brakit 0.8.4 → 0.8.5

package/dist/runtime/index.js

@@ -9,28 +9,29 @@ var __export = (target, all) => {
 };
 
 // src/constants/routes.ts
-var DASHBOARD_PREFIX, DASHBOARD_API_REQUESTS, DASHBOARD_API_EVENTS, DASHBOARD_API_FLOWS, DASHBOARD_API_CLEAR, DASHBOARD_API_LOGS, DASHBOARD_API_FETCHES, DASHBOARD_API_ERRORS, DASHBOARD_API_QUERIES, DASHBOARD_API_INGEST, DASHBOARD_API_METRICS, DASHBOARD_API_ACTIVITY, DASHBOARD_API_METRICS_LIVE, DASHBOARD_API_INSIGHTS, DASHBOARD_API_SECURITY, DASHBOARD_API_TAB, DASHBOARD_API_FINDINGS, VALID_TABS;
+var DASHBOARD_PREFIX, DASHBOARD_API_REQUESTS, DASHBOARD_API_EVENTS, DASHBOARD_API_FLOWS, DASHBOARD_API_CLEAR, DASHBOARD_API_LOGS, DASHBOARD_API_FETCHES, DASHBOARD_API_ERRORS, DASHBOARD_API_QUERIES, DASHBOARD_API_INGEST, DASHBOARD_API_METRICS, DASHBOARD_API_ACTIVITY, DASHBOARD_API_METRICS_LIVE, DASHBOARD_API_INSIGHTS, DASHBOARD_API_SECURITY, DASHBOARD_API_TAB, DASHBOARD_API_FINDINGS, DASHBOARD_API_FINDINGS_REPORT, VALID_TABS_TUPLE, VALID_TABS;
 var init_routes = __esm({
   "src/constants/routes.ts"() {
     "use strict";
     DASHBOARD_PREFIX = "/__brakit";
-    DASHBOARD_API_REQUESTS = "/__brakit/api/requests";
-    DASHBOARD_API_EVENTS = "/__brakit/api/events";
-    DASHBOARD_API_FLOWS = "/__brakit/api/flows";
-    DASHBOARD_API_CLEAR = "/__brakit/api/clear";
-    DASHBOARD_API_LOGS = "/__brakit/api/logs";
-    DASHBOARD_API_FETCHES = "/__brakit/api/fetches";
-    DASHBOARD_API_ERRORS = "/__brakit/api/errors";
-    DASHBOARD_API_QUERIES = "/__brakit/api/queries";
-    DASHBOARD_API_INGEST = "/__brakit/api/ingest";
-    DASHBOARD_API_METRICS = "/__brakit/api/metrics";
-    DASHBOARD_API_ACTIVITY = "/__brakit/api/activity";
-    DASHBOARD_API_METRICS_LIVE = "/__brakit/api/metrics/live";
-    DASHBOARD_API_INSIGHTS = "/__brakit/api/insights";
-    DASHBOARD_API_SECURITY = "/__brakit/api/security";
-    DASHBOARD_API_TAB = "/__brakit/api/tab";
-    DASHBOARD_API_FINDINGS = "/__brakit/api/findings";
-    VALID_TABS = /* @__PURE__ */ new Set([
+    DASHBOARD_API_REQUESTS = `${DASHBOARD_PREFIX}/api/requests`;
+    DASHBOARD_API_EVENTS = `${DASHBOARD_PREFIX}/api/events`;
+    DASHBOARD_API_FLOWS = `${DASHBOARD_PREFIX}/api/flows`;
+    DASHBOARD_API_CLEAR = `${DASHBOARD_PREFIX}/api/clear`;
+    DASHBOARD_API_LOGS = `${DASHBOARD_PREFIX}/api/logs`;
+    DASHBOARD_API_FETCHES = `${DASHBOARD_PREFIX}/api/fetches`;
+    DASHBOARD_API_ERRORS = `${DASHBOARD_PREFIX}/api/errors`;
+    DASHBOARD_API_QUERIES = `${DASHBOARD_PREFIX}/api/queries`;
+    DASHBOARD_API_INGEST = `${DASHBOARD_PREFIX}/api/ingest`;
+    DASHBOARD_API_METRICS = `${DASHBOARD_PREFIX}/api/metrics`;
+    DASHBOARD_API_ACTIVITY = `${DASHBOARD_PREFIX}/api/activity`;
+    DASHBOARD_API_METRICS_LIVE = `${DASHBOARD_PREFIX}/api/metrics/live`;
+    DASHBOARD_API_INSIGHTS = `${DASHBOARD_PREFIX}/api/insights`;
+    DASHBOARD_API_SECURITY = `${DASHBOARD_PREFIX}/api/security`;
+    DASHBOARD_API_TAB = `${DASHBOARD_PREFIX}/api/tab`;
+    DASHBOARD_API_FINDINGS = `${DASHBOARD_PREFIX}/api/findings`;
+    DASHBOARD_API_FINDINGS_REPORT = `${DASHBOARD_PREFIX}/api/findings/report`;
+    VALID_TABS_TUPLE = [
       "overview",
       "actions",
       "requests",
@@ -40,12 +41,13 @@ var init_routes = __esm({
       "logs",
       "performance",
       "security"
-    ]);
+    ];
+    VALID_TABS = new Set(VALID_TABS_TUPLE);
   }
 });
 
 // src/constants/limits.ts
-var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES, MAX_TAB_NAME_LENGTH, MAX_INGEST_BYTES, TERMINAL_TRUNCATE_LENGTH, SENSITIVE_MASK_MIN_LENGTH, SENSITIVE_MASK_VISIBLE_CHARS;
+var MAX_REQUEST_ENTRIES, DEFAULT_MAX_BODY_CAPTURE, DEFAULT_API_LIMIT, MAX_TELEMETRY_ENTRIES, MAX_TAB_NAME_LENGTH, MAX_INGEST_BYTES, TERMINAL_TRUNCATE_LENGTH, SENSITIVE_MASK_MIN_LENGTH, SENSITIVE_MASK_VISIBLE_CHARS, MAX_JSON_BODY_BYTES, ANALYSIS_DEBOUNCE_MS, FINDING_ID_HASH_LENGTH, FINDINGS_DATA_VERSION, SENSITIVE_MASK_PLACEHOLDER;
 var init_limits = __esm({
   "src/constants/limits.ts"() {
     "use strict";
@@ -54,10 +56,15 @@ var init_limits = __esm({
     DEFAULT_API_LIMIT = 500;
     MAX_TELEMETRY_ENTRIES = 1e3;
     MAX_TAB_NAME_LENGTH = 32;
-    MAX_INGEST_BYTES = 10 * 1024 * 1024;
+    MAX_INGEST_BYTES = 10485760;
     TERMINAL_TRUNCATE_LENGTH = 80;
     SENSITIVE_MASK_MIN_LENGTH = 8;
     SENSITIVE_MASK_VISIBLE_CHARS = 4;
+    MAX_JSON_BODY_BYTES = 65536;
+    ANALYSIS_DEBOUNCE_MS = 300;
+    FINDING_ID_HASH_LENGTH = 16;
+    FINDINGS_DATA_VERSION = 1;
+    SENSITIVE_MASK_PLACEHOLDER = "****";
   }
 });
 
@@ -104,31 +111,23 @@ var init_transport = __esm({
   "src/constants/transport.ts"() {
     "use strict";
     SSE_HEARTBEAT_INTERVAL_MS = 3e4;
-    NOISE_HOSTS = [
-      "registry.npmjs.org",
-      "telemetry.nextjs.org",
-      "vitejs.dev"
-    ];
-    NOISE_PATH_PATTERNS = [
-      ".hot-update.",
-      "__webpack",
-      "__vite"
-    ];
+    NOISE_HOSTS = ["registry.npmjs.org", "telemetry.nextjs.org", "vitejs.dev"];
+    NOISE_PATH_PATTERNS = [".hot-update.", "__webpack", "__vite"];
   }
 });
 
 // src/constants/metrics.ts
-var METRICS_DIR, METRICS_FILE, METRICS_FLUSH_INTERVAL_MS, METRICS_MAX_SESSIONS, METRICS_MAX_DATA_POINTS, PORT_FILE, FINDINGS_FILE, FINDINGS_FLUSH_INTERVAL_MS;
+var METRICS_DIR, METRICS_FILE, PORT_FILE, FINDINGS_FILE, METRICS_FLUSH_INTERVAL_MS, METRICS_MAX_SESSIONS, METRICS_MAX_DATA_POINTS, FINDINGS_FLUSH_INTERVAL_MS;
 var init_metrics = __esm({
   "src/constants/metrics.ts"() {
     "use strict";
     METRICS_DIR = ".brakit";
     METRICS_FILE = ".brakit/metrics.json";
+    PORT_FILE = ".brakit/port";
+    FINDINGS_FILE = ".brakit/findings.json";
     METRICS_FLUSH_INTERVAL_MS = 3e4;
     METRICS_MAX_SESSIONS = 50;
     METRICS_MAX_DATA_POINTS = 200;
-    PORT_FILE = ".brakit/port";
-    FINDINGS_FILE = ".brakit/findings.json";
     FINDINGS_FLUSH_INTERVAL_MS = 1e4;
   }
 });
@@ -150,38 +149,36 @@ var init_headers = __esm({
 });
 
 // src/constants/network.ts
-var LOCALHOST_IPS, LOCALHOST_HOSTNAMES, CLOUD_SIGNALS, MAX_HEALTH_ERRORS;
+var CLOUD_SIGNALS, MAX_HEALTH_ERRORS, RECOVERY_WINDOW_MS, LOCALHOST_IPS, LOCALHOST_HOSTNAMES, URL_PARSE_BASE;
 var init_network = __esm({
   "src/constants/network.ts"() {
     "use strict";
-    LOCALHOST_IPS = /* @__PURE__ */ new Set([
-      "127.0.0.1",
-      "::1",
-      "::ffff:127.0.0.1"
-    ]);
-    LOCALHOST_HOSTNAMES = /* @__PURE__ */ new Set([
-      "localhost",
-      "127.0.0.1",
-      "::1"
-    ]);
     CLOUD_SIGNALS = [
       "VERCEL",
       "VERCEL_ENV",
       "NETLIFY",
       "AWS_LAMBDA_FUNCTION_NAME",
       "AWS_EXECUTION_ENV",
+      "ECS_CONTAINER_METADATA_URI",
       "GOOGLE_CLOUD_PROJECT",
       "GCP_PROJECT",
+      "K_SERVICE",
       "AZURE_FUNCTIONS_ENVIRONMENT",
+      "WEBSITE_SITE_NAME",
       "FLY_APP_NAME",
       "RAILWAY_ENVIRONMENT",
       "RENDER",
-      "HEROKU",
+      "HEROKU_APP_NAME",
+      "DYNO",
+      "CF_INSTANCE_GUID",
       "CF_PAGES",
-      "KUBERNETES_SERVICE_HOST",
-      "ECS_CONTAINER_METADATA_URI"
+      "KUBERNETES_SERVICE_HOST"
     ];
     MAX_HEALTH_ERRORS = 10;
+    RECOVERY_WINDOW_MS = 5 * 60 * 1e3;
+    LOCALHOST_IPS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+    LOCALHOST_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+    URL_PARSE_BASE = "http://localhost";
   }
 });
 
@@ -204,7 +201,7 @@ var init_encoding = __esm({
 });
 
 // src/constants/severity.ts
-var SEVERITY_ICON, SEVERITY_CRITICAL, SEVERITY_WARNING, SEVERITY_INFO, SEVERITY_ICON_MAP;
+var SEVERITY_ICON;
 var init_severity = __esm({
   "src/constants/severity.ts"() {
     "use strict";
@@ -213,28 +210,27 @@ var init_severity = __esm({
       warning: "\u26A0",
       info: "\u2139"
     };
-    SEVERITY_CRITICAL = "critical";
-    SEVERITY_WARNING = "warning";
-    SEVERITY_INFO = "info";
-    SEVERITY_ICON_MAP = {
-      [SEVERITY_CRITICAL]: { icon: "\u2717", cls: "critical" },
-      [SEVERITY_WARNING]: { icon: "\u26A0", cls: "warning" },
-      [SEVERITY_INFO]: { icon: "\u2139", cls: "info" }
-    };
   }
 });
 
 // src/constants/telemetry.ts
-var POSTHOG_HOST, POSTHOG_CAPTURE_PATH, POSTHOG_REQUEST_TIMEOUT_MS, POSTHOG_SPAWN_TIMEOUT_MS, SIGNAL_EXIT_SIGINT, SIGNAL_EXIT_SIGTERM;
+var POSTHOG_HOST, POSTHOG_CAPTURE_PATH, POSTHOG_REQUEST_TIMEOUT_MS;
 var init_telemetry = __esm({
   "src/constants/telemetry.ts"() {
     "use strict";
     POSTHOG_HOST = "https://us.i.posthog.com";
     POSTHOG_CAPTURE_PATH = "/i/v0/e/";
     POSTHOG_REQUEST_TIMEOUT_MS = 3e3;
-    POSTHOG_SPAWN_TIMEOUT_MS = 5e3;
-    SIGNAL_EXIT_SIGINT = 130;
-    SIGNAL_EXIT_SIGTERM = 143;
+  }
+});
+
+// src/constants/lifecycle.ts
+var VALID_FINDING_STATES, VALID_AI_FIX_STATUSES;
+var init_lifecycle = __esm({
+  "src/constants/lifecycle.ts"() {
+    "use strict";
+    VALID_FINDING_STATES = /* @__PURE__ */ new Set(["open", "fixing", "resolved"]);
+    VALID_AI_FIX_STATUSES = /* @__PURE__ */ new Set(["fixed", "wont_fix"]);
   }
 });
 
@@ -253,6 +249,7 @@ var init_constants = __esm({
     init_encoding();
     init_severity();
     init_telemetry();
+    init_lifecycle();
   }
 });
 
@@ -419,11 +416,12 @@ function createCaptureError(emit) {
 }
 function setupErrorHook(emit) {
   const captureError = createCaptureError(emit);
-  process.on("uncaughtException", (err) => {
+  const brakitExceptionHandler = (err) => {
     captureError(err);
-    process.removeAllListeners("uncaughtException");
+    process.removeListener("uncaughtException", brakitExceptionHandler);
     throw err;
-  });
+  };
+  process.on("uncaughtException", brakitExceptionHandler);
   process.on("unhandledRejection", (reason) => {
     captureError(reason);
   });
@@ -610,7 +608,10 @@ var init_pg = __esm({
           const result = saved.apply(this, args);
           if (result && typeof result.then === "function") {
             return result.then((res) => {
-              emitQuery(res?.rowCount ?? void 0);
+              try {
+                emitQuery(res?.rowCount ?? void 0);
+              } catch {
+              }
               return res;
             });
           }
@@ -688,7 +689,10 @@ var init_mysql2 = __esm({
             const result = orig.apply(this, args);
             if (result && typeof result.then === "function") {
               return result.then((res) => {
-                emitQuery();
+                try {
+                  emitQuery();
+                } catch {
+                }
                 return res;
               });
             }
@@ -803,6 +807,27 @@ var init_adapters = __esm({
   }
 });
 
+// src/constants/http.ts
+var HTTP_OK, HTTP_NO_CONTENT, HTTP_BAD_REQUEST, HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_PAYLOAD_TOO_LARGE, HTTP_INTERNAL_ERROR, SECURITY_HEADERS;
+var init_http = __esm({
+  "src/constants/http.ts"() {
+    "use strict";
+    HTTP_OK = 200;
+    HTTP_NO_CONTENT = 204;
+    HTTP_BAD_REQUEST = 400;
+    HTTP_NOT_FOUND = 404;
+    HTTP_METHOD_NOT_ALLOWED = 405;
+    HTTP_PAYLOAD_TOO_LARGE = 413;
+    HTTP_INTERNAL_ERROR = 500;
+    SECURITY_HEADERS = {
+      "x-content-type-options": "nosniff",
+      "x-frame-options": "DENY",
+      "referrer-policy": "no-referrer",
+      "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; img-src data:"
+    };
+  }
+});
+
 // src/analysis/categorize.ts
 function detectCategory(req) {
   const { method, url, statusCode, responseHeaders } = req;
@@ -1184,12 +1209,12 @@ var init_group = __esm({
 });
 
 // src/dashboard/api/shared.ts
-function maskSensitiveHeaders(headers) {
+function maskSensitiveHeaders(headers2) {
   const masked = {};
-  for (const [key, value] of Object.entries(headers)) {
+  for (const [key, value] of Object.entries(headers2)) {
     if (SENSITIVE_HEADER_NAMES.has(key.toLowerCase())) {
       const s = String(value);
-      masked[key] = s.length <= SENSITIVE_MASK_MIN_LENGTH ? "****" : s.slice(0, SENSITIVE_MASK_VISIBLE_CHARS) + "..." + s.slice(-SENSITIVE_MASK_VISIBLE_CHARS);
+      masked[key] = s.length <= SENSITIVE_MASK_MIN_LENGTH ? SENSITIVE_MASK_PLACEHOLDER : s.slice(0, SENSITIVE_MASK_VISIBLE_CHARS) + "..." + s.slice(-SENSITIVE_MASK_VISIBLE_CHARS);
     } else {
       masked[key] = value;
     }
@@ -1209,14 +1234,14 @@ function getCorsOrigin(req) {
 }
 function getJsonHeaders(req) {
   const corsOrigin = getCorsOrigin(req);
-  const headers = {
+  const headers2 = {
     "content-type": "application/json",
     "cache-control": "no-cache"
   };
   if (corsOrigin) {
-    headers["access-control-allow-origin"] = corsOrigin;
+    headers2["access-control-allow-origin"] = corsOrigin;
   }
-  return headers;
+  return headers2;
 }
 function sendJson(req, res, status, data) {
   res.writeHead(status, getJsonHeaders(req));
@@ -1224,23 +1249,58 @@ function sendJson(req, res, status, data) {
 }
 function requireGet(req, res) {
   if (req.method !== "GET") {
-    sendJson(req, res, 405, { error: "Method not allowed" });
+    sendJson(req, res, HTTP_METHOD_NOT_ALLOWED, { error: "Method not allowed" });
     return false;
   }
   return true;
 }
+function parseRequestUrl(req) {
+  return new URL(req.url ?? "/", URL_PARSE_BASE);
+}
+function readJsonBody(req, res, maxBytes = MAX_JSON_BODY_BYTES) {
+  return new Promise((resolve5) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > maxBytes) {
+        sendJson(req, res, HTTP_PAYLOAD_TOO_LARGE, { error: "Payload too large" });
+        req.destroy();
+        resolve5(null);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (size > maxBytes) {
+        resolve5(null);
+        return;
+      }
+      try {
+        resolve5(JSON.parse(Buffer.concat(chunks).toString()));
+      } catch {
+        sendJson(req, res, HTTP_BAD_REQUEST, { error: "Invalid JSON body" });
+        resolve5(null);
+      }
+    });
+    req.on("error", () => {
+      resolve5(null);
+    });
+  });
+}
 function handleTelemetryGet(req, res, store) {
   if (!requireGet(req, res)) return;
-  const url = new URL(req.url ?? "/", "http://localhost");
+  const url = parseRequestUrl(req);
   const requestId = url.searchParams.get("requestId");
   const entries = requestId ? store.getByRequest(requestId) : [...store.getAll()];
-  sendJson(req, res, 200, { total: entries.length, entries: entries.reverse() });
+  sendJson(req, res, HTTP_OK, { total: entries.length, entries: entries.reverse() });
 }
 var init_shared2 = __esm({
   "src/dashboard/api/shared.ts"() {
     "use strict";
     init_constants();
     init_limits();
+    init_http();
   }
 });
 
@@ -1255,7 +1315,7 @@ function sanitizeRequest(r) {
 function createRequestsHandler(registry) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    const url = new URL(req.url ?? "/", "http://localhost");
+    const url = parseRequestUrl(req);
     const method = url.searchParams.get("method");
     const status = url.searchParams.get("status");
     const search = url.searchParams.get("search");
@@ -1288,7 +1348,7 @@ function createRequestsHandler(registry) {
     const total = results.length;
     results = results.slice(offset, offset + limit);
     const sanitized = results.map(sanitizeRequest);
-    sendJson(req, res, 200, { total, requests: sanitized });
+    sendJson(req, res, HTTP_OK, { total, requests: sanitized });
   };
 }
 function createFlowsHandler(registry) {
@@ -1298,13 +1358,13 @@ function createFlowsHandler(registry) {
       ...flow,
       requests: flow.requests.map(sanitizeRequest)
     }));
-    sendJson(req, res, 200, { total: flows.length, flows });
+    sendJson(req, res, HTTP_OK, { total: flows.length, flows });
   };
 }
 function createClearHandler(registry) {
   return (req, res) => {
     if (req.method !== "POST") {
-      sendJson(req, res, 405, { error: "Method not allowed" });
+      sendJson(req, res, HTTP_METHOD_NOT_ALLOWED, { error: "Method not allowed" });
       return;
     }
     registry.get("request-store").clear();
@@ -1315,7 +1375,7 @@ function createClearHandler(registry) {
     registry.get("metrics-store").reset();
     if (registry.has("finding-store")) registry.get("finding-store").clear();
     registry.get("event-bus").emit("store:cleared", void 0);
-    sendJson(req, res, 200, { cleared: true });
+    sendJson(req, res, HTTP_OK, { cleared: true });
   };
 }
 function createFetchesHandler(registry) {
@@ -1335,10 +1395,158 @@ var init_handlers = __esm({
     "use strict";
     init_group();
     init_constants();
+    init_http();
     init_shared2();
   }
 });
 
+// src/utils/type-guards.ts
+function isString(val) {
+  return typeof val === "string";
+}
+function isNumber(val) {
+  return typeof val === "number" && !isNaN(val);
+}
+function isBoolean(val) {
+  return typeof val === "boolean";
+}
+function getErrorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+function isValidFindingState(val) {
+  return typeof val === "string" && VALID_FINDING_STATES.has(val);
+}
+function isValidAiFixStatus(val) {
+  return typeof val === "string" && VALID_AI_FIX_STATUSES.has(val);
+}
+var init_type_guards = __esm({
+  "src/utils/type-guards.ts"() {
+    "use strict";
+    init_lifecycle();
+  }
+});
+
+// src/dashboard/api/sdk-event-parser.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function str(val, fallback) {
+  return isString(val) ? val : fallback;
+}
+function strOrUndef(val) {
+  return isString(val) ? val : void 0;
+}
+function num(val, fallback) {
+  return isNumber(val) ? val : fallback;
+}
+function numOrUndef(val) {
+  return isNumber(val) ? val : void 0;
+}
+function headers(val) {
+  if (val && typeof val === "object" && !Array.isArray(val)) {
+    return val;
+  }
+  return {};
+}
+function parseQueryEvent(data, ts, parentRequestId) {
+  return {
+    driver: str(data.source, "sdk"),
+    source: strOrUndef(data.source),
+    sql: strOrUndef(data.sql),
+    model: strOrUndef(data.model),
+    operation: strOrUndef(data.operation),
+    normalizedOp: strOrUndef(data.normalizedOp) ?? strOrUndef(data.operation) ?? "OTHER",
+    table: str(data.table, ""),
+    durationMs: num(data.duration, num(data.durationMs, 0)),
+    rowCount: numOrUndef(data.rowCount),
+    parentRequestId,
+    timestamp: ts
+  };
+}
+function parseFetchEvent(data, ts, parentRequestId) {
+  return {
+    url: str(data.url, ""),
+    method: str(data.method, "GET"),
+    statusCode: num(data.statusCode, 0),
+    durationMs: num(data.duration, num(data.durationMs, 0)),
+    parentRequestId,
+    timestamp: ts
+  };
+}
+function parseLogEvent(data, ts, parentRequestId) {
+  return {
+    level: str(data.level, "log"),
+    message: str(data.message, ""),
+    parentRequestId,
+    timestamp: ts
+  };
+}
+function parseErrorEvent(data, ts, parentRequestId) {
+  return {
+    name: str(data.name, "Error"),
+    message: str(data.message, ""),
+    stack: str(data.stack, ""),
+    parentRequestId,
+    timestamp: ts
+  };
+}
+function parseAuthEvent(data, ts, parentRequestId) {
+  return {
+    level: "info",
+    message: `[auth] ${str(data.provider, "unknown")}: ${str(data.result, "check")}`,
+    parentRequestId,
+    timestamp: ts
+  };
+}
+function parseRequestEvent(data, ts) {
+  const url = str(data.url, "");
+  return {
+    id: str(data.id, randomUUID3()),
+    method: str(data.method, "GET"),
+    url,
+    path: url.split("?")[0],
+    headers: headers(data.headers),
+    requestBody: isString(data.requestBody) ? data.requestBody : null,
+    statusCode: num(data.statusCode, 200),
+    responseHeaders: headers(data.responseHeaders),
+    responseBody: isString(data.responseBody) ? data.responseBody : null,
+    startedAt: ts,
+    durationMs: num(data.durationMs, 0),
+    responseSize: num(data.responseSize, 0),
+    isStatic: isBoolean(data.isStatic) ? data.isStatic : false
+  };
+}
+function routeSDKEvent(event, stores) {
+  const ts = event.timestamp || Date.now();
+  const parentRequestId = event.requestId ?? null;
+  switch (event.type) {
+    case "db.query":
+      stores.addQuery(parseQueryEvent(event.data, ts, parentRequestId));
+      break;
+    case "fetch":
+      stores.addFetch(parseFetchEvent(event.data, ts, parentRequestId));
+      break;
+    case "log":
+      stores.addLog(parseLogEvent(event.data, ts, parentRequestId));
+      break;
+    case "error":
+      stores.addError(parseErrorEvent(event.data, ts, parentRequestId));
+      break;
+    case "auth.check":
+      stores.addLog(parseAuthEvent(event.data, ts, parentRequestId));
+      break;
+    case "request":
+      stores.addRequest(parseRequestEvent(event.data, ts));
+      break;
+  }
+}
+var init_sdk_event_parser = __esm({
+  "src/dashboard/api/sdk-event-parser.ts"() {
+    "use strict";
+    init_type_guards();
+  }
+});
+
 // src/dashboard/api/ingest.ts
 function isBrakitBatch(msg) {
   return typeof msg === "object" && msg !== null && "_brakit" in msg && msg._brakit === true && !("version" in msg);
@@ -1363,65 +1571,21 @@ function createIngestHandler(registry) {
         break;
     }
   };
-  const routeSDKEvent = (event) => {
-    const ts = event.timestamp || Date.now();
-    const parentRequestId = event.requestId ?? null;
-    switch (event.type) {
-      case "db.query":
-        registry.get("query-store").add({
-          driver: event.data.source ?? "sdk",
-          source: event.data.source ?? "sdk",
-          sql: event.data.sql,
-          model: event.data.model,
-          operation: event.data.operation,
-          normalizedOp: event.data.normalizedOp ?? event.data.operation ?? "OTHER",
-          table: event.data.table ?? "",
-          durationMs: event.data.duration ?? event.data.durationMs ?? 0,
-          rowCount: event.data.rowCount,
-          parentRequestId,
-          timestamp: ts
-        });
-        break;
-      case "fetch":
-        registry.get("fetch-store").add({
-          url: event.data.url ?? "",
-          method: event.data.method ?? "GET",
-          statusCode: event.data.statusCode ?? 0,
-          durationMs: event.data.duration ?? event.data.durationMs ?? 0,
-          parentRequestId,
-          timestamp: ts
-        });
-        break;
-      case "log":
-        registry.get("log-store").add({
-          level: event.data.level ?? "log",
-          message: event.data.message ?? "",
-          parentRequestId,
-          timestamp: ts
-        });
-        break;
-      case "error":
-        registry.get("error-store").add({
-          name: event.data.name ?? "Error",
-          message: event.data.message ?? "",
-          stack: event.data.stack ?? "",
-          parentRequestId,
-          timestamp: ts
-        });
-        break;
-      case "auth.check":
-        registry.get("log-store").add({
-          level: "info",
-          message: `[auth] ${event.data.provider ?? "unknown"}: ${event.data.result ?? "check"}`,
-          parentRequestId,
-          timestamp: ts
-        });
-        break;
-    }
+  const queryStore = registry.get("query-store");
+  const fetchStore = registry.get("fetch-store");
+  const logStore = registry.get("log-store");
+  const errorStore = registry.get("error-store");
+  const requestStore = registry.get("request-store");
+  const stores = {
+    addQuery: (data) => queryStore.add(data),
+    addFetch: (data) => fetchStore.add(data),
+    addLog: (data) => logStore.add(data),
+    addError: (data) => errorStore.add(data),
+    addRequest: (data) => requestStore.add(data)
   };
   return (req, res) => {
     if (req.method !== "POST") {
-      sendJson(req, res, 405, { error: "Method not allowed" });
+      sendJson(req, res, HTTP_METHOD_NOT_ALLOWED, { error: "Method not allowed" });
       return;
     }
     const chunks = [];
@@ -1429,7 +1593,7 @@ function createIngestHandler(registry) {
     req.on("data", (chunk) => {
       totalSize += chunk.length;
       if (totalSize > MAX_INGEST_BYTES) {
-        sendJson(req, res, 413, { error: "Payload too large" });
+        sendJson(req, res, HTTP_PAYLOAD_TOO_LARGE, { error: "Payload too large" });
         req.destroy();
         return;
       }
@@ -1441,9 +1605,9 @@ function createIngestHandler(registry) {
         const body = JSON.parse(Buffer.concat(chunks).toString());
         if (isSDKPayload(body)) {
           for (const event of body.events) {
-            routeSDKEvent(event);
+            routeSDKEvent(event, stores);
           }
-          res.writeHead(204);
+          res.writeHead(HTTP_NO_CONTENT);
           res.end();
           return;
         }
@@ -1451,13 +1615,19 @@ function createIngestHandler(registry) {
           for (const event of body.events) {
             routeEvent(event);
           }
-          res.writeHead(204);
+          res.writeHead(HTTP_NO_CONTENT);
           res.end();
           return;
         }
-        sendJson(req, res, 400, { error: "Invalid batch" });
+        sendJson(req, res, HTTP_BAD_REQUEST, { error: "Invalid batch" });
       } catch {
-        sendJson(req, res, 400, { error: "Invalid JSON" });
+        sendJson(req, res, HTTP_BAD_REQUEST, { error: "Invalid JSON" });
+      }
+    });
+    req.on("error", () => {
+      if (!res.headersSent) {
+        res.writeHead(HTTP_BAD_REQUEST);
+        res.end();
       }
     });
   };
@@ -1466,7 +1636,9 @@ var init_ingest = __esm({
   "src/dashboard/api/ingest.ts"() {
     "use strict";
     init_limits();
+    init_http();
     init_shared2();
+    init_sdk_event_parser();
   }
 });
 
@@ -1474,20 +1646,21 @@ var init_ingest = __esm({
 function createMetricsHandler(metricsStore) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    const url = new URL(req.url ?? "/", "http://localhost");
+    const url = parseRequestUrl(req);
     const endpoint = url.searchParams.get("endpoint");
     if (endpoint) {
       const ep = metricsStore.getEndpoint(endpoint);
-      sendJson(req, res, 200, { endpoints: ep ? [ep] : [] });
+      sendJson(req, res, HTTP_OK, { endpoints: ep ? [ep] : [] });
       return;
     }
-    sendJson(req, res, 200, { endpoints: metricsStore.getAll() });
+    sendJson(req, res, HTTP_OK, { endpoints: metricsStore.getAll() });
   };
 }
 var init_metrics2 = __esm({
   "src/dashboard/api/metrics.ts"() {
     "use strict";
     init_shared2();
+    init_http();
   }
 });
 
@@ -1505,15 +1678,34 @@ var init_metrics_live = __esm({
   }
 });
 
+// src/utils/log.ts
+function brakitWarn(message) {
+  process.stderr.write(`${PREFIX} ${message}
+`);
+}
+function brakitDebug(message) {
+  if (process.env.DEBUG_BRAKIT) {
+    process.stderr.write(`${PREFIX}:debug ${message}
+`);
+  }
+}
+var PREFIX;
+var init_log = __esm({
+  "src/utils/log.ts"() {
+    "use strict";
+    PREFIX = "[brakit]";
+  }
+});
+
 // src/dashboard/api/activity.ts
 function createActivityHandler(registry) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
     try {
-      const url = new URL(req.url ?? "/", "http://localhost");
+      const url = parseRequestUrl(req);
       const requestId = url.searchParams.get("requestId");
       if (!requestId) {
-        sendJson(req, res, 400, { error: "requestId parameter required" });
+        sendJson(req, res, HTTP_BAD_REQUEST, { error: "requestId parameter required" });
         return;
       }
       const fetches = registry.get("fetch-store").getByRequest(requestId);
@@ -1530,7 +1722,7 @@ function createActivityHandler(registry) {
       for (const q of queries)
         timeline.push({ type: "query", timestamp: q.timestamp, data: { ...q } });
       timeline.sort((a, b) => a.timestamp - b.timestamp);
-      sendJson(req, res, 200, {
+      sendJson(req, res, HTTP_OK, {
         requestId,
         total: timeline.length,
         timeline,
@@ -1542,9 +1734,9 @@ function createActivityHandler(registry) {
         }
       });
     } catch (err) {
-      console.error("[brakit] activity handler error:", err);
+      brakitDebug(`activity handler error: ${err}`);
       if (!res.headersSent) {
-        sendJson(req, res, 500, { error: "Internal error" });
+        sendJson(req, res, HTTP_INTERNAL_ERROR, { error: "Internal error" });
       }
     }
   };
@@ -1553,6 +1745,8 @@ var init_activity = __esm({
   "src/dashboard/api/activity.ts"() {
     "use strict";
     init_shared2();
+    init_http();
+    init_log();
   }
 });
 
@@ -1572,19 +1766,20 @@ var init_api = __esm({
 function createInsightsHandler(engine) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    sendJson(req, res, 200, { insights: engine.getStatefulInsights() });
+    sendJson(req, res, HTTP_OK, { insights: engine.getStatefulInsights() });
   };
 }
 function createSecurityHandler(engine) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    sendJson(req, res, 200, { findings: engine.getStatefulFindings() });
+    sendJson(req, res, HTTP_OK, { findings: engine.getStatefulFindings() });
   };
 }
 var init_insights = __esm({
   "src/dashboard/api/insights.ts"() {
     "use strict";
     init_shared2();
+    init_http();
   }
 });
 
@@ -1592,99 +1787,160 @@ var init_insights = __esm({
 function createFindingsHandler(findingStore) {
   return (req, res) => {
     if (!requireGet(req, res)) return;
-    const url = new URL(req.url ?? "/", "http://localhost");
+    const url = parseRequestUrl(req);
     const stateParam = url.searchParams.get("state");
     let findings;
-    if (stateParam && VALID_STATES.has(stateParam)) {
+    if (stateParam && isValidFindingState(stateParam)) {
       findings = findingStore.getByState(stateParam);
     } else {
       findings = findingStore.getAll();
     }
-    sendJson(req, res, 200, {
+    sendJson(req, res, HTTP_OK, {
       total: findings.length,
       findings
     });
   };
 }
-var VALID_STATES;
+function createFindingsReportHandler(findingStore, eventBus, analysisEngine) {
+  return async (req, res) => {
+    if (req.method !== "POST") {
+      sendJson(req, res, HTTP_METHOD_NOT_ALLOWED, { error: "Method not allowed" });
+      return;
+    }
+    const body = await readJsonBody(req, res);
+    if (!body) return;
+    const { findingId, status, notes } = body;
+    if (!findingId || typeof findingId !== "string") {
+      sendJson(req, res, HTTP_BAD_REQUEST, { error: "findingId is required" });
+      return;
+    }
+    if (!isValidAiFixStatus(status)) {
+      sendJson(req, res, HTTP_BAD_REQUEST, { error: "status must be 'fixed' or 'wont_fix'" });
+      return;
+    }
+    if (!notes || typeof notes !== "string") {
+      sendJson(req, res, HTTP_BAD_REQUEST, { error: "notes is required" });
+      return;
+    }
+    const findingOk = findingStore.reportFix(findingId, status, notes);
+    if (findingOk) {
+      eventBus.emit("findings:changed", findingStore.getAll());
+      sendJson(req, res, HTTP_OK, { ok: true });
+      return;
+    }
+    if (analysisEngine?.reportInsightFix(findingId, status, notes)) {
+      eventBus.emit("analysis:updated", {
+        insights: analysisEngine.getInsights(),
+        findings: analysisEngine.getFindings(),
+        statefulFindings: analysisEngine.getStatefulFindings(),
+        statefulInsights: analysisEngine.getStatefulInsights()
+      });
+      sendJson(req, res, HTTP_OK, { ok: true });
+      return;
+    }
+    sendJson(req, res, HTTP_NOT_FOUND, { error: "Finding not found" });
+  };
+}
 var init_findings = __esm({
   "src/dashboard/api/findings.ts"() {
     "use strict";
     init_shared2();
-    VALID_STATES = /* @__PURE__ */ new Set(["open", "fixing", "resolved"]);
+    init_type_guards();
+    init_http();
   }
 });
 
-// src/core/disposable.ts
-var SubscriptionBag;
-var init_disposable = __esm({
-  "src/core/disposable.ts"() {
+// src/constants/events.ts
+var SSE_EVENT_FETCH, SSE_EVENT_LOG, SSE_EVENT_ERROR, SSE_EVENT_QUERY, SSE_EVENT_INSIGHTS, SSE_EVENT_SECURITY;
+var init_events = __esm({
+  "src/constants/events.ts"() {
     "use strict";
-    SubscriptionBag = class {
-      items = [];
-      add(teardown) {
-        this.items.push(typeof teardown === "function" ? { dispose: teardown } : teardown);
-      }
-      dispose() {
-        for (const d of this.items) d.dispose();
-        this.items.length = 0;
-      }
-    };
+    SSE_EVENT_FETCH = "fetch";
+    SSE_EVENT_LOG = "log";
+    SSE_EVENT_ERROR = "error_event";
+    SSE_EVENT_QUERY = "query";
+    SSE_EVENT_INSIGHTS = "insights";
+    SSE_EVENT_SECURITY = "security";
   }
 });
 
 // src/dashboard/sse.ts
 function createSSEHandler(registry) {
-  return (req, res) => {
-    res.writeHead(200, {
-      "content-type": "text/event-stream",
-      "cache-control": "no-cache",
-      connection: "keep-alive",
-      "access-control-allow-origin": "*"
-    });
-    res.write(":ok\n\n");
-    const writeEvent = (eventType, data) => {
-      if (res.destroyed) return;
-      if (eventType) {
-        res.write(`event: ${eventType}
+  const clients = /* @__PURE__ */ new Set();
+  function broadcast(eventType, data) {
+    if (clients.size === 0) return;
+    const frame = eventType ? `event: ${eventType}
 data: ${data}
 
-`);
-      } else {
-        res.write(`data: ${data}
+` : `data: ${data}
 
-`);
+`;
+    for (const client of clients) {
+      if (client.res.destroyed) {
+        clients.delete(client);
+        continue;
       }
+      try {
+        client.res.write(frame);
+      } catch {
+        clients.delete(client);
+      }
+    }
+  }
+  const bus = registry.get("event-bus");
+  bus.on("request:completed", (r) => broadcast(null, JSON.stringify(r)));
+  bus.on("telemetry:fetch", (e) => broadcast(SSE_EVENT_FETCH, JSON.stringify(e)));
+  bus.on("telemetry:log", (e) => broadcast(SSE_EVENT_LOG, JSON.stringify(e)));
+  bus.on("telemetry:error", (e) => broadcast(SSE_EVENT_ERROR, JSON.stringify(e)));
+  bus.on("telemetry:query", (e) => broadcast(SSE_EVENT_QUERY, JSON.stringify(e)));
+  bus.on("analysis:updated", ({ statefulInsights, statefulFindings }) => {
+    broadcast(SSE_EVENT_INSIGHTS, JSON.stringify(statefulInsights));
+    broadcast(SSE_EVENT_SECURITY, JSON.stringify(statefulFindings));
+  });
+  bus.on("findings:changed", (findings) => {
+    broadcast(SSE_EVENT_SECURITY, JSON.stringify(findings));
+  });
+  return (req, res) => {
+    const headers2 = {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache",
+      connection: "keep-alive"
     };
-    const bus = registry.get("event-bus");
-    const subs = new SubscriptionBag();
-    subs.add(bus.on("request:completed", (r) => writeEvent(null, JSON.stringify(r))));
-    subs.add(bus.on("telemetry:fetch", (e) => writeEvent("fetch", JSON.stringify(e))));
-    subs.add(bus.on("telemetry:log", (e) => writeEvent("log", JSON.stringify(e))));
-    subs.add(bus.on("telemetry:error", (e) => writeEvent("error_event", JSON.stringify(e))));
-    subs.add(bus.on("telemetry:query", (e) => writeEvent("query", JSON.stringify(e))));
-    subs.add(bus.on("analysis:updated", ({ statefulInsights, statefulFindings }) => {
-      writeEvent("insights", JSON.stringify(statefulInsights));
-      writeEvent("security", JSON.stringify(statefulFindings));
-    }));
+    const corsOrigin = getCorsOrigin(req);
+    if (corsOrigin) {
+      headers2["access-control-allow-origin"] = corsOrigin;
+    }
+    res.writeHead(HTTP_OK, headers2);
+    res.write(":ok\n\n");
     const heartbeat = setInterval(() => {
       if (res.destroyed) {
         clearInterval(heartbeat);
+        clients.delete(client);
         return;
       }
-      res.write(":heartbeat\n\n");
+      try {
+        res.write(":heartbeat\n\n");
+      } catch {
+        clearInterval(heartbeat);
+        clients.delete(client);
+      }
     }, SSE_HEARTBEAT_INTERVAL_MS);
+    heartbeat.unref();
+    const client = { res, heartbeat };
+    clients.add(client);
     req.on("close", () => {
       clearInterval(heartbeat);
-      subs.dispose();
+      clients.delete(client);
     });
   };
 }
 var init_sse = __esm({
   "src/dashboard/sse.ts"() {
     "use strict";
-    init_disposable();
     init_constants();
+    init_http();
+    init_events();
+    init_shared2();
   }
 });
 
@@ -2203,6 +2459,13 @@ function getSecurityStyles() {
 .sec-item-resolved{color:var(--text-muted)}
 .sec-item-resolved .sec-item-desc{text-decoration:line-through;text-decoration-color:var(--text-muted)}
 .sec-resolved-item-icon{color:var(--green);font-size:12px;flex-shrink:0;margin-right:8px}
+
+/* AI status badges */
+.sec-ai-badge{font-size:10px;font-weight:600;padding:2px 8px;border-radius:8px;margin-left:8px;white-space:nowrap}
+.sec-ai-fixing{background:rgba(217,119,6,.1);color:var(--amber)}
+.sec-ai-wontfix{background:rgba(107,114,128,.1);color:var(--text-muted)}
+.sec-ai-verified{background:rgba(22,163,74,.1);color:var(--green)}
+.sec-ai-notes{font-size:11px;color:var(--text-muted);font-style:italic;margin-top:2px;padding-left:0}
 `;
 }
 var init_security = __esm({
@@ -2266,9 +2529,17 @@ var init_styles = __esm({
 });
 
 // src/utils/fs.ts
-import { access } from "fs/promises";
+import { access, readFile, writeFile } from "fs/promises";
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { resolve } from "path";
+async function fileExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function ensureGitignore(dir, entry) {
   try {
     const gitignorePath = resolve(dir, "../.gitignore");
@@ -2282,28 +2553,22 @@ function ensureGitignore(dir, entry) {
   } catch {
   }
 }
-var init_fs = __esm({
-  "src/utils/fs.ts"() {
-    "use strict";
-  }
-});
-
-// src/utils/log.ts
-function brakitWarn(message) {
-  process.stderr.write(`${PREFIX} ${message}
-`);
-}
-function brakitDebug(message) {
-  if (process.env.DEBUG_BRAKIT) {
-    process.stderr.write(`${PREFIX}:debug ${message}
-`);
+async function ensureGitignoreAsync(dir, entry) {
+  try {
+    const gitignorePath = resolve(dir, "../.gitignore");
+    if (await fileExists(gitignorePath)) {
+      const content = await readFile(gitignorePath, "utf-8");
+      if (content.split("\n").some((l) => l.trim() === entry)) return;
+      await writeFile(gitignorePath, content.trimEnd() + "\n" + entry + "\n");
+    } else {
+      await writeFile(gitignorePath, entry + "\n");
+    }
+  } catch {
   }
 }
-var PREFIX;
-var init_log = __esm({
-  "src/utils/log.ts"() {
+var init_fs = __esm({
+  "src/utils/fs.ts"() {
     "use strict";
-    PREFIX = "[brakit]";
   }
 });
 
@@ -2321,6 +2586,7 @@ var init_atomic_writer = __esm({
     "use strict";
     init_fs();
     init_log();
+    init_type_guards();
     AtomicWriter = class {
       constructor(opts) {
         this.opts = opts;
@@ -2335,7 +2601,7 @@ var init_atomic_writer = __esm({
           writeFileSync2(this.tmpPath, content);
           renameSync(this.tmpPath, this.opts.filePath);
         } catch (err) {
-          brakitWarn(`failed to save ${this.opts.label}: ${err.message}`);
+          brakitWarn(`failed to save ${this.opts.label}: ${getErrorMessage(err)}`);
         }
       }
       async writeAsync(content) {
@@ -2349,13 +2615,14 @@ var init_atomic_writer = __esm({
           await writeFile2(this.tmpPath, content);
           await rename(this.tmpPath, this.opts.filePath);
         } catch (err) {
-          brakitWarn(`failed to save ${this.opts.label}: ${err.message}`);
+          brakitWarn(`failed to save ${this.opts.label}: ${getErrorMessage(err)}`);
         } finally {
           this.writing = false;
           if (this.pendingContent !== null) {
             const next = this.pendingContent;
             this.pendingContent = null;
-            this.writeAsync(next);
+            this.writeAsync(next).catch(() => {
+            });
           }
         }
       }
@@ -2368,10 +2635,10 @@ var init_atomic_writer = __esm({
         }
       }
       async ensureDirAsync() {
-        if (!existsSync2(this.opts.dir)) {
+        if (!await fileExists(this.opts.dir)) {
           await mkdir(this.opts.dir, { recursive: true });
           if (this.opts.gitignoreEntry) {
-            ensureGitignore(this.opts.dir, this.opts.gitignoreEntry);
+            await ensureGitignoreAsync(this.opts.dir, this.opts.gitignoreEntry);
           }
         }
       }
@@ -2383,23 +2650,32 @@ var init_atomic_writer = __esm({
 import { createHash } from "crypto";
 function computeFindingId(finding) {
   const key = `${finding.rule}:${finding.endpoint}:${finding.desc}`;
-  return createHash("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash("sha256").update(key).digest("hex").slice(0, FINDING_ID_HASH_LENGTH);
+}
+function computeInsightId(type, endpoint, desc) {
+  const key = `${type}:${endpoint}:${desc}`;
+  return createHash("sha256").update(key).digest("hex").slice(0, FINDING_ID_HASH_LENGTH);
 }
 var init_finding_id = __esm({
   "src/store/finding-id.ts"() {
     "use strict";
+    init_limits();
   }
 });
 
 // src/store/finding-store.ts
+import { readFile as readFile2 } from "fs/promises";
 import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
 import { resolve as resolve2 } from "path";
 var FindingStore;
 var init_finding_store = __esm({
   "src/store/finding-store.ts"() {
     "use strict";
+    init_fs();
     init_constants();
+    init_limits();
     init_atomic_writer();
+    init_log();
     init_finding_id();
     FindingStore = class {
       constructor(rootDir) {
@@ -2412,7 +2688,6 @@ var init_finding_store = __esm({
           gitignoreEntry: METRICS_DIR,
           label: "findings"
         });
-        this.load();
       }
       findings = /* @__PURE__ */ new Map();
       flushTimer = null;
@@ -2420,6 +2695,8 @@ var init_finding_store = __esm({
       writer;
       findingsPath;
       start() {
+        this.loadAsync().catch(() => {
+        });
         this.flushTimer = setInterval(
           () => this.flush(),
           FINDINGS_FLUSH_INTERVAL_MS
@@ -2456,7 +2733,9 @@ var init_finding_store = __esm({
           firstSeenAt: now,
           lastSeenAt: now,
           resolvedAt: null,
-          occurrences: 1
+          occurrences: 1,
+          aiStatus: null,
+          aiNotes: null
         };
         this.findings.set(id, stateful);
         this.dirty = true;
@@ -2472,6 +2751,17 @@ var init_finding_store = __esm({
         this.dirty = true;
         return true;
       }
+      reportFix(findingId, status, notes) {
+        const finding = this.findings.get(findingId);
+        if (!finding) return false;
+        finding.aiStatus = status;
+        finding.aiNotes = notes;
+        if (status === "fixed") {
+          finding.state = "fixing";
+        }
+        this.dirty = true;
+        return true;
+      }
       /**
        * Reconcile passive findings against the current analysis results.
        *
@@ -2484,7 +2774,7 @@ var init_finding_store = __esm({
       reconcilePassive(currentFindings) {
         const currentIds = new Set(currentFindings.map(computeFindingId));
         for (const [id, stateful] of this.findings) {
-          if (stateful.source === "passive" && stateful.state === "open" && !currentIds.has(id)) {
+          if (stateful.source === "passive" && (stateful.state === "open" || stateful.state === "fixing") && !currentIds.has(id)) {
             stateful.state = "resolved";
             stateful.resolvedAt = Date.now();
             this.dirty = true;
@@ -2504,18 +2794,35 @@ var init_finding_store = __esm({
         this.findings.clear();
         this.dirty = true;
       }
-      load() {
+      async loadAsync() {
+        try {
+          if (await fileExists(this.findingsPath)) {
+            const raw = await readFile2(this.findingsPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed?.version === FINDINGS_DATA_VERSION && Array.isArray(parsed.findings)) {
+              for (const f of parsed.findings) {
+                this.findings.set(f.findingId, f);
+              }
+            }
+          }
+        } catch (err) {
+          brakitDebug(`FindingStore: could not load findings file, starting fresh: ${err}`);
+        }
+      }
+      /** Sync load for tests only — not used in production paths. */
+      loadSync() {
         try {
           if (existsSync3(this.findingsPath)) {
             const raw = readFileSync2(this.findingsPath, "utf-8");
             const parsed = JSON.parse(raw);
-            if (parsed?.version === 1 && Array.isArray(parsed.findings)) {
+            if (parsed?.version === FINDINGS_DATA_VERSION && Array.isArray(parsed.findings)) {
               for (const f of parsed.findings) {
                 this.findings.set(f.findingId, f);
               }
             }
           }
-        } catch {
+        } catch (err) {
+          brakitDebug(`FindingStore: could not load findings file, starting fresh: ${err}`);
         }
       }
       flush() {
@@ -2530,7 +2837,7 @@ var init_finding_store = __esm({
       }
       serialize() {
         const data = {
-          version: 1,
+          version: FINDINGS_DATA_VERSION,
           findings: [...this.findings.values()]
         };
         return JSON.stringify(data);
@@ -2540,9 +2847,9 @@ var init_finding_store = __esm({
 });
 
 // src/detect/project.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3, readdir } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
-import { join } from "path";
+import { join, relative } from "path";
 function detectFrameworkFromDeps(allDeps) {
   for (const f of FRAMEWORKS) {
     if (allDeps[f.dep]) return f.name;
@@ -2579,11 +2886,11 @@ var init_patterns = __esm({
     SECRET_KEYS = /^(password|passwd|secret|api_key|apiKey|api_secret|apiSecret|private_key|privateKey|client_secret|clientSecret)$/;
     TOKEN_PARAMS = /^(token|api_key|apiKey|secret|password|access_token|session_id|sessionId)$/;
     SAFE_PARAMS = /^(_rsc|__clerk_handshake|__clerk_db_jwt|callback|code|state|nonce|redirect_uri|utm_|fbclid|gclid)$/;
-    STACK_TRACE_RE = /at\s+.+\(.+:\d+:\d+\)|at\s+Module\._compile|at\s+Object\.<anonymous>|at\s+processTicksAndRejections/;
+    STACK_TRACE_RE = /at\s+.+\(.+:\d+:\d+\)|at\s+Module\._compile|at\s+Object\.<anonymous>|at\s+processTicksAndRejections|Traceback \(most recent call last\)|File ".+", line \d+/;
     DB_CONN_RE = /(postgres|mysql|mongodb|redis):\/\//;
     SQL_FRAGMENT_RE = /\b(SELECT\s+[\w.*]+\s+FROM|INSERT\s+INTO|UPDATE\s+\w+\s+SET|DELETE\s+FROM)\b/i;
-    SECRET_VAL_RE = /(api_key|apiKey|secret|token)\s*[:=]\s*["']?[A-Za-z0-9_\-\.+\/]{8,}/;
-    LOG_SECRET_RE = /(password|secret|token|api_key|apiKey)\s*[:=]\s*["']?[A-Za-z0-9_\-\.+\/]{8,}/i;
+    SECRET_VAL_RE = /(api_key|apiKey|secret|token)\s*[:=]\s*["']?[A-Za-z0-9_\-.+/]{8,}/;
+    LOG_SECRET_RE = /(password|secret|token|api_key|apiKey)\s*[:=]\s*["']?[A-Za-z0-9_\-.+/]{8,}/i;
     MASKED_RE = /^\*+$|\[REDACTED\]|\[FILTERED\]|CHANGE_ME|^x{3,}$/i;
     EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
     INTERNAL_ID_KEYS = /^(id|_id|userId|user_id|createdBy|updatedBy|organizationId|org_id|tenantId|tenant_id)$/;
@@ -2595,9 +2902,9 @@ var init_patterns = __esm({
       "token-in-url": "Pass tokens in the Authorization header, not URL query parameters.",
       "stack-trace-leak": "Use a custom error handler that returns generic messages in production.",
       "error-info-leak": "Sanitize error responses. Return generic messages instead of internal details.",
+      "insecure-cookie": "Set HttpOnly and SameSite flags on all cookies.",
       "sensitive-logs": "Redact PII before logging. Never log passwords or tokens.",
       "cors-credentials": "Cannot use credentials:true with origin:*. Specify explicit origins.",
-      "insecure-cookie": "Set HttpOnly and SameSite flags on all cookies.",
       "response-pii-leak": "API responses should return minimal data. Don't echo back full user records \u2014 select only the fields the client needs."
     };
   }
@@ -3021,48 +3328,47 @@ function hasInternalIds(obj) {
   }
   return false;
 }
-function detectPII(method, reqBody, resBody) {
-  const target = unwrapResponse(resBody);
-  if (WRITE_METHODS.has(method) && reqBody && typeof reqBody === "object") {
-    const reqEmails = findEmails(reqBody);
-    if (reqEmails.length > 0) {
-      const resEmails = findEmails(target);
-      const echoed = reqEmails.filter((e) => resEmails.includes(e));
-      if (echoed.length > 0) {
-        const inspectObj = Array.isArray(target) && target.length > 0 ? target[0] : target;
-        if (hasInternalIds(inspectObj) || topLevelFieldCount(inspectObj) >= FULL_RECORD_MIN_FIELDS) {
-          return { reason: "echo", emailCount: echoed.length };
-        }
-      }
-    }
+function detectEchoPII(method, reqBody, target) {
+  if (!WRITE_METHODS.has(method) || !reqBody || typeof reqBody !== "object") return null;
+  const reqEmails = findEmails(reqBody);
+  if (reqEmails.length === 0) return null;
+  const resEmails = findEmails(target);
+  const echoed = reqEmails.filter((e) => resEmails.includes(e));
+  if (echoed.length === 0) return null;
+  const inspectObj = Array.isArray(target) && target.length > 0 ? target[0] : target;
+  if (hasInternalIds(inspectObj) || topLevelFieldCount(inspectObj) >= FULL_RECORD_MIN_FIELDS) {
+    return { reason: "echo", emailCount: echoed.length };
   }
-  if (target && typeof target === "object" && !Array.isArray(target)) {
-    const fields = topLevelFieldCount(target);
-    if (fields >= FULL_RECORD_MIN_FIELDS && hasInternalIds(target)) {
-      const emails = findEmails(target);
-      if (emails.length > 0) {
-        return { reason: "full-record", emailCount: emails.length };
-      }
+  return null;
+}
+function detectFullRecordPII(target) {
+  if (!target || typeof target !== "object" || Array.isArray(target)) return null;
+  const fields = topLevelFieldCount(target);
+  if (fields < FULL_RECORD_MIN_FIELDS || !hasInternalIds(target)) return null;
+  const emails = findEmails(target);
+  if (emails.length === 0) return null;
+  return { reason: "full-record", emailCount: emails.length };
+}
+function detectListPII(target) {
+  if (!Array.isArray(target) || target.length < LIST_PII_MIN_ITEMS) return null;
+  let itemsWithEmail = 0;
+  for (let i = 0; i < Math.min(target.length, 10); i++) {
+    const item = target[i];
+    if (item && typeof item === "object" && findEmails(item).length > 0) {
+      itemsWithEmail++;
     }
   }
-  if (Array.isArray(target) && target.length >= LIST_PII_MIN_ITEMS) {
-    let itemsWithEmail = 0;
-    for (let i = 0; i < Math.min(target.length, 10); i++) {
-      const item = target[i];
-      if (item && typeof item === "object") {
-        const emails = findEmails(item);
-        if (emails.length > 0) itemsWithEmail++;
-      }
-    }
-    if (itemsWithEmail >= LIST_PII_MIN_ITEMS) {
-      const first = target[0];
-      if (hasInternalIds(first) || topLevelFieldCount(first) >= FULL_RECORD_MIN_FIELDS) {
-        return { reason: "list-pii", emailCount: itemsWithEmail };
-      }
-    }
+  if (itemsWithEmail < LIST_PII_MIN_ITEMS) return null;
+  const first = target[0];
+  if (hasInternalIds(first) || topLevelFieldCount(first) >= FULL_RECORD_MIN_FIELDS) {
+    return { reason: "list-pii", emailCount: itemsWithEmail };
   }
   return null;
 }
+function detectPII(method, reqBody, resBody) {
+  const target = unwrapResponse(resBody);
+  return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target);
+}
 var WRITE_METHODS, FULL_RECORD_MIN_FIELDS, LIST_PII_MIN_ITEMS, REASON_LABELS, responsePiiLeakRule;
 var init_response_pii_leak = __esm({
   "src/analysis/rules/response-pii-leak.ts"() {
@@ -3180,6 +3486,24 @@ var init_rules = __esm({
   }
 });
 
+// src/core/disposable.ts
+var SubscriptionBag;
+var init_disposable = __esm({
+  "src/core/disposable.ts"() {
+    "use strict";
+    SubscriptionBag = class {
+      items = [];
+      add(teardown) {
+        this.items.push(typeof teardown === "function" ? { dispose: teardown } : teardown);
+      }
+      dispose() {
+        for (const d of this.items) d.dispose();
+        this.items.length = 0;
+      }
+    };
+  }
+});
+
 // src/utils/collections.ts
 function groupBy(items, keyFn) {
   const map = /* @__PURE__ */ new Map();
@@ -4021,14 +4345,19 @@ function computeInsightKey(insight) {
   const identifier = extractEndpointFromDesc(insight.desc) ?? insight.title;
   return `${insight.type}:${identifier}`;
 }
+function enrichedIdFromInsight(insight) {
+  return computeInsightId(insight.type, insight.nav ?? "global", insight.desc);
+}
 var InsightTracker;
 var init_insight_tracker = __esm({
   "src/analysis/insight-tracker.ts"() {
     "use strict";
     init_endpoint();
+    init_finding_id();
     init_thresholds();
     InsightTracker = class {
       tracked = /* @__PURE__ */ new Map();
+      enrichedIndex = /* @__PURE__ */ new Map();
       reconcile(current) {
         const currentKeys = /* @__PURE__ */ new Set();
         const now = Date.now();
@@ -4036,6 +4365,7 @@ var init_insight_tracker = __esm({
           const key = computeInsightKey(insight);
           currentKeys.add(key);
           const existing = this.tracked.get(key);
+          this.enrichedIndex.set(enrichedIdFromInsight(insight), key);
           if (existing) {
             existing.insight = insight;
             existing.lastSeenAt = now;
@@ -4052,28 +4382,44 @@ var init_insight_tracker = __esm({
               firstSeenAt: now,
               lastSeenAt: now,
               resolvedAt: null,
-              consecutiveAbsences: 0
+              consecutiveAbsences: 0,
+              aiStatus: null,
+              aiNotes: null
             });
           }
         }
-        for (const [key, stateful] of this.tracked) {
-          if (stateful.state === "open" && !currentKeys.has(stateful.key)) {
+        for (const [, stateful] of this.tracked) {
+          if ((stateful.state === "open" || stateful.state === "fixing") && !currentKeys.has(stateful.key)) {
             stateful.consecutiveAbsences++;
             if (stateful.consecutiveAbsences >= RESOLVE_AFTER_ABSENCES) {
               stateful.state = "resolved";
               stateful.resolvedAt = now;
             }
           } else if (stateful.state === "resolved" && stateful.resolvedAt !== null && now - stateful.resolvedAt > RESOLVED_INSIGHT_TTL_MS) {
-            this.tracked.delete(key);
+            this.tracked.delete(stateful.key);
+            this.enrichedIndex.delete(enrichedIdFromInsight(stateful.insight));
           }
         }
         return [...this.tracked.values()];
       }
+      reportFix(enrichedId, status, notes) {
+        const key = this.enrichedIndex.get(enrichedId);
+        if (!key) return false;
+        const stateful = this.tracked.get(key);
+        if (!stateful) return false;
+        stateful.aiStatus = status;
+        stateful.aiNotes = notes;
+        if (status === "fixed") {
+          stateful.state = "fixing";
+        }
+        return true;
+      }
       getAll() {
         return [...this.tracked.values()];
       }
       clear() {
         this.tracked.clear();
+        this.enrichedIndex.clear();
       }
     };
   }
@@ -4084,13 +4430,14 @@ var AnalysisEngine;
 var init_engine = __esm({
   "src/analysis/engine.ts"() {
     "use strict";
+    init_limits();
     init_disposable();
     init_group();
     init_rules();
     init_insights3();
     init_insight_tracker();
     AnalysisEngine = class {
-      constructor(registry, debounceMs = 300) {
+      constructor(registry, debounceMs = ANALYSIS_DEBOUNCE_MS) {
         this.registry = registry;
         this.debounceMs = debounceMs;
         this.scanner = createDefaultScanner();
@@ -4126,7 +4473,10 @@ var init_engine = __esm({
         return this.registry.has("finding-store") ? this.registry.get("finding-store").getAll() : [];
       }
       getStatefulInsights() {
-        return this.cachedStatefulInsights;
+        return this.insightTracker.getAll();
+      }
+      reportInsightFix(enrichedId, status, notes) {
+        return this.insightTracker.reportFix(enrichedId, status, notes);
       }
       scheduleRecompute() {
         if (this.debounceTimer) return;
@@ -4184,7 +4534,7 @@ var init_src = __esm({
     init_engine();
     init_insights3();
     init_insights2();
-    VERSION = "0.8.4";
+    VERSION = "0.8.5";
   }
 });
 
@@ -4873,7 +5223,7 @@ function getFlowDetail() {
     h += '<span>' + req.durationMs + 'ms</span>';
     if (req.responseSize) h += '<span>' + formatSize(req.responseSize) + '</span>';
     h += '</div>';
-    h += '<div class="request-timeline tl-hidden" data-request-id="' + req.id + '" data-request-started="' + req.startedAt + '"></div>';
+    h += '<div class="request-timeline tl-hidden" data-request-id="' + escHtml(req.id) + '" data-request-started="' + escHtml(String(req.startedAt)) + '"></div>';
     h += '<div class="detail-grid">';
     h += '<div class="detail-section"><h4>Request Headers</h4><pre>' + formatHeaders(req.headers) + '</pre></div>';
     h += '<div class="detail-section"><h4>Response Headers</h4><pre>' + formatHeaders(req.responseHeaders) + '</pre></div>';
@@ -6131,7 +6481,7 @@ function getOverviewRender() {
     container.appendChild(summary);
 
     var all = state.insights || [];
-    var open = all.filter(function(si) { return si.state === 'open'; });
+    var open = all.filter(function(si) { return si.state === 'open' || si.state === 'fixing'; });
     var resolved = all.filter(function(si) { return si.state === 'resolved'; });
 
     if (open.length === 0 && resolved.length === 0) {
@@ -6176,10 +6526,17 @@ function getOverviewRender() {
           if (insight.hint) expandHtml += '<div class="ov-card-hint">' + escHtml(insight.hint) + '</div>';
           expandHtml += '<span class="ov-card-link" data-nav="' + insight.nav + '">View in ' + (NAV_LABELS[insight.nav] || insight.nav) + ' \\u2192</span>';
 
+          var aiBadge = '';
+          if (si.state === 'fixing' && si.aiStatus === 'fixed') {
+            aiBadge = '<span class="sec-ai-badge sec-ai-fixing">AI fixed \\u2014 awaiting verification</span>';
+          } else if (si.aiStatus === 'wont_fix') {
+            aiBadge = '<span class="sec-ai-badge sec-ai-wontfix">AI: won\\u2019t fix</span>';
+          }
+
           card.innerHTML =
             '<span class="ov-card-icon ' + iconCls + '">' + iconChar + '</span>' +
             '<div class="ov-card-body">' +
-              '<div class="ov-card-title">' + escHtml(insight.title) + '</div>' +
+              '<div class="ov-card-title">' + escHtml(insight.title) + aiBadge + '</div>' +
               '<div class="ov-card-desc">' + insight.desc + '</div>' +
               '<div class="ov-card-expand">' + expandHtml + '</div>' +
             '</div>' +
@@ -6271,7 +6628,26 @@ function getSecurityView() {
     container.innerHTML = '';
     var SEV = ${SEVERITY_MAP};
 
-    var all = state.findings || [];
+    var all = (state.findings || []).slice();
+    var insightsList = state.insights || [];
+    for (var ix = 0; ix < insightsList.length; ix++) {
+      var si = insightsList[ix];
+      all.push({
+        findingId: si.key,
+        state: si.state,
+        aiStatus: si.aiStatus,
+        aiNotes: si.aiNotes,
+        finding: {
+          severity: si.insight.severity,
+          rule: 'insight-' + si.insight.type,
+          title: si.insight.title,
+          desc: si.insight.desc,
+          hint: si.insight.hint,
+          endpoint: si.insight.nav || 'global',
+          count: 1
+        }
+      });
+    }
     var open = all.filter(function(f) { return f.state === 'open' || f.state === 'fixing'; });
     var resolved = all.filter(function(f) { return f.state === 'resolved'; });
 
@@ -6319,12 +6695,13 @@ function getSecurityView() {
       var groups = {};
       var groupOrder = [];
       for (var gi = 0; gi < open.length; gi++) {
-        var f = open[gi].finding;
+        var sf = open[gi];
+        var f = sf.finding;
         if (!groups[f.rule]) {
           groups[f.rule] = { rule: f.rule, title: f.title, severity: f.severity, hint: f.hint, items: [] };
           groupOrder.push(f.rule);
         }
-        groups[f.rule].items.push(f);
+        groups[f.rule].items.push(sf);
       }
 
       groupOrder.sort(function(a, b) {
@@ -6361,12 +6738,21 @@ function getSecurityView() {
         var list = document.createElement('div');
         list.className = 'sec-items';
         for (var ii = 0; ii < group.items.length; ii++) {
-          var item = group.items[ii];
+          var sf2 = group.items[ii];
+          var item = sf2.finding;
           var row = document.createElement('div');
           row.className = 'sec-item';
+          var aiBadge = '';
+          if (sf2.state === 'fixing' && sf2.aiStatus === 'fixed') {
+            aiBadge = '<span class="sec-ai-badge sec-ai-fixing">AI fixed \\u2014 awaiting verification</span>';
+          } else if (sf2.aiStatus === 'wont_fix') {
+            aiBadge = '<span class="sec-ai-badge sec-ai-wontfix">AI: won\\u2019t fix</span>';
+          }
+          var aiNotes = sf2.aiNotes ? '<div class="sec-ai-notes">' + escHtml(sf2.aiNotes) + '</div>' : '';
           row.innerHTML =
             '<div class="sec-item-desc">' + escHtml(item.desc) + '</div>' +
-            (item.count > 1 ? '<span class="sec-item-count">' + item.count + 'x</span>' : '');
+            (item.count > 1 ? '<span class="sec-item-count">' + item.count + 'x</span>' : '') +
+            aiBadge + aiNotes;
           list.appendChild(row);
         }
         section.appendChild(list);
@@ -6385,12 +6771,16 @@ function getSecurityView() {
       var resolvedItems = document.createElement('div');
       resolvedItems.className = 'sec-items';
       for (var ri = 0; ri < resolved.length; ri++) {
-        var rf = resolved[ri].finding;
+        var rsf = resolved[ri];
+        var rf = rsf.finding;
         var rRow = document.createElement('div');
         rRow.className = 'sec-item sec-item-resolved';
+        var verifiedBadge = rsf.aiStatus === 'fixed' ? '<span class="sec-ai-badge sec-ai-verified">Verified fix</span>' : '';
+        var rNotes = rsf.aiNotes ? '<div class="sec-ai-notes">' + escHtml(rsf.aiNotes) + '</div>' : '';
         rRow.innerHTML =
           '<span class="sec-resolved-item-icon">\\u2713</span>' +
-          '<div class="sec-item-desc">' + escHtml(rf.title) + ' \\u2014 ' + escHtml(rf.endpoint) + '</div>';
+          '<div class="sec-item-desc">' + escHtml(rf.title) + ' \\u2014 ' + escHtml(rf.endpoint) + '</div>' +
+          verifiedBadge + rNotes;
         resolvedItems.appendChild(rRow);
       }
       resolvedGroup.appendChild(resolvedItems);
@@ -6481,6 +6871,7 @@ function getApp() {
     events.addEventListener('insights', function(e) {
       state.insights = JSON.parse(e.data);
       if (state.activeView === 'overview') renderOverview();
+      if (state.activeView === 'security') renderSecurity();
       updateStats();
     });
 
@@ -6684,7 +7075,7 @@ var init_page = __esm({
 import { homedir } from "os";
 import { join as join2 } from "path";
 import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 function readConfig() {
   try {
     if (!existsSync5(CONFIG_PATH)) return null;
@@ -6708,27 +7099,33 @@ function getOrCreateConfig() {
   if (existing && typeof existing.telemetry === "boolean" && existing.anonymousId) {
     return existing;
   }
-  const config = { telemetry: true, anonymousId: randomUUID3() };
+  const config = { telemetry: true, anonymousId: randomUUID4() };
   writeConfig(config);
   return config;
 }
 function isTelemetryEnabled() {
+  if (cachedEnabled !== null) return cachedEnabled;
   const env = process.env.BRAKIT_TELEMETRY;
-  if (env !== void 0) return env !== "false" && env !== "0" && env !== "off";
-  return readConfig()?.telemetry ?? true;
+  if (env !== void 0) {
+    cachedEnabled = env !== "false" && env !== "0" && env !== "off";
+    return cachedEnabled;
+  }
+  cachedEnabled = readConfig()?.telemetry ?? true;
+  return cachedEnabled;
 }
-var CONFIG_DIR, CONFIG_PATH;
+var CONFIG_DIR, CONFIG_PATH, cachedEnabled;
 var init_config = __esm({
   "src/telemetry/config.ts"() {
     "use strict";
     CONFIG_DIR = join2(homedir(), ".brakit");
     CONFIG_PATH = join2(CONFIG_DIR, "config.json");
+    cachedEnabled = null;
   }
 });
 
 // src/telemetry/index.ts
 import { platform, release, arch } from "os";
-import { spawnSync } from "child_process";
+import { spawn } from "child_process";
 function initSession(framework, packageManager, isCustomCommand, adapters) {
   session.startTime = Date.now();
   session.framework = framework;
@@ -6815,14 +7212,15 @@ function trackSession(registry) {
   try {
     const body = JSON.stringify(payload);
     const url = `${POSTHOG_HOST}${POSTHOG_CAPTURE_PATH}`;
-    spawnSync(
+    const child = spawn(
       process.execPath,
       [
         "-e",
         `fetch(${JSON.stringify(url)},{method:"POST",headers:{"content-type":"application/json"},body:${JSON.stringify(body)},signal:AbortSignal.timeout(${POSTHOG_REQUEST_TIMEOUT_MS})}).catch(()=>{})`
       ],
-      { timeout: POSTHOG_SPAWN_TIMEOUT_MS, stdio: "ignore" }
+      { detached: true, stdio: "ignore" }
     );
+    child.unref();
   } catch {
   }
 }
@@ -6877,7 +7275,13 @@ function createDashboardHandler(registry) {
     routes[DASHBOARD_API_SECURITY] = createSecurityHandler(analysisEngine);
   }
   if (registry.has("finding-store")) {
-    routes[DASHBOARD_API_FINDINGS] = createFindingsHandler(registry.get("finding-store"));
+    const findingStore = registry.get("finding-store");
+    routes[DASHBOARD_API_FINDINGS] = createFindingsHandler(findingStore);
+    routes[DASHBOARD_API_FINDINGS_REPORT] = createFindingsReportHandler(
+      findingStore,
+      registry.get("event-bus"),
+      analysisEngine
+    );
   }
   routes[DASHBOARD_API_TAB] = (req, res) => {
     const raw = (req.url ?? "").split("tab=")[1];
@@ -6885,7 +7289,7 @@ function createDashboardHandler(registry) {
       const tab = decodeURIComponent(raw).slice(0, MAX_TAB_NAME_LENGTH);
       if (VALID_TABS.has(tab) && isTelemetryEnabled()) recordTabViewed(tab);
     }
-    res.writeHead(204);
+    res.writeHead(HTTP_NO_CONTENT);
     res.end();
   };
   return (req, res, config) => {
@@ -6896,7 +7300,7 @@ function createDashboardHandler(registry) {
       return;
     }
     if (isTelemetryEnabled()) recordDashboardOpened();
-    res.writeHead(200, {
+    res.writeHead(HTTP_OK, {
       "content-type": "text/html; charset=utf-8",
       "cache-control": "no-cache",
       ...SECURITY_HEADERS
@@ -6904,23 +7308,17 @@ function createDashboardHandler(registry) {
     res.end(getDashboardHtml(config));
   };
 }
-var SECURITY_HEADERS;
 var init_router = __esm({
   "src/dashboard/router.ts"() {
     "use strict";
     init_constants();
+    init_http();
     init_api();
     init_insights();
     init_findings();
     init_sse();
     init_page();
     init_telemetry2();
-    SECURITY_HEADERS = {
-      "x-content-type-options": "nosniff",
-      "x-frame-options": "DENY",
-      "referrer-policy": "no-referrer",
-      "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; img-src data:"
-    };
   }
 });
 
@@ -6929,6 +7327,7 @@ var EventBus;
 var init_event_bus = __esm({
   "src/core/event-bus.ts"() {
     "use strict";
+    init_log();
     EventBus = class {
       listeners = /* @__PURE__ */ new Map();
       emit(channel, data) {
@@ -6937,7 +7336,8 @@ var init_event_bus = __esm({
         for (const fn of set) {
           try {
             fn(data);
-          } catch {
+          } catch (err) {
+            brakitDebug(`EventBus listener threw on channel "${channel}": ${err}`);
           }
         }
       }
@@ -7001,9 +7401,9 @@ var init_static_patterns = __esm({
 });
 
 // src/store/request-store.ts
-function flattenHeaders(headers) {
+function flattenHeaders(headers2) {
   const flat = {};
-  for (const [key, value] of Object.entries(headers)) {
+  for (const [key, value] of Object.entries(headers2)) {
     if (value === void 0) continue;
     flat[key] = Array.isArray(value) ? value.join(", ") : value;
   }
@@ -7059,6 +7459,15 @@ var init_request_store = __esm({
         }
         return entry;
       }
+      add(entry) {
+        this.requests.push(entry);
+        if (this.requests.length > this.maxEntries) {
+          this.requests.shift();
+        }
+        for (const fn of this.listeners) {
+          fn(entry);
+        }
+      }
       getAll() {
         return this.requests;
       }
@@ -7077,7 +7486,7 @@ var init_request_store = __esm({
 });
 
 // src/store/telemetry-store.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var TelemetryStore;
 var init_telemetry_store = __esm({
   "src/store/telemetry-store.ts"() {
@@ -7090,7 +7499,7 @@ var init_telemetry_store = __esm({
       entries = [];
       listeners = [];
       add(data) {
-        const entry = { id: randomUUID4(), ...data };
+        const entry = { id: randomUUID5(), ...data };
         this.entries.push(entry);
         if (this.entries.length > this.maxEntries) this.entries.shift();
         for (const fn of this.listeners) fn(entry);
@@ -7174,7 +7583,7 @@ var init_math = __esm({
 });
 
 // src/store/metrics/metrics-store.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function createAccumulator() {
   return {
     durations: [],
@@ -7198,19 +7607,23 @@ var init_metrics_store = __esm({
     MetricsStore = class {
       constructor(persistence) {
         this.persistence = persistence;
-        this.data = persistence.load();
-        for (const ep of this.data.endpoints) {
-          this.endpointIndex.set(ep.endpoint, ep);
-        }
+        this.data = { version: 1, endpoints: [] };
       }
       data;
       endpointIndex = /* @__PURE__ */ new Map();
-      sessionId = randomUUID5();
+      sessionId = randomUUID6();
       sessionStart = Date.now();
       flushTimer = null;
       accumulators = /* @__PURE__ */ new Map();
       pendingPoints = /* @__PURE__ */ new Map();
       start() {
+        this.persistence.loadAsync().then((data) => {
+          this.data = data;
+          for (const ep of this.data.endpoints) {
+            this.endpointIndex.set(ep.endpoint, ep);
+          }
+        }).catch(() => {
+        });
         this.flushTimer = setInterval(
           () => this.flush(),
           METRICS_FLUSH_INTERVAL_MS
@@ -7370,6 +7783,7 @@ var init_metrics_store = __esm({
 });
 
 // src/store/metrics/persistence.ts
+import { readFile as readFile4 } from "fs/promises";
 import { readFileSync as readFileSync4, existsSync as existsSync6, unlinkSync } from "fs";
 import { resolve as resolve3 } from "path";
 var FileMetricsPersistence;
@@ -7378,7 +7792,9 @@ var init_persistence = __esm({
     "use strict";
     init_constants();
     init_atomic_writer();
+    init_fs();
     init_log();
+    init_type_guards();
     FileMetricsPersistence = class {
       metricsPath;
       writer;
@@ -7401,7 +7817,21 @@ var init_persistence = __esm({
             }
           }
         } catch (err) {
-          brakitWarn(`failed to load metrics: ${err.message}`);
+          brakitWarn(`failed to load metrics: ${getErrorMessage(err)}`);
+        }
+        return { version: 1, endpoints: [] };
+      }
+      async loadAsync() {
+        try {
+          if (await fileExists(this.metricsPath)) {
+            const raw = await readFile4(this.metricsPath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed?.version === 1 && Array.isArray(parsed.endpoints)) {
+              return parsed;
+            }
+          }
+        } catch (err) {
+          brakitWarn(`failed to load metrics: ${getErrorMessage(err)}`);
         }
         return { version: 1, endpoints: [] };
       }
@@ -7540,17 +7970,28 @@ var init_health2 = __esm({
     BrakitHealth = class {
       errorCount = 0;
       disabled = false;
+      disabledAt = 0;
       teardownFn = null;
       reportError() {
         this.errorCount++;
         if (this.errorCount >= MAX_HEALTH_ERRORS && !this.disabled) {
           this.disabled = true;
-          console.warn("brakit: too many errors, disabling for this session.");
+          this.disabledAt = Date.now();
+          try {
+            process.stderr.write("brakit: too many errors, disabling temporarily.\n");
+          } catch {
+          }
           this.teardownFn?.();
         }
       }
       isActive() {
-        return !this.disabled;
+        if (!this.disabled) return true;
+        if (Date.now() - this.disabledAt > RECOVERY_WINDOW_MS) {
+          this.disabled = false;
+          this.errorCount = 0;
+          return true;
+        }
+        return false;
       }
       setTeardown(fn) {
         this.teardownFn = fn;
@@ -7591,10 +8032,10 @@ var init_guard = __esm({
 });
 
 // src/runtime/capture.ts
-import { gunzipSync, brotliDecompressSync, inflateSync } from "zlib";
-function outgoingToIncoming(headers) {
+import { gunzip, brotliDecompress, inflate } from "zlib";
+function outgoingToIncoming(headers2) {
   const result = {};
-  for (const [key, value] of Object.entries(headers)) {
+  for (const [key, value] of Object.entries(headers2)) {
     if (value === void 0) continue;
     if (Array.isArray(value)) {
       result[key] = value.map(String);
@@ -7604,15 +8045,19 @@ function outgoingToIncoming(headers) {
   }
   return result;
 }
-function decompress(body, encoding) {
-  try {
-    if (encoding === CONTENT_ENCODING_GZIP) return gunzipSync(body);
-    if (encoding === CONTENT_ENCODING_BR) return brotliDecompressSync(body);
-    if (encoding === CONTENT_ENCODING_DEFLATE) return inflateSync(body);
-  } catch (e) {
-    brakitDebug(`decompress failed: ${e.message}`);
-  }
-  return body;
+function decompressAsync(body, encoding) {
+  const decompressor = encoding === CONTENT_ENCODING_GZIP ? gunzip : encoding === CONTENT_ENCODING_BR ? brotliDecompress : encoding === CONTENT_ENCODING_DEFLATE ? inflate : null;
+  if (!decompressor) return Promise.resolve(body);
+  return new Promise((resolve5) => {
+    decompressor(body, (err, result) => {
+      if (err) {
+        brakitDebug(`decompress failed: ${err.message}`);
+        resolve5(body);
+      } else {
+        resolve5(result);
+      }
+    });
+  });
 }
 function toBuffer(chunk) {
   if (Buffer.isBuffer(chunk)) return chunk;
@@ -7656,29 +8101,35 @@ function captureInProcess(req, res, requestId, requestStore) {
     }
     const result = originalEnd.apply(this, args);
     const endTime = performance.now();
-    try {
-      const encoding = String(res.getHeader("content-encoding") ?? "").toLowerCase();
-      let body = resChunks.length > 0 ? Buffer.concat(resChunks) : null;
-      if (body && encoding) {
-        body = decompress(body, encoding);
+    const encoding = String(res.getHeader("content-encoding") ?? "").toLowerCase();
+    const statusCode = res.statusCode;
+    const responseHeaders = outgoingToIncoming(res.getHeaders());
+    const responseContentType = String(res.getHeader("content-type") ?? "");
+    const capturedChunks = resChunks.slice();
+    void (async () => {
+      try {
+        let body = capturedChunks.length > 0 ? Buffer.concat(capturedChunks) : null;
+        if (body && encoding) {
+          body = await decompressAsync(body, encoding);
+        }
+        requestStore.capture({
+          requestId,
+          method,
+          url: req.url ?? "/",
+          requestHeaders: req.headers,
+          requestBody: null,
+          statusCode,
+          responseHeaders,
+          responseBody: body,
+          responseContentType,
+          startTime,
+          endTime,
+          config: { maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE }
+        });
+      } catch (e) {
+        brakitDebug(`capture store: ${e.message}`);
       }
-      requestStore.capture({
-        requestId,
-        method,
-        url: req.url ?? "/",
-        requestHeaders: req.headers,
-        requestBody: null,
-        statusCode: res.statusCode,
-        responseHeaders: outgoingToIncoming(res.getHeaders()),
-        responseBody: body,
-        responseContentType: String(res.getHeader("content-type") ?? ""),
-        startTime,
-        endTime,
-        config: { maxBodyCapture: DEFAULT_MAX_BODY_CAPTURE }
-      });
-    } catch (e) {
-      brakitDebug(`capture store: ${e.message}`);
-    }
+    })();
     return result;
   };
 }
@@ -7692,7 +8143,7 @@ var init_capture = __esm({
 
 // src/runtime/interceptor.ts
 import http from "http";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function installInterceptor(deps) {
   originalEmit = http.Server.prototype.emit;
   const saved = originalEmit;
@@ -7718,14 +8169,14 @@ function installInterceptor(deps) {
       }
       if (isDashboardRequest(url)) {
         if (!isLocalRequest(req)) {
-          res.writeHead(404);
+          res.writeHead(HTTP_NOT_FOUND);
           res.end("Not Found");
           return true;
         }
         deps.handleDashboard(req, res, deps.config);
         return true;
       }
-      const requestId = randomUUID6();
+      const requestId = randomUUID7();
       const ctx = {
         requestId,
         url,
@@ -7754,6 +8205,7 @@ var init_interceptor = __esm({
     init_safe_wrap();
     init_guard();
     init_capture();
+    init_http();
     originalEmit = null;
   }
 });
@@ -7763,11 +8215,15 @@ var setup_exports = {};
 __export(setup_exports, {
   setup: () => setup
 });
-import { writeFileSync as writeFileSync4, readFileSync as readFileSync5, mkdirSync as mkdirSync4, existsSync as existsSync7, unlinkSync as unlinkSync2 } from "fs";
+import { readFile as readFile5, mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { existsSync as existsSync7, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve4 } from "path";
 function setup() {
-  if (initialized) return;
-  initialized = true;
+  if (initPromise) return initPromise;
+  initPromise = doSetup();
+  return initPromise;
+}
+async function doSetup() {
   const bus = new EventBus();
   const registry = new ServiceRegistry();
   const requestStore = new RequestStore();
@@ -7798,7 +8254,7 @@ function setup() {
   const cwd = process.cwd();
   let framework = "unknown";
   try {
-    const pkg = JSON.parse(readFileSync5(resolve4(cwd, "package.json"), "utf-8"));
+    const pkg = JSON.parse(await readFile5(resolve4(cwd, "package.json"), "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     framework = detectFrameworkFromDeps(allDeps);
   } catch {
@@ -7841,29 +8297,42 @@ function setup() {
     requestStore,
     onFirstRequest(port) {
       setBrakitPort(port);
-      const dir = resolve4(cwd, METRICS_DIR);
-      if (!existsSync7(dir)) mkdirSync4(dir, { recursive: true });
-      const portPath = resolve4(cwd, PORT_FILE);
-      if (existsSync7(portPath)) {
-        const old = readFileSync5(portPath, "utf-8").trim();
-        if (old && old !== String(port)) {
-          brakitDebug(`Overwriting stale port file (was ${old}, now ${port})`);
+      void (async () => {
+        try {
+          const dir = resolve4(cwd, METRICS_DIR);
+          await mkdir2(dir, { recursive: true });
+          const portPath = resolve4(cwd, PORT_FILE);
+          try {
+            const old = await readFile5(portPath, "utf-8");
+            if (old.trim() && old.trim() !== String(port)) {
+              brakitDebug(`Overwriting stale port file (was ${old.trim()}, now ${port})`);
+            }
+          } catch {
+          }
+          await writeFile3(portPath, String(port));
+        } catch (err) {
+          brakitDebug(`port file write failed: ${err.message}`);
         }
-      }
-      writeFileSync4(portPath, String(port));
+      })();
       terminalDispose = startTerminalInsights(registry, port);
       process.stdout.write(`  brakit v${VERSION} \u2014 http://localhost:${port}${DASHBOARD_PREFIX}
 `);
     }
   });
-  let teardownCalled = false;
-  const runTeardown = () => {
-    if (teardownCalled) return;
-    teardownCalled = true;
+  let telemetrySent = false;
+  const sendTelemetry = () => {
+    if (telemetrySent) return;
+    telemetrySent = true;
     recordRequestCount(requestStore.getAll().length);
     recordInsightTypes(analysisEngine.getInsights().map((i) => i.type));
     recordRulesTriggered(analysisEngine.getFindings().map((f) => f.rule));
     trackSession(registry);
+  };
+  let teardownCalled = false;
+  const runTeardown = () => {
+    if (teardownCalled) return;
+    teardownCalled = true;
+    sendTelemetry();
     uninstallInterceptor();
     terminalDispose?.();
     analysisEngine.stop();
@@ -7876,16 +8345,14 @@ function setup() {
     }
   };
   health.setTeardown(runTeardown);
-  process.once("SIGINT", () => {
-    runTeardown();
-    process.exit(SIGNAL_EXIT_SIGINT);
+  process.on("beforeExit", () => {
+    sendTelemetry();
   });
-  process.once("SIGTERM", () => {
+  process.on("exit", () => {
     runTeardown();
-    process.exit(SIGNAL_EXIT_SIGTERM);
   });
 }
-var initialized;
+var initPromise;
 var init_setup = __esm({
   "src/runtime/setup.ts"() {
     "use strict";
@@ -7907,13 +8374,12 @@ var init_setup = __esm({
     init_terminal();
     init_src();
     init_constants();
-    init_telemetry();
     init_health2();
     init_interceptor();
     init_log();
     init_project();
     init_telemetry2();
-    initialized = false;
+    initPromise = null;
   }
 });
 
@@ -7932,7 +8398,7 @@ function shouldActivate() {
 if (shouldActivate()) {
   try {
     const { setup: setup2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
-    setup2();
+    await setup2();
   } catch (err) {
     console.warn("brakit: failed to start \u2014", err?.message);
   }