@swestash/agent-lens 0.4.0 → 0.5.1

package/dist/agent-lens.js

@@ -591,7 +591,7 @@ var CAC = class extends EventEmitter {
 var cac = (name = "") => new CAC(name);
 
 // ../core/dist/schema.js
-var SCHEMA_VERSION = 11;
+var SCHEMA_VERSION = 12;
 var SCHEMA_SQL = (
   /* sql */
   `
@@ -781,6 +781,34 @@ CREATE TABLE IF NOT EXISTS classifications (
   PRIMARY KEY (scope, target_id)
 );
 
+-- Security findings (ADR-017), re-runnable. A deterministic rule engine (detect.ts) scans each
+-- tool call's verbatim input/result for risky operations \u2014 destructive/data-loss, credential access,
+-- data exfiltration, privilege/guardrail bypass \u2014 and records one row per (tool_call, rule) match.
+-- Findings are 0..N per tool call (unlike classifications, which are 1-per-session), so an incremental
+-- re-run DELETEs the touched sessions' rows and re-INSERTs (delete-then-insert) rather than upserting.
+-- Every input/modifier is captured in signals_json so a finding is fully explainable; framework_ref
+-- anchors it to OWASP Agentic / MITRE ATLAS. detector_version lets a future engine supersede rows.
+CREATE TABLE IF NOT EXISTS findings (
+  id               TEXT PRIMARY KEY,   -- deterministic hash(tool_call_id, rule_id)
+  session_id       TEXT NOT NULL REFERENCES sessions(id),
+  tool_call_id     TEXT REFERENCES tool_calls(id),
+  event_uuid       TEXT,               -- the tool call's event, for jump-to-transcript
+  turn_id          TEXT,
+  rule_id          TEXT NOT NULL,      -- 'destructive.rm_rf'
+  category         TEXT NOT NULL,      -- destructive | credential-access | exfiltration | privilege-bypass
+  framework_ref    TEXT,               -- 'OWASP ASI02' | 'MITRE ATLAS AML.T0086' | ...
+  severity         TEXT NOT NULL,      -- info | low | medium | high | critical
+  title            TEXT,
+  evidence         TEXT,               -- matched snippet, truncated (no wholesale secret dump)
+  signals_json     TEXT,               -- why: rule, matched pattern, context modifiers
+  detector_version INTEGER NOT NULL DEFAULT 1
+);
+CREATE INDEX IF NOT EXISTS idx_findings_session  ON findings(session_id);
+CREATE INDEX IF NOT EXISTS idx_findings_severity ON findings(severity);
+CREATE INDEX IF NOT EXISTS idx_findings_category ON findings(category);
+CREATE INDEX IF NOT EXISTS idx_findings_rule     ON findings(rule_id);
+CREATE INDEX IF NOT EXISTS idx_findings_tool_call ON findings(tool_call_id);
+
 -- Workflow-tool run results, ingested from the sidecar JSON the runner writes next to the launching
 -- session (\u2026/projects/<enc>/<sessionId>/workflows/wf_<id>.json). The transcript only carries the
 -- "launched in background" ack for an async run; this sidecar is the authoritative record of how the
@@ -868,6 +896,55 @@ END;
 `
 );
 
+// ../core/dist/security.js
+var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
+function severityRank(s) {
+  return SEVERITY_ORDER.indexOf(s);
+}
+function bumpSeverity(s, delta) {
+  const i = SEVERITY_ORDER.indexOf(s);
+  const j = Math.max(0, Math.min(SEVERITY_ORDER.length - 1, i + delta));
+  return SEVERITY_ORDER[j];
+}
+var SECURITY_CATEGORIES = [
+  {
+    key: "destructive",
+    title: "Destructive & data-loss operations",
+    framework_ref: "OWASP ASI02",
+    framework_url: "https://genai.owasp.org/",
+    what: "Commands or edits that irreversibly delete, overwrite, or truncate data \u2014 rm -rf, git reset --hard, force-pushes, DROP/TRUNCATE, disk writes (dd/mkfs/shred), and overwrites of critical project files (lockfiles, CI config).",
+    why: "An agent acting on a bad plan or a poisoned instruction can wipe work, history, or a database with a single tool call. Because agent-lens sees sessions after the fact, this is how you notice the damage \u2014 and the blast radius \u2014 even when nobody was watching live.",
+    remediation: "Open the flagged session, confirm the target was intended, and check the tool result for whether it succeeded. Restore from git/backups if needed, and consider a PreToolUse hook to block the pattern going forward."
+  },
+  {
+    key: "credential-access",
+    title: "Secret & credential access",
+    framework_ref: "MITRE ATLAS: Credential Access",
+    framework_url: "https://atlas.mitre.org/",
+    what: "Reads of secret-bearing files (.env, ~/.ssh keys, ~/.aws/credentials, .npmrc, .pem) or secret-looking values (private keys, AWS keys, GitHub/Slack tokens) appearing in a command or a captured tool result.",
+    why: "Credentials the agent touched may have been exposed to the model context, logs, or a downstream tool \u2014 and could be leaked or reused. Retrospective visibility tells you which secrets to rotate.",
+    remediation: "Treat any accessed secret as potentially exposed: rotate it. Verify the access was purposeful, and keep secrets out of the working tree the agent operates on."
+  },
+  {
+    key: "exfiltration",
+    title: "Data exfiltration",
+    framework_ref: "MITRE ATLAS AML.T0086",
+    framework_url: "https://atlas.mitre.org/techniques/AML.T0086",
+    what: "Local data flowing outbound: curl/wget uploads to external hosts, piping files into a network command, netcat/reverse-shell patterns, and other ways an agent's write-capable tools become an exfiltration channel.",
+    why: "Exfiltration via the agent's own tool calls (AML.T0086) is a primary agentic attack path \u2014 a prompt-injected agent can POST your files or secrets to an attacker with one command. These are the highest-signal findings to review.",
+    remediation: "Inspect the destination host and the data referenced in the command. If it was not you, treat it as an incident: rotate anything referenced, review what left the host, and audit the session for the injection source."
+  },
+  {
+    key: "privilege-bypass",
+    title: "Privilege escalation & guardrail bypass",
+    framework_ref: "OWASP LLM06",
+    framework_url: "https://genai.owasp.org/",
+    what: "Actions that widen the agent's authority or sidestep safety: sudo, chmod 777, curl | sh, --dangerously-skip-permissions, writes outside the working project, and persistence mechanisms (cron, systemd, shell rc files).",
+    why: "Excessive agency (LLM06) is the root cause behind most agent incidents \u2014 every disabled guardrail or out-of-scope write removes a barrier the design relied on. Persistence in particular outlives the session that created it.",
+    remediation: "Confirm the escalation was necessary and scoped. Remove any persistence the agent added, re-tighten permissions, and avoid running agents with skipped permission prompts on a trusted host."
+  }
+];
+
 // ../core/dist/pricing.js
 var PRICE_TABLE = {
   // Opus 4.0 / 4.1 launched at $15/$75; Opus 4.5 cut the Opus tier to $5/$25 and 4.6/4.7/4.8 kept it.
@@ -1717,6 +1794,7 @@ function resetSchema(db) {
     DROP TRIGGER IF EXISTS events_ad;
     DROP TRIGGER IF EXISTS events_ai;
     DROP TABLE IF EXISTS events_fts;
+    DROP TABLE IF EXISTS findings;
     DROP TABLE IF EXISTS classifications;
     DROP TABLE IF EXISTS token_usage;
     DROP TABLE IF EXISTS tool_calls;
@@ -2239,8 +2317,465 @@ function classify(db, dirty) {
   return { count: sessions.length, version: CLASSIFIER_VERSION };
 }
 
-// ../ingest/dist/pipeline.js
+// ../ingest/dist/detect.js
 import { createHash } from "crypto";
+var DETECTOR_VERSION = 5;
+function evidence(s, max = 200) {
+  const one = s.replace(/\s+/g, " ").trim();
+  return one.length > max ? one.slice(0, max - 1) + "\u2026" : one;
+}
+function findingId(toolCallId, ruleId) {
+  return createHash("sha1").update(toolCallId).update("\0").update(ruleId).digest("hex").slice(0, 16);
+}
+var SYSTEM_PATH = /(^|\s)(\/etc\/|\/usr\/|\/bin\/|\/sbin\/|\/boot\/|\/var\/|\/root\/|~\/\.ssh\/|~\/\.aws\/)/;
+var HOME_OR_ROOT_TARGET = /(\s|^)(~\/?|\/|\/\*|\$HOME\/?|\*)(\s|$)/;
+var SECRET_FILE = /(^|\/|\s)(\.env(\.[\w.-]+)?|id_rsa|id_ed25519|id_ecdsa|\.ssh\/[\w.-]+|\.aws\/credentials|\.gcp\/|gcloud\/|\.npmrc|\.pypirc|\.netrc|\.pem|\.p12|\.pfx|secrets?\.(ya?ml|json|txt)|credentials(\.json)?)\b/i;
+var EXAMPLE_FILE = /\.(example|sample|template|dist)(?![\w-])/i;
+var CONTENT_READ_CMD = /\b(cat|less|more|head|tail|bat|xxd|strings|base64|grep|egrep|rg|awk|sed|nl|tac|od|hexdump|cp|scp|sort)\b/i;
+var SECRET_VALUE_PATTERNS = [
+  { re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/, label: "private-key", critical: true },
+  { re: /\bAKIA[0-9A-Z]{16}\b/, label: "aws-access-key-id" },
+  { re: /\bASIA[0-9A-Z]{16}\b/, label: "aws-temp-key-id" },
+  { re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/, label: "github-token" },
+  { re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, label: "slack-token" },
+  { re: /\bsk-[A-Za-z0-9]{20,}\b/, label: "api-secret-key" }
+];
+var isBash = (t) => t === "Bash";
+var stripComments = (c) => c.replace(/(^|\s)#[^\n]*/g, "$1");
+var neutralizeEcho = (c) => c.replace(/((?:^|[;&|\n(])\s*)(?:echo|printf)\b(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^;&|\n])*/gi, "$1echo");
+var blankHeredoc = (c) => c.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\s*\2\b/g, "<<HEREDOC");
+var codeOf = (c) => neutralizeEcho(stripComments(blankHeredoc(c)));
+var blankQuoted = (c) => c.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'[^']*'/g, "''");
+var bareOf = (c) => blankQuoted(codeOf(c));
+function execGeneratedScript(cmd) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const m of cmd.matchAll(/(?:>>?|\btee\b\s+(?:-a\s+)?)\s*["']?([A-Za-z0-9._/~-]+)/g)) {
+    if (m[1] && !m[1].startsWith("/dev/"))
+      targets.add(m[1]);
+  }
+  for (const t of targets) {
+    const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const interp = new RegExp(`\\b(?:sh|bash|zsh|ksh|dash|source)\\s+["']?${e}\\b|(?:^|[\\n;|&(])\\s*\\.\\s+["']?${e}\\b`);
+    const hasPath = /^(\.\/|\/|~\/)/.test(t);
+    const path = hasPath ? new RegExp(`(?:^|[\\n;|&(])\\s*${e}(?:\\s|$|[;&|<>])`) : new RegExp(`(?:^|[\\n;|&(])\\s*\\.\\/${e}\\b`);
+    if (interp.test(cmd) || path.test(cmd))
+      return t;
+  }
+  return null;
+}
+var TEMP_PATH = /^(\/tmp\/|\/var\/folders\/|\/private\/var\/folders\/)/;
+function isAgentOwnedPath(p, configDirs) {
+  if (TEMP_PATH.test(p))
+    return true;
+  if (configDirs.some((d) => p === d || p.startsWith(d + "/")))
+    return true;
+  const tmp = process.env.TMPDIR;
+  return !!tmp && p.startsWith(tmp.replace(/\/$/, "") + "/");
+}
+function outsideProject(filePath, projectPath, configDirs) {
+  if (!filePath || !filePath.startsWith("/"))
+    return false;
+  if (isAgentOwnedPath(filePath, configDirs))
+    return false;
+  if (!projectPath)
+    return false;
+  return filePath !== projectPath && !filePath.startsWith(projectPath.replace(/\/$/, "") + "/");
+}
+var RULES = [
+  // --- Destructive / data-loss (OWASP ASI02 Tool Misuse) -------------------
+  {
+    id: "destructive.rm_rf",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Recursive force delete (rm -rf)",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      const rf = /\brm\s+[^|;&\n]*(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r|--recursive[^|;&\n]*--force|--force[^|;&\n]*--recursive)/i;
+      if (!rf.test(c))
+        return null;
+      const dangerousTarget = HOME_OR_ROOT_TARGET.test(c) || /\s\/(?:\s|$)/.test(c) || /\brm\b[^|;&\n]*\*/.test(c);
+      return { evidence: evidence(ctx.command), severity: dangerousTarget ? "critical" : "high", mods: { dangerous_target: dangerousTarget } };
+    }
+  },
+  {
+    id: "destructive.git_reset_hard",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Discards local changes (git reset --hard)",
+    tools: ["Bash"],
+    baseSeverity: "medium",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/\bgit\s+reset\s+--hard\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "destructive.git_force_push",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Force-push rewrites remote history",
+    tools: ["Bash"],
+    baseSeverity: "medium",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/\bgit\s+push\b[^|;&\n]*(--force\b|--force-with-lease\b|\s-f\b)/i.test(c))
+        return null;
+      const mainBranch = /\b(main|master|release)\b/.test(c);
+      return { evidence: evidence(ctx.command), severity: mainBranch ? "high" : "medium", mods: { protected_branch: mainBranch } };
+    }
+  },
+  {
+    id: "destructive.sql_drop",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Drops or truncates a database object",
+    tools: "*",
+    baseSeverity: "high",
+    test(ctx) {
+      const query = typeof ctx.input?.query === "string" ? ctx.input.query : null;
+      const hay = ctx.commandCode ?? query;
+      if (!hay || !/\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE(\s+TABLE)?)\b/i.test(hay))
+        return null;
+      return { evidence: evidence(ctx.command ?? query) };
+    }
+  },
+  {
+    id: "destructive.disk_wipe",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Low-level disk write / wipe (dd, mkfs, shred)",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/(\bdd\s+if=|\bmkfs(\.\w+)?\b|\bshred\b)/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "destructive.overwrite_critical",
+    category: "destructive",
+    framework_ref: "OWASP ASI02",
+    title: "Overwrites a critical project file",
+    tools: ["Write", "Edit", "MultiEdit"],
+    baseSeverity: "medium",
+    test(ctx) {
+      const f = ctx.filePath;
+      if (!f)
+        return null;
+      if (!/(^|\/)(package-lock\.json|pnpm-lock\.ya?ml|yarn\.lock|Cargo\.lock|go\.sum|\.github\/workflows\/|\.gitlab-ci\.ya?ml)\b/.test(f))
+        return null;
+      return { evidence: evidence(f) };
+    }
+  },
+  // --- Credential & secret access ------------------------------------------
+  {
+    id: "credential.secret_file_access",
+    category: "credential-access",
+    framework_ref: "MITRE ATLAS: Credential Access",
+    title: "Reads a secret/credential file",
+    tools: ["Read", "Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      if (isBash(ctx.toolName)) {
+        const cmd = ctx.commandBare;
+        if (!cmd)
+          return null;
+        const segments = cmd.split(/\|\||&&|[|;\n]/);
+        const reads = segments.some((seg) => SECRET_FILE.test(seg) && !EXAMPLE_FILE.test(seg) && CONTENT_READ_CMD.test(seg));
+        return reads ? { evidence: evidence(ctx.command) } : null;
+      }
+      const f = ctx.filePath;
+      if (!f || !SECRET_FILE.test(f) || EXAMPLE_FILE.test(f))
+        return null;
+      return { evidence: evidence(f) };
+    }
+  },
+  {
+    id: "credential.secret_in_data",
+    category: "credential-access",
+    framework_ref: "MITRE ATLAS: Credential Access",
+    title: "Secret-looking value in command or output",
+    tools: "*",
+    baseSeverity: "high",
+    test(ctx) {
+      const hay = [ctx.command, ctx.resultSummary].filter(Boolean).join("\n");
+      if (!hay)
+        return null;
+      for (const p of SECRET_VALUE_PATTERNS) {
+        const m = p.re.exec(hay);
+        if (m)
+          return { evidence: `${p.label}: ${evidence(m[0], 40)}`, severity: p.critical ? "critical" : "high", mods: { secret_kind: p.label } };
+      }
+      return null;
+    }
+  },
+  // --- Data exfiltration (MITRE ATLAS AML.T0086) ---------------------------
+  {
+    id: "exfil.pipe_to_network",
+    category: "exfiltration",
+    framework_ref: "MITRE ATLAS AML.T0086",
+    title: "Pipes local data into a network command",
+    tools: ["Bash"],
+    baseSeverity: "critical",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      if (!/(\||<)\s*(sudo\s+)?(curl|wget|nc|ncat|netcat|ssh|scp)\b/i.test(c))
+        return null;
+      if (!/\b(cat|tar|zip|gzip|base64|env|printenv|cat\s|<)\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "exfil.network_upload",
+    category: "exfiltration",
+    framework_ref: "MITRE ATLAS AML.T0086",
+    title: "Uploads data to an external host",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      const upload = /\b(curl|wget)\b[^|;&\n]*(-X\s*POST|--data\b|--data-\w+\b|\s-d\b|-T\b|--upload-file\b|-F\b|--form\b)/i.test(c);
+      if (!upload)
+        return null;
+      const external = /https?:\/\/(?!(localhost|127\.0\.0\.1|0\.0\.0\.0))/i.test(c);
+      const withFile = /(@[^\s'"]+|--upload-file|\s-T\b)/.test(c);
+      return {
+        evidence: evidence(ctx.command),
+        severity: withFile && external ? "critical" : "high",
+        mods: { external, with_file: withFile }
+      };
+    }
+  },
+  {
+    id: "exfil.reverse_shell",
+    category: "exfiltration",
+    framework_ref: "MITRE ATLAS AML.T0086",
+    title: "Netcat / reverse-shell style connection",
+    tools: ["Bash"],
+    baseSeverity: "critical",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      if (!/\b(nc|ncat|netcat)\b[^|;&\n]*(-e\b|-c\b|\d{2,5})|\/dev\/tcp\/|bash\s+-i\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  // --- Privilege escalation / guardrail bypass (OWASP LLM06 Excessive Agency)
+  {
+    id: "privilege.skip_permissions",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Bypasses the permission guardrail",
+    tools: "*",
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/--dangerously-skip-permissions\b|--yolo\b|--dangerously-skip\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.curl_pipe_shell",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Executes a remote script (curl | sh)",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|python\d?|node)\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.sudo",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Runs a command as root (sudo)",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    // root escalation removes a real safety barrier — higher than an in-project op
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/(?:^|[\n;|&(])\s*sudo\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.exec_generated_script",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Writes a shell script from inline output and executes it",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const raw = ctx.command;
+      if (!raw)
+        return null;
+      const file = execGeneratedScript(stripComments(raw));
+      if (!file)
+        return null;
+      const critical = /(?:^|["'\s;|&(])sudo\b|\brm\s+[^|;&\n]*-[a-z]*r[a-z]*f|\bchmod\s+0?777\b|\bmkfs|\bdd\s+if=/i.test(raw);
+      return { evidence: evidence(raw), severity: critical ? "critical" : "high", mods: { script_file: file } };
+    }
+  },
+  {
+    id: "privilege.chmod_777",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Overly permissive permissions (chmod 777)",
+    tools: ["Bash"],
+    baseSeverity: "medium",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !/\bchmod\s+(-[a-zA-Z]+\s+)*0?777\b/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.persistence",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Installs a persistence mechanism",
+    tools: ["Bash"],
+    baseSeverity: "high",
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c)
+        return null;
+      if (!/\bcrontab\s+-|\bsystemctl\s+enable\b|\blaunchctl\s+load\b|>>\s*~\/\.(bashrc|zshrc|profile|bash_profile)\b|\/etc\/(cron|systemd|rc\.local)/i.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  },
+  {
+    id: "privilege.write_outside_project",
+    category: "privilege-bypass",
+    framework_ref: "OWASP LLM06",
+    title: "Writes a file outside the working project",
+    tools: ["Write", "Edit", "MultiEdit"],
+    baseSeverity: "medium",
+    test(ctx) {
+      const f = ctx.filePath;
+      if (!outsideProject(f, ctx.projectPath, ctx.ownedConfigDirs))
+        return null;
+      const system = !!f && SYSTEM_PATH.test(f);
+      return { evidence: evidence(f), severity: system ? "high" : "medium", mods: { project: ctx.projectPath, system_path: system } };
+    }
+  }
+];
+function appliesTo(rule, toolName) {
+  return rule.tools === "*" || rule.tools.includes(toolName);
+}
+function buildContext(row, projectPath, ownedConfigDirs) {
+  let input = null;
+  try {
+    input = row.input_json ? JSON.parse(row.input_json) : null;
+  } catch {
+    input = null;
+  }
+  const command = typeof input?.command === "string" ? input.command : null;
+  const commandCode = command != null ? codeOf(command) : null;
+  const commandBare = command != null ? bareOf(command) : null;
+  const filePath = typeof input?.file_path === "string" ? input.file_path : null;
+  return { toolName: row.tool_name, command, commandCode, commandBare, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath, ownedConfigDirs };
+}
+function detect(db, dirty) {
+  const incremental = dirty != null;
+  if (incremental) {
+    db.exec("DROP TABLE IF EXISTS _dirty_sec");
+    db.exec("CREATE TEMP TABLE _dirty_sec (id TEXT PRIMARY KEY)");
+    const ins = db.prepare("INSERT OR IGNORE INTO _dirty_sec (id) VALUES (?)");
+    db.transaction((ids) => {
+      for (const id of ids)
+        ins.run(id);
+    })(dirty);
+  }
+  const scope = incremental ? " WHERE tc.session_id IN (SELECT id FROM _dirty_sec)" : "";
+  const ownedConfigDirs = db.prepare("SELECT config_dir FROM sources WHERE config_dir IS NOT NULL").all().map((r) => r.config_dir.replace(/\/$/, "")).filter(Boolean);
+  const projPath = /* @__PURE__ */ new Map();
+  for (const r of db.prepare(`SELECT s.id id, p.path path FROM sessions s JOIN projects p ON p.id = s.project_id${incremental ? " WHERE s.id IN (SELECT id FROM _dirty_sec)" : ""}`).all()) {
+    projPath.set(r.id, r.path);
+  }
+  const rows = db.prepare(`SELECT tc.id, tc.session_id, tc.event_uuid, tc.turn_id, tc.tool_name, tc.input_json, tc.result_summary, tc.status
+       FROM tool_calls tc${scope}`).all();
+  const insert = db.prepare(`INSERT INTO findings (id, session_id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json, detector_version)
+     VALUES (@id, @session_id, @tool_call_id, @event_uuid, @turn_id, @rule_id, @category, @framework_ref, @severity, @title, @evidence, @signals_json, @detector_version)
+     ON CONFLICT(id) DO NOTHING`);
+  const delScope = incremental ? "DELETE FROM findings WHERE session_id IN (SELECT id FROM _dirty_sec)" : "DELETE FROM findings";
+  const tx = db.transaction(() => {
+    db.exec(delScope);
+    for (const row of rows) {
+      const ctx = buildContext(row, projPath.get(row.session_id) ?? null, ownedConfigDirs);
+      for (const rule of RULES) {
+        if (!appliesTo(rule, ctx.toolName))
+          continue;
+        const m = rule.test(ctx);
+        if (!m)
+          continue;
+        let severity = m.severity ?? rule.baseSeverity;
+        const mods = { ...m.mods ?? {} };
+        if (row.status === "error") {
+          severity = bumpSeverity(severity, -1);
+          mods.attempted = true;
+        }
+        const signals = {
+          rule: rule.id,
+          category: rule.category,
+          framework_ref: rule.framework_ref,
+          tool_name: ctx.toolName,
+          base_severity: rule.baseSeverity,
+          severity,
+          status: row.status,
+          modifiers: mods,
+          detector_version: DETECTOR_VERSION
+        };
+        insert.run({
+          id: findingId(row.id, rule.id),
+          session_id: row.session_id,
+          tool_call_id: row.id,
+          event_uuid: row.event_uuid,
+          turn_id: row.turn_id,
+          rule_id: rule.id,
+          category: rule.category,
+          framework_ref: rule.framework_ref,
+          severity,
+          title: rule.title,
+          evidence: m.evidence,
+          signals_json: JSON.stringify(signals),
+          detector_version: DETECTOR_VERSION
+        });
+      }
+    }
+  });
+  tx();
+  if (incremental)
+    db.exec("DROP TABLE IF EXISTS _dirty_sec");
+  const count = db.prepare("SELECT COUNT(*) n FROM findings").get().n;
+  return { count, version: DETECTOR_VERSION };
+}
+
+// ../ingest/dist/pipeline.js
+import { createHash as createHash2 } from "crypto";
 function newStats() {
   return { files: 0, skipped: 0, malformed: 0, newEvents: 0 };
 }
@@ -2278,7 +2813,7 @@ function skillSummary(body) {
   return null;
 }
 function skillVersionId(name, body) {
-  return createHash("sha1").update(name).update("\0").update(body).digest("hex").slice(0, 16);
+  return createHash2("sha1").update(name).update("\0").update(body).digest("hex").slice(0, 16);
 }
 function pruneExcluded(db, excludedPaths) {
   if (!excludedPaths.length)
@@ -2312,6 +2847,7 @@ function pruneExcluded(db, excludedPaths) {
   const files = db.prepare("SELECT DISTINCT source_file f FROM events WHERE session_id IN (SELECT id FROM _prune) AND source_file IS NOT NULL").all().map((r) => r.f);
   db.pragma("foreign_keys = OFF");
   db.transaction(() => {
+    db.exec("DELETE FROM findings WHERE session_id IN (SELECT id FROM _prune)");
     for (const t of ["token_usage", "tool_calls", "turns", "events"])
       db.exec(`DELETE FROM ${t} WHERE session_id IN (SELECT id FROM _prune)`);
     db.exec("DELETE FROM classifications WHERE scope = 'session' AND target_id IN (SELECT id FROM _prune)");
@@ -2544,6 +3080,7 @@ function rebuildDerived(db, dirty) {
   `);
   db.exec(`DELETE FROM sessions WHERE event_count = 0${andId}`);
   db.exec("DELETE FROM classifications WHERE scope = 'session' AND target_id NOT IN (SELECT id FROM sessions)");
+  db.exec("DELETE FROM findings WHERE session_id NOT IN (SELECT id FROM sessions)");
   if (!incremental) {
     db.exec("DELETE FROM skills WHERE id NOT IN (SELECT skill_id FROM tool_calls WHERE skill_id IS NOT NULL)");
   }
@@ -2609,7 +3146,7 @@ function prepareStatements(db) {
          workflow_run_id = COALESCE(excluded.workflow_run_id, workflow_run_id)`)
   };
 }
-function ingestFile(db, stmts, adapter, file, lines, meta, now, stats) {
+function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
   const sessionMeta = {};
   let eventsInFile = 0;
   const tx = db.transaction(() => {
@@ -2658,13 +3195,13 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now, stats) {
     }
     let projectId = null;
     if (sessionMeta.cwd) {
-      projectId = createHash("sha1").update(`${adapter.agentId}\0${sessionMeta.cwd}`).digest("hex").slice(0, 16);
+      projectId = createHash2("sha1").update(`${adapter.agentId}\0${sessionMeta.cwd}`).digest("hex").slice(0, 16);
       stmts.upsertProject.run({
         id: projectId,
         agent_id: adapter.agentId,
         path: sessionMeta.cwd,
         encoded_dir: file.encodedDir || null,
-        now
+        now: now2
       });
     }
     stmts.upsertSession.run({
@@ -2686,7 +3223,7 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now, stats) {
       mtime_ms: Math.trunc(meta.mtimeMs),
       sha256: meta.hash,
       events_ingested: eventsInFile,
-      ingested_at: now
+      ingested_at: now2
     });
   });
   tx();
@@ -2697,7 +3234,7 @@ import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as
 import { basename as basename3, join as join5 } from "path";
 
 // ../ingest/dist/redact.js
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash as createHash3, randomBytes } from "crypto";
 function parseExcludes(csv) {
   return (csv ?? "").split(",").map((s) => s.trim()).filter(Boolean).map(encodeProjectPath);
 }
@@ -2706,17 +3243,17 @@ function isExcludedArchivePath(filePath, excluded) {
 }
 
 // ../ingest/dist/fileread.js
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
 import { StringDecoder } from "string_decoder";
 var STREAM_THRESHOLD = 8 * 1024 * 1024;
 var CHUNK2 = 64 * 1024;
 function sha256(buf) {
-  return createHash3("sha256").update(buf).digest("hex");
+  return createHash4("sha256").update(buf).digest("hex");
 }
 function sha256File(path) {
   const fd = openSync2(path, "r");
-  const h = createHash3("sha256");
+  const h = createHash4("sha256");
   const buf = Buffer.allocUnsafe(CHUNK2);
   try {
     let n;
@@ -2803,7 +3340,7 @@ function cleanStr(v) {
     return null;
   return s.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\[[0-9;]+m\]?/g, "").trim() || null;
 }
-function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now, stats, full) {
+function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
   let paths = discoverSidecars(sourceArchiveDir);
   if (excludedDirs.length)
     paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
@@ -2846,7 +3383,7 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
     }
     const hash = sha256(buf);
     if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
@@ -2884,9 +3421,9 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
       duration_ms: durationMs2,
       started_at: startedAt,
       ended_at: endedAt,
-      ingested_at: now
+      ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -2925,7 +3462,7 @@ function discoverMeta(sourceArchiveDir) {
 }
 var intOrNull2 = (v) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : null;
 var strOrNull2 = (v) => typeof v === "string" && v ? v : null;
-function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now, stats, full) {
+function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
   let paths = discoverMeta(sourceArchiveDir);
   if (excludedDirs.length)
     paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
@@ -2960,7 +3497,7 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now, s
     }
     const hash = sha256(buf);
     if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
@@ -2983,9 +3520,9 @@ function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now, s
       agent_description: strOrNull2(d.description),
       spawn_depth: intOrNull2(d.spawnDepth),
       tool_use_id: strOrNull2(d.toolUseId),
-      ingested_at: now
+      ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -3027,7 +3564,7 @@ function sessionFromPath2(path) {
   const i = parts.indexOf("tool-results");
   return i > 0 ? parts[i - 1] : null;
 }
-function ingestToolResults(db, sourceArchiveDir, excludedDirs, now, stats, full) {
+function ingestToolResults(db, sourceArchiveDir, excludedDirs, now2, stats, full) {
   let paths = discoverResults(sourceArchiveDir);
   if (excludedDirs.length)
     paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
@@ -3061,7 +3598,7 @@ function ingestToolResults(db, sourceArchiveDir, excludedDirs, now, stats, full)
     }
     const hash = sha256(buf);
     if (prev && prev.sha256 === hash) {
-      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+      setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
       stats.skipped++;
       continue;
     }
@@ -3071,9 +3608,9 @@ function ingestToolResults(db, sourceArchiveDir, excludedDirs, now, stats, full)
       path,
       bytes: st.size,
       text: buf.toString("utf8"),
-      ingested_at: now
+      ingested_at: now2
     });
-    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now });
+    setState.run({ file_path: path, size: st.size, mtime_ms: mtimeMs, sha256: hash, ingested_at: now2 });
     stats.upserted++;
   }
 }
@@ -3115,7 +3652,7 @@ function runIngest(argv = process.argv.slice(2)) {
   const adapterList = [new ClaudeCodeAdapter()];
   const adapterById = new Map(adapterList.map((a) => [a.agentId, a]));
   const sources = loadSources();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const now2 = (/* @__PURE__ */ new Date()).toISOString();
   const excludePaths = loadExcludes();
   const excludedDirs = parseExcludes(excludePaths.join(","));
   const pruned = pruneExcluded(db, excludePaths);
@@ -3156,21 +3693,22 @@ function runIngest(argv = process.argv.slice(2)) {
           mtime_ms: mtimeMs,
           sha256: hash,
           events_ingested: prev.events_ingested,
-          ingested_at: now
+          ingested_at: now2
         });
         stats.skipped++;
         continue;
       }
       const lines = small ? buf.toString("utf8").split("\n") : streamLines(file.path);
-      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash }, now, stats);
+      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash }, now2, stats);
       dirty.add(file.sessionId);
     }
-    ingestWorkflowResults(db, join8(archiveRoot, source.label), source.label, excludedDirs, now, wfStats, args.full);
-    ingestSubagentMeta(db, join8(archiveRoot, source.label), source.label, excludedDirs, now, metaStats, args.full);
-    ingestToolResults(db, join8(archiveRoot, source.label), excludedDirs, now, trStats, args.full);
+    ingestWorkflowResults(db, join8(archiveRoot, source.label), source.label, excludedDirs, now2, wfStats, args.full);
+    ingestSubagentMeta(db, join8(archiveRoot, source.label), source.label, excludedDirs, now2, metaStats, args.full);
+    ingestToolResults(db, join8(archiveRoot, source.label), excludedDirs, now2, trStats, args.full);
   }
   const expanded = rebuildDerived(db, args.full ? null : dirty);
   const classified = classify(db, args.full ? null : expanded);
+  const detected = detect(db, args.full ? null : expanded);
   const count = (sql) => db.prepare(sql).get().n;
   const sessions = count("SELECT COUNT(*) n FROM sessions");
   const turns = count("SELECT COUNT(*) n FROM turns");
@@ -3186,12 +3724,16 @@ function runIngest(argv = process.argv.slice(2)) {
   const wfRuns = count("SELECT COUNT(*) n FROM workflow_results");
   const metaRows = count("SELECT COUNT(*) n FROM session_meta");
   const trRows = count("SELECT COUNT(*) n FROM tool_results");
+  const sevCounts = db.prepare("SELECT severity, COUNT(*) n FROM findings GROUP BY severity").all();
+  const sevMap = Object.fromEntries(sevCounts.map((r) => [r.severity, r.n]));
+  const sevLine = ["critical", "high", "medium", "low", "info"].map((s) => `${s}=${sevMap[s] ?? 0}`).join(" ");
   db.close();
   console.log(`agent-lens-ingest: files=${stats.files} skipped=${stats.skipped} new_events=${stats.newEvents} malformed=${stats.malformed}${pruned ? ` excluded_pruned=${pruned}` : ""}
   sessions=${sessions} turns=${turns} events=${events} tool_calls=${tools} classified=${classified.count}
   workflow_results=${wfRuns} (sidecar upserted=${wfStats.upserted} skipped=${wfStats.skipped} malformed=${wfStats.malformed})
   session_meta=${metaRows} (upserted=${metaStats.upserted} skipped=${metaStats.skipped} malformed=${metaStats.malformed})
   tool_results=${trRows} (upserted=${trStats.upserted} skipped=${trStats.skipped} malformed=${trStats.malformed})
+  findings=${detected.count} (${sevLine})
   tokens=${totalTokens.toLocaleString()} est_cost=$${cost.toFixed(2)} db=${dbPath}`);
 }
 function runMetrics(argv = process.argv.slice(2)) {
@@ -3207,8 +3749,9 @@ function runMetrics(argv = process.argv.slice(2)) {
   }
   const db = openDb(dbPath);
   const r = classify(db);
+  const d = detect(db);
   db.close();
-  console.log(`agent-lens-metrics: classified=${r.count} classifier_version=${CLASSIFIER_VERSION} db=${dbPath}`);
+  console.log(`agent-lens-metrics: classified=${r.count} classifier_version=${CLASSIFIER_VERSION} findings=${d.count} detector_version=${DETECTOR_VERSION} db=${dbPath}`);
 }
 
 // ../server/dist/run.js
@@ -3281,9 +3824,9 @@ function listSessions(db, f) {
   if (f.project)
     where.push("s.project_id = ?"), params.push(f.project);
   if (f.from)
-    where.push("s.started_at >= ?"), params.push(f.from);
+    where.push("date(s.started_at) >= date(?)"), params.push(f.from);
   if (f.to)
-    where.push("s.started_at <= ?"), params.push(f.to);
+    where.push("date(s.started_at) <= date(?)"), params.push(f.to);
   if (f.kind === "main")
     where.push("s.is_sidechain = 0");
   if (f.kind === "subagent")
@@ -3390,6 +3933,33 @@ function getSession(db, id) {
         t.full_result = { text: full.text, bytes: full.bytes };
     }
   }
+  const sessionFindings = [];
+  if (tableExists(db, "findings")) {
+    const findingRows = db.prepare(`SELECT id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json
+         FROM findings WHERE session_id = ?`).all(id);
+    const byToolCall = /* @__PURE__ */ new Map();
+    for (const fr of findingRows) {
+      const f = {
+        id: fr.id,
+        tool_call_id: fr.tool_call_id,
+        event_uuid: fr.event_uuid,
+        turn_id: fr.turn_id,
+        rule_id: fr.rule_id,
+        category: fr.category,
+        framework_ref: fr.framework_ref,
+        severity: fr.severity,
+        title: fr.title,
+        evidence: fr.evidence,
+        signals: safeJson(fr.signals_json)
+      };
+      sessionFindings.push(f);
+      if (fr.tool_call_id)
+        (byToolCall.get(fr.tool_call_id) ?? byToolCall.set(fr.tool_call_id, []).get(fr.tool_call_id)).push(f);
+    }
+    for (const t of toolRows)
+      t.findings = byToolCall.get(t.id) ?? [];
+    sessionFindings.sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+  }
   const toolsByEvent = /* @__PURE__ */ new Map();
   for (const t of toolRows) {
     if (!t.event_uuid)
@@ -3478,7 +4048,7 @@ function getSession(db, id) {
        FROM tool_calls tc LEFT JOIN turns t ON t.id = tc.turn_id
        WHERE tc.session_id = ? AND tc.workflow_run_id IS NOT NULL
        ORDER BY t.seq`).all(id);
-  return { session, turns, events, classification, parent, children, workflow_runs };
+  return { session, turns, events, classification, parent, children, workflow_runs, findings: sessionFindings };
 }
 function xmlTag(text, tag) {
   return text.match(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`))?.[1]?.trim() ?? null;
@@ -3634,6 +4204,101 @@ function getSkill(db, name) {
   const call_count = sessions.reduce((a, s) => a + s.fire_count, 0);
   return { name, versions, sessions, call_count };
 }
+var SEVERITY_RANK_SQL = "CASE f.severity WHEN 'critical' THEN 5 WHEN 'high' THEN 4 WHEN 'medium' THEN 3 WHEN 'low' THEN 2 WHEN 'info' THEN 1 ELSE 0 END";
+var MUTED_SQL = `EXISTS (SELECT 1 FROM triage.muted_rules m WHERE m.rule_id = f.rule_id
+   AND (m.scope='global' OR (m.scope='project' AND m.scope_id = s.project_id) OR (m.scope='source' AND m.scope_id = s.source_id)))`;
+function triageAttached(db) {
+  return db.prepare("PRAGMA database_list").all().some((r) => r.name === "triage");
+}
+function findingWhere(f) {
+  const sql = [];
+  const params = [];
+  if (f.severity)
+    sql.push("f.severity = ?"), params.push(f.severity);
+  if (f.category)
+    sql.push("f.category = ?"), params.push(f.category);
+  if (f.rule)
+    sql.push("f.rule_id = ?"), params.push(f.rule);
+  if (f.session)
+    sql.push("f.session_id = ?"), params.push(f.session);
+  if (f.source)
+    sql.push("s.source_id = ?"), params.push(f.source);
+  if (f.project)
+    sql.push("s.project_id = ?"), params.push(f.project);
+  if (f.from)
+    sql.push("date(s.started_at) >= date(?)"), params.push(f.from);
+  if (f.to)
+    sql.push("date(s.started_at) <= date(?)"), params.push(f.to);
+  return { sql, params };
+}
+function statusWhere(status, attached) {
+  if (!attached)
+    return status === "dismissed" || status === "muted" ? "1 = 0" : "";
+  switch (status) {
+    case "dismissed":
+      return "d.finding_id IS NOT NULL";
+    case "muted":
+      return `d.finding_id IS NULL AND ${MUTED_SQL}`;
+    case "all":
+      return "";
+    default:
+      return `d.finding_id IS NULL AND NOT ${MUTED_SQL}`;
+  }
+}
+function listFindings(db, f) {
+  if (!tableExists(db, "findings"))
+    return { total: 0, findings: [] };
+  const attached = triageAttached(db);
+  const w = findingWhere(f);
+  const st = statusWhere(f.status ?? "open", attached);
+  const where = [...w.sql, ...st ? [st] : []];
+  const whereSql = where.length ? `WHERE ${where.join(" AND ")}` : "";
+  const dismissJoin = attached ? "LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id" : "";
+  const triageCols = attached ? `, (d.finding_id IS NOT NULL) AS dismissed, d.note AS dismiss_note, d.dismissed_at, ${MUTED_SQL} AS muted` : `, 0 AS dismissed, NULL AS dismiss_note, NULL AS dismissed_at, 0 AS muted`;
+  const total = db.prepare(`SELECT COUNT(*) n FROM findings f JOIN sessions s ON s.id = f.session_id ${dismissJoin} ${whereSql}`).get(...w.params).n;
+  const ORDER = {
+    severity: SEVERITY_RANK_SQL,
+    session: "f.session_id",
+    rule: "f.rule_id",
+    category: "f.category",
+    time: "s.started_at"
+  };
+  const orderCol = ORDER[f.sort ?? "severity"] ?? SEVERITY_RANK_SQL;
+  const dir = f.dir === "asc" ? "ASC" : "DESC";
+  const findings = db.prepare(`SELECT f.id, f.session_id, f.tool_call_id, f.event_uuid, f.turn_id, f.rule_id, f.category,
+              f.framework_ref, f.severity, f.title, f.evidence, tc.tool_name,
+              COALESCE(s.ai_title, s.slug) AS session_title, s.source_id, s.is_sidechain,
+              s.started_at, p.path AS project_path, s.project_id ${triageCols}
+       FROM findings f
+       JOIN sessions s ON s.id = f.session_id
+       LEFT JOIN projects p ON p.id = s.project_id
+       LEFT JOIN tool_calls tc ON tc.id = f.tool_call_id
+       ${dismissJoin}
+       ${whereSql}
+       ORDER BY ${orderCol} ${dir}, ${SEVERITY_RANK_SQL} DESC, f.id ASC
+       LIMIT ? OFFSET ?`).all(...w.params, f.limit, f.offset);
+  return { total, findings };
+}
+function securitySummary(db) {
+  const categories = SECURITY_CATEGORIES;
+  if (!tableExists(db, "findings")) {
+    return { total: 0, sessions_flagged: 0, dismissed: 0, muted: 0, by_severity: [], by_category: [], by_rule: [], categories };
+  }
+  const attached = triageAttached(db);
+  const dismissJoin = attached ? "LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id" : "";
+  const base = `FROM findings f JOIN sessions s ON s.id = f.session_id ${dismissJoin}`;
+  const openWhere = attached ? `WHERE d.finding_id IS NULL AND NOT ${MUTED_SQL}` : "";
+  const scalar = (sql) => db.prepare(sql).get().n;
+  const total = scalar(`SELECT COUNT(*) n ${base} ${openWhere}`);
+  const sessions_flagged = scalar(`SELECT COUNT(DISTINCT f.session_id) n ${base} ${openWhere}`);
+  const dismissed = attached ? scalar(`SELECT COUNT(*) n FROM findings f LEFT JOIN triage.dismissed_findings d ON d.finding_id = f.id WHERE d.finding_id IS NOT NULL`) : 0;
+  const muted = attached ? scalar(`SELECT COUNT(*) n ${base} WHERE d.finding_id IS NULL AND ${MUTED_SQL}`) : 0;
+  const by_severity = db.prepare(`SELECT f.severity AS severity, COUNT(*) n ${base} ${openWhere} GROUP BY f.severity ORDER BY ${SEVERITY_RANK_SQL} DESC`).all();
+  const by_category = db.prepare(`SELECT f.category AS category, COUNT(*) n ${base} ${openWhere} GROUP BY f.category ORDER BY n DESC`).all();
+  const by_rule = db.prepare(`SELECT f.rule_id AS rule_id, f.category AS category, f.title AS title, COUNT(*) n, MAX(${SEVERITY_RANK_SQL}) AS rank
+       ${base} ${openWhere} GROUP BY f.rule_id ORDER BY rank DESC, n DESC`).all();
+  return { total, sessions_flagged, dismissed, muted, by_severity, by_category, by_rule, categories };
+}
 
 // ../server/dist/app.js
 import { existsSync as existsSync6 } from "fs";
@@ -3647,9 +4312,9 @@ function sessionWhere(f) {
   if (f.source)
     where.push("s.source_id = ?"), params.push(f.source);
   if (f.from)
-    where.push("s.started_at >= ?"), params.push(f.from);
+    where.push("date(s.started_at) >= date(?)"), params.push(f.from);
   if (f.to)
-    where.push("s.started_at <= ?"), params.push(f.to);
+    where.push("date(s.started_at) <= date(?)"), params.push(f.to);
   return { sql: where.length ? `WHERE ${where.join(" AND ")}` : "", params };
 }
 var zeroSplit = () => ({ input: 0, output: 0, cache_creation: 0, cache_read: 0 });
@@ -3839,9 +4504,93 @@ function runRefresh() {
   }
 }
 
+// ../server/dist/triage.js
+import Database3 from "better-sqlite3";
+var TRIAGE_SCHEMA_SQL = (
+  /* sql */
+  `
+PRAGMA journal_mode = WAL;
+
+-- Findings the user reviewed and marked safe. Keyed by the stable finding id so it survives re-ingest.
+CREATE TABLE IF NOT EXISTS dismissed_findings (
+  finding_id   TEXT PRIMARY KEY,   -- findings.id = sha1(tool_call_id, rule_id)
+  tool_call_id TEXT,               -- reference only (may be null)
+  rule_id      TEXT,               -- reference only (may be null)
+  note         TEXT,
+  dismissed_at TEXT NOT NULL
+);
+
+-- Rules the user muted (suppressed as noise), optionally scoped to a project or source. A muted rule
+-- hides its current AND future findings from the open view \u2014 the scalable lever for a noisy rule.
+CREATE TABLE IF NOT EXISTS muted_rules (
+  rule_id  TEXT NOT NULL,
+  scope    TEXT NOT NULL DEFAULT 'global',  -- 'global' | 'project' | 'source'
+  scope_id TEXT NOT NULL DEFAULT '',        -- project_id / source_id; '' for global (NOT NULL keeps it in the PK)
+  note     TEXT,
+  muted_at TEXT NOT NULL,
+  PRIMARY KEY (rule_id, scope, scope_id)
+);
+`
+);
+function openTriage(file) {
+  const db = new Database3(file);
+  db.pragma("journal_mode = WAL");
+  db.exec(TRIAGE_SCHEMA_SQL);
+  return db;
+}
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+function dismiss(db, ids, note) {
+  const stmt = db.prepare(`INSERT INTO dismissed_findings (finding_id, note, dismissed_at) VALUES (?, ?, ?)
+     ON CONFLICT(finding_id) DO UPDATE SET note = excluded.note, dismissed_at = excluded.dismissed_at`);
+  const ts = now();
+  const tx = db.transaction((list) => {
+    for (const id of list)
+      stmt.run(id, note ?? null, ts);
+  });
+  tx(ids);
+  return ids.length;
+}
+function reopen(db, ids) {
+  const stmt = db.prepare("DELETE FROM dismissed_findings WHERE finding_id = ?");
+  let n = 0;
+  const tx = db.transaction((list) => {
+    for (const id of list)
+      n += stmt.run(id).changes;
+  });
+  tx(ids);
+  return n;
+}
+function muteRule(db, ruleId, scope = "global", scopeId = "", note) {
+  db.prepare(`INSERT INTO muted_rules (rule_id, scope, scope_id, note, muted_at) VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(rule_id, scope, scope_id) DO UPDATE SET note = excluded.note, muted_at = excluded.muted_at`).run(ruleId, scope, scope === "global" ? "" : scopeId, note ?? null, now());
+}
+function unmute(db, ruleId, scope = "global", scopeId = "") {
+  return db.prepare("DELETE FROM muted_rules WHERE rule_id = ? AND scope = ? AND scope_id = ?").run(ruleId, scope, scope === "global" ? "" : scopeId).changes;
+}
+function listMutes(db) {
+  return db.prepare("SELECT rule_id, scope, scope_id, note, muted_at FROM muted_rules ORDER BY muted_at DESC").all();
+}
+
 // ../server/dist/app.js
 async function createApp(db, opts = {}) {
   const app = Fastify({ logger: false });
+  let triageDb = null;
+  if (opts.triageDbPath) {
+    triageDb = openTriage(opts.triageDbPath);
+    db.exec(`ATTACH DATABASE '${opts.triageDbPath.replace(/'/g, "''")}' AS triage`);
+    app.addHook("onClose", async () => triageDb?.close());
+  }
+  const guardWrite = (req, reply) => {
+    if (!originAllowed(req.headers.origin)) {
+      reply.code(403).send({ error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin write blocked" } });
+      return false;
+    }
+    if (!triageDb) {
+      reply.code(503).send({ error: { code: "TRIAGE_UNAVAILABLE", message: "triage store not configured" } });
+      return false;
+    }
+    return true;
+  };
   app.get("/api/health", async () => {
     const s = schemaStatus(db);
     return { ok: true, last_ingested: lastIngested(db), schema_version: s.db_version, schema_stale: s.stale };
@@ -3904,6 +4653,72 @@ async function createApp(db, opts = {}) {
       return reply.code(404).send({ error: "not found" });
     return result;
   });
+  app.get("/api/security/summary", async () => securitySummary(db));
+  const findingFilters = (q) => ({
+    severity: q.severity,
+    category: q.category,
+    rule: q.rule,
+    session: q.session,
+    source: q.source,
+    project: q.project,
+    from: q.from,
+    to: q.to,
+    status: ["open", "dismissed", "muted", "all"].find((s) => s === q.status)
+  });
+  app.get("/api/security/findings", async (req) => {
+    const q = req.query;
+    return listFindings(db, {
+      ...findingFilters(q),
+      sort: ["severity", "session", "rule", "category", "time"].find((s) => s === q.sort),
+      dir: q.dir === "asc" ? "asc" : q.dir === "desc" ? "desc" : void 0,
+      limit: Math.min(Number(q.limit) || 50, 5e3),
+      offset: Number(q.offset) || 0
+    });
+  });
+  app.get("/api/security/mutes", async () => triageDb ? listMutes(triageDb) : []);
+  app.post("/api/security/dismiss", async (req, reply) => {
+    if (!guardWrite(req, reply))
+      return reply;
+    const b = req.body ?? {};
+    const n = dismiss(triageDb, Array.isArray(b.ids) ? b.ids : [], b.note ?? null);
+    return { ok: true, dismissed: n };
+  });
+  app.post("/api/security/reopen", async (req, reply) => {
+    if (!guardWrite(req, reply))
+      return reply;
+    const b = req.body ?? {};
+    const n = reopen(triageDb, Array.isArray(b.ids) ? b.ids : []);
+    return { ok: true, reopened: n };
+  });
+  app.post("/api/security/dismiss-matching", async (req, reply) => {
+    if (!guardWrite(req, reply))
+      return reply;
+    const b = req.body ?? {};
+    const page = listFindings(db, { ...findingFilters(b.filter ?? {}), status: "open", limit: 1e5, offset: 0 });
+    const ids = page.findings.map((r) => r.id);
+    const n = dismiss(triageDb, ids, b.note ?? null);
+    return { ok: true, dismissed: n };
+  });
+  app.post("/api/security/mute", async (req, reply) => {
+    if (!guardWrite(req, reply))
+      return reply;
+    const b = req.body ?? {};
+    if (!b.rule_id)
+      return reply.code(400).send({ error: { code: "BAD_REQUEST", message: "rule_id required" } });
+    const scope = ["global", "project", "source"].find((s) => s === b.scope) ?? "global";
+    muteRule(triageDb, b.rule_id, scope, b.scope_id ?? "", b.note ?? null);
+    return { ok: true };
+  });
+  app.post("/api/security/unmute", async (req, reply) => {
+    if (!guardWrite(req, reply))
+      return reply;
+    const b = req.body ?? {};
+    if (!b.rule_id)
+      return reply.code(400).send({ error: { code: "BAD_REQUEST", message: "rule_id required" } });
+    const scope = ["global", "project", "source"].find((s) => s === b.scope) ?? "global";
+    const n = unmute(triageDb, b.rule_id, scope, b.scope_id ?? "");
+    return { ok: true, unmuted: n };
+  });
   app.get("/api/skills", async (req) => {
     const q = req.query;
     return listSkills(db, { q: q.q, source: q.source, project: q.project });
@@ -3973,8 +4788,9 @@ async function startServer() {
     console.error(`agent-lens-server: db not found: ${dbPath} (run ingest first)`);
     process.exit(1);
   }
+  const triageDbPath = process.env.AGENT_LENS_TRIAGE_DB || join10(dirname5(dbPath), "triage.db");
   const db = openReadonly(dbPath);
-  const app = await createApp(db, { webDist });
+  const app = await createApp(db, { webDist, triageDbPath });
   try {
     await app.listen({ host, port });
     console.log(`agent-lens-server: http://${host}:${port}  (db: ${dbPath})`);