@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/docs/contextual-reviews.md

@@ -0,0 +1,155 @@
+# Contextual evidence reviews
+
+Cases → Evidence → **Specialist evidence reviews** offers incident-sequence, domain-history,
+platform-object, storefront and connector reviews. Inputs stay in page memory until you
+save or download. Saved reports use the existing Case attachment and evidence
+summary controls; select the report file explicitly when preparing a response
+packet. Switching tasks or Case sections preserves opened drafts; leaving the Case
+discards them. Save the review in the Case, download its JSON, or print a summary.
+Reusable inputs are a separate download. Storefront columns keep unreviewed fields
+distinct from reviewed fields with no values; platform histories separate report
+status, provider response and independent recheck. Sources and interpretation are
+available beneath each review, with exact observation times and citation copying.
+
+The CLI uses the same models:
+
+```sh
+whoisleuth review-evidence selected-input.json --json --strict-exit
+```
+
+Each input has `schema`, `version: 1` and `evidence`. Unknown versions and fields
+are rejected. Inputs are bounded to 16 MiB; each supplied context list permits
+200 records. `--strict-exit` returns 4 for a partial contextual review. Neither
+adapter contacts a destination or executes selected software.
+
+## Incident sequence
+
+Build an analyst-ordered sequence from retained Case pins, imported records and
+reported actions. A retained pin supplies its own source, time, completeness and
+limitations; unknown times stay unknown. Reordering is deliberate, and reversed
+timestamps are flagged without rewriting the sequence. A displayed instruction
+is not recorded as a person having followed it.
+
+Schema: `whoisleuth.incident-sequence.input`. `evidence` is an array:
+
+```json
+{
+  "schema": "whoisleuth.incident-sequence.input", "version": 1,
+  "evidence": [{
+    "id": "stage-1", "kind": "credential_entry", "basis": "reported_action",
+    "description": "The reporter entered a password into the displayed form.",
+    "occurredAt": null, "hostname": "example.test",
+    "source": "Reporter interview", "reference": "interview-17",
+    "referenceSha256": null, "completeness": "unknown",
+    "limitations": ["Event time not supplied."]
+  }]
+}
+```
+
+Kinds cover messages, navigation, identity prompts, credential entry, consent,
+browser instructions, clipboard events, local execution, payment, recovery and
+other events. Basis is `retained_observation`, `imported_record` or
+`reported_action`. Reference hashes identify the supplied record; they do not
+authenticate its source. Save the reusable input with the review to continue
+later. These stages never execute a command, submit a form or open a destination.
+
+## Domain history and retirement
+
+The Case view compares retained snapshots using the existing source, hostname,
+scan-depth and model-version rules. Registration, DNS, mail and web changes are
+shown alongside source-qualified certificate pins. Equal-time observations are
+not ordered into a change sequence. Retired dependencies must involve the Case
+domain or one of its hostnames. An expected window qualifies the review; it does
+not approve a change automatically or establish transfer or takeover.
+Review prompts connect comparable page, mail, delegation and registration changes
+to the retained concern. Incomplete comparisons remain visible. A changed creation
+date asks for reassessment of earlier decisions without asserting a new owner,
+resetting a baseline or discarding history; expiry alone never establishes deletion.
+
+Schema: `whoisleuth.domain-history.input`. Its `evidence` contains:
+
+- `caseExport`: an ordinary supported editable Case export, with `version` and
+  `cases`; the exact existing Case reader rejects data loss or silent repair.
+- `caseId`: the Case selected from that export.
+- `declarations`: `expectedChanges` and `retiredDependencies` arrays.
+
+An expected change is `{family, start, end, reason}`. A retired dependency is
+`{asset, dependency, family, retiredAt, source}`. Families are `registration`,
+`dns`, `mail`, `certificate` and `web`; times are explicit ISO timestamps. The
+reusable input download includes the selected Case and is not duplicated in
+workspace storage when saving the report.
+
+## Platform objects
+
+Schema: `whoisleuth.platform-continuity.input`. `evidence` is an array:
+
+```json
+{
+  "schema": "whoisleuth.platform-continuity.input",
+  "version": 1,
+  "evidence": [{
+    "platformOrigin": "https://platform.example.test",
+    "objectType": "extension", "objectId": "extension-17", "version": "1.0.0",
+    "observedAt": "2026-09-22T00:00:00.000Z", "source": "Selected manifest",
+    "report": "acknowledged", "providerOutcome": "provider_reports_resolved",
+    "recheck": "not_checked", "recheckedAt": null
+  }]
+}
+```
+
+Object types include account, tenant, application, extension, package, page,
+channel and post. Identity is scoped to platform origin and object type, not a
+URL alone. Version is nullable. Report status is `not_reported`, `submitted` or
+`acknowledged`. Provider outcomes and independent rechecks use the existing Case
+response vocabulary. A recheck needs its own time; provider resolution does not
+establish removal. Save or download the reusable input to add later observations.
+
+## Storefronts
+
+Schema: `whoisleuth.storefront-review.input`. `evidence` contains `official`,
+`candidate`, `authorisedComparator: true`, `resellerStatus` and `resellerSource`.
+Reseller status is `authorised`, `not_authorised` or `unknown`; a non-unknown
+declaration needs a source. Both observations use this shape:
+
+```json
+{
+  "hostname": "shop.example.test",
+  "observedAt": "2026-09-22T00:00:00.000Z", "source": "Selected capture",
+  "brandNames": ["Example shop"], "contactDomains": ["example.test"],
+  "policyHashes": null, "checkoutOrigins": ["https://checkout.example.test"],
+  "paymentMethods": ["card"], "assetHashes": null
+}
+```
+
+Null means not reviewed; an empty array means no values were recorded. Policy
+and asset hashes are lowercase hexadecimal SHA-256. Checkout values are origins
+only. Exact shared values are displayed without a combined scam score. Check
+reseller, affiliate and regional-store authority before preparing a complaint.
+
+## Connectors
+
+Schema: `whoisleuth.connector-review.input`. `evidence` contains `current` and
+nullable `previous` configuration objects, each with exactly one `mcpServers`
+or `servers` map. Select that section rather than unrelated application settings.
+
+```json
+{
+  "schema": "whoisleuth.connector-review.input", "version": 1,
+  "evidence": {
+    "current": {"mcpServers": {
+      "remote": {"url": "https://connector.example.test/service"},
+      "local": {"command": "npx", "args": ["--yes", "@example/connector@1.0.0"]}
+    }},
+    "previous": null
+  }
+}
+```
+
+The browser accepts the configuration itself. Reports retain names, endpoint
+origins, executable basenames, recognised package identities, declared
+capabilities and metadata counts. They exclude local paths, argument contents,
+environment values, header values, authentication material and URL paths or
+queries. Raw configuration is not saved with the report. Matching retained
+metadata does not mean excluded values are unchanged. No command, connector,
+tool, prompt or model is run; declarations are not negotiated capabilities or a
+safety assessment.

package/lib/analyst-taxonomy.mjs

@@ -1,40 +1,2 @@
-// Deliberately small interoperability projection over reviewed MISP
-// taxonomies. WHOISleuth retains its own bounded workflow vocabulary and
-// derives machine tags only when an analyst-owned disposition and reason make
-// the mapping unambiguous. These tags never alter collection or scoring.
-const ANALYST_REVIEW_REASONS = Object.freeze([
-    Object.freeze({ value: '', label: 'Not recorded' }),
-    Object.freeze({ value: 'authorized_or_owned', label: 'Authorised or owned domain' }),
-    Object.freeze({ value: 'shared_infrastructure', label: 'Shared infrastructure explained the signal' }),
-    Object.freeze({ value: 'generic_platform_or_template', label: 'Generic platform or template' }),
-    Object.freeze({ value: 'parked_or_reseller', label: 'Parking or reseller page' }),
-    Object.freeze({ value: 'insufficient_evidence', label: 'Insufficient evidence' }),
-    Object.freeze({ value: 'legitimate_third_party', label: 'Legitimate third party' }),
-    Object.freeze({ value: 'confirmed_credential_abuse', label: 'Confirmed credential abuse' }),
-    Object.freeze({ value: 'confirmed_malware', label: 'Confirmed malware' }),
-    Object.freeze({ value: 'other_reviewed', label: 'Other reviewed reason' }),
-]);
-const ANALYST_REVIEW_REASON_VALUES = new Set(ANALYST_REVIEW_REASONS.map(({ value }) => value).filter(Boolean));
-const MISP_TAXONOMY_REFERENCES = Object.freeze([
-    Object.freeze({ namespace: 'domain-abuse', version: 2, sourceSha256: '5fcfb44742daac97061726faaaadd2ce6b7eac55306acaae3d30c3882d18f991', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/domain-abuse/machinetag.json' }),
-    Object.freeze({ namespace: 'estimative-language', version: 5, sourceSha256: '1010927d396f66f7cc58a229ebb8af6ad2cdc0250ad5f8ce3b1bd9aacf5ab4da', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/estimative-language/machinetag.json' }),
-    Object.freeze({ namespace: 'event-assessment', version: 2, sourceSha256: '39291bdd50e1b2975a93e33e396f42b398178015580a84402bc3d8d549dd721e', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/event-assessment/machinetag.json' }),
-    Object.freeze({ namespace: 'false-positive', version: 7, sourceSha256: 'ffc8d35ae36eb1d39f33611d1090793021f2bfe3b4b31ae41631e22cf544a2fb', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/false-positive/machinetag.json' }),
-    Object.freeze({ namespace: 'phishing', version: 5, sourceSha256: '8628ebe4d5935216a7b006a4d975669c4ae1a554ef8ed78ffaadd62f763d7263', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/phishing/machinetag.json' }),
-]);
-function analystInteroperabilityTags(disposition, reviewReasonCode) {
-    const tags = new Set();
-    if (disposition === 'false_positive')
-        tags.add('false-positive:confirmed="true"');
-    if ((disposition === 'false_positive' || disposition === 'expected')
-        && ['authorized_or_owned', 'shared_infrastructure', 'generic_platform_or_template', 'parked_or_reseller', 'legitimate_third_party'].includes(String(reviewReasonCode)))
-        tags.add('false-positive:risk="high"');
-    if (reviewReasonCode === 'insufficient_evidence') {
-        tags.add('estimative-language:confidence-in-analytic-judgment="low"');
-    }
-    if (disposition === 'confirmed_abuse' && reviewReasonCode === 'confirmed_credential_abuse') {
-        tags.add('phishing:techniques="fake-website"');
-    }
-    return [...tags].sort();
-}
-export { ANALYST_REVIEW_REASONS, ANALYST_REVIEW_REASON_VALUES, MISP_TAXONOMY_REFERENCES, analystInteroperabilityTags, };
+// Retained public import; the runtime-neutral implementation lives in the domain layer.
+export * from "../packages/analysis/analyst-taxonomy.mjs";

package/lib/application-version.mjs

@@ -1,3 +1,3 @@
 import packageDocument from '../package.json' with { type: 'json' };
-import { normalizeBoundedSemanticVersion } from "./semantic-version.mjs";
+import { normalizeBoundedSemanticVersion } from "../packages/analysis/semantic-version.mjs";
 export const WHOISLEUTH_APPLICATION_VERSION = normalizeBoundedSemanticVersion(packageDocument.version, 'Application manifest');