@prism-d1/cli 1.3.0 → 1.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/src/aws/advice.d.ts +33 -0
- package/dist/src/aws/advice.d.ts.map +1 -0
- package/dist/src/aws/advice.js +174 -0
- package/dist/src/aws/advice.js.map +1 -0
- package/dist/src/aws/check.d.ts +64 -0
- package/dist/src/aws/check.d.ts.map +1 -0
- package/dist/src/aws/check.js +269 -0
- package/dist/src/aws/check.js.map +1 -0
- package/dist/src/aws/connect.d.ts +65 -0
- package/dist/src/aws/connect.d.ts.map +1 -0
- package/dist/src/aws/connect.js +255 -0
- package/dist/src/aws/connect.js.map +1 -0
- package/dist/src/aws/connection.d.ts +67 -0
- package/dist/src/aws/connection.d.ts.map +1 -0
- package/dist/src/aws/connection.js +137 -0
- package/dist/src/aws/connection.js.map +1 -0
- package/dist/src/aws/recommend.d.ts +76 -0
- package/dist/src/aws/recommend.d.ts.map +1 -0
- package/dist/src/aws/recommend.js +267 -0
- package/dist/src/aws/recommend.js.map +1 -0
- package/dist/src/aws/run-check.d.ts +31 -0
- package/dist/src/aws/run-check.d.ts.map +1 -0
- package/dist/src/aws/run-check.js +92 -0
- package/dist/src/aws/run-check.js.map +1 -0
- package/dist/src/codewatch/globalHooks.d.ts +1 -3
- package/dist/src/codewatch/globalHooks.d.ts.map +1 -1
- package/dist/src/codewatch/globalHooks.js +2 -7
- package/dist/src/codewatch/globalHooks.js.map +1 -1
- package/dist/src/codewatch/hooks.d.ts +9 -2
- package/dist/src/codewatch/hooks.d.ts.map +1 -1
- package/dist/src/codewatch/hooks.js +13 -0
- package/dist/src/codewatch/hooks.js.map +1 -1
- package/dist/src/codewatch/results.d.ts +32 -1
- package/dist/src/codewatch/results.d.ts.map +1 -1
- package/dist/src/codewatch/results.js +4 -0
- package/dist/src/codewatch/results.js.map +1 -1
- package/dist/src/commands/_top/dashboard.js +1 -1
- package/dist/src/commands/_top/dashboard.js.map +1 -1
- package/dist/src/commands/aws/check.d.ts +25 -0
- package/dist/src/commands/aws/check.d.ts.map +1 -0
- package/dist/src/commands/aws/check.js +42 -0
- package/dist/src/commands/aws/check.js.map +1 -0
- package/dist/src/commands/aws/connect.d.ts +16 -0
- package/dist/src/commands/aws/connect.d.ts.map +1 -0
- package/dist/src/commands/aws/connect.js +39 -0
- package/dist/src/commands/aws/connect.js.map +1 -0
- package/dist/src/commands/aws/recommend.d.ts +12 -0
- package/dist/src/commands/aws/recommend.d.ts.map +1 -0
- package/dist/src/commands/aws/recommend.js +21 -0
- package/dist/src/commands/aws/recommend.js.map +1 -0
- package/dist/src/commands/bedrock-protection/scan-account.d.ts.map +1 -1
- package/dist/src/commands/bedrock-protection/scan-account.js +14 -35
- package/dist/src/commands/bedrock-protection/scan-account.js.map +1 -1
- package/dist/src/commands/bedrock-protection/scan-org.d.ts.map +1 -1
- package/dist/src/commands/bedrock-protection/scan-org.js +12 -5
- package/dist/src/commands/bedrock-protection/scan-org.js.map +1 -1
- package/dist/src/commands/bootstrapper/setup-otel-sync.d.ts.map +1 -1
- package/dist/src/commands/bootstrapper/setup-otel-sync.js +3 -2
- package/dist/src/commands/bootstrapper/setup-otel-sync.js.map +1 -1
- package/dist/src/commands/codewatch/pre-commit.d.ts.map +1 -1
- package/dist/src/commands/codewatch/pre-commit.js +3 -1
- package/dist/src/commands/codewatch/pre-commit.js.map +1 -1
- package/dist/src/commands/codewatch/pre-push.d.ts.map +1 -1
- package/dist/src/commands/codewatch/pre-push.js +3 -1
- package/dist/src/commands/codewatch/pre-push.js.map +1 -1
- package/dist/src/commands/codewatch/report.d.ts.map +1 -1
- package/dist/src/commands/codewatch/report.js +9 -3
- package/dist/src/commands/codewatch/report.js.map +1 -1
- package/dist/src/commands/enable/codeburn.d.ts.map +1 -1
- package/dist/src/commands/enable/codeburn.js +2 -3
- package/dist/src/commands/enable/codeburn.js.map +1 -1
- package/dist/src/commands/enable/codewatch.d.ts.map +1 -1
- package/dist/src/commands/enable/codewatch.js +2 -1
- package/dist/src/commands/enable/codewatch.js.map +1 -1
- package/dist/src/commands/enable/security.d.ts.map +1 -1
- package/dist/src/commands/enable/security.js +5 -7
- package/dist/src/commands/enable/security.js.map +1 -1
- package/dist/src/commands/security/code-review.d.ts.map +1 -1
- package/dist/src/commands/security/code-review.js +4 -3
- package/dist/src/commands/security/code-review.js.map +1 -1
- package/dist/src/commands/security/findings.d.ts.map +1 -1
- package/dist/src/commands/security/findings.js +6 -4
- package/dist/src/commands/security/findings.js.map +1 -1
- package/dist/src/commands/security/pentest.d.ts.map +1 -1
- package/dist/src/commands/security/pentest.js +4 -3
- package/dist/src/commands/security/pentest.js.map +1 -1
- package/dist/src/commands/security/threat-model.d.ts.map +1 -1
- package/dist/src/commands/security/threat-model.js +2 -1
- package/dist/src/commands/security/threat-model.js.map +1 -1
- package/dist/src/commands/security/threats.d.ts.map +1 -1
- package/dist/src/commands/security/threats.js +2 -1
- package/dist/src/commands/security/threats.js.map +1 -1
- package/dist/src/commands/securityagent/setup.d.ts.map +1 -1
- package/dist/src/dashboard/aws.d.ts +39 -0
- package/dist/src/dashboard/aws.d.ts.map +1 -0
- package/dist/src/dashboard/aws.js +35 -0
- package/dist/src/dashboard/aws.js.map +1 -0
- package/dist/src/dashboard/codewatch.js +1 -1
- package/dist/src/dashboard/codewatch.js.map +1 -1
- package/dist/src/dashboard/page.d.ts.map +1 -1
- package/dist/src/dashboard/page.js +34 -1
- package/dist/src/dashboard/page.js.map +1 -1
- package/dist/src/dashboard/payload.d.ts +3 -0
- package/dist/src/dashboard/payload.d.ts.map +1 -1
- package/dist/src/dashboard/payload.js +2 -0
- package/dist/src/dashboard/payload.js.map +1 -1
- package/dist/src/index.d.ts +2 -0
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +16 -1
- package/dist/src/index.js.map +1 -1
- package/dist/src/security/errors.d.ts +1 -0
- package/dist/src/security/errors.d.ts.map +1 -1
- package/dist/src/security/errors.js +2 -1
- package/dist/src/security/errors.js.map +1 -1
- package/dist/src/security/marker.d.ts +1 -1
- package/dist/src/security/marker.d.ts.map +1 -1
- package/dist/src/security/marker.js +4 -4
- package/dist/src/security/marker.js.map +1 -1
- package/dist/src/security/pentest.d.ts.map +1 -1
- package/dist/src/security/pentest.js +5 -1
- package/dist/src/security/pentest.js.map +1 -1
- package/dist/src/security/review.d.ts +4 -4
- package/dist/src/security/review.d.ts.map +1 -1
- package/dist/src/security/review.js +12 -8
- package/dist/src/security/review.js.map +1 -1
- package/dist/src/security/setup.d.ts +18 -2
- package/dist/src/security/setup.d.ts.map +1 -1
- package/dist/src/security/setup.js +32 -16
- package/dist/src/security/setup.js.map +1 -1
- package/dist/src/security/threat-model.d.ts +7 -0
- package/dist/src/security/threat-model.d.ts.map +1 -1
- package/dist/src/security/threat-model.js +37 -3
- package/dist/src/security/threat-model.js.map +1 -1
- package/dist/src/utils/audit-account.d.ts +50 -0
- package/dist/src/utils/audit-account.d.ts.map +1 -0
- package/dist/src/utils/audit-account.js +69 -0
- package/dist/src/utils/audit-account.js.map +1 -0
- package/dist/src/utils/audit-iam.d.ts +1 -1
- package/dist/src/utils/audit-iam.d.ts.map +1 -1
- package/dist/src/utils/audit-iam.js +11 -7
- package/dist/src/utils/audit-iam.js.map +1 -1
- package/dist/src/utils/otel-sync-schedule.d.ts +8 -0
- package/dist/src/utils/otel-sync-schedule.d.ts.map +1 -1
- package/dist/src/utils/otel-sync-schedule.js +16 -0
- package/dist/src/utils/otel-sync-schedule.js.map +1 -1
- package/package.json +1 -1
|
@@ -2,6 +2,13 @@ export declare const HOOK_MARKER = "# prism-cli enable codewatch";
|
|
|
2
2
|
export declare const BACKUP_SUFFIX = ".pre-prism";
|
|
3
3
|
export declare const MANAGED_HOOKS: readonly ["pre-commit", "pre-push"];
|
|
4
4
|
export type ManagedHook = typeof MANAGED_HOOKS[number];
|
|
5
|
+
/**
|
|
6
|
+
* `git config prism.codewatch false` skips codewatch in a repo, with the
|
|
7
|
+
* per-repo and the global hooks alike (a hook it backed up or chains still
|
|
8
|
+
* runs). git reads the effective value: the repo's own setting, else --global.
|
|
9
|
+
*/
|
|
10
|
+
export declare const OPT_OUT_KEY = "prism.codewatch";
|
|
11
|
+
export declare function isOptedOut(repo: string): boolean;
|
|
5
12
|
/**
|
|
6
13
|
* pre-commit: blocks on a gitleaks finding.
|
|
7
14
|
*
|
|
@@ -9,12 +16,12 @@ export type ManagedHook = typeof MANAGED_HOOKS[number];
|
|
|
9
16
|
* on PATH it still runs gitleaks directly, so the block does not depend on the
|
|
10
17
|
* CLI being installed globally.
|
|
11
18
|
*/
|
|
12
|
-
export declare const PRE_COMMIT_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-commit secret scan (blocks on a finding).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nif [ -x \"$HOOK_DIR/pre-commit.pre-prism\" ]; then\n \"$HOOK_DIR/pre-commit.pre-prism\" \"$@\" || exit $?\nfi\n# Probe first: an older prism-cli on PATH has no \"codewatch pre-commit\" and would\n# fail every commit with \"unknown command\". Its --help exits 0 with the root help,\n# so the probe checks that the subcommand's own usage line is printed.\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-commit --help 2>/dev/null | grep -q 'codewatch pre-commit'; then\n exec prism-cli codewatch pre-commit\nfi\nif command -v gitleaks >/dev/null 2>&1; then\n set -- protect --staged --redact --no-banner --exit-code=1\n [ -f .gitleaks.toml ] && set -- \"$@\" --config=.gitleaks.toml\n [ -f .prism/gitleaks-baseline.json ] && set -- \"$@\" --baseline-path=.prism/gitleaks-baseline.json\n if ! gitleaks \"$@\"; then\n echo \"prism: gitleaks flagged the staged changes; commit blocked.\" >&2\n echo \"prism: fix it, allowlist a false positive in .gitleaks.toml, or bypass once with --no-verify.\" >&2\n exit 1\n fi\n exit 0\nfi\necho \"prism: neither prism-cli nor gitleaks is on PATH; secret scan skipped.\" >&2\nexit 0\n";
|
|
19
|
+
export declare const PRE_COMMIT_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-commit secret scan (blocks on a finding).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nif [ -x \"$HOOK_DIR/pre-commit.pre-prism\" ]; then\n \"$HOOK_DIR/pre-commit.pre-prism\" \"$@\" || exit $?\nfi\nif [ \"$(git config --bool --get prism.codewatch 2>/dev/null)\" = \"false\" ]; then exit 0; fi\n# Probe first: an older prism-cli on PATH has no \"codewatch pre-commit\" and would\n# fail every commit with \"unknown command\". Its --help exits 0 with the root help,\n# so the probe checks that the subcommand's own usage line is printed.\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-commit --help 2>/dev/null | grep -q 'codewatch pre-commit'; then\n exec prism-cli codewatch pre-commit\nfi\nif command -v gitleaks >/dev/null 2>&1; then\n set -- protect --staged --redact --no-banner --exit-code=1\n [ -f .gitleaks.toml ] && set -- \"$@\" --config=.gitleaks.toml\n [ -f .prism/gitleaks-baseline.json ] && set -- \"$@\" --baseline-path=.prism/gitleaks-baseline.json\n if ! gitleaks \"$@\"; then\n echo \"prism: gitleaks flagged the staged changes; commit blocked.\" >&2\n echo \"prism: fix it, allowlist a false positive in .gitleaks.toml, or bypass once with --no-verify.\" >&2\n exit 1\n fi\n exit 0\nfi\necho \"prism: neither prism-cli nor gitleaks is on PATH; secret scan skipped.\" >&2\nexit 0\n";
|
|
13
20
|
/**
|
|
14
21
|
* pre-push: report-only review. Exits 0 no matter what the review does.
|
|
15
22
|
* stdin (the pushed refs) is buffered so both a chained hook and prism-cli see it.
|
|
16
23
|
*/
|
|
17
|
-
export declare const PRE_PUSH_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-push local eval review (report only, never blocks).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nPRISM_PUSH_INPUT=$(cat)\nif [ -x \"$HOOK_DIR/pre-push.pre-prism\" ]; then\n printf '%s\\n' \"$PRISM_PUSH_INPUT\" | \"$HOOK_DIR/pre-push.pre-prism\" \"$@\" || exit $?\nfi\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then\n printf '%s\\n' \"$PRISM_PUSH_INPUT\" | prism-cli codewatch pre-push --remote \"${1:-}\" || true\nelse\n echo \"prism: prism-cli (with 'codewatch pre-push') is not on PATH; local review skipped (report only).\" >&2\nfi\nexit 0\n";
|
|
24
|
+
export declare const PRE_PUSH_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-push local eval review (report only, never blocks).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nPRISM_PUSH_INPUT=$(cat)\nif [ -x \"$HOOK_DIR/pre-push.pre-prism\" ]; then\n printf '%s\\n' \"$PRISM_PUSH_INPUT\" | \"$HOOK_DIR/pre-push.pre-prism\" \"$@\" || exit $?\nfi\nif [ \"$(git config --bool --get prism.codewatch 2>/dev/null)\" = \"false\" ]; then exit 0; fi\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then\n printf '%s\\n' \"$PRISM_PUSH_INPUT\" | prism-cli codewatch pre-push --remote \"${1:-}\" || true\nelse\n echo \"prism: prism-cli (with 'codewatch pre-push') is not on PATH; local review skipped (report only).\" >&2\nfi\nexit 0\n";
|
|
18
25
|
export declare const HOOK_SCRIPTS: Record<ManagedHook, string>;
|
|
19
26
|
/**
|
|
20
27
|
* Hooks directory as git resolves it: honours core.hooksPath and works in a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAW1D,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,aAAa,qCAAsC,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,
|
|
1
|
+
{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAW1D,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,aAAa,qCAAsC,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAG7C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGhD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,i6CA2B7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,6zBAe3B,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAGpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAWD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE5D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAsB3D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAkB7D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYzE;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7D"}
|
|
@@ -22,6 +22,17 @@ const OWN_MARKERS = [HOOK_MARKER, '# prism-cli enable security'];
|
|
|
22
22
|
const LEGACY_MARKER = 'AI-Origin';
|
|
23
23
|
export const BACKUP_SUFFIX = '.pre-prism';
|
|
24
24
|
export const MANAGED_HOOKS = ['pre-commit', 'pre-push'];
|
|
25
|
+
/**
|
|
26
|
+
* `git config prism.codewatch false` skips codewatch in a repo, with the
|
|
27
|
+
* per-repo and the global hooks alike (a hook it backed up or chains still
|
|
28
|
+
* runs). git reads the effective value: the repo's own setting, else --global.
|
|
29
|
+
*/
|
|
30
|
+
export const OPT_OUT_KEY = 'prism.codewatch';
|
|
31
|
+
const OPT_OUT_CHECK = `if [ "$(git config --bool --get ${OPT_OUT_KEY} 2>/dev/null)" = "false" ]; then exit 0; fi`;
|
|
32
|
+
export function isOptedOut(repo) {
|
|
33
|
+
const r = run('git', ['-C', repo, 'config', '--bool', '--get', OPT_OUT_KEY]);
|
|
34
|
+
return r.ok && r.stdout === 'false';
|
|
35
|
+
}
|
|
25
36
|
/**
|
|
26
37
|
* pre-commit: blocks on a gitleaks finding.
|
|
27
38
|
*
|
|
@@ -36,6 +47,7 @@ HOOK_DIR=$(dirname "$0")
|
|
|
36
47
|
if [ -x "$HOOK_DIR/pre-commit${BACKUP_SUFFIX}" ]; then
|
|
37
48
|
"$HOOK_DIR/pre-commit${BACKUP_SUFFIX}" "$@" || exit $?
|
|
38
49
|
fi
|
|
50
|
+
${OPT_OUT_CHECK}
|
|
39
51
|
# Probe first: an older prism-cli on PATH has no "codewatch pre-commit" and would
|
|
40
52
|
# fail every commit with "unknown command". Its --help exits 0 with the root help,
|
|
41
53
|
# so the probe checks that the subcommand's own usage line is printed.
|
|
@@ -68,6 +80,7 @@ PRISM_PUSH_INPUT=$(cat)
|
|
|
68
80
|
if [ -x "$HOOK_DIR/pre-push${BACKUP_SUFFIX}" ]; then
|
|
69
81
|
printf '%s\\n' "$PRISM_PUSH_INPUT" | "$HOOK_DIR/pre-push${BACKUP_SUFFIX}" "$@" || exit $?
|
|
70
82
|
fi
|
|
83
|
+
${OPT_OUT_CHECK}
|
|
71
84
|
if command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then
|
|
72
85
|
printf '%s\\n' "$PRISM_PUSH_INPUT" | prism-cli codewatch pre-push --remote "\${1:-}" || true
|
|
73
86
|
else
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAC1D;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;AACjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,UAAU,CAAU,CAAC;AAGjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;EAC/B,WAAW;;;+BAGkB,aAAa;yBACnB,aAAa
|
|
1
|
+
{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,8BAA8B,CAAC;AAC1D;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;AACjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,UAAU,CAAU,CAAC;AAGjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAC7C,MAAM,aAAa,GAAG,mCAAmC,WAAW,6CAA6C,CAAC;AAElH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;EAC/B,WAAW;;;+BAGkB,aAAa;yBACnB,aAAa;;EAEpC,aAAa;;;;;;;;;;;;;;;;;;;;CAoBd,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;EAC7B,WAAW;;;;6BAIgB,aAAa;4DACkB,aAAa;;EAEvE,aAAa;;;;;;;CAOd,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAgC;IACvD,YAAY,EAAE,iBAAiB;IAC/B,UAAU,EAAE,eAAe;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,UAAoB,WAAW;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QACtC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,sEAAsE;gBACtE,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1C,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,OAAO,OAAO,IAAI,GAAG,aAAa,0BAA0B,EAAE,CAAC,CAAC;YACzH,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,IAAI,GAAG,aAAa,cAAc,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QACD,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IACtC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IACD,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvJ,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,aAAa,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,MAAM,+EAA+E,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { Finding as AuditFinding, Severity as AuditSeverity } from '../utils/audit.js';
|
|
1
2
|
export declare const RESULT_SCHEMA_VERSION = 1;
|
|
2
3
|
export declare const RESULTS_DIR = ".prism/results";
|
|
3
4
|
/** Pre-commit ran with no gitleaks on PATH: the commit was allowed but not secret-scanned. */
|
|
@@ -33,7 +34,35 @@ export interface Finding {
|
|
|
33
34
|
* `security-threat-model` = an AWS Security Agent threat model job;
|
|
34
35
|
* `security-pentest` = an AWS Security Agent penetration test job.
|
|
35
36
|
*/
|
|
36
|
-
export type ResultKind = 'secrets' | 'review' | 'security-review' | 'security-threat-model' | 'security-pentest';
|
|
37
|
+
export type ResultKind = 'secrets' | 'review' | 'security-review' | 'security-threat-model' | 'security-pentest' | 'aws-check';
|
|
38
|
+
/**
|
|
39
|
+
* aws-check only: one `prism-cli aws check` run. The audit findings live in
|
|
40
|
+
* `checks` (their shape differs from a code finding); `findings` stays empty.
|
|
41
|
+
*/
|
|
42
|
+
export interface AwsCheckInfo {
|
|
43
|
+
account: string;
|
|
44
|
+
alias: string | null;
|
|
45
|
+
region: string;
|
|
46
|
+
profile: string | null;
|
|
47
|
+
/** Where the profile came from, e.g. "--profile" or "aws connect, user". */
|
|
48
|
+
profile_source: string | null;
|
|
49
|
+
/** The sections that ran, in order. */
|
|
50
|
+
sections: string[];
|
|
51
|
+
/** PASS / FAIL / INDETERMINATE counts per section. */
|
|
52
|
+
section_counts: Record<string, {
|
|
53
|
+
pass: number;
|
|
54
|
+
fail: number;
|
|
55
|
+
indeterminate: number;
|
|
56
|
+
}>;
|
|
57
|
+
counts: {
|
|
58
|
+
pass: number;
|
|
59
|
+
fail: number;
|
|
60
|
+
indeterminate: number;
|
|
61
|
+
};
|
|
62
|
+
/** FAIL findings per severity. */
|
|
63
|
+
fail_by_severity: Record<AuditSeverity, number>;
|
|
64
|
+
checks: AuditFinding[];
|
|
65
|
+
}
|
|
37
66
|
/** security-threat-model only: the job behind the result. */
|
|
38
67
|
export interface ThreatModelInfo {
|
|
39
68
|
job_id: string;
|
|
@@ -171,6 +200,8 @@ export interface PrismResult {
|
|
|
171
200
|
threat_model?: ThreatModelInfo;
|
|
172
201
|
/** Present on kind security-pentest. */
|
|
173
202
|
pentest?: PentestInfo;
|
|
203
|
+
/** Present on kind aws-check. */
|
|
204
|
+
aws_check?: AwsCheckInfo;
|
|
174
205
|
}
|
|
175
206
|
export type ResultInit = Omit<PrismResult, 'schema_version' | 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'> & Partial<Pick<PrismResult, 'tool_version' | 'model' | 'commit' | 'tree' | 'branch' | 'upstream' | 'base' | 'summary' | 'score' | 'reason' | 'findings'>>;
|
|
176
207
|
export declare function makeResult(init: ResultInit): PrismResult;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"results.d.ts","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,IAAI,YAAY,EAAE,QAAQ,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE5F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AACjD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,2HAA2H;IAC3H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0HAA0H;IAC1H,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/H;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,6DAA6D;IAC7D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oHAAoH;IACpH,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,4GAA4G;IAC5G,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,mHAAmH;IACnH,qBAAqB,EAAE,OAAO,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2HAA2H;IAC3H,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,2GAA2G;IAC3G,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iGAAiG;IACjG,eAAe,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAC;AACrE;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;OAIG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,wCAAwC;IACxC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iCAAiC;IACjC,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,GACtL,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAE5J,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAgBxD;AAOD,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAOrD;AAED;;;GAGG;AACH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS/D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAYjF;AAED,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAgBjE;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAE3D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAI7E"}
|
|
@@ -47,6 +47,10 @@ export function compactTimestamp(iso) {
|
|
|
47
47
|
* no commit yet (pre-commit).
|
|
48
48
|
*/
|
|
49
49
|
export function resultFileName(r) {
|
|
50
|
+
// An account check is not tied to a commit: `aws-<account>-<region>-<time>-aws-check.json`.
|
|
51
|
+
if (r.kind === 'aws-check' && r.aws_check) {
|
|
52
|
+
return `aws-${safePart(r.aws_check.account)}-${safePart(r.aws_check.region)}-${compactTimestamp(r.started_at)}-${safePart(r.kind)}.json`;
|
|
53
|
+
}
|
|
50
54
|
const id = r.commit ? safePart(r.commit.slice(0, 12)) : r.tree ? `tree-${safePart(r.tree.slice(0, 12))}` : 'nocommit';
|
|
51
55
|
return `${id}-${compactTimestamp(r.started_at)}-${safePart(r.hook)}-${safePart(r.kind)}.json`;
|
|
52
56
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAGvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AA0M1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,4FAA4F;IAC5F,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3I,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc,EAAE,EAAW;IACvE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACxG,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}
|
|
@@ -30,7 +30,7 @@ export default {
|
|
|
30
30
|
description: 'Local web dashboard (127.0.0.1 only): codewatch results, codeburn usage and setup checklist. No AWS calls.',
|
|
31
31
|
options: [
|
|
32
32
|
{ flags: '--json', description: 'Print the dashboard data as JSON and exit (no server)' },
|
|
33
|
-
{ flags: '--root <dir>', description: 'Where to look for repos
|
|
33
|
+
{ flags: '--root <dir>', description: 'Where to look for git repos, 3 levels deep (default: your home directory)' },
|
|
34
34
|
{ flags: '--all', description: '[deprecated, no effect] every repo under --root is now shown by default' },
|
|
35
35
|
{ flags: '--port <n>', description: 'Port on 127.0.0.1 (default: a random free port)' },
|
|
36
36
|
{ flags: '--no-open', description: 'Do not open a browser' },
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../../../src/commands/_top/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAa,EAAE,IAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAqB;IAC7C,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,eAAe;IACb,WAAW,EAAE,4GAA4G;IACzH,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;QACzF,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,
|
|
1
|
+
{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../../../src/commands/_top/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAa,EAAE,IAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAqB;IAC7C,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,eAAe;IACb,WAAW,EAAE,4GAA4G;IACzH,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE;QACzF,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,2EAA2E,EAAE;QACnH,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC1G,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,iDAAiD,EAAE;QACvF,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,uBAAuB,EAAE;KAC7D;IACD,KAAK,CAAC,MAAM,CAAC,IAAqF;QAChG,4CAA4C;QAC5C,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,mHAAmH,CAAC,CAAC;QACjJ,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAE1E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAE9G,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,2EAA2E;YAC3E,MAAM,SAAS,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,eAAe,CAAE,CAAC,MAAM,OAAO,EAAE,CAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9H,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,2CAA2C,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,SAAS,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,GAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF,CAAC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
import { type CheckOptions, type CheckRunDeps } from '../../aws/run-check.js';
|
|
2
|
+
import { type RunHooks } from '../enable/security.js';
|
|
3
|
+
export declare function checkDeps(): CheckRunDeps;
|
|
4
|
+
/** --profile and --region, shared by aws check and aws recommend. */
|
|
5
|
+
export declare const AWS_TARGET_OPTIONS: {
|
|
6
|
+
flags: string;
|
|
7
|
+
description: string;
|
|
8
|
+
}[];
|
|
9
|
+
export interface CheckHooks extends RunHooks {
|
|
10
|
+
checkDeps?: () => CheckRunDeps;
|
|
11
|
+
}
|
|
12
|
+
declare const _default: {
|
|
13
|
+
description: string;
|
|
14
|
+
options: ({
|
|
15
|
+
flags: string;
|
|
16
|
+
description: string;
|
|
17
|
+
} | {
|
|
18
|
+
flags: string;
|
|
19
|
+
description: string;
|
|
20
|
+
parser: (v: string, prev?: string[]) => string[];
|
|
21
|
+
})[];
|
|
22
|
+
action(opts: CheckOptions, hooks?: CheckHooks): Promise<void>;
|
|
23
|
+
};
|
|
24
|
+
export default _default;
|
|
25
|
+
//# sourceMappingURL=check.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/aws/check.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,wBAAgB,SAAS,IAAI,YAAY,CAYxC;AAID,qEAAqE;AACrE,eAAO,MAAM,kBAAkB;;;GAG9B,CAAC;AAEF,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAAG,SAAS,CAAC,EAAE,MAAM,YAAY,CAAA;CAAE;;;;;;;;;oBAR3D,MAAM,SAAQ,MAAM,EAAE;;iBAkBrB,YAAY,UAAS,UAAU;;AARpD,wBAcE"}
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
import { homedir } from 'node:os';
|
|
2
|
+
import { run } from '../../utils/exec.js';
|
|
3
|
+
import { FAIL_ON_OPTION, JSON_OPTION } from '../../utils/audit.js';
|
|
4
|
+
import { configuredRegion, connectionDefaults } from '../../aws/connection.js';
|
|
5
|
+
import { SECTIONS } from '../../aws/check.js';
|
|
6
|
+
import { awsCheck } from '../../aws/run-check.js';
|
|
7
|
+
import { runGuarded } from '../enable/security.js';
|
|
8
|
+
export function checkDeps() {
|
|
9
|
+
return {
|
|
10
|
+
env: process.env,
|
|
11
|
+
home: homedir(),
|
|
12
|
+
cwd: () => process.cwd(),
|
|
13
|
+
configRegion: configuredRegion,
|
|
14
|
+
awsVersion: () => { const r = run('aws', ['--version']); return r.ok ? r.stdout : null; },
|
|
15
|
+
git: (args) => run('git', args),
|
|
16
|
+
log: (line = '') => console.log(line),
|
|
17
|
+
err: (line = '') => console.error(line),
|
|
18
|
+
now: () => new Date(),
|
|
19
|
+
};
|
|
20
|
+
}
|
|
21
|
+
const collect = (v, prev = []) => [...prev, v];
|
|
22
|
+
/** --profile and --region, shared by aws check and aws recommend. */
|
|
23
|
+
export const AWS_TARGET_OPTIONS = [
|
|
24
|
+
{ flags: '--profile <name>', description: 'AWS CLI profile (default: AWS_PROFILE or env credentials, else the one saved by prism-cli aws connect, else the default chain)' },
|
|
25
|
+
{ flags: '--region <region>', description: 'AWS region (default: AWS_REGION, AWS_DEFAULT_REGION, the aws connect region, else the profile\'s region; refuses when none is set)' },
|
|
26
|
+
];
|
|
27
|
+
export default {
|
|
28
|
+
description: 'Read-only AWS account checks: Bedrock protection, PRISM setup, account baseline (results saved for aws recommend and the dashboard)',
|
|
29
|
+
options: [
|
|
30
|
+
...AWS_TARGET_OPTIONS,
|
|
31
|
+
{ flags: '--section <name>', description: `Run only this section, repeatable: ${SECTIONS.map((s) => s.name).join(', ')} (default: all)`, parser: collect },
|
|
32
|
+
{ ...FAIL_ON_OPTION, description: 'Exit 1 if any FAIL is at or above this severity (CRITICAL|HIGH|MEDIUM|LOW|none; default none: report only)' },
|
|
33
|
+
JSON_OPTION,
|
|
34
|
+
],
|
|
35
|
+
async action(opts, hooks = {}) {
|
|
36
|
+
await runGuarded(async () => {
|
|
37
|
+
const o = connectionDefaults({ ...opts, profile: opts.profile || undefined, region: opts.region || undefined }, hooks.env);
|
|
38
|
+
return awsCheck(o, (hooks.checkDeps ?? checkDeps)()).code;
|
|
39
|
+
}, hooks);
|
|
40
|
+
},
|
|
41
|
+
};
|
|
42
|
+
//# sourceMappingURL=check.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../../src/commands/aws/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAwC,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAElE,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,OAAO,EAAE;QACf,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,YAAY,EAAE,gBAAgB;QAC9B,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC/B,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAEjE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,gIAAgI,EAAE;IAC5K,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,oIAAoI,EAAE;CAClL,CAAC;AAIF,eAAe;IACb,WAAW,EAAE,qIAAqI;IAClJ,OAAO,EAAE;QACP,GAAG,kBAAkB;QACrB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,sCAAsC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1J,EAAE,GAAG,cAAc,EAAE,WAAW,EAAE,4GAA4G,EAAE;QAChJ,WAAW;KACZ;IACD,KAAK,CAAC,MAAM,CAAC,IAAkB,EAAE,QAAoB,EAAE;QACrD,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3H,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5D,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
import { type ConnectDeps, type ConnectOptions } from '../../aws/connect.js';
|
|
2
|
+
import { type RunHooks } from '../enable/security.js';
|
|
3
|
+
export declare function connectDeps(): ConnectDeps;
|
|
4
|
+
export interface ConnectHooks extends RunHooks {
|
|
5
|
+
connectDeps?: () => ConnectDeps;
|
|
6
|
+
}
|
|
7
|
+
declare const _default: {
|
|
8
|
+
description: string;
|
|
9
|
+
options: {
|
|
10
|
+
flags: string;
|
|
11
|
+
description: string;
|
|
12
|
+
}[];
|
|
13
|
+
action(opts: ConnectOptions, hooks?: ConnectHooks): Promise<void>;
|
|
14
|
+
};
|
|
15
|
+
export default _default;
|
|
16
|
+
//# sourceMappingURL=connect.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../../src/commands/aws/connect.ts"],"names":[],"mappings":"AAKA,OAAO,EAAc,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE,wBAAgB,WAAW,IAAI,WAAW,CAiBzC;AAED,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAAG,WAAW,CAAC,EAAE,MAAM,WAAW,CAAA;CAAE;;;;;;;iBAW7D,cAAc,UAAS,YAAY;;AATxD,wBAeE"}
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
import { homedir } from 'node:os';
|
|
2
|
+
import { createInterface } from 'node:readline';
|
|
3
|
+
import { aws } from '../../utils/aws.js';
|
|
4
|
+
import { run } from '../../utils/exec.js';
|
|
5
|
+
import { configuredRegion, listProfiles } from '../../aws/connection.js';
|
|
6
|
+
import { awsConnect } from '../../aws/connect.js';
|
|
7
|
+
import { runGuarded } from '../enable/security.js';
|
|
8
|
+
export function connectDeps() {
|
|
9
|
+
return {
|
|
10
|
+
aws: (args, profile, region) => aws([...args, '--region', region], { profile, env: { AWS_PAGER: '' } }),
|
|
11
|
+
listProfiles,
|
|
12
|
+
configRegion: configuredRegion,
|
|
13
|
+
git: (args) => run('git', args),
|
|
14
|
+
env: process.env,
|
|
15
|
+
home: homedir(),
|
|
16
|
+
cwd: () => process.cwd(),
|
|
17
|
+
isTTY: !!(process.stdin.isTTY && process.stdout.isTTY),
|
|
18
|
+
ask: (q) => new Promise((done) => {
|
|
19
|
+
const rl = createInterface({ input: process.stdin, output: process.stdout });
|
|
20
|
+
rl.question(q, (a) => { rl.close(); done(a); });
|
|
21
|
+
}),
|
|
22
|
+
log: (line = '') => console.log(line),
|
|
23
|
+
now: () => new Date(),
|
|
24
|
+
};
|
|
25
|
+
}
|
|
26
|
+
export default {
|
|
27
|
+
description: 'Choose and verify the AWS profile and region the other AWS commands default to (read-only; stores no credentials)',
|
|
28
|
+
options: [
|
|
29
|
+
{ flags: '--profile <name>', description: 'AWS CLI profile to save (default: choose from aws configure list-profiles on a terminal)' },
|
|
30
|
+
{ flags: '--region <region>', description: 'Region to save (default: AWS_REGION, AWS_DEFAULT_REGION or the profile\'s region; asked on a terminal)' },
|
|
31
|
+
{ flags: '--repo', description: 'Save (or clear) a per-repo override in .prism/aws.local.json instead of ~/.prism/aws.json' },
|
|
32
|
+
{ flags: '--status', description: 'Show what is saved, where it comes from, and whether it still validates' },
|
|
33
|
+
{ flags: '--clear', description: 'Remove the saved connection (the user file, or the repo file with --repo)' },
|
|
34
|
+
],
|
|
35
|
+
async action(opts, hooks = {}) {
|
|
36
|
+
await runGuarded(() => awsConnect({ ...opts, profile: opts.profile || undefined, region: opts.region || undefined }, (hooks.connectDeps ?? connectDeps)()), hooks);
|
|
37
|
+
},
|
|
38
|
+
};
|
|
39
|
+
//# sourceMappingURL=connect.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../../src/commands/aws/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAyC,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAElE,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC;QACvG,YAAY;QACZ,YAAY,EAAE,gBAAgB;QAC9B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,OAAO,EAAE;QACf,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACtD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAID,eAAe;IACb,WAAW,EAAE,mHAAmH;IAChI,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,0FAA0F,EAAE;QACtI,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,wGAAwG,EAAE;QACrJ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,2FAA2F,EAAE;QAC7H,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,2EAA2E,EAAE;KAC/G;IACD,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,QAAsB,EAAE;QACzD,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAC/B,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EACjF,CAAC,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,CACrC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
import { type RecommendOptions } from '../../aws/recommend.js';
|
|
2
|
+
import { type CheckHooks } from './check.js';
|
|
3
|
+
declare const _default: {
|
|
4
|
+
description: string;
|
|
5
|
+
options: {
|
|
6
|
+
flags: string;
|
|
7
|
+
description: string;
|
|
8
|
+
}[];
|
|
9
|
+
action(opts: RecommendOptions, hooks?: CheckHooks): Promise<void>;
|
|
10
|
+
};
|
|
11
|
+
export default _default;
|
|
12
|
+
//# sourceMappingURL=recommend.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"recommend.d.ts","sourceRoot":"","sources":["../../../../src/commands/aws/recommend.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;;;;;;;iBAWvD,gBAAgB,UAAS,UAAU;;AATxD,wBAeE"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
import { connectionDefaults } from '../../aws/connection.js';
|
|
2
|
+
import { awsRecommend } from '../../aws/recommend.js';
|
|
3
|
+
import { runGuarded } from '../enable/security.js';
|
|
4
|
+
import { AWS_TARGET_OPTIONS, checkDeps } from './check.js';
|
|
5
|
+
export default {
|
|
6
|
+
description: 'Turn the latest aws check result into a ranked fix list (no AWS calls; --refresh runs aws check first)',
|
|
7
|
+
options: [
|
|
8
|
+
...AWS_TARGET_OPTIONS,
|
|
9
|
+
{ flags: '--account <id>', description: 'Account whose result to read (default: the aws connect account, else the latest result)' },
|
|
10
|
+
{ flags: '--refresh', description: 'Run prism-cli aws check first (read-only AWS calls)' },
|
|
11
|
+
{ flags: '--json', description: 'Print the recommendations as JSON' },
|
|
12
|
+
{ flags: '--markdown', description: 'Also write a Markdown report next to the result in .prism/results/' },
|
|
13
|
+
],
|
|
14
|
+
async action(opts, hooks = {}) {
|
|
15
|
+
await runGuarded(async () => {
|
|
16
|
+
const o = connectionDefaults({ ...opts, profile: opts.profile || undefined, region: opts.region || undefined }, hooks.env);
|
|
17
|
+
return awsRecommend(o, (hooks.checkDeps ?? checkDeps)());
|
|
18
|
+
}, hooks);
|
|
19
|
+
},
|
|
20
|
+
};
|
|
21
|
+
//# sourceMappingURL=recommend.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"recommend.js","sourceRoot":"","sources":["../../../../src/commands/aws/recommend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAyB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAE5E,eAAe;IACb,WAAW,EAAE,wGAAwG;IACrH,OAAO,EAAE;QACP,GAAG,kBAAkB;QACrB,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,yFAAyF,EAAE;QACnI,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC1F,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;QACrE,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,oEAAoE,EAAE;KAC3G;IACD,KAAK,CAAC,MAAM,CAAC,IAAsB,EAAE,QAAoB,EAAE;QACzD,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3H,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan-account.d.ts","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-account.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"scan-account.d.ts","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-account.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;;;;;iBAckB;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC3E;;AAfH,wBA0DE"}
|
|
@@ -1,9 +1,8 @@
|
|
|
1
|
-
import { resolveAccount
|
|
1
|
+
import { resolveAccount } from '../../utils/aws.js';
|
|
2
2
|
import { DEFAULT_REGION } from '../../utils/region.js';
|
|
3
3
|
import { validateAwsRegion } from '../../utils/validate.js';
|
|
4
4
|
import { renderReport, parseFailOn, applyFailOn, FAIL_ON_OPTION, JSON_OPTION, } from '../../utils/audit.js';
|
|
5
|
-
import {
|
|
6
|
-
import { auditBudgets, auditBudgetAlerting, auditDetection, auditAiProtection, auditCommitments, auditForensics } from '../../utils/audit-bedrock.js';
|
|
5
|
+
import { auditAccount, auditDefaults, accountChangeWarning, ACCOUNT_AUDIT_GROUPS, AUDIT_PROFILE_OPTION, auditRegionOption } from '../../utils/audit-account.js';
|
|
7
6
|
/**
|
|
8
7
|
* Audit the AWS account side of Bedrock protection.
|
|
9
8
|
*
|
|
@@ -33,8 +32,8 @@ import { auditBudgets, auditBudgetAlerting, auditDetection, auditAiProtection, a
|
|
|
33
32
|
export default {
|
|
34
33
|
description: 'Audit the AWS account for LLMjacking exposure: IAM credential hygiene plus Bedrock spend guardrails, detection speed and invocation logging',
|
|
35
34
|
options: [
|
|
36
|
-
|
|
37
|
-
|
|
35
|
+
auditRegionOption('Region for Bedrock, CloudWatch and Provisioned Throughput checks'),
|
|
36
|
+
AUDIT_PROFILE_OPTION,
|
|
38
37
|
{ flags: '--max-key-age <days>', description: 'Flag active access keys older than this', default: '90' },
|
|
39
38
|
{ flags: '--unused-days <days>', description: 'Flag credentials idle longer than this', default: '90' },
|
|
40
39
|
{ flags: '--iam-only', description: 'Only run the IAM credential hygiene checks' },
|
|
@@ -43,7 +42,8 @@ export default {
|
|
|
43
42
|
FAIL_ON_OPTION,
|
|
44
43
|
],
|
|
45
44
|
async action(opts) {
|
|
46
|
-
const
|
|
45
|
+
const defaults = auditDefaults(opts, DEFAULT_REGION);
|
|
46
|
+
const region = validateAwsRegion(defaults.region);
|
|
47
47
|
const failOn = parseFailOn(opts.failOn);
|
|
48
48
|
if (opts.iamOnly && opts.bedrockOnly) {
|
|
49
49
|
throw new Error('--iam-only and --bedrock-only are mutually exclusive; omit both to run everything');
|
|
@@ -55,46 +55,25 @@ export default {
|
|
|
55
55
|
if (!Number.isFinite(unusedDays) || unusedDays < 1)
|
|
56
56
|
throw new Error('--unused-days must be a positive integer');
|
|
57
57
|
// One target for every check; scan-org supplies assumed-role creds instead.
|
|
58
|
-
const target = { profile:
|
|
58
|
+
const target = { profile: defaults.profile };
|
|
59
|
+
if (defaults.note)
|
|
60
|
+
console.error(defaults.note);
|
|
59
61
|
const accountId = resolveAccount(target);
|
|
60
62
|
if (!accountId) {
|
|
61
63
|
process.exitCode = 2;
|
|
62
64
|
return;
|
|
63
65
|
}
|
|
66
|
+
const changed = accountChangeWarning(defaults.connection, accountId);
|
|
67
|
+
if (changed)
|
|
68
|
+
console.error(changed);
|
|
64
69
|
const runIam = !opts.bedrockOnly;
|
|
65
70
|
const runBedrock = !opts.iamOnly;
|
|
66
|
-
|
|
67
|
-
// scope its per-notification calls to them rather than every budget.
|
|
68
|
-
const budgets = runBedrock ? auditBudgets(target, accountId) : null;
|
|
69
|
-
const findings = [
|
|
70
|
-
...(runIam ? [
|
|
71
|
-
...auditRoot(target),
|
|
72
|
-
auditPasswordPolicy(target),
|
|
73
|
-
...auditUsers(target, maxKeyAge, unusedDays),
|
|
74
|
-
auditUserPolicies(target),
|
|
75
|
-
] : []),
|
|
76
|
-
...(runBedrock && budgets ? [
|
|
77
|
-
...budgets.findings,
|
|
78
|
-
auditBudgetAlerting(target, accountId, budgets.coveringBudgets, budgets.listError),
|
|
79
|
-
...auditDetection(target, region),
|
|
80
|
-
auditAiProtection(target, region),
|
|
81
|
-
auditCommitments(target, region),
|
|
82
|
-
auditForensics(target, region),
|
|
83
|
-
] : []),
|
|
84
|
-
];
|
|
71
|
+
const findings = auditAccount(target, accountId, region, { maxKeyAge, unusedDays, runIam, runBedrock });
|
|
85
72
|
const scope = runIam && runBedrock ? '' : runIam ? ' Scope: IAM only' : ' Scope: Bedrock only';
|
|
86
73
|
renderReport(findings, {
|
|
87
74
|
title: '🛡️ Bedrock protection — account audit',
|
|
88
75
|
subtitle: `Account: ${accountId} Region: ${region}${scope}`,
|
|
89
|
-
groups:
|
|
90
|
-
['root', 'Root user — unconstrainable by design'],
|
|
91
|
-
['users', 'IAM users and access keys'],
|
|
92
|
-
['policy', 'Account-wide policy'],
|
|
93
|
-
['budget', 'Spend ceilings — both billing surfaces'],
|
|
94
|
-
['detection', 'Detection speed — how fast you find out'],
|
|
95
|
-
['commitment', 'Standing commitments'],
|
|
96
|
-
['forensics', 'Forensics — can you answer "who?"'],
|
|
97
|
-
],
|
|
76
|
+
groups: ACCOUNT_AUDIT_GROUPS,
|
|
98
77
|
json: Boolean(opts.json),
|
|
99
78
|
jsonContext: {
|
|
100
79
|
account: accountId,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan-account.js","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,cAAc,EAAE,
|
|
1
|
+
{"version":3,"file":"scan-account.js","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACI,YAAY,EAAE,WAAW,EAAE,WAAW,EAC/C,cAAc,EAAE,WAAW,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEhK;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,eAAe;IACb,WAAW,EAAE,6IAA6I;IAC1J,OAAO,EAAE;QACP,iBAAiB,CAAC,kEAAkE,CAAC;QACrF,oBAAoB;QACpB,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,IAAI,EAAE;QACxG,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,IAAI,EAAE;QACvG,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,4CAA4C,EAAE;QAClF,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,2DAA2D,EAAE;QACrG,WAAW;QACX,cAAc;KACf;IACD,KAAK,CAAC,MAAM,CAAC,IAGZ;QACC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9G,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAEhH,4EAA4E;QAC5E,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI;YAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QACjC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAEjC,MAAM,QAAQ,GAAc,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnH,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAErG,YAAY,CAAC,QAAQ,EAAE;YACrB,KAAK,EAAE,yCAAyC;YAChD,QAAQ,EAAE,YAAY,SAAS,eAAe,MAAM,GAAG,KAAK,EAAE;YAC9D,MAAM,EAAE,oBAAoB;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,WAAW,EAAE;gBACX,OAAO,EAAE,SAAS;gBAClB,MAAM;gBACN,KAAK,EAAE,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc;aAC5E;SACF,CAAC,CAAC;QAEH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scan-org.d.ts","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-org.ts"],"names":[],"mappings":";;;;;;
|
|
1
|
+
{"version":3,"file":"scan-org.d.ts","sourceRoot":"","sources":["../../../../src/commands/bedrock-protection/scan-org.ts"],"names":[],"mappings":";;;;;;iBA2JqB;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAClE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QACzF,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjC;;AArBH,wBAsTE"}
|