@shield-agent/kya 0.32.9 → 0.33.2

package/dist/receipt/render-receipt.js

@@ -1,10 +1,12 @@
 /**
  * Activity feed HTML/MD for local trail events.
  */
+import { liveMapScripts, MAP_CSS, MAP_LIVE_ZONE_CSS } from "../map/page.js";
+import { semanticInstallCommand, semanticRuntimeInstalled } from "./semantic-status.js";
 import { assertNoSecrets, clip, stripEscapes } from "../dash/render.js";
 import { clipMultiline, DIFF_MAX_TOTAL_CHARS } from "../diff-preview.js";
 import { DOMAIN_LABELS, domainOrder } from "../certify/render.js";
-import { productLabel, readTrail, readTrailSince } from "../trail.js";
+import { productLabel, eventsSince, readTrail } from "../trail.js";
 import { mcpServerLabel, parseMcpToolId } from "../mcp-servers.js";
 import { loadInvestigateLastRun, } from "../investigate/last-run.js";
 import { readNotifyLog, summarizeNotifyLog, } from "../notify/log.js";
@@ -18,6 +20,8 @@ import { GATE_NOT_SETUP_QUICKSTART, loadGatePage, toolNameFromToolId, toolServer
 import { receiptCss } from "./receipt-css.js";
 import { applyChipFilters, rankEvents } from "./search.js";
 import { emptyOpenshellCard, loadOpenshellCard } from "./openshell-card.js";
+import { readIocResult } from "../ioc/result.js";
+import { postureCard } from "../posture/card.js";
 export const PAGE_SIZE = 50;
 export function clampPage(page, total) {
     if (total === 0)
@@ -282,6 +286,8 @@ export function buildReceiptModel(sessionId, events, extras) {
         investigate: extras?.investigate,
         alerts: extras?.alerts,
         otel: extras?.otel,
+        ioc: extras?.ioc,
+        posture: extras?.posture,
     };
 }
 export function buildWindowReceiptModel(events, days, extras) {
@@ -310,6 +316,8 @@ export function buildWindowReceiptModel(events, days, extras) {
         investigate: extras?.investigate,
         alerts: extras?.alerts,
         otel: extras?.otel,
+        ioc: extras?.ioc,
+        posture: extras?.posture,
     };
 }
 /** Shared loader for static artifacts and the live loopback server. */
@@ -317,13 +325,13 @@ export function loadReceiptModel(input) {
     const days = input.days > 0 ? Math.floor(input.days) : 3;
     const env = input.env ?? process.env;
     const showback = loadShowbackCard(input.cwd);
-    const events = input.sessionId
-        ? readTrail(input.cwd, env)
-        : readTrailSince(input.cwd, new Date(Date.now() - days * 24 * 60 * 60 * 1000), env);
-    // The Import card aggregates the full trail, not just the window: imported
-    // spans keep their foreign timestamps and would fall out of a short window.
+    // One trail read per model. The Import card aggregates the full trail, not just the window:
+    // imported spans keep their foreign timestamps and would fall out of a short window.
     // The OpenShell card rolls up the same full-trail view for the same reason.
-    const importEvents = input.sessionId ? events : readTrail(input.cwd, env);
+    const importEvents = readTrail(input.cwd, env);
+    const events = input.sessionId
+        ? importEvents
+        : eventsSince(importEvents, new Date(Date.now() - days * 24 * 60 * 60 * 1000));
     const certify = loadCertifyCard(input.cwd);
     const extras = {
         page: input.page ?? 1,
@@ -343,6 +351,8 @@ export function loadReceiptModel(input) {
         investigate: loadInvestigateLastRun(env),
         alerts: summarizeNotifyLog(readNotifyLog(env)),
         otel: readOtelStats(env),
+        ioc: readIocResult(env),
+        posture: postureCard(env),
         spend: showback
             ? {
                 tokens: showback.totalTokensIn + showback.totalTokensOut,
@@ -389,8 +399,21 @@ function projectMeta(project) {
       <span class="dot">-</span>
       <span class="project">${esc(clip(p, 40))}</span>`;
 }
-function renderFeed(events, nowMs, live, preserveOrder) {
+/** Empty list while events exist: the search or the chip filters matched nothing. */
+function noMatchHint(query, env = process.env) {
+    const q = query?.trim();
+    if (!q)
+        return "No events match these filters. Clear a filter to see more.";
+    const base = `No events match &ldquo;${esc(clip(q, 60))}&rdquo;.`;
+    if (semanticRuntimeInstalled(env))
+        return base;
+    return (`${base} Plain-language search is off, so only exact words match. ` +
+        `Turn it on once with <code>${esc(semanticInstallCommand(env))}</code>, then search again.`);
+}
+function renderFeed(events, nowMs, live, preserveOrder, noMatch) {
     if (events.length === 0) {
+        if (noMatch)
+            return `<p class="empty">${noMatch}</p>`;
         const hint = live
             ? "No events yet - evaluate a tool call with <code>kya wrap</code> and this page will refresh."
             : "No events yet - evaluate a tool call with <code>kya wrap</code>, then regenerate this receipt.";
@@ -1837,7 +1860,7 @@ function normalizeTrailEvents(events) {
         targetPath: e.targetPath ? clip(e.targetPath, 80) : undefined,
     }));
 }
-export function renderFeedPage(events, filters, page, nowMs, live, query, embeddings, queryEmbedding) {
+export function renderFeedPage(events, filters, page, nowMs, live, query, embeddings, queryEmbedding, indexVersion) {
     const q = query?.trim();
     let ordered;
     let total;
@@ -1848,6 +1871,7 @@ export function renderFeedPage(events, filters, page, nowMs, live, query, embedd
             embeddings,
             queryEmbedding,
             facetBoost: 0.05,
+            indexVersion,
         });
         ordered = ranked.map((r) => r.event);
         total = ranked.length;
@@ -1862,7 +1886,7 @@ export function renderFeedPage(events, filters, page, nowMs, live, query, embedd
     const start = (p - 1) * PAGE_SIZE;
     const pageEvents = ordered.slice(start, start + PAGE_SIZE);
     return {
-        feedHtml: renderFeed(pageEvents, nowMs, live, !!q),
+        feedHtml: renderFeed(pageEvents, nowMs, live, !!q, pageEvents.length === 0 && events.length > 0 ? noMatchHint(q) : undefined),
         paginationHtml: paginationBar(total, p, pages),
         total,
         page: p,
@@ -1948,6 +1972,70 @@ export function buildLiveFragments(model, livePaged) {
         },
     };
 }
+/**
+ * IoC banner: only when a scan found something. It sits above the zones, so it shows on every
+ * page as a safety signal. The detail is in the System zone.
+ */
+function iocBannerHtml(ioc) {
+    const n = ioc?.findings.length ?? 0;
+    if (n === 0)
+        return "";
+    return `<aside class="alert" aria-label="IoC findings">
+  <strong>IoC check: ${n} finding${n === 1 ? "" : "s"} (advisory)</strong>
+  <a href="#system">See the details on the System page</a>
+</aside>`;
+}
+/** IoC card for the System zone: the findings list, or a quiet line when clean. Nothing before the first scan. */
+function iocSectionHtml(ioc) {
+    if (!ioc)
+        return "";
+    const n = ioc.findings.length;
+    if (n > 0) {
+        const items = ioc.findings
+            .map((f) => `<li><code>${esc(f.ioc)}</code> ${esc(f.check)} <code>${esc(f.evidence)}</code><br><span class="mute">Fix: ${esc(f.hint)}</span></li>`)
+            .join("");
+        return `<section class="card" aria-label="IoC check details">
+  <h3>IoC check: ${n} finding${n === 1 ? "" : "s"} (advisory)</h3>
+  <ul>${items}</ul>
+  <p class="mute">List ${esc(ioc.listVersion)} · checked ${esc(ioc.checkedAt)}. A clean check does not prove the machine is clean.</p>
+</section>`;
+    }
+    return `<section class="card" aria-label="IoC check">
+  <h3>IoC check</h3>
+  <p class="mute">No findings. List ${esc(ioc.listVersion)} · checked ${esc(ioc.checkedAt)} · unreadable files skipped: ${ioc.skipped}. Advisory: a clean check does not prove the machine is clean.</p>
+</section>`;
+}
+/** Developer setup card (advisory). Shows what a send would contain and the local on/off switch. */
+function postureSectionHtml(card, live) {
+    if (!card)
+        return "";
+    const list = (items) => items.length === 0 ? "none" : items.map((i) => `<code>${esc(i)}</code>`).join(", ");
+    const toggle = live
+        ? card.share
+            ? `<button type="button" class="stat" data-report-action="posture" data-posture-share="off">Stop sharing</button>`
+            : `<button type="button" class="stat" data-report-action="posture" data-posture-share="on">Turn sharing on</button>`
+        : `<p class="mute small">To change this, run <code>kya posture on</code> or <code>kya posture off</code>.</p>`;
+    const blocked = card.violations.length > 0
+        ? `<p class="mute">Not sendable as it is: ${esc(card.violations.map((v) => `${v.path || "report"} (${v.reason})`).join("; "))}.</p>`
+        : "";
+    return `<section class="card" aria-label="Developer setup">
+  <h3>Developer setup</h3>
+  <p class="mute">Sharing is <strong>${card.share ? "on" : "off"}</strong>. Hosted login: ${card.hosted ? "yes" : "no"}. Workspace policy (cached): ${esc(card.policy)}${card.lastSentAt ? `. Last sent: ${esc(card.lastSentAt)}` : ""}.</p>
+  <p class="mute small">Nothing is sent unless you have a hosted login and your workspace admin turned it on. Turning this on only changes a setting on this machine.${card.hosted ? "" : " Hosted login: no, so nothing is sent from this machine."}</p>
+  <p class="mute small">This list is what the report says about this machine. A send also adds a random device id and a label. The default label is 8 hex characters of a hash. Change it with <code>kya posture label NAME</code>. A send contains no paths, no environment values and no user name:</p>
+  <ul>
+    <li>Agent hosts: ${list(card.hosts)}</li>
+    <li>Agent extensions: ${list(card.extensions)}</li>
+    <li>MCP servers (name, transport, command name): ${list(card.mcpServers)}</li>
+    <li>IoC check: ${esc(card.iocLine)}</li>
+    <li>Never-list: mode ${esc(card.neverMode)}</li>
+  </ul>
+  ${blocked}
+  ${toggle}
+  <div id="report-action-result-posture"></div>
+  <p class="mute small">Advisory. This card reports what is shared. It does not prevent anything.</p>
+</section>`;
+}
 export function renderReceiptHtml(model) {
     const nowMs = Date.now();
     const events = normalizeTrailEvents(model.events);
@@ -1977,6 +2065,8 @@ export function renderReceiptHtml(model) {
     const tools = model.mcpSeen && model.mcpSeen.length > 0
         ? model.mcpSeen.map((m) => m.toolId)
         : [...new Set(events.map((e) => e.toolId))];
+    // Only the findings banner repeats on every page; the quiet cards live in the System zone.
+    const iocBanner = iocBannerHtml(model.ioc);
     const blockedBanner = blocked.length === 0
         ? ""
         : `<aside class="alert" aria-label="Blocked never-events">
@@ -2332,6 +2422,7 @@ export function renderReceiptHtml(model) {
       dirty = false;
       feedUpdate();
       scheduleFragments();
+      if (window.kyaMapRefresh && location.hash === '#map') window.kyaMapRefresh();
     }
     // EventSource is absent in DOM shims and very old engines; the page still
     // works, it just does not stream updates.
@@ -2623,7 +2714,9 @@ export function renderReceiptHtml(model) {
       var resultEl = document.getElementById('report-action-result-' + action);
       btn.disabled = true;
       setResult(resultEl, 'Working...', false);
-      post('/action/' + action, {})
+      var shareAttr = btn.getAttribute('data-posture-share');
+      var body = shareAttr ? { share: shareAttr === 'on' } : {};
+      post('/action/' + action, body)
         .then(parseJson)
         .then(function(data){
           if (data && data.ok) {
@@ -2633,7 +2726,9 @@ export function renderReceiptHtml(model) {
                 ? 'Done: ' + data.total + ' item(s) discovered'
                 : action === 'notify-test'
                   ? (data.detail ? String(data.detail) : 'Test alert sent to ' + data.targets + ' target(s)')
-                  : String(data.detail || 'ok');
+                  : action === 'posture'
+                    ? 'Developer setup sharing is ' + (data.share ? 'on' : 'off') + '.'
+                    : String(data.detail || 'ok');
             setResult(resultEl, '<p>' + esc(msg) + '</p>', false);
             if (action === 'otel-test') {
               btn.disabled = false;
@@ -2714,6 +2809,8 @@ export function renderReceiptHtml(model) {
     // (zoneBody lives at module level; buildLiveFragments above produces the
     // overview and certify bodies through the same helper.)
     const systemBody = zoneBody([
+        iocSectionHtml(model.ioc),
+        postureSectionHtml(model.posture, !!model.liveToken),
         capabilitiesPanel(model),
         gatePanel(model.gate, nowMs),
         wiredHostsPanel(model.wiredHosts),
@@ -2729,7 +2826,7 @@ export function renderReceiptHtml(model) {
 <meta charset="utf-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
 <title>${esc(model.title)} - ${esc(model.rangeLabel)}</title>
-<style>${receiptCss()}</style>
+<style>${receiptCss()}${model.liveToken ? MAP_CSS + MAP_LIVE_ZONE_CSS : ""}</style>
 </head>
 <body>
 <aside class="sidebar">
@@ -2745,6 +2842,7 @@ export function renderReceiptHtml(model) {
     ${navItem("#changes", "Changes", changes.fileCount)}
     ${navItem("#certify", "Certify", model.certify?.gap ?? 0)}
     ${navItem("#orr", "ORR", model.orr ? model.orr.scorecards.fail : undefined)}
+    ${model.liveToken ? navItem("#map", "Map", undefined) : ""}
     ${navGroup("Gateway", model.gate?.state === "running")}
     ${navSubItem("#gateway-home", "Home", model.gate?.servers.length ?? 0)}
     ${navSubItem("#gateway-listeners", "Listeners", model.gate?.listeners?.length ?? 0)}
@@ -2770,6 +2868,7 @@ ${model.liveToken ? '<main data-live-token="1">' : '<main>'}
     ${identityLine(model.identity)}
   </header>
   ${blockedBanner}
+  ${iocBanner}
   <section class="zone" id="overview" aria-labelledby="tab-overview">
     <div class="hero">
       ${fr.fragments.heroCertify}
@@ -2809,12 +2908,14 @@ ${fr.fragments.changesList}
   <section class="zone" id="orr" aria-labelledby="tab-orr">
     <div id="frag-orr">${fr.fragments.orrPanel}</div>
   </section>
+  ${model.liveToken ? '<section class="zone" id="map" aria-labelledby="tab-map"><div id="frag-map"><p class="mute">Loading the map.</p></div></section>' : ""}
   ${gatePagePanel(model.gate, nowMs)}
   <section class="zone" id="system" aria-labelledby="tab-system">
     ${systemBody}
   </section>
 </main>
 ${filterScript}
+${model.liveToken ? liveMapScripts() : ""}
 ${staticSearchScript}
 ${themeScript}
 ${gateScript}
@@ -2836,6 +2937,10 @@ export function renderReceiptMarkdown(model) {
         `Allow ${c.allow} | Deny ${c.deny} | Review ${c.require} | Never ${c.never}`,
         "",
     ];
+    if (model.ioc) {
+        const k = model.ioc.findings.length;
+        lines.push(mdText(`IoC check (advisory): ${k === 0 ? "no findings" : `${k} finding${k === 1 ? "" : "s"}`}, list ${model.ioc.listVersion}, checked ${model.ioc.checkedAt}.`), "");
+    }
     if (model.identity) {
         const id = model.identity;
         const nameId = id.agentName && id.agentId