brakit 0.8.6 → 0.8.7

package/README.md

@@ -2,7 +2,7 @@
 
 <p align="center">
   <b>AI writes your code. Brakit watches what it does.</b> <br />
-  Every request, query, and security issue, caught before you ship. <br />
+  Every request, query, and API call mapped to the action that triggered it. See your entire backend at a glance. <br />
   <b>Open source · Local first · Zero config · AI-native via MCP</b>
 </p>
 
@@ -32,6 +32,12 @@
 
 ---
 
+<p align="center">
+  <img width="700" src="docs/images/actions.png" alt="Brakit Actions — endpoints grouped by user action" />
+  <br />
+  <sub>Every endpoint grouped by the action that triggered it — see "Sign Up" and "Load Dashboard", not 47 raw requests</sub>
+</p>
+
 <p align="center">
   <img width="700" src="docs/images/dashboard.png" alt="Brakit Dashboard — issues surfaced automatically" />
   <br />

package/dist/api.d.ts

@@ -63,6 +63,7 @@ interface TelemetryEntry {
     timestamp: number;
 }
 interface TracedFetch extends TelemetryEntry {
+    fetchId?: string;
     url: string;
     method: string;
     statusCode: number;
@@ -75,11 +76,11 @@ interface TracedLog extends TelemetryEntry {
 interface TracedError extends TelemetryEntry {
     name: string;
     message: string;
-    stack: string;
+    stack?: string;
 }
 type NormalizedOp = "SELECT" | "INSERT" | "UPDATE" | "DELETE" | "OTHER";
 interface TracedQuery extends TelemetryEntry {
-    driver: "pg" | "mysql2" | "prisma" | "sdk";
+    driver: "pg" | "mysql2" | "prisma" | "asyncpg" | "sqlalchemy" | "sdk";
     sql?: string;
     model?: string;
     operation?: string;
@@ -88,6 +89,7 @@ interface TracedQuery extends TelemetryEntry {
     normalizedOp?: NormalizedOp;
     table?: string;
     source?: string;
+    parentFetchId?: string;
 }
 type TelemetryEvent = {
     type: "fetch";

package/dist/api.js

@@ -17,7 +17,7 @@ var ISSUES_DATA_VERSION = 2;
 var SECRET_SCAN_ARRAY_LIMIT = 5;
 var PII_SCAN_ARRAY_LIMIT = 10;
 var MIN_SECRET_VALUE_LENGTH = 8;
-var FULL_RECORD_MIN_FIELDS = 5;
+var FULL_RECORD_MIN_FIELDS = 8;
 var LIST_PII_MIN_ITEMS = 2;
 var MAX_OBJECT_SCAN_DEPTH = 5;
 var ISSUE_PRUNE_TTL_MS = 10 * 60 * 1e3;
@@ -132,11 +132,10 @@ import { writeFile as writeFile2, mkdir, rename } from "fs/promises";
 var AtomicWriter = class {
   constructor(opts) {
     this.opts = opts;
+    this.writing = false;
+    this.pendingContent = null;
     this.tmpPath = opts.filePath + ".tmp";
   }
-  tmpPath;
-  writing = false;
-  pendingContent = null;
   writeSync(content) {
     try {
       this.ensureDir();
@@ -198,6 +197,9 @@ function computeIssueId(issue) {
 var IssueStore = class {
   constructor(dataDir) {
     this.dataDir = dataDir;
+    this.issues = /* @__PURE__ */ new Map();
+    this.flushTimer = null;
+    this.dirty = false;
     this.issuesPath = resolve2(dataDir, ISSUES_FILE);
     this.writer = new AtomicWriter({
       dir: dataDir,
@@ -205,11 +207,6 @@ var IssueStore = class {
       label: "issues"
     });
   }
-  issues = /* @__PURE__ */ new Map();
-  flushTimer = null;
-  dirty = false;
-  writer;
-  issuesPath;
   start() {
     this.loadAsync().catch((err) => brakitDebug(`IssueStore: async load failed: ${err}`));
     this.flushTimer = setInterval(
@@ -429,8 +426,10 @@ function detectFrameworkFromDeps(allDeps) {
 
 // src/instrument/adapter-registry.ts
 var AdapterRegistry = class {
-  adapters = [];
-  active = [];
+  constructor() {
+    this.adapters = [];
+    this.active = [];
+  }
   register(adapter) {
     this.adapters.push(adapter);
   }
@@ -504,6 +503,8 @@ var MASKED_RE = /^\*+$|\[REDACTED\]|\[FILTERED\]|CHANGE_ME|^x{3,}$/i;
 var EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
 var INTERNAL_ID_KEYS = /^(id|_id|userId|user_id|createdBy|updatedBy|organizationId|org_id|tenantId|tenant_id)$/;
 var INTERNAL_ID_SUFFIX = /Id$|_id$/;
+var SELF_SERVICE_PATH = /\/(?:me|account|profile|settings|self)(?=\/|\?|#|$)/i;
+var SENSITIVE_FIELD_NAMES = /^(phone|phoneNumber|phone_number|ssn|socialSecurityNumber|social_security_number|dateOfBirth|date_of_birth|dob|address|streetAddress|street_address|creditCard|credit_card|cardNumber|card_number|bankAccount|bank_account|passport|passportNumber|passport_number|nationalId|national_id)$/i;
 var SELECT_STAR_RE = /^SELECT\s+\*/i;
 var SELECT_DOT_STAR_RE = /\.\*\s+FROM/i;
 var RULE_HINTS = {
@@ -854,6 +855,15 @@ function hasInternalIds(obj) {
   }
   return false;
 }
+function hasSensitiveFieldNames(obj, depth = 0) {
+  if (depth >= MAX_OBJECT_SCAN_DEPTH) return false;
+  if (!obj || typeof obj !== "object") return false;
+  if (Array.isArray(obj)) return obj.length > 0 && hasSensitiveFieldNames(obj[0], depth + 1);
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELD_NAMES.test(key)) return true;
+  }
+  return false;
+}
 function detectEchoPII(method, reqBody, target) {
   if (!WRITE_METHODS.has(method) || !reqBody || typeof reqBody !== "object") return null;
   const reqEmails = findEmails(reqBody);
@@ -875,6 +885,13 @@ function detectFullRecordPII(target) {
   if (emails.length === 0) return null;
   return { reason: "full-record", emailCount: emails.length };
 }
+function detectSensitiveFieldPII(target) {
+  const inspect = Array.isArray(target) && target.length > 0 ? target[0] : target;
+  if (!inspect || typeof inspect !== "object" || Array.isArray(inspect)) return null;
+  if (!hasSensitiveFieldNames(inspect)) return null;
+  if (!hasInternalIds(inspect) && topLevelFieldCount(inspect) < FULL_RECORD_MIN_FIELDS) return null;
+  return { reason: "sensitive-fields", emailCount: 0 };
+}
 function detectListPII(target) {
   if (!Array.isArray(target) || target.length < LIST_PII_MIN_ITEMS) return null;
   let itemsWithEmail = 0;
@@ -893,12 +910,13 @@ function detectListPII(target) {
 }
 function detectPII(method, reqBody, resBody) {
   const target = unwrapResponse(resBody);
-  return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target);
+  return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target) ?? detectSensitiveFieldPII(target);
 }
 var REASON_LABELS = {
   echo: "echoes back PII from the request body",
   "full-record": "returns a full record with email and internal IDs",
-  "list-pii": "returns a list of records containing email addresses"
+  "list-pii": "returns a list of records containing email addresses",
+  "sensitive-fields": "contains sensitive personal data fields (phone, SSN, date of birth, address, etc.)"
 };
 var responsePiiLeakRule = {
   id: "response-pii-leak",
@@ -910,14 +928,14 @@ var responsePiiLeakRule = {
     const seen = /* @__PURE__ */ new Map();
     for (const r of ctx.requests) {
       if (isErrorStatus(r.statusCode)) continue;
+      if (SELF_SERVICE_PATH.test(r.path)) continue;
       const resJson = ctx.parsedBodies.response.get(r.id);
       if (!resJson) continue;
       const reqJson = ctx.parsedBodies.request.get(r.id) ?? null;
       const detection = detectPII(r.method, reqJson, resJson);
       if (!detection) continue;
       const ep = `${r.method} ${r.path}`;
-      const dedupKey = `${ep}:${detection.reason}`;
-      const existing = seen.get(dedupKey);
+      const existing = seen.get(ep);
       if (existing) {
         existing.count++;
         continue;
@@ -926,12 +944,12 @@ var responsePiiLeakRule = {
         severity: "warning",
         rule: "response-pii-leak",
         title: "PII Leak in Response",
-        desc: `${ep} \u2014 ${REASON_LABELS[detection.reason]}`,
-        hint: this.hint,
+        desc: `${ep} \u2014 exposes PII in response`,
+        hint: `Detection: ${REASON_LABELS[detection.reason]}. ${this.hint}`,
         endpoint: ep,
         count: 1
       };
-      seen.set(dedupKey, finding);
+      seen.set(ep, finding);
       findings.push(finding);
     }
     return findings;
@@ -955,7 +973,9 @@ function buildBodyCache(requests) {
   return { response, request };
 }
 var SecurityScanner = class {
-  rules = [];
+  constructor() {
+    this.rules = [];
+  }
   register(rule) {
     this.rules.push(rule);
   }
@@ -992,7 +1012,9 @@ function createDefaultScanner() {
 
 // src/core/disposable.ts
 var SubscriptionBag = class {
-  items = [];
+  constructor() {
+    this.items = [];
+  }
   add(teardown) {
     this.items.push(typeof teardown === "function" ? { dispose: teardown } : teardown);
   }
@@ -1557,7 +1579,9 @@ function prepareContext(ctx) {
 // src/analysis/insights/runner.ts
 var SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
 var InsightRunner = class {
-  rules = [];
+  constructor() {
+    this.rules = [];
+  }
   register(rule) {
     this.rules.push(rule);
   }
@@ -2123,13 +2147,12 @@ var AnalysisEngine = class {
   constructor(registry, debounceMs = ANALYSIS_DEBOUNCE_MS) {
     this.registry = registry;
     this.debounceMs = debounceMs;
+    this.cachedInsights = [];
+    this.cachedFindings = [];
+    this.debounceTimer = null;
+    this.subs = new SubscriptionBag();
     this.scanner = createDefaultScanner();
   }
-  scanner;
-  cachedInsights = [];
-  cachedFindings = [];
-  debounceTimer = null;
-  subs = new SubscriptionBag();
   start() {
     const bus = this.registry.get("event-bus");
     this.subs.add(bus.on("request:completed", () => this.scheduleRecompute()));
@@ -2203,7 +2226,7 @@ var AnalysisEngine = class {
 };
 
 // src/index.ts
-var VERSION = "0.8.6";
+var VERSION = "0.8.7";
 export {
   AdapterRegistry,
   AnalysisEngine,

package/dist/bin/brakit.js

@@ -18,7 +18,7 @@ var init_limits = __esm({
     SECRET_SCAN_ARRAY_LIMIT = 5;
     PII_SCAN_ARRAY_LIMIT = 10;
     MIN_SECRET_VALUE_LENGTH = 8;
-    FULL_RECORD_MIN_FIELDS = 5;
+    FULL_RECORD_MIN_FIELDS = 8;
     LIST_PII_MIN_ITEMS = 2;
     MAX_OBJECT_SCAN_DEPTH = 5;
     ISSUE_PRUNE_TTL_MS = 10 * 60 * 1e3;
@@ -172,7 +172,7 @@ var init_mcp = __esm({
     MAX_TIMELINE_EVENTS = 20;
     MAX_RESOLVED_DISPLAY = 5;
     ENRICHMENT_SEVERITY_FILTER = ["critical", "warning"];
-    MCP_SERVER_VERSION = "0.8.6";
+    MCP_SERVER_VERSION = "0.8.7";
   }
 });
 
@@ -215,6 +215,20 @@ var init_cli = __esm({
   }
 });
 
+// src/constants/timeline.ts
+var init_timeline = __esm({
+  "src/constants/timeline.ts"() {
+    "use strict";
+  }
+});
+
+// src/constants/sdk-events.ts
+var init_sdk_events = __esm({
+  "src/constants/sdk-events.ts"() {
+    "use strict";
+  }
+});
+
 // src/constants/index.ts
 var init_constants = __esm({
   "src/constants/index.ts"() {
@@ -232,6 +246,8 @@ var init_constants = __esm({
     init_telemetry();
     init_lifecycle();
     init_cli();
+    init_timeline();
+    init_sdk_events();
   }
 });
 
@@ -1399,6 +1415,8 @@ var MASKED_RE = /^\*+$|\[REDACTED\]|\[FILTERED\]|CHANGE_ME|^x{3,}$/i;
 var EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
 var INTERNAL_ID_KEYS = /^(id|_id|userId|user_id|createdBy|updatedBy|organizationId|org_id|tenantId|tenant_id)$/;
 var INTERNAL_ID_SUFFIX = /Id$|_id$/;
+var SELF_SERVICE_PATH = /\/(?:me|account|profile|settings|self)(?=\/|\?|#|$)/i;
+var SENSITIVE_FIELD_NAMES = /^(phone|phoneNumber|phone_number|ssn|socialSecurityNumber|social_security_number|dateOfBirth|date_of_birth|dob|address|streetAddress|street_address|creditCard|credit_card|cardNumber|card_number|bankAccount|bank_account|passport|passportNumber|passport_number|nationalId|national_id)$/i;
 var RULE_HINTS = {
   "exposed-secret": "Never include secret fields in API responses. Strip sensitive fields before returning.",
   "token-in-url": "Pass tokens in the Authorization header, not URL query parameters.",
@@ -1748,6 +1766,15 @@ function hasInternalIds(obj) {
   }
   return false;
 }
+function hasSensitiveFieldNames(obj, depth = 0) {
+  if (depth >= MAX_OBJECT_SCAN_DEPTH) return false;
+  if (!obj || typeof obj !== "object") return false;
+  if (Array.isArray(obj)) return obj.length > 0 && hasSensitiveFieldNames(obj[0], depth + 1);
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELD_NAMES.test(key)) return true;
+  }
+  return false;
+}
 function detectEchoPII(method, reqBody, target) {
   if (!WRITE_METHODS.has(method) || !reqBody || typeof reqBody !== "object") return null;
   const reqEmails = findEmails(reqBody);
@@ -1769,6 +1796,13 @@ function detectFullRecordPII(target) {
   if (emails.length === 0) return null;
   return { reason: "full-record", emailCount: emails.length };
 }
+function detectSensitiveFieldPII(target) {
+  const inspect = Array.isArray(target) && target.length > 0 ? target[0] : target;
+  if (!inspect || typeof inspect !== "object" || Array.isArray(inspect)) return null;
+  if (!hasSensitiveFieldNames(inspect)) return null;
+  if (!hasInternalIds(inspect) && topLevelFieldCount(inspect) < FULL_RECORD_MIN_FIELDS) return null;
+  return { reason: "sensitive-fields", emailCount: 0 };
+}
 function detectListPII(target) {
   if (!Array.isArray(target) || target.length < LIST_PII_MIN_ITEMS) return null;
   let itemsWithEmail = 0;
@@ -1787,12 +1821,13 @@ function detectListPII(target) {
 }
 function detectPII(method, reqBody, resBody) {
   const target = unwrapResponse(resBody);
-  return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target);
+  return detectEchoPII(method, reqBody, target) ?? detectFullRecordPII(target) ?? detectListPII(target) ?? detectSensitiveFieldPII(target);
 }
 var REASON_LABELS = {
   echo: "echoes back PII from the request body",
   "full-record": "returns a full record with email and internal IDs",
-  "list-pii": "returns a list of records containing email addresses"
+  "list-pii": "returns a list of records containing email addresses",
+  "sensitive-fields": "contains sensitive personal data fields (phone, SSN, date of birth, address, etc.)"
 };
 var responsePiiLeakRule = {
   id: "response-pii-leak",
@@ -1804,14 +1839,14 @@ var responsePiiLeakRule = {
     const seen = /* @__PURE__ */ new Map();
     for (const r of ctx.requests) {
       if (isErrorStatus(r.statusCode)) continue;
+      if (SELF_SERVICE_PATH.test(r.path)) continue;
       const resJson = ctx.parsedBodies.response.get(r.id);
       if (!resJson) continue;
       const reqJson = ctx.parsedBodies.request.get(r.id) ?? null;
       const detection = detectPII(r.method, reqJson, resJson);
       if (!detection) continue;
       const ep = `${r.method} ${r.path}`;
-      const dedupKey = `${ep}:${detection.reason}`;
-      const existing = seen.get(dedupKey);
+      const existing = seen.get(ep);
       if (existing) {
         existing.count++;
         continue;
@@ -1820,12 +1855,12 @@ var responsePiiLeakRule = {
         severity: "warning",
         rule: "response-pii-leak",
         title: "PII Leak in Response",
-        desc: `${ep} \u2014 ${REASON_LABELS[detection.reason]}`,
-        hint: this.hint,
+        desc: `${ep} \u2014 exposes PII in response`,
+        hint: `Detection: ${REASON_LABELS[detection.reason]}. ${this.hint}`,
         endpoint: ep,
         count: 1
       };
-      seen.set(dedupKey, finding);
+      seen.set(ep, finding);
       findings.push(finding);
     }
     return findings;
@@ -1894,7 +1929,7 @@ init_constants();
 init_endpoint();
 
 // src/index.ts
-var VERSION = "0.8.6";
+var VERSION = "0.8.7";
 
 // src/cli/commands/install.ts
 init_constants();