ways to handle a false positive:\n#\n#   1. Allowlist the path or pattern below (preferred -- reviewable, and it\n#      keeps working as the file changes).\n#   2. Add an inline \"gitleaks:allow\" comment on the offending line.\n#\n# A real exposure is NOT a false positive: rotate the credential first, because\n# deleting it from the branch does not un-expose what was already pushed.\n\n[extend]\n# Keep gitleaks' built-in ruleset. Removing this line replaces the defaults\n# entirely rather than adding to them, which turns the gate into a no-op for\n# every credential type not restated in this file.\nuseDefault = true\n\n[[allowlists]]\ndescription = \"Test fixtures and documented examples\"\npaths = [\n  '''(^|/)tests?/''',\n  '''(^|/)__fixtures__/''',\n  '''(^|/)__tests__/''',\n  '''\\.example($|\\.)''',\n]\n";
+/**
+ * One-line, platform-specific gitleaks install hint. Never a curl-piped-to-shell.
+ * Single source for the installer, the pre-commit warning and the dashboard.
+ */
+export declare function gitleaksInstallHint(platform?: NodeJS.Platform): string;
+/** Writes the starter config unless the repo already has one. Returns true when written. */
+export declare function installGitleaksConfig(gitRoot: string): boolean;
+/**
+ * Converts a gitleaks JSON report to schema findings.
+ *
+ * Only location and rule fields are projected. `Secret` and `Match` are never
+ * read, so a result file cannot carry the credential even if --redact was lost.
+ */
+export declare function parseGitleaksReport(json: string): Finding[];
+export interface PreCommitOutcome {
+    /** Process exit code for the hook: 1 blocks the commit. */
+    exitCode: number;
+    result: PrismResult;
+    resultPath: string | null;
+}
+/**
+ * `gitleaks protect --staged` against the repo config and baseline.
+ *
+ * Blocks (exit 1) on a finding and when gitleaks runs but cannot produce a
+ * verdict (bad config, unreadable report): a broken secret scan should be
+ * fixed, not silently passed. A MISSING gitleaks does not block -- it warns and
+ * records a `skipped` result with reason `gitleaks-missing`; CI's gitleaks
+ * step remains the backstop.
+ */
+export declare function runPreCommit(repoRoot: string, gitleaksBin?: string): PreCommitOutcome;
+/** A result that cannot be written must never change the hook's verdict. */
+export declare function safeWrite(repoRoot: string, r: PrismResult): string | null;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/src/codewatch/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/gitleaks.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoD,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,g+BA0BnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,CAKxF;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CAW3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAOD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,SAAa,GAAG,gBAAgB,CAyCzF;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAEzE"}