@telora/daemon 0.21.26 → 0.21.82

package/dist/security/security-rescan-resolution.js

@@ -0,0 +1,117 @@
+/**
+ * Re-scan resolution: when a scan run completes that covered a finding's
+ * IOC class but did not re-produce a previously-open finding, flip the
+ * finding to 'resolved' and (if the linked injection's delivery is done)
+ * auto-verify the injection.
+ *
+ * Called by the scanner engine immediately after a run finishes writing
+ * its findings, before the next tick begins.
+ *
+ * @module security-rescan-resolution
+ */
+import { callApi } from '../queries/shared.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'security-rescan-resolution' });
+/**
+ * Resolve previously-open findings that didn't re-appear in this run.
+ *
+ * @returns the list of finding ids that were flipped to 'resolved'.
+ */
+export async function resolveStaleFindings(productId, observedSets, deps) {
+    const iocClasses = observedSets.map((s) => s.iocClass);
+    if (iocClasses.length === 0)
+        return [];
+    const openFindings = await deps.listOpenFindings(productId, iocClasses);
+    const observedByClass = new Map();
+    for (const set of observedSets) {
+        observedByClass.set(set.iocClass, set.identifiers);
+    }
+    const resolvedIds = [];
+    const resolvedInjectionIds = [];
+    for (const finding of openFindings) {
+        const observedInClass = observedByClass.get(finding.iocClass);
+        if (!observedInClass)
+            continue;
+        if (observedInClass.has(finding.identifier))
+            continue;
+        // Finding was open, its class was covered, but it didn't re-appear.
+        await deps.markFindingResolved(finding.id);
+        await deps.writeAudit({
+            findingId: finding.id,
+            organizationId: finding.organizationId,
+            action: 'resolved',
+            payload: { reason: 'absent_in_rescan', ioc_class: finding.iocClass },
+        });
+        resolvedIds.push(finding.id);
+        // Auto-verify the linked injection if its delivery has reached 'done'.
+        if (finding.linkedInjectionId) {
+            resolvedInjectionIds.push(finding.linkedInjectionId);
+            const status = await deps.getInjectionDeliveryStatus(finding.linkedInjectionId);
+            if (status === 'done') {
+                await deps.verifyInjection(finding.linkedInjectionId);
+            }
+        }
+    }
+    // Attempt to close any Security focuses whose findings have all been
+    // resolved by this sweep. The server-side gate enforces the close
+    // criteria (all findings resolved + all deliveries terminal); we just
+    // collect candidates here and fan out. closeSecurityFocus returning
+    // false (criteria not yet met) is non-fatal.
+    if (resolvedInjectionIds.length > 0) {
+        try {
+            const mappings = await deps.lookupFocusForInjections(resolvedInjectionIds);
+            const focusIds = Array.from(new Set(mappings.map((m) => m.focusId)));
+            for (const focusId of focusIds) {
+                try {
+                    await deps.closeSecurityFocus(focusId);
+                }
+                catch (err) {
+                    log.warn(`[security-rescan-resolution] closeSecurityFocus ${focusId}:`, err.message);
+                }
+            }
+        }
+        catch (err) {
+            log.warn('[security-rescan-resolution] lookupFocusForInjections:', err.message);
+        }
+    }
+    return resolvedIds;
+}
+// ---------------------------------------------------------------------------
+// Default Deps -- daemon-side wiring via callApi.
+// ---------------------------------------------------------------------------
+export function buildDefaultResolutionDeps() {
+    return {
+        listOpenFindings: async (productId, iocClasses) => {
+            const res = await callApi('daemon_list_open_security_findings', { productId, iocClasses });
+            return res.items ?? [];
+        },
+        markFindingResolved: async (findingId) => {
+            await callApi('daemon_resolve_security_finding', { findingId });
+        },
+        writeAudit: async (input) => {
+            // `action` is reserved at the wire layer for the dispatcher route, so
+            // we rename the audit action to `auditAction` to avoid the collision.
+            const { action, ...rest } = input;
+            await callApi('daemon_write_security_finding_audit', {
+                ...rest,
+                auditAction: action,
+            });
+        },
+        getInjectionDeliveryStatus: async (injectionNodeId) => {
+            const res = await callApi('daemon_get_injection_delivery_status', { injectionNodeId });
+            return res.status;
+        },
+        verifyInjection: async (injectionNodeId) => {
+            await callApi('reality_tree_verify_injection', { injectionNodeId });
+        },
+        lookupFocusForInjections: async (injectionNodeIds) => {
+            const res = await callApi('daemon_lookup_focus_for_injections', { injectionNodeIds });
+            return res.items ?? [];
+        },
+        closeSecurityFocus: async (focusId) => {
+            const res = await callApi('daemon_close_security_focus', { focusId });
+            return res.closed === true;
+        },
+    };
+}
+//# sourceMappingURL=security-rescan-resolution.js.map

package/dist/security/security-rescan-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-rescan-resolution.js","sourceRoot":"","sources":["../../src/security/security-rescan-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;AA0DnE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,YAAiC,EACjC,IAAoB;IAEpB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,SAAS;QAEtD,oEAAoE;QACpE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;SACrE,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE7B,uEAAuE;QACvE,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAChF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,6CAA6C;IAC7C,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CACN,mDAAmD,OAAO,GAAG,EAC5D,GAAa,CAAC,OAAO,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,wDAAwD,EACvD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,oCAAoC,EACpC,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACvC,MAAM,OAAO,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,OAAO,CAAC,qCAAqC,EAAE;gBACnD,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;QACD,0BAA0B,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,EAAE,eAAe,EAAE,CACpB,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC;QACpB,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACzC,MAAM,OAAO,CAAC,+BAA+B,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAEtB,oCAAoC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,6BAA6B,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security/security-scan-engine.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Security scan engine.
+ *
+ * Polls security_scan_configs for due scans (cron-due or manual_run_requested_at
+ * set), dispatches pluggable Scanner implementations per IOC class, upserts
+ * security_findings rows (one per product/ioc_class/identifier), and hands
+ * any newly-observed or unremediated-open finding to security-auto-inject
+ * for remediation materialization.
+ *
+ * No longer writes scan-run rows -- the current-state model only persists
+ * findings. `last_run_at` on the config is updated directly at the end of
+ * runScanForConfig.
+ *
+ * Activation: gated by shouldRunLoop('TELORA_SECURITY_SCAN_LOOP') in
+ * unified-shell.ts. Opt-out semantics match the other daemon loop ticks
+ * (unset/anything-but-'0' = enabled, '0' = disabled). See
+ * docs/runbook-loop-activation.md.
+ *
+ * @module security-scan-engine
+ */
+import type { DaemonConfig } from '../types/index.js';
+import { type AutoInjectDeps } from './security-auto-inject.js';
+import { type ResolutionDeps } from './security-rescan-resolution.js';
+export type Severity = 'low' | 'medium' | 'high' | 'critical';
+export type FindingStatus = 'open' | 'remediating' | 'resolved' | 'escalated';
+/** Configuration row driving an individual product's scan cadence. */
+export interface ScanConfig {
+    id: string;
+    organizationId: string;
+    productId: string;
+    scheduleCron: string;
+    enabledIocClasses: string[];
+    enabled: boolean;
+    manualRunRequestedAt: string | null;
+    lastRunAt: string | null;
+}
+/** Per-scan context passed to each Scanner. */
+export interface ScanContext {
+    config: ScanConfig;
+    repoPath: string;
+}
+/** Single finding draft emitted by a Scanner. Stored in security_findings. */
+export interface FindingDraft {
+    iocClass: string;
+    severity: Severity;
+    identifier: string;
+    payload: Record<string, unknown>;
+}
+/** Per-scanner output for a single scan run. */
+export interface ScanResult {
+    findings: FindingDraft[];
+    /** Coverage breadcrumb (e.g. packages_audited, files_scanned) + any warnings. */
+    coverage: Record<string, unknown>;
+}
+/** Pluggable Scanner contract -- one per IOC class. */
+export interface Scanner {
+    /** IOC class slug, matched against ScanConfig.enabledIocClasses. */
+    iocClass: string;
+    scan(ctx: ScanContext): Promise<ScanResult>;
+}
+export declare function registerScanner(scanner: Scanner): void;
+export declare function getRegisteredScanners(): Scanner[];
+export interface UpsertFindingResult {
+    findingId: string;
+    /** True when this row was just inserted (vs an existing row was updated). */
+    wasNew: boolean;
+    status: FindingStatus;
+    linkedInjectionId: string | null;
+}
+/** Options that further narrow which due configs the tick should pick up. */
+export interface DueScanConfigsOptions {
+    /**
+     * When true, return only configs with a pending manual-run request and
+     * skip cron evaluation entirely. Used by the fast (30s) request-drain
+     * loop so the click-to-run latency matches other queued-work pickups.
+     */
+    manualOnly?: boolean;
+}
+export interface SecurityScanDeps {
+    getDueScanConfigs: (opts?: DueScanConfigsOptions) => Promise<ScanConfig[]>;
+    /**
+     * Insert or update one row of security_findings. Conflict on
+     * (product_id, ioc_class, identifier) updates last_seen_at, severity,
+     * and payload. first_seen_at is set on insert only.
+     */
+    upsertFinding: (productId: string, organizationId: string, finding: FindingDraft) => Promise<UpsertFindingResult>;
+    /** Stamp last_run_at on the config after a scan completes. */
+    updateConfigLastRun: (configId: string) => Promise<void>;
+    clearManualRunRequest: (configId: string) => Promise<void>;
+    /**
+     * Resolve the repo to scan for a product, or null when this daemon does not
+     * manage that product. NULL IS LOAD-BEARING: the caller must skip the scan
+     * entirely rather than substitute a fallback path. Returning some other
+     * repo's path makes `npm audit` (and every path-based scanner) report THAT
+     * repo's findings against this product -- see the fail-closed gate in
+     * runScanForConfig.
+     */
+    resolveCwd: (productId: string) => string | null;
+    /**
+     * Flush the OSV + GHSA feed caches. Invoked at the start of every
+     * manual-triggered scan so a user-clicked "Refresh feeds" pulls fresh
+     * upstream advisory data rather than the cached 15-minute window.
+     */
+    clearFeedCaches: () => void;
+    scanners: Scanner[];
+    /**
+     * Optional auto-injection hook. When set, each new finding (or
+     * existing open finding with no remediation) is passed to
+     * processNewFinding so the daemon can materialize a remediation
+     * injection + delivery for it.
+     */
+    autoInjectDeps?: AutoInjectDeps;
+    /**
+     * Optional re-scan resolution hook. When set, after every scan run
+     * finishes, the engine asks the resolution module to flip previously
+     * open findings whose identifiers did not re-appear to 'resolved'.
+     */
+    resolutionDeps?: ResolutionDeps;
+}
+/**
+ * Memoize the per-batch identifiers within one scan-run: focus (+ tree),
+ * entity node, injection node, and delivery. The server handlers always
+ * create new rows; without this wrapper, every finding in the scan would
+ * land in its own focus + delivery, producing N noisy copies of what is
+ * conceptually one remediation batch. Returns undefined when no
+ * auto-inject is configured.
+ *
+ * Failure semantics: if a memoized call throws, that slot's cached promise
+ * is discarded so the next finding in the run retries the create. Slots
+ * are independent -- a transient failure on createInjection does not
+ * invalidate the already-resolved focus or entity.
+ *
+ * Also exposes peekFocusId() so the engine can finalize the focus name
+ * (appending the finding count) once the scan loop completes.
+ */
+export interface ScanRunAutoInject {
+    deps: AutoInjectDeps;
+    /** focusId of the memoized focus, or null if no focus was created. */
+    peekFocusId(): string | null;
+}
+export declare function wrapAutoInjectForScanRun(inner: AutoInjectDeps | undefined): ScanRunAutoInject | undefined;
+export declare function runScanForConfig(config: ScanConfig, trigger: 'schedule' | 'manual', deps: SecurityScanDeps): Promise<void>;
+export declare function runSecurityScanTick(deps: SecurityScanDeps, opts?: DueScanConfigsOptions): Promise<void>;
+export declare function buildDefaultSecurityScanDeps(config: DaemonConfig): SecurityScanDeps;
+//# sourceMappingURL=security-scan-engine.d.ts.map

package/dist/security/security-scan-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CAyB/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwIf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAiDnF"}

package/dist/security/security-scan-engine.js

@@ -0,0 +1,271 @@
+/**
+ * Security scan engine.
+ *
+ * Polls security_scan_configs for due scans (cron-due or manual_run_requested_at
+ * set), dispatches pluggable Scanner implementations per IOC class, upserts
+ * security_findings rows (one per product/ioc_class/identifier), and hands
+ * any newly-observed or unremediated-open finding to security-auto-inject
+ * for remediation materialization.
+ *
+ * No longer writes scan-run rows -- the current-state model only persists
+ * findings. `last_run_at` on the config is updated directly at the end of
+ * runScanForConfig.
+ *
+ * Activation: gated by shouldRunLoop('TELORA_SECURITY_SCAN_LOOP') in
+ * unified-shell.ts. Opt-out semantics match the other daemon loop ticks
+ * (unset/anything-but-'0' = enabled, '0' = disabled). See
+ * docs/runbook-loop-activation.md.
+ *
+ * @module security-scan-engine
+ */
+import { callApi } from '../queries/shared.js';
+import { configForProduct } from '../shell/config.js';
+import { buildDefaultAutoInjectDeps, processNewFinding, } from './security-auto-inject.js';
+import { resolveStaleFindings, buildDefaultResolutionDeps, } from './security-rescan-resolution.js';
+import { clearOsvCache } from '../feeds/osv.js';
+import { clearGhsaCache } from '../feeds/ghsa.js';
+import { createLogger } from '../shell/log.js';
+const log = createLogger({ module: 'security-scan-engine' });
+// ---------------------------------------------------------------------------
+// Default registry -- scanners self-register here in their own modules
+// ---------------------------------------------------------------------------
+const DEFAULT_REGISTRY = new Map();
+export function registerScanner(scanner) {
+    DEFAULT_REGISTRY.set(scanner.iocClass, scanner);
+}
+export function getRegisteredScanners() {
+    return [...DEFAULT_REGISTRY.values()];
+}
+function makeMemoSlot(fn, onResolve) {
+    let cached = null;
+    return (input) => {
+        if (!cached) {
+            cached = fn(input).then((result) => {
+                onResolve?.(result);
+                return result;
+            }, (err) => {
+                cached = null;
+                throw err;
+            });
+        }
+        return cached;
+    };
+}
+export function wrapAutoInjectForScanRun(inner) {
+    if (!inner)
+        return undefined;
+    let resolvedFocusId = null;
+    const focusFn = makeMemoSlot((input) => inner.createSecurityRemediationFocus(input.productId, input.organizationId), (result) => {
+        resolvedFocusId = result.focusId;
+    });
+    const entityFn = makeMemoSlot(inner.upsertEntityNode);
+    const injectionFn = makeMemoSlot(inner.createInjection);
+    const deliveryFn = makeMemoSlot(inner.createDelivery);
+    const wrapped = {
+        ...inner,
+        createSecurityRemediationFocus: (productId, organizationId) => focusFn({ productId, organizationId }),
+        upsertEntityNode: entityFn,
+        createInjection: injectionFn,
+        createDelivery: deliveryFn,
+    };
+    return {
+        deps: wrapped,
+        peekFocusId: () => resolvedFocusId,
+    };
+}
+export async function runScanForConfig(config, trigger, deps) {
+    // Manual triggers carry the "Refresh feeds" intent: flush the OSV/GHSA
+    // TTL caches so this scan pulls fresh advisory data instead of replaying
+    // the 15-minute window. Scheduled triggers honour the cache to keep
+    // upstream load proportional to scan cadence.
+    if (trigger === 'manual') {
+        deps.clearFeedCaches();
+    }
+    // Fail-closed product gate. Scan configs exist per product ORG-WIDE, but this
+    // daemon only manages the products it was started with. Scanning a product we
+    // have no checkout for can only produce findings about some OTHER repo, so we
+    // scan nothing rather than scan the wrong tree. Skipping without stamping
+    // last_run_at is deliberate: the config stays due, so the daemon that DOES
+    // manage this product still picks it up on its own tick.
+    const repoPath = deps.resolveCwd(config.productId);
+    if (repoPath === null) {
+        log.debug(`Skipping security scan for product ${config.productId}: not managed by this daemon ` +
+            `(no repo checkout here). Leaving the config due for a daemon that manages it.`);
+        return;
+    }
+    // Per-scan-run focus memoization. The server handler always creates a new
+    // focus, so without this wrapper each finding in a scan would land in its
+    // own focus. The first finding in this run triggers focus creation; every
+    // subsequent finding shares the same focus. Next scan run gets a fresh
+    // closure -> fresh focus = fresh batch.
+    const scanScopedAutoInject = wrapAutoInjectForScanRun(deps.autoInjectDeps);
+    let injectedCount = 0;
+    const enabledScanners = deps.scanners.filter((s) => config.enabledIocClasses.includes(s.iocClass));
+    // Per-class observed identifier sets for re-scan resolution. Only
+    // classes whose scanner ran without error contribute -- a failed
+    // scanner can't claim coverage for its class.
+    const observedByClass = new Map();
+    for (const scanner of enabledScanners) {
+        try {
+            const result = await scanner.scan({
+                config,
+                repoPath,
+            });
+            const observed = new Set();
+            for (const finding of result.findings) {
+                const upsert = await deps.upsertFinding(config.productId, config.organizationId, finding);
+                observed.add(finding.identifier);
+                // Trigger auto-inject when:
+                //   * the finding is brand new, OR
+                //   * the existing finding is open with no remediation in flight
+                //     (e.g. previous delivery was cancelled).
+                const shouldRemediate = upsert.wasNew || (upsert.status === 'open' && upsert.linkedInjectionId === null);
+                if (scanScopedAutoInject && shouldRemediate) {
+                    try {
+                        const forInjection = {
+                            id: upsert.findingId,
+                            organizationId: config.organizationId,
+                            productId: config.productId,
+                            iocClass: finding.iocClass,
+                            severity: finding.severity,
+                            identifier: finding.identifier,
+                            payload: finding.payload,
+                            status: upsert.status,
+                            linkedInjectionId: upsert.linkedInjectionId,
+                        };
+                        const injectResult = await processNewFinding(forInjection, {}, scanScopedAutoInject.deps);
+                        if (injectResult.status === 'injected') {
+                            injectedCount++;
+                        }
+                    }
+                    catch (err) {
+                        log.warn(`[security-scan-engine] auto-inject ${finding.identifier}:`, err.message);
+                    }
+                }
+            }
+            observedByClass.set(scanner.iocClass, observed);
+        }
+        catch (err) {
+            log.warn(`[security-scan-engine] scanner ${scanner.iocClass} failed:`, err.message);
+        }
+    }
+    // Re-scan resolution: previously-open findings whose class was
+    // covered by this run but whose identifier did not re-appear are
+    // flipped to 'resolved'. Failures here are non-fatal.
+    if (deps.resolutionDeps && observedByClass.size > 0) {
+        try {
+            const observedSets = Array.from(observedByClass.entries()).map(([iocClass, identifiers]) => ({ iocClass, identifiers }));
+            await resolveStaleFindings(config.productId, observedSets, deps.resolutionDeps);
+        }
+        catch (err) {
+            log.warn('resolution sweep failed:', err.message);
+        }
+    }
+    // Finalize the security remediation focus name with the batch finding count
+    // so dashboard names like "Security Remediation 2026-05-21 19:44 UTC" become
+    // "... (3 findings)". Best-effort -- no-op when no focus was created or the
+    // dep is not wired (tests).
+    if (scanScopedAutoInject && injectedCount > 0) {
+        const focusId = scanScopedAutoInject.peekFocusId();
+        if (focusId && deps.autoInjectDeps?.finalizeSecurityRemediationFocusName) {
+            try {
+                await deps.autoInjectDeps.finalizeSecurityRemediationFocusName(focusId, injectedCount);
+            }
+            catch (err) {
+                log.warn('[security-scan-engine] finalizeSecurityRemediationFocusName failed:', err.message);
+            }
+        }
+    }
+    // Stamp config.last_run_at so cadence recomputes.
+    try {
+        await deps.updateConfigLastRun(config.id);
+    }
+    catch (err) {
+        log.warn('updateConfigLastRun failed:', err.message);
+    }
+    if (trigger === 'manual') {
+        await deps.clearManualRunRequest(config.id);
+    }
+}
+// ---------------------------------------------------------------------------
+// Loop tick -- invoked by unified-shell on a fixed cadence
+// ---------------------------------------------------------------------------
+// Per-process re-entry guard. A slow scan run (rate-limited retries,
+// many findings) can take longer than the 30s manual-drain tick interval;
+// without this, the same config gets picked up again and a second
+// runScanForConfig runs in parallel, producing duplicate Security
+// remediation focuses for the same scan batch.
+const inFlightConfigs = new Set();
+export async function runSecurityScanTick(deps, opts = {}) {
+    const configs = await deps.getDueScanConfigs(opts);
+    for (const config of configs) {
+        if (!config.enabled)
+            continue;
+        if (inFlightConfigs.has(config.id))
+            continue;
+        const trigger = config.manualRunRequestedAt ? 'manual' : 'schedule';
+        inFlightConfigs.add(config.id);
+        try {
+            await runScanForConfig(config, trigger, deps);
+        }
+        catch (err) {
+            // Per-config failures are swallowed so a single broken product
+            // does not stop the engine from servicing others.
+            log.debug('Per-config failures are swallowed so a single broken product', { error: String(err?.message ?? err) });
+        }
+        finally {
+            inFlightConfigs.delete(config.id);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Default Deps -- daemon-side wiring via callApi
+// ---------------------------------------------------------------------------
+export function buildDefaultSecurityScanDeps(config) {
+    const resolveCwd = (productId) => {
+        const product = config.products.find((p) => p.id === productId);
+        // Fail CLOSED. This previously returned config.repoPath -- the daemon's own
+        // primary repo -- for any product this daemon does not manage. A scan config
+        // exists per product org-wide, but config.products holds only the products
+        // THIS daemon was started with, so every unmanaged product was scanned
+        // against the daemon's own tree: `npm audit` passed its Node-project gate
+        // legitimately (the daemon's repo IS a Node project) and reported the
+        // DAEMON's dependency advisories as findings on an unrelated product.
+        // Observed 2026-07-24: @modelcontextprotocol/sdk, @hono/node-server,
+        // fast-uri and dompurify -- all Telora's own deps -- filed against a Quarto
+        // book, a Rust/Godot workspace, and a Python+Vite app, each spawning a
+        // Security Remediation focus whose team found nothing and escalated.
+        if (!product)
+            return null;
+        return configForProduct(config, product).repoPath;
+    };
+    return {
+        getDueScanConfigs: async (opts) => {
+            const res = await callApi('daemon_get_due_security_scan_configs', opts?.manualOnly ? { manualOnly: true } : {});
+            return res.items ?? [];
+        },
+        upsertFinding: async (productId, organizationId, finding) => {
+            const res = await callApi('daemon_upsert_security_finding', {
+                productId,
+                organizationId,
+                ...finding,
+            });
+            return res;
+        },
+        updateConfigLastRun: async (configId) => {
+            await callApi('daemon_update_scan_config_last_run', { configId });
+        },
+        clearManualRunRequest: async (configId) => {
+            await callApi('daemon_clear_manual_scan_request', { configId });
+        },
+        resolveCwd,
+        clearFeedCaches: () => {
+            clearOsvCache();
+            clearGhsaCache();
+        },
+        scanners: getRegisteredScanners(),
+        autoInjectDeps: buildDefaultAutoInjectDeps(),
+        resolutionDeps: buildDefaultResolutionDeps(),
+    };
+}
+//# sourceMappingURL=security-scan-engine.js.map

package/dist/security/security-scan-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../../src/security/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AA4FD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,sCAAsC,MAAM,CAAC,SAAS,+BAA+B;YACrF,+EAA+E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}

package/dist/session/session-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lineage.d.ts","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAChG,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC,GAAG,WAAW,CAKd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAKV"}

package/dist/session/session-lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-lineage.js","sourceRoot":"","sources":["../../src/session/session-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAGlC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO;WACjC,CAAC,IAAI,CAAC,SAAS,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAsB,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;IAC5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,IAI/B;IACC,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA8C,EAC9C,OAAe,EACf,SAAiB;IAEjB,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,cAAc,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC"}

package/dist/session/session-stamp.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Single stamp site for the `session_started` event (Session identity at the
+ * lineage-pass level, D2 write-path).
+ *
+ * When a spawned team lead emits `session_started`, the daemon must record the
+ * engine's Claude session id in two places, keyed by the team's DECLARED lineage:
+ *
+ *  1. the focus per-lineage resume slot (`product_focuses.claude_session_ids`),
+ *     so a same-lineage re-spawn can `--resume` it and a sibling lineage cannot
+ *     clobber it (INJ-A/INJ-B);
+ *  2. forward onto THIS lead segment row (`agent_sessions.claude_session_id`),
+ *     so pass grouping is exact -- the join key historically lived only on the
+ *     focus slot.
+ *
+ * This logic previously lived inline in BOTH `output-monitor.ts` and
+ * `spawner/helpers.ts`. The two copies drifted in nothing yet, but a single
+ * source removes that risk and gives the decision a unit test. The pure decision
+ * (`resolveSessionStartedStamp`) is testable without mocks; `stampSessionStarted`
+ * is the impure applier both call sites invoke.
+ */
+import type { FocusTeamState } from '../types/index.js';
+/** The two writes a `session_started` stamp performs, plus the team-state mutation. */
+export interface SessionStartedStamp {
+    /** Always written: the focus per-lineage resume slot. */
+    focusSlot: {
+        focusId: string;
+        lineage: string;
+        claudeSessionId: string;
+    };
+    /**
+     * Written only when the team lead has a persisted segment row -- the forward
+     * stamp onto agent_sessions.claude_session_id. Null when leadSessionId is unset.
+     */
+    segment: {
+        sessionId: string;
+        claudeSessionId: string;
+    } | null;
+}
+/**
+ * Pure decision: given the team's lineage + lead-session id and the focus id +
+ * the engine session id from the event, resolve the two writes to perform.
+ *
+ * The segment write is suppressed when there is no `leadSessionId` (a lead
+ * segment row was never persisted), since there is nothing to stamp.
+ */
+export declare function resolveSessionStartedStamp(args: {
+    focusId: string;
+    lineage: string;
+    leadSessionId: string | null;
+    eventSessionId: string;
+}): SessionStartedStamp;
+/**
+ * Apply a `session_started` stamp: mutate the in-memory team state and fire the
+ * two (best-effort, fire-and-forget) DB writes. The single stamp site shared by
+ * `output-monitor.ts` and `spawner/helpers.ts`.
+ */
+export declare function stampSessionStarted(args: {
+    teamState: FocusTeamState;
+    focusId: string;
+    focusName: string;
+    eventSessionId: string;
+}): void;
+//# sourceMappingURL=session-stamp.d.ts.map

package/dist/session/session-stamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-stamp.d.ts","sourceRoot":"","sources":["../../src/session/session-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,yDAAyD;IACzD,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;OAGG;IACH,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAChE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,mBAAmB,CAOtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,cAAc,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,IAAI,CA4BP"}