@shield-agent/kya 0.33.5 → 0.34.0

package/dist/alerts/triage-setup.js

@@ -0,0 +1,280 @@
+/**
+ * One-time offer of security alerts with local triage, made by `kya start` (same pattern as
+ * receipt/semantic-setup.ts). Alerts tell you when KYA detects a security incident (destructive change,
+ * secret access, exfiltration, repeated denies). The optional local model adds a category, an urgency and a
+ * suggested action to each alert. It runs offline after one download. Advisory: it never blocks anything.
+ *
+ * Asks once, in a terminal. Yes: installs the runtime and the model, turns alerts on in the USER-level config,
+ * sends one test alert. No: remembered (alerts-choice.json), never asked again. Without a terminal: one hint line.
+ * `KYA_ALERTS=on` installs without asking (scripts, images). `KYA_ALERTS=off` never asks.
+ * Never fails `kya start`: any problem prints the manual command and moves on. Without the model, alerts still
+ * work with the detector severity.
+ */
+import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createWriteStream, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { kyaHome, globalConfigDir, readFileConfig } from "../config.js";
+import { notifyIncident, resolveIncidentWebhooks } from "../notify/index.js";
+import { resolveAlertsConfig, writeAlertsEnabled } from "./config.js";
+import { desktopNotify } from "./desktop.js";
+import { buildTestIncidentAlert } from "./incident-alert.js";
+import { TRIAGE_MODEL_HOST, TRIAGE_MODEL_MAX_BYTES, TRIAGE_MODEL_MB, TRIAGE_MODEL_SHA256, TRIAGE_MODEL_URL, TRIAGE_RUNTIME_PACKAGE, triageInstallCommand, triageInstalled, triageModelInstallPath, triageModelPresent, triageRuntimeDir, triageRuntimeInstalled, } from "./triage-status.js";
+const CHOICE_FILE = "alerts-choice.json";
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+/** Time to the response headers (connect and first byte). */
+const DOWNLOAD_CONNECT_TIMEOUT_MS = 10_000;
+/** Longest silence while the body streams. */
+const DOWNLOAD_READ_TIMEOUT_MS = 60_000;
+/** A model file smaller than this is not a model (error page, empty body). */
+const MIN_MODEL_BYTES = 1_000_000;
+const NOTICE = [
+    "Security alerts (optional).",
+    "KYA tells you when it detects a security incident: a destructive change, secret access, data exfiltration or repeated denies.",
+    `A small local model adds a category, an urgency and a next step to each alert. It runs fully offline after one download: about ${TRIAGE_MODEL_MB} MB for the model and about 100 MB for a local runtime. Nothing leaves this machine.`,
+    "Alerts are advisory: local KYA never blocks because of them.",
+];
+function choicePath(env) {
+    return join(globalConfigDir(env), CHOICE_FILE);
+}
+function declinedBefore(env) {
+    try {
+        return JSON.parse(readFileSync(choicePath(env), "utf8")).answer === "no";
+    }
+    catch {
+        return false;
+    }
+}
+function recordChoice(env, answer) {
+    try {
+        mkdirSync(globalConfigDir(env), { recursive: true });
+        writeFileSync(choicePath(env), `${JSON.stringify({ answer, askedAt: new Date().toISOString() })}\n`, { mode: 0o600 });
+    }
+    catch {
+        /* a lost answer only means we may ask again */
+    }
+}
+/** Other platforms' native binaries are dead weight (about 200 MB). Removes them from our own runtime dir. */
+function pruneOtherPlatforms(env) {
+    try {
+        const bin = join(triageRuntimeDir(env), "node_modules", "onnxruntime-node", "bin");
+        for (const napi of readdirSync(bin)) {
+            for (const plat of readdirSync(join(bin, napi))) {
+                if (plat !== process.platform)
+                    rmSync(join(bin, napi, plat), { recursive: true, force: true });
+            }
+        }
+    }
+    catch {
+        /* pruning is only a size saving */
+    }
+}
+/** `npm install --prefix <dir> onnxruntime-node@1.30.0`. Fixed arguments, no user text. */
+export function installTriageRuntime(env) {
+    const dir = triageRuntimeDir(env);
+    try {
+        mkdirSync(dir, { recursive: true });
+    }
+    catch (err) {
+        return Promise.resolve({ ok: false, detail: err instanceof Error ? err.message : String(err) });
+    }
+    const win = process.platform === "win32";
+    return new Promise((resolve) => {
+        execFile(win ? "npm.cmd" : "npm", 
+        // --ignore-scripts: the only install script of onnxruntime-node downloads CUDA binaries on Linux x64 (hundreds of MB). The CPU binary is bundled.
+        ["install", "--prefix", win ? `"${dir}"` : dir, "--no-audit", "--no-fund", "--ignore-scripts", TRIAGE_RUNTIME_PACKAGE], { env: { ...env, ONNXRUNTIME_NODE_INSTALL: "skip" }, timeout: INSTALL_TIMEOUT_MS, windowsHide: true, shell: win }, (err, _stdout, stderr) => {
+            if (err)
+                return resolve({ ok: false, detail: (String(stderr).trim().split("\n").pop() || err.message).slice(0, 200) });
+            pruneOtherPlatforms(env);
+            resolve({ ok: triageRuntimeInstalled(env) });
+        });
+    });
+}
+/** https, exactly the model host, default port, no credentials. No exception for any other host or scheme. */
+export function modelUrlRefusal(url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return "model URL is not valid";
+    }
+    if (u.protocol !== "https:")
+        return "model URL must use https";
+    if (u.hostname !== TRIAGE_MODEL_HOST || u.port !== "" || u.username !== "" || u.password !== "")
+        return `model URL must be on ${TRIAGE_MODEL_HOST}`;
+    return undefined;
+}
+/**
+ * Download the pinned model once. The URL is a constant: no environment variable or option changes it
+ * (`KYA_TRIAGE_MODEL_URL` is ignored).
+ */
+export function downloadTriageModel(env) {
+    return downloadModelFrom(env, { url: TRIAGE_MODEL_URL });
+}
+/**
+ * The download, for any source (tests). Rules: https only, one host, redirects are never followed (a 3xx is a failure), the
+ * response must declare a Content-Length of at most 200 MB, the stream is cut off past the cap, the bytes are
+ * hashed while they are written to a temp file next to the target, and only a file with the pinned sha256 is
+ * renamed into place (atomic). The temp file is removed on any failure. Timeouts: 10 s to the headers, 60 s of
+ * silence while streaming.
+ */
+export async function downloadModelFrom(env, deps) {
+    const target = triageModelInstallPath(env);
+    const tmp = `${target}.${randomBytes(8).toString("hex")}.part`;
+    const abort = new AbortController();
+    const cap = deps.maxBytes ?? TRIAGE_MODEL_MAX_BYTES;
+    let timer;
+    const arm = (ms, what) => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => abort.abort(new Error(what)), ms);
+    };
+    try {
+        const url = deps.url;
+        const refusal = (deps.refusal ?? modelUrlRefusal)(url);
+        if (refusal)
+            return { ok: false, detail: refusal };
+        mkdirSync(dirname(target), { recursive: true });
+        arm(deps.connectTimeoutMs ?? DOWNLOAD_CONNECT_TIMEOUT_MS, "download timed out (no answer in 10 s)");
+        const res = await (deps.fetch ?? fetch)(url, { redirect: "manual", signal: abort.signal });
+        if (res.status >= 300 && res.status < 400)
+            return { ok: false, detail: `download refused: redirect (HTTP ${res.status}) is not followed` };
+        if (!res.ok || !res.body)
+            return { ok: false, detail: `download failed (HTTP ${res.status})` };
+        const declared = res.headers.get("content-length");
+        if (declared === null || !/^\d{1,12}$/.test(declared))
+            return { ok: false, detail: "download refused: no Content-Length" };
+        if (Number(declared) > cap)
+            return { ok: false, detail: "download refused: file is larger than 200 MB" };
+        const hash = createHash("sha256");
+        let bytes = 0;
+        // pipeline closes both ends and passes any stream error on, so a broken write cannot crash the process.
+        await pipeline(Readable.fromWeb(res.body), new Transform({
+            transform(chunk, _enc, cb) {
+                bytes += chunk.length;
+                if (bytes > cap)
+                    return cb(new Error("download aborted: more than 200 MB"));
+                arm(deps.readTimeoutMs ?? DOWNLOAD_READ_TIMEOUT_MS, "download timed out (no data for 60 s)");
+                hash.update(chunk);
+                cb(null, chunk);
+            },
+        }), createWriteStream(tmp, { mode: 0o600 }), { signal: abort.signal });
+        const want = (deps.sha256 ?? TRIAGE_MODEL_SHA256).toLowerCase();
+        if (hash.digest("hex") !== want) {
+            rmSync(tmp, { force: true });
+            return { ok: false, detail: "sha256 does not match the pinned value: file refused" };
+        }
+        if (bytes < MIN_MODEL_BYTES) {
+            rmSync(tmp, { force: true });
+            return { ok: false, detail: "model file is too small: refused" };
+        }
+        renameSync(tmp, target);
+        return { ok: true };
+    }
+    catch (err) {
+        const reason = abort.signal.aborted && abort.signal.reason instanceof Error ? abort.signal.reason : err;
+        return { ok: false, detail: (reason instanceof Error ? reason.message : String(reason)).slice(0, 200) };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        rmSync(tmp, { force: true });
+    }
+}
+/** Desktop notification plus every configured incident webhook, marked as a test. */
+export async function sendTestAlert(env) {
+    const alert = buildTestIncidentAlert();
+    const desktop = resolveAlertsConfig(env).desktop ? await desktopNotify(alert, env) : false;
+    const targets = resolveIncidentWebhooks(readFileConfig(kyaHome(env)));
+    const webhooks = targets.length > 0 ? await notifyIncident(alert, targets, env) : 0;
+    return { desktop, webhooks };
+}
+function defaultAsk(question) {
+    return new Promise((resolve) => {
+        // Prompt on stderr so stdout stays clean for anything piping the command's output.
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        rl.question(`${question} `, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+async function runInstall(io, env) {
+    io.error("Turning on security alerts. The local model download can take a few minutes...");
+    const wasOn = readFileConfig(kyaHome(env)).alerts?.enabled === true;
+    let modelOk = true;
+    let installedNow = false;
+    if (!triageRuntimeInstalled(env)) {
+        const r = await (io.installRuntime ?? installTriageRuntime)(env);
+        if (!r.ok) {
+            modelOk = false;
+            io.error(`Could not install the local runtime${r.detail ? ` (${r.detail})` : ""}.`);
+        }
+        else
+            installedNow = true;
+    }
+    if (modelOk && !triageModelPresent(env)) {
+        const r = await (io.downloadModel ?? downloadTriageModel)(env);
+        if (!r.ok) {
+            modelOk = false;
+            io.error(`Could not get the local model${r.detail ? ` (${r.detail})` : ""}.`);
+        }
+        else
+            installedNow = true;
+    }
+    try {
+        writeAlertsEnabled(env, true);
+    }
+    catch (err) {
+        io.error(`Could not write the alerts setting (${err instanceof Error ? err.message : String(err)}). Try later: ${triageInstallCommand()}`);
+        return "partial";
+    }
+    if (modelOk)
+        io.error("Security alerts are on, with local triage.");
+    else
+        io.error(`Security alerts are on with the detector severity only. Add the local model later: ${triageInstallCommand()}`);
+    // KYA_ALERTS=on runs this on every start while the model is missing: send the test alert only when this run changed something.
+    if (wasOn && !installedNow)
+        return modelOk ? "installed" : "partial";
+    try {
+        const t = await (io.testAlert ?? sendTestAlert)(env);
+        const where = [t.desktop ? "a desktop notification" : "", t.webhooks > 0 ? `${t.webhooks} webhook(s)` : ""].filter(Boolean);
+        io.error(where.length > 0 ? `Sent a test alert: ${where.join(" and ")}.` : "No desktop notifier found and no webhook set: alerts show in the report only.");
+    }
+    catch {
+        /* a failed test alert does not change anything else */
+    }
+    return modelOk ? "installed" : "partial";
+}
+export async function maybeOfferTriageAlerts(io, env) {
+    const mode = env.KYA_ALERTS?.trim().toLowerCase();
+    if (mode === "off" || mode === "0" || mode === "false")
+        return "skipped";
+    if (triageInstalled(env))
+        return "already";
+    if (mode === "on" || mode === "1" || mode === "true")
+        return runInstall(io, env);
+    // An explicit user-level choice (`kya alerts on|off`) is a decision: do not ask.
+    if (resolveAlertsConfig(env).source === "config" || declinedBefore(env))
+        return "skipped";
+    const interactive = io.isTty ?? Boolean(process.stdin.isTTY && process.stderr.isTTY);
+    if (!interactive) {
+        io.error(`Security alerts are off. Turn them on: ${triageInstallCommand()}`);
+        return "hinted";
+    }
+    for (const line of NOTICE)
+        io.error(line);
+    const answer = await (io.ask ?? defaultAsk)("Turn on security alerts? [Y/n]");
+    const no = /^n(o)?$/i.test(answer.trim());
+    recordChoice(env, no ? "no" : "yes");
+    if (no) {
+        io.error(`No problem. Turn it on later: ${triageInstallCommand()}`);
+        return "declined";
+    }
+    return runInstall(io, env);
+}
+//# sourceMappingURL=triage-setup.js.map

package/dist/alerts/triage-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-setup.js","sourceRoot":"","sources":["../../src/alerts/triage-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAyB,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AACtC,6DAA6D;AAC7D,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,8CAA8C;AAC9C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,8EAA8E;AAC9E,MAAM,eAAe,GAAG,SAAS,CAAC;AAmBlC,MAAM,MAAM,GAAG;IACb,6BAA6B;IAC7B,+HAA+H;IAC/H,kIAAkI,eAAe,sFAAsF;IACvO,8DAA8D;CAC/D,CAAC;AAEF,SAAS,UAAU,CAAC,GAAsB;IACxC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC,MAAM,KAAK,IAAI,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB,EAAE,MAAoB;IAChE,IAAI,CAAC;QACH,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,SAAS,mBAAmB,CAAC,GAAsB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,KAAK,OAAO,CAAC,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACvB,kJAAkJ;QAClJ,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,EACtH,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EACjH,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,IAAI,GAAG;gBAAE,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvH,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAmBD,8GAA8G;AAC9G,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,0BAA0B,CAAC;IAC/D,IAAI,CAAC,CAAC,QAAQ,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,wBAAwB,iBAAiB,EAAE,CAAC;IACpJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,OAAO,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAsB,EAAE,IAAoB;IAClF,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IACpD,IAAI,KAAiC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAY,EAAQ,EAAE;QAC7C,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACnD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,2BAA2B,EAAE,wCAAwC,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC;QAC3I,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAC3H,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACzG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,wGAAwG;QACxG,MAAM,QAAQ,CACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,EACpE,IAAI,SAAS,CAAC;YACZ,SAAS,CAAC,KAAa,EAAE,IAAI,EAAE,EAAE;gBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,GAAG;oBAAE,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBAC5E,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;gBAC7F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClB,CAAC;SACF,CAAC,EACF,iBAAiB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACvC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzB,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACnE,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QACxG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1G,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAsB;IACxD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,MAAM,OAAO,GAAG,uBAAuB,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAqB,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,mFAAmF;QACnF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YACrC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAiB,EAAE,GAAsB;IACjE,EAAE,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAwC,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAC5G,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,cAAc,IAAI,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,GAAG,KAAK,CAAC;YAChB,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;;YAAM,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO,GAAG,KAAK,CAAC;YAChB,EAAE,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;;YAAM,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,CAAC,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC3I,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO;QAAE,EAAE,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;;QAC/D,EAAE,CAAC,KAAK,CAAC,sFAAsF,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC9H,+HAA+H;IAC/H,IAAI,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5H,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC;IAC9J,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAiB,EAAE,GAAsB;IACpF,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjF,iFAAiF;IACjF,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1F,MAAM,WAAW,GAAG,EAAE,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,EAAE,CAAC,KAAK,CAAC,0CAA0C,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,EAAE,CAAC,KAAK,CAAC,iCAAiC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/alerts/triage-status.d.ts

@@ -0,0 +1,26 @@
+/** Pinned exact version, published 2026-09-14. No network at hook time: it is installed once, by the offer. */
+export declare const TRIAGE_RUNTIME_PACKAGE = "onnxruntime-node@1.30.0";
+export declare const TRIAGE_RUNTIME_NAME = "onnxruntime-node";
+export declare const TRIAGE_MODEL_ID = "kya-triage-v1";
+/** The only host the model is downloaded from: a public Cloudflare R2 bucket (`kya-models`) behind a custom domain. */
+export declare const TRIAGE_MODEL_HOST = "models.shield-agent.com";
+/** Immutable object path (a new model is a new path). Upload steps: docs/operations/kya-triage-model-release.md. */
+export declare const TRIAGE_MODEL_URL = "https://models.shield-agent.com/triage-model-v1/kya-triage-v1.bin";
+/** A model file larger than this is refused (the real file is about 145 MiB). */
+export declare const TRIAGE_MODEL_MAX_BYTES: number;
+/** sha256 of the packed model file (of the uploaded object). A download with another hash is refused. */
+export declare const TRIAGE_MODEL_SHA256 = "9df79939edaef4bdadbb9972bf357a9f7c396b6a837489f438974a54e00be786";
+export declare const TRIAGE_MODEL_MB = 150;
+export declare function triageRuntimeDir(env?: NodeJS.ProcessEnv): string;
+/** Where the offer writes the model. */
+export declare function triageModelInstallPath(env?: NodeJS.ProcessEnv): string;
+/** The model file to load. `KYA_TRIAGE_MODEL_PATH` points at a locally built file (tests, development). */
+export declare function triageModelFile(env?: NodeJS.ProcessEnv): string;
+/** The one command that installs the runtime and the model (printed when an install fails). */
+export declare function triageInstallCommand(): string;
+/** True when the runtime package files exist under the opt-in prefix. Nothing is loaded. */
+export declare function triageRuntimeInstalled(env?: NodeJS.ProcessEnv): boolean;
+export declare function triageModelPresent(env?: NodeJS.ProcessEnv): boolean;
+/** Runtime and model are both there: the alert scan then adds triage to each new incident alert. */
+export declare function triageInstalled(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=triage-status.d.ts.map

package/dist/alerts/triage-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-status.d.ts","sourceRoot":"","sources":["../../src/alerts/triage-status.ts"],"names":[],"mappings":"AAUA,+GAA+G;AAC/G,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AACtD,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAC/C,uHAAuH;AACvH,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAC3D,oHAAoH;AACpH,eAAO,MAAM,gBAAgB,sEAAmE,CAAC;AACjG,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAoB,CAAC;AACxD,yGAAyG;AACzG,eAAO,MAAM,mBAAmB,qEAAqE,CAAC;AACtG,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,wCAAwC;AACxC,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEnF;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG5E;AAED,+FAA+F;AAC/F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAOpF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAMhF;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE7E"}

package/dist/alerts/triage-status.js

@@ -0,0 +1,61 @@
+/**
+ * Whether the opt-in local triage model is installed. Light on purpose: the alert scan and `kya start`
+ * import it, so it loads no code from the runtime and no model. See triage-model.ts for the loader.
+ * Runtime: onnxruntime-node under <kya home>/.kya/triage (same pattern as the plain-language search runtime).
+ * Model: one file, downloaded once from models.shield-agent.com (R2), sha256 pinned below.
+ */
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { globalConfigDir } from "../config.js";
+/** Pinned exact version, published 2026-09-14. No network at hook time: it is installed once, by the offer. */
+export const TRIAGE_RUNTIME_PACKAGE = "onnxruntime-node@1.30.0";
+export const TRIAGE_RUNTIME_NAME = "onnxruntime-node";
+export const TRIAGE_MODEL_ID = "kya-triage-v1";
+/** The only host the model is downloaded from: a public Cloudflare R2 bucket (`kya-models`) behind a custom domain. */
+export const TRIAGE_MODEL_HOST = "models.shield-agent.com";
+/** Immutable object path (a new model is a new path). Upload steps: docs/operations/kya-triage-model-release.md. */
+export const TRIAGE_MODEL_URL = `https://${TRIAGE_MODEL_HOST}/triage-model-v1/kya-triage-v1.bin`;
+/** A model file larger than this is refused (the real file is about 145 MiB). */
+export const TRIAGE_MODEL_MAX_BYTES = 200 * 1024 * 1024;
+/** sha256 of the packed model file (of the uploaded object). A download with another hash is refused. */
+export const TRIAGE_MODEL_SHA256 = "9df79939edaef4bdadbb9972bf357a9f7c396b6a837489f438974a54e00be786";
+export const TRIAGE_MODEL_MB = 150;
+export function triageRuntimeDir(env = process.env) {
+    return join(globalConfigDir(env), "triage");
+}
+/** Where the offer writes the model. */
+export function triageModelInstallPath(env = process.env) {
+    return join(triageRuntimeDir(env), "model", `${TRIAGE_MODEL_ID}.bin`);
+}
+/** The model file to load. `KYA_TRIAGE_MODEL_PATH` points at a locally built file (tests, development). */
+export function triageModelFile(env = process.env) {
+    const override = env.KYA_TRIAGE_MODEL_PATH?.trim();
+    return override ? override : triageModelInstallPath(env);
+}
+/** The one command that installs the runtime and the model (printed when an install fails). */
+export function triageInstallCommand() {
+    return "KYA_ALERTS=on kya start";
+}
+/** True when the runtime package files exist under the opt-in prefix. Nothing is loaded. */
+export function triageRuntimeInstalled(env = process.env) {
+    try {
+        const root = realpathSync(triageRuntimeDir(env));
+        return existsSync(join(root, "node_modules", TRIAGE_RUNTIME_NAME, "package.json"));
+    }
+    catch {
+        return false;
+    }
+}
+export function triageModelPresent(env = process.env) {
+    try {
+        return statSync(triageModelFile(env)).size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Runtime and model are both there: the alert scan then adds triage to each new incident alert. */
+export function triageInstalled(env = process.env) {
+    return triageRuntimeInstalled(env) && triageModelPresent(env);
+}
+//# sourceMappingURL=triage-status.js.map

package/dist/alerts/triage-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-status.js","sourceRoot":"","sources":["../../src/alerts/triage-status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,uHAAuH;AACvH,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAC3D,oHAAoH;AACpH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,iBAAiB,oCAAoC,CAAC;AACjG,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAG,kEAAkE,CAAC;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,eAAe,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB;IAClC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC"}

package/dist/alerts/triage-tokenizer.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Byte-level BPE tokenizer for ModernBERT (GPT-2 style): NFC, split on added tokens, GPT-2 pre-tokenizer
+ * regex, byte-to-unicode, BPE merges by rank, then [CLS] ... [SEP]. The vocabulary and merges ship in the
+ * model file, so no npm package is needed. Parity with the Hugging Face
+ * tokenizer is pinned by test/fixtures/alerts/triage-model-golden.json (token ids of fixed cases).
+ */
+export interface TokenizerMeta {
+    readonly vocab: Readonly<Record<string, number>>;
+    readonly merges: readonly string[];
+    /** [content, id] of every added token (special tokens and runs of spaces). */
+    readonly added: ReadonlyArray<readonly [string, number]>;
+    readonly cls: number;
+    readonly sep: number;
+}
+/** Byte value to its printable character (the GPT-2 map). Exported for tests. */
+export declare const BYTE_TO_UNICODE: string[];
+export declare class BpeTokenizer {
+    private readonly meta;
+    private readonly ranks;
+    private readonly cache;
+    private readonly addedRe;
+    private readonly addedIds;
+    constructor(meta: TokenizerMeta);
+    private bpe;
+    private plain;
+    /** Token ids with [CLS] and [SEP], cut so that the whole sequence has at most `maxLen` ids. */
+    encode(text: string, maxLen: number): number[];
+}
+//# sourceMappingURL=triage-tokenizer.d.ts.map

package/dist/alerts/triage-tokenizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-tokenizer.d.ts","sourceRoot":"","sources":["../../src/alerts/triage-tokenizer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAeD,iFAAiF;AACjF,eAAO,MAAM,eAAe,UAAY,CAAC;AAIzC,qBAAa,YAAY;IAMX,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAEzB,IAAI,EAAE,aAAa;IAOhD,OAAO,CAAC,GAAG;IAsBX,OAAO,CAAC,KAAK;IASb,+FAA+F;IAC/F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;CAc/C"}

package/dist/alerts/triage-tokenizer.js

@@ -0,0 +1,82 @@
+const PRETOKEN = /'(?:s|t|re|ve|m|ll|d)| ?\p{L}+| ?\p{N}+| ?[^\s\p{L}\p{N}]+|\s+(?!\S)|\s+/gu;
+/** GPT-2 byte to printable unicode map. */
+function byteMap() {
+    const keep = [];
+    for (let b = 33; b <= 126; b++)
+        keep.push(b);
+    for (let b = 161; b <= 172; b++)
+        keep.push(b);
+    for (let b = 174; b <= 255; b++)
+        keep.push(b);
+    const map = new Array(256);
+    let extra = 0;
+    for (let b = 0; b < 256; b++)
+        map[b] = String.fromCodePoint(keep.includes(b) ? b : 256 + extra++);
+    return map;
+}
+/** Byte value to its printable character (the GPT-2 map). Exported for tests. */
+export const BYTE_TO_UNICODE = byteMap();
+const BYTES = BYTE_TO_UNICODE;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+export class BpeTokenizer {
+    meta;
+    ranks = new Map();
+    cache = new Map();
+    addedRe;
+    addedIds = new Map();
+    constructor(meta) {
+        this.meta = meta;
+        meta.merges.forEach((m, i) => this.ranks.set(m, i));
+        for (const [content, id] of meta.added)
+            this.addedIds.set(content, id);
+        const parts = [...this.addedIds.keys()].sort((a, b) => b.length - a.length).map(escapeRe);
+        this.addedRe = parts.length > 0 ? new RegExp(parts.join("|"), "g") : undefined;
+    }
+    bpe(word) {
+        const hit = this.cache.get(word);
+        if (hit)
+            return hit;
+        let parts = Array.from(word);
+        while (parts.length > 1) {
+            let best = -1;
+            let bestRank = Infinity;
+            for (let i = 0; i < parts.length - 1; i++) {
+                const r = this.ranks.get(`${parts[i]} ${parts[i + 1]}`);
+                if (r !== undefined && r < bestRank) {
+                    bestRank = r;
+                    best = i;
+                }
+            }
+            if (best < 0)
+                break;
+            parts = [...parts.slice(0, best), parts[best] + parts[best + 1], ...parts.slice(best + 2)];
+        }
+        const ids = parts.map((p) => this.meta.vocab[p]).filter((v) => v !== undefined);
+        this.cache.set(word, ids);
+        return ids;
+    }
+    plain(chunk) {
+        const ids = [];
+        for (const m of chunk.matchAll(PRETOKEN)) {
+            const mapped = Array.from(Buffer.from(m[0], "utf8"), (b) => BYTES[b]).join("");
+            ids.push(...this.bpe(mapped));
+        }
+        return ids;
+    }
+    /** Token ids with [CLS] and [SEP], cut so that the whole sequence has at most `maxLen` ids. */
+    encode(text, maxLen) {
+        const norm = text.normalize("NFC");
+        const ids = [];
+        let last = 0;
+        if (this.addedRe) {
+            for (const m of norm.matchAll(this.addedRe)) {
+                ids.push(...this.plain(norm.slice(last, m.index)));
+                ids.push(this.addedIds.get(m[0]));
+                last = m.index + m[0].length;
+            }
+        }
+        ids.push(...this.plain(norm.slice(last)));
+        return [this.meta.cls, ...ids.slice(0, Math.max(0, maxLen - 2)), this.meta.sep];
+    }
+}
+//# sourceMappingURL=triage-tokenizer.js.map

package/dist/alerts/triage-tokenizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-tokenizer.js","sourceRoot":"","sources":["../../src/alerts/triage-tokenizer.ts"],"names":[],"mappings":"AAeA,MAAM,QAAQ,GAAG,4EAA4E,CAAC;AAE9F,2CAA2C;AAC3C,SAAS,OAAO;IACd,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAa,IAAI,KAAK,CAAS,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;IAClG,OAAO,GAAG,CAAC;AACb,CAAC;AACD,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,EAAE,CAAC;AACzC,MAAM,KAAK,GAAG,eAAe,CAAC;AAC9B,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAEjF,MAAM,OAAO,YAAY;IAMM;IALZ,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IACpC,OAAO,CAAqB;IAC5B,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAEO,GAAG,CAAC,IAAY;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;YACd,IAAI,QAAQ,GAAG,QAAQ,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;oBACpC,QAAQ,GAAG,CAAC,CAAC;oBACb,IAAI,GAAG,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;YACD,IAAI,IAAI,GAAG,CAAC;gBAAE,MAAM;YACpB,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAE,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,IAAY,EAAE,MAAc;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBACnC,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;CACF"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAkLH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,qGAAqG;IACrG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAcD,sFAAsF;AACtF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,+FAA+F;AAC/F,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,KAAiB,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAs7BjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AAoLH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,qGAAqG;IACrG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAcD,sFAAsF;AACtF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,+FAA+F;AAC/F,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,KAAiB,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAm8BjB"}

package/dist/cli.js

@@ -113,6 +113,8 @@ Commands:
                     <file>, or --from agt [--file <path>] for the AGT audit log)
   investigate       Deterministic trail analysis: detectors, grouped incidents,
                     markdown fix briefs for coding agents (--json)
+  alerts            Security alerts for detected incidents, optional local triage model, off by default, advisory
+                    (status [--json] | test | on | off) - see docs/alerts.md
   discover          Scan this endpoint for AI agents, IDEs, runtimes, and MCP servers
                     (--json, --diff <snapshot>, --push)
 
@@ -239,6 +241,9 @@ export async function runCli(argv, io = defaultIo, env = process.env, cwd = proc
                 if (!config.json) {
                     const { maybeOfferSemanticSearch } = await import("./receipt/semantic-setup.js");
                     await maybeOfferSemanticSearch(io, env).catch(() => undefined);
+                    // Security alerts with optional local triage: asked once, after the search offer, same rules. Never fails start.
+                    const { maybeOfferTriageAlerts } = await import("./alerts/triage-setup.js");
+                    await maybeOfferTriageAlerts(io, env).catch(() => undefined);
                 }
                 const result = await runStart(config, { force, open: !noOpen, gate: !noGate });
                 if (config.json) {
@@ -1077,6 +1082,15 @@ export async function runCli(argv, io = defaultIo, env = process.env, cwd = proc
                 const { discoverOptionsFromArgs, runDiscover } = await import("./commands/discover.js");
                 return await runDiscover(discoverOptionsFromArgs(parsed), io, cwd, env);
             }
+            case "alerts": {
+                const { runAlerts } = await import("./commands/alerts.js");
+                return await runAlerts({
+                    io: { log: (line) => io.log(line), error: (line) => io.error(line) },
+                    env,
+                    sub: parsed.positionals[0],
+                    flags: parsed.flags,
+                });
+            }
             case "notify-flush": {
                 const { runNotifyFlush } = await import("./commands/notify-flush.js");
                 // Internal: spawned detached by hook/wrap (src/notify/dispatch.ts).