chainlesschain 0.162.147 → 0.162.148

package/src/harness/remote-session-registry.js

@@ -0,0 +1,420 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+
+export const REMOTE_SESSION_PROTOCOL_VERSION = "1.0";
+export const REMOTE_SESSION_SCOPES = Object.freeze([
+  "observe",
+  "prompt",
+  "approve",
+  "interrupt",
+]);
+
+const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+
+function hashToken(token) {
+  return createHash("sha256").update(String(token), "utf8").digest();
+}
+
+function tokensMatch(token, digest) {
+  const candidate = hashToken(token);
+  return (
+    candidate.length === digest.length && timingSafeEqual(candidate, digest)
+  );
+}
+
+function normalizeScopes(scopes) {
+  const requested = scopes || REMOTE_SESSION_SCOPES;
+  if (!Array.isArray(requested) || requested.length === 0) {
+    throw new TypeError("Remote session scopes must be a non-empty array");
+  }
+  const unique = [...new Set(requested)];
+  for (const scope of unique) {
+    if (!REMOTE_SESSION_SCOPES.includes(scope)) {
+      throw new Error(`Unsupported remote session scope: ${scope}`);
+    }
+  }
+  return unique;
+}
+
+/**
+ * Org-level constraints an administrator can impose on Remote Sessions. Lives
+ * next to the registry (its single enforcement point) so both the direct WS
+ * join and the relay pairing path go through the same checks. Permissive by
+ * default — an unconfigured policy is a no-op.
+ */
+export class RemoteSessionPolicy {
+  constructor({
+    allowedScopes = null,
+    maxDevices = null,
+    maxSessionTtlMs = null,
+    maxTokenTtlMs = null,
+    allowRelayPairing = true,
+  } = {}) {
+    this.allowedScopes = allowedScopes ? [...new Set(allowedScopes)] : null;
+    if (this.allowedScopes) {
+      if (this.allowedScopes.length === 0) {
+        throw new Error("allowedScopes cannot be empty");
+      }
+      for (const scope of this.allowedScopes) {
+        if (!REMOTE_SESSION_SCOPES.includes(scope)) {
+          throw new Error(`Unknown scope in org policy: ${scope}`);
+        }
+      }
+    }
+    this.maxDevices =
+      maxDevices == null ? null : Math.max(0, Math.floor(maxDevices));
+    this.maxSessionTtlMs =
+      maxSessionTtlMs == null ? null : Math.max(1, Math.floor(maxSessionTtlMs));
+    this.maxTokenTtlMs =
+      maxTokenTtlMs == null ? null : Math.max(1, Math.floor(maxTokenTtlMs));
+    this.allowRelayPairing = allowRelayPairing !== false;
+  }
+
+  /**
+   * Narrow requested scopes to the org-allowed set. Throws only when the request
+   * and the allow-list are wholly disjoint (i.e. nothing could be granted).
+   */
+  applyScopes(requestedScopes) {
+    if (!this.allowedScopes) {
+      return { scopes: requestedScopes || null, narrowed: false };
+    }
+    const requested =
+      requestedScopes && requestedScopes.length
+        ? [...new Set(requestedScopes)]
+        : [...REMOTE_SESSION_SCOPES];
+    const granted = requested.filter((scope) =>
+      this.allowedScopes.includes(scope),
+    );
+    if (granted.length === 0) {
+      throw new Error("Remote session scopes are not permitted by org policy");
+    }
+    return { scopes: granted, narrowed: granted.length !== requested.length };
+  }
+
+  capSessionTtl(ttlMs) {
+    return this.maxSessionTtlMs == null
+      ? ttlMs
+      : Math.min(ttlMs, this.maxSessionTtlMs);
+  }
+
+  capTokenTtl(ttlMs) {
+    return this.maxTokenTtlMs == null
+      ? ttlMs
+      : Math.min(ttlMs, this.maxTokenTtlMs);
+  }
+
+  enforceJoin({ deviceCount, via } = {}) {
+    if (via === "relay" && !this.allowRelayPairing) {
+      throw new Error("Relay pairing is disabled by org policy");
+    }
+    if (this.maxDevices != null && deviceCount >= this.maxDevices) {
+      throw new Error("Org policy device limit reached");
+    }
+  }
+
+  describe() {
+    return {
+      allowedScopes: this.allowedScopes,
+      maxDevices: this.maxDevices,
+      maxSessionTtlMs: this.maxSessionTtlMs,
+      maxTokenTtlMs: this.maxTokenTtlMs,
+      allowRelayPairing: this.allowRelayPairing,
+    };
+  }
+
+  static fromEnv(env = {}) {
+    const options = {};
+    const scopes = env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOWED_SCOPES;
+    if (scopes) {
+      options.allowedScopes = scopes
+        .split(",")
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    }
+    const num = (value) => {
+      const parsed = Number(value);
+      return Number.isFinite(parsed) ? parsed : null;
+    };
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_DEVICES != null) {
+      options.maxDevices = num(env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_DEVICES);
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_SESSION_TTL_MS != null) {
+      options.maxSessionTtlMs = num(
+        env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_SESSION_TTL_MS,
+      );
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_TOKEN_TTL_MS != null) {
+      options.maxTokenTtlMs = num(
+        env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_TOKEN_TTL_MS,
+      );
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOW_RELAY != null) {
+      options.allowRelayPairing = !/^(0|false|no|off)$/i.test(
+        String(env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOW_RELAY).trim(),
+      );
+    }
+    return new RemoteSessionPolicy(options);
+  }
+}
+
+function publicSession(session) {
+  return {
+    protocolVersion: REMOTE_SESSION_PROTOCOL_VERSION,
+    sessionId: session.sessionId,
+    agentSessionId: session.agentSessionId,
+    name: session.name,
+    hostClientId: session.hostClientId,
+    createdAt: session.createdAt,
+    expiresAt: session.expiresAt,
+    memberCount: session.members.size,
+  };
+}
+
+/** In-memory authorization state for one local CLI process. */
+export class RemoteSessionRegistry {
+  constructor(options = {}) {
+    this.now = options.now || Date.now;
+    this.tokenTtlMs = options.tokenTtlMs || DEFAULT_TOKEN_TTL_MS;
+    this.sessionTtlMs = options.sessionTtlMs || DEFAULT_SESSION_TTL_MS;
+    this.policy = options.policy || new RemoteSessionPolicy();
+    this.sessions = new Map();
+    this.tokens = new Map();
+  }
+
+  create({ hostClientId, agentSessionId, name, scopes } = {}) {
+    if (!hostClientId) throw new Error("hostClientId is required");
+    if (!agentSessionId) throw new Error("agentSessionId is required");
+    const now = this.now();
+    const session = {
+      sessionId: randomUUID(),
+      agentSessionId,
+      name: name || agentSessionId,
+      hostClientId,
+      createdAt: now,
+      expiresAt: now + this.policy.capSessionTtl(this.sessionTtlMs),
+      members: new Map([
+        [
+          hostClientId,
+          {
+            clientId: hostClientId,
+            scopes: REMOTE_SESSION_SCOPES,
+            joinedAt: now,
+          },
+        ],
+      ]),
+    };
+    this.sessions.set(session.sessionId, session);
+    return {
+      session: publicSession(session),
+      pairing: this.issuePairingToken(session.sessionId, { scopes }),
+    };
+  }
+
+  issuePairingToken(sessionId, { scopes } = {}) {
+    const session = this.requireSession(sessionId);
+    const token = randomBytes(32).toString("base64url");
+    const now = this.now();
+    const { scopes: applied, narrowed } = this.policy.applyScopes(scopes);
+    const grantedScopes = normalizeScopes(applied);
+    this.tokens.set(sessionId, {
+      digest: hashToken(token),
+      scopes: grantedScopes,
+      createdAt: now,
+      expiresAt: Math.min(
+        now + this.policy.capTokenTtl(this.tokenTtlMs),
+        session.expiresAt,
+      ),
+    });
+    return {
+      token,
+      expiresAt: this.tokens.get(sessionId).expiresAt,
+      scopes: grantedScopes,
+      policyNarrowed: narrowed,
+    };
+  }
+
+  join({
+    sessionId,
+    clientId,
+    token,
+    via = "direct",
+    pushToken = null,
+    pushProvider = null,
+  } = {}) {
+    if (!clientId) throw new Error("clientId is required");
+    const session = this.requireSession(sessionId);
+    const pairing = this.tokens.get(sessionId);
+    if (!pairing || pairing.expiresAt <= this.now()) {
+      this.tokens.delete(sessionId);
+      throw new Error("Pairing token is missing or expired");
+    }
+    if (!tokensMatch(token, pairing.digest)) {
+      throw new Error("Invalid pairing token");
+    }
+    // Org policy is enforced only after the token proves the caller is invited,
+    // so a device-limit / relay-disabled message never leaks to unauthenticated
+    // probes. Existing (non-host) devices count against the limit.
+    const deviceCount = [...session.members.values()].filter(
+      (member) => member.clientId !== session.hostClientId,
+    ).length;
+    this.policy.enforceJoin({ deviceCount, via });
+    // Pairing credentials are deliberately one-time. The host must explicitly
+    // issue another token for each additional device.
+    this.tokens.delete(sessionId);
+    const member = {
+      clientId,
+      scopes: pairing.scopes,
+      joinedAt: this.now(),
+      pushToken: pushToken || null,
+      pushProvider: pushToken ? pushProvider || null : null,
+    };
+    session.members.set(clientId, member);
+    return { session: publicSession(session), member: { ...member } };
+  }
+
+  /**
+   * A device registers (or refreshes / clears) its own vendor push token after
+   * pairing — e.g. once FCM assigns one. Only an existing member may set its own
+   * token. A null token clears push for that device.
+   */
+  registerPush(sessionId, clientId, { token = null, provider = null } = {}) {
+    const session = this.requireSession(sessionId);
+    const member = session.members.get(clientId);
+    if (!member) {
+      throw new Error("Device is not paired with this remote session");
+    }
+    member.pushToken = token || null;
+    member.pushProvider = token ? provider || null : null;
+    return {
+      clientId,
+      hasPush: Boolean(member.pushToken),
+      provider: member.pushProvider,
+    };
+  }
+
+  /** Non-host members that carry a push token, for wake-up dispatch. */
+  pushTargets(sessionId, { excludeClientId } = {}) {
+    const session = this.requireSession(sessionId);
+    const targets = [];
+    for (const member of session.members.values()) {
+      if (member.clientId === session.hostClientId) continue;
+      if (member.clientId === excludeClientId) continue;
+      if (!member.pushToken) continue;
+      targets.push({
+        clientId: member.clientId,
+        pushToken: member.pushToken,
+        pushProvider: member.pushProvider,
+      });
+    }
+    return targets;
+  }
+
+  authorize(sessionId, clientId, scope) {
+    const session = this.requireSession(sessionId);
+    const member = session.members.get(clientId);
+    if (!member)
+      throw new Error("Client is not paired with this remote session");
+    if (!member.scopes.includes(scope)) {
+      throw new Error(`Remote session scope required: ${scope}`);
+    }
+    return { session, member };
+  }
+
+  members(sessionId) {
+    const session = this.requireSession(sessionId);
+    return [...session.members.values()].map((member) => ({ ...member }));
+  }
+
+  /**
+   * Host-only view of every paired device on a session. The host flag lets the
+   * UI keep the host row un-revocable and label it distinctly.
+   */
+  listDevices(sessionId, hostClientId) {
+    const session = this.requireSession(sessionId);
+    if (hostClientId && session.hostClientId !== hostClientId) {
+      throw new Error("Only the host can list paired devices");
+    }
+    return {
+      session: publicSession(session),
+      devices: [...session.members.values()].map((member) => ({
+        clientId: member.clientId,
+        scopes: [...member.scopes],
+        joinedAt: member.joinedAt,
+        isHost: member.clientId === session.hostClientId,
+        hasPush: Boolean(member.pushToken),
+        pushProvider: member.pushProvider || null,
+      })),
+    };
+  }
+
+  /**
+   * Host-initiated revocation of a single paired device. The host cannot revoke
+   * itself (use close() to end the whole session). Returns the removed member so
+   * callers can push a revocation notice to that device.
+   */
+  revokeMember(sessionId, hostClientId, clientId) {
+    if (!clientId) throw new Error("clientId is required");
+    const session = this.requireSession(sessionId);
+    if (session.hostClientId !== hostClientId) {
+      throw new Error("Only the host can revoke devices");
+    }
+    if (clientId === session.hostClientId) {
+      throw new Error("Cannot revoke the host device");
+    }
+    const member = session.members.get(clientId);
+    if (!member)
+      throw new Error("Device is not paired with this remote session");
+    session.members.delete(clientId);
+    return { session: publicSession(session), member: { ...member } };
+  }
+
+  findHosted(agentSessionId, hostClientId) {
+    const matches = [];
+    for (const session of this.sessions.values()) {
+      if (
+        session.agentSessionId === agentSessionId &&
+        session.hostClientId === hostClientId &&
+        session.expiresAt > this.now()
+      ) {
+        matches.push(session);
+      }
+    }
+    return matches;
+  }
+
+  removeClient(clientId) {
+    const affected = [];
+    for (const [sessionId, session] of this.sessions) {
+      if (!session.members.delete(clientId)) continue;
+      if (session.hostClientId === clientId) {
+        this.sessions.delete(sessionId);
+        this.tokens.delete(sessionId);
+        affected.push({ sessionId, closed: true });
+      } else {
+        affected.push({ sessionId, closed: false });
+      }
+    }
+    return affected;
+  }
+
+  close(sessionId, clientId) {
+    const session = this.requireSession(sessionId);
+    if (session.hostClientId !== clientId) {
+      throw new Error("Only the host can close a Remote Session");
+    }
+    this.sessions.delete(sessionId);
+    this.tokens.delete(sessionId);
+    return publicSession(session);
+  }
+
+  requireSession(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) throw new Error("Remote session not found");
+    if (session.expiresAt <= this.now()) {
+      this.sessions.delete(sessionId);
+      this.tokens.delete(sessionId);
+      throw new Error("Remote session expired");
+    }
+    return session;
+  }
+}

package/src/lib/did-manager.js

@@ -163,10 +163,12 @@ export function setDefaultIdentity(db, did) {
   const identity = getIdentity(db, did);
   if (!identity) return false;
 
-  db.prepare("UPDATE did_identities SET is_default = ? WHERE did LIKE ?").run(
-    0,
-    "%",
-  );
+  // Clear the current default(s). Match on is_default rather than `did LIKE '%'`
+  // so there's no wildcard pattern here that a reader/scanner could mistake for
+  // LIKE-injection — the target below is set via exact `did = ?` regardless.
+  db.prepare(
+    "UPDATE did_identities SET is_default = 0 WHERE is_default = 1",
+  ).run();
   db.prepare("UPDATE did_identities SET is_default = ? WHERE did = ?").run(
     1,
     identity.did,

package/src/lib/mcp-oauth.js

@@ -35,6 +35,7 @@ export const _deps = {
   sha256: (s) => crypto.createHash("sha256").update(s).digest(),
   createServer: (h) => http.createServer(h),
   openBrowser: defaultOpenBrowser,
+  spawn: (...a) => spawn(...a),
   now: () => Date.now(),
   // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -648,13 +649,29 @@ export async function ensureValidToken(
 
 // ── interactive orchestrator ──────────────────────────────────────────────
 
-function defaultOpenBrowser(url) {
-  const platform = process.platform;
-  const cmd =
-    platform === "win32" ? "cmd" : platform === "darwin" ? "open" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+export function defaultOpenBrowser(url, platform = process.platform) {
+  // The authorize URL derives from REMOTE OAuth server metadata, so treat it
+  // as untrusted: only http(s) may reach the OS opener (no file:/ms-settings:/
+  // custom-scheme handlers), and it must never pass through cmd.exe's line
+  // parser — `cmd /c start "" <url>` truncates at the first unquoted `&` and
+  // EXECUTES the remainder as commands (query strings always contain `&`).
+  let parsed;
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  // win32: rundll32 is a plain executable — the URL arrives as a verbatim
+  // argv entry with no shell metacharacter interpretation.
+  const [cmd, args] =
+    platform === "win32"
+      ? ["rundll32", ["url.dll,FileProtocolHandler", parsed.href]]
+      : platform === "darwin"
+        ? ["open", [parsed.href]]
+        : ["xdg-open", [parsed.href]];
+  try {
+    const child = _deps.spawn(cmd, args, { stdio: "ignore", detached: true });
     child.unref?.();
     return true;
   } catch {

package/src/lib/session-manager.js

@@ -7,6 +7,7 @@
 
 import { createHash } from "crypto";
 import { safeJsonParse } from "./safe-json.js";
+import { likePrefix } from "./sql-like.js";
 
 function ensureSessionsTable(db) {
   db.exec(`
@@ -115,10 +116,13 @@ export function getSession(db, sessionId) {
     .prepare("SELECT * FROM llm_sessions WHERE id = ?")
     .get(sessionId);
 
-  if (!session) {
+  if (!session && sessionId) {
+    // Prefix match as a fallback. Escape LIKE metachars (% _ \) in the id and
+    // pair with ESCAPE '\' so a value containing them can't wildcard-match the
+    // WRONG session — getSession resolves the id that resume writes back to.
     session = db
-      .prepare("SELECT * FROM llm_sessions WHERE id LIKE ? LIMIT 1")
-      .get(`${sessionId}%`);
+      .prepare("SELECT * FROM llm_sessions WHERE id LIKE ? ESCAPE '\\' LIMIT 1")
+      .get(likePrefix(sessionId));
   }
 
   if (!session) return null;

package/src/runtime/agent-runtime.js

@@ -1,5 +1,5 @@
 import chalk from "chalk";
-import { execSync } from "child_process";
+import { defaultOpenBrowser } from "../lib/mcp-oauth.js";
 import path from "path";
 import {
   RuntimeEventEmitter,
@@ -41,19 +41,10 @@ const BUILTIN_CODING_AGENT_MCP_REGISTRY = Object.freeze({
   ],
 });
 
+// Shared safe opener: validates http(s) and never routes the URL through a
+// shell (execSync `start "" "${url}"` let `"`/`$()` in a URL reach cmd.exe/sh).
 function openBrowser(url) {
-  try {
-    const platform = process.platform;
-    if (platform === "win32") {
-      execSync(`start "" "${url}"`, { stdio: "ignore" });
-    } else if (platform === "darwin") {
-      execSync(`open "${url}"`, { stdio: "ignore" });
-    } else {
-      execSync(`xdg-open "${url}"`, { stdio: "ignore" });
-    }
-  } catch (_err) {
-    // Non-critical.
-  }
+  defaultOpenBrowser(url);
 }
 
 export class AgentRuntime {
@@ -211,6 +202,8 @@ export class AgentRuntime {
       allowRemote,
       project,
       httpPort,
+      remoteSessionRelayUrl,
+      remoteSessionPeerId,
     } = this.policy;
     let { host } = this.policy;
 
@@ -325,6 +318,8 @@ export class AgentRuntime {
       maxConnections,
       timeout,
       sessionManager,
+      remoteSessionRelayUrl,
+      remoteSessionPeerId,
       envelopeBus,
     });
 

package/src/runtime/policies/agent-policy.js

@@ -26,6 +26,8 @@ export function resolveAgentPolicy({
     noStream: overrides.noStream === true,
     parkOnExit: overrides.parkOnExit === false ? false : true,
     bundlePath: overrides.bundlePath || null,
+    remoteSessionRelayUrl: overrides.remoteSessionRelayUrl || null,
+    remoteSessionPeerId: overrides.remoteSessionPeerId || null,
     additionalDirectories: Array.isArray(overrides.additionalDirectories)
       ? overrides.additionalDirectories
       : [],

package/src/assets/web-panel/assets/ChatBubbleRenderer-D2KfETZD.js

@@ -1 +0,0 @@
-import{I as h,P as u,J as S,U as n,R as a,S as y,K as C,Q as x,V as w,_ as B,b as s}from"./vendor-BvqAck49.js";import{_ as k}from"./index-UUMCA2Sq.js";import"./icons-DP3uiYxy.js";const N={__name:"ChatBubbleRenderer",props:{event:{type:Object,required:!0}},setup(c,{expose:d}){d();const t=c,r=s(()=>{const e=t.event.content||{};return e.text||e.body||e.message||e.title||JSON.stringify(e).slice(0,200)}),i=s(()=>{const e=t.event.content||{};return e.from||e.sender||e.senderName||t.event.actor||"(unknown)"}),l=s(()=>{const e=(t.event.actor||"").toLowerCase();return e.includes("self")||e==="me"||e.endsWith("_self")}),o=s(()=>{const e=t.event.source.adapter||"";return e.startsWith("messaging-qq")?"magenta":e==="wechat"?"green":"blue"}),m=s(()=>{if(!t.event.occurredAt)return"";try{const e=new Date(t.event.occurredAt),p=e.getFullYear(),b=String(e.getMonth()+1).padStart(2,"0"),f=String(e.getDate()).padStart(2,"0"),g=String(e.getHours()).padStart(2,"0"),v=String(e.getMinutes()).padStart(2,"0");return`${p}-${b}-${f} ${g}:${v}`}catch{return""}}),_={props:t,messageText:r,actorLabel:i,isMine:l,adapterColor:o,formattedTime:m,computed:s};return Object.defineProperty(_,"__isScriptSetup",{enumerable:!1,value:!0}),_}},T={class:"bubble"},q={class:"meta"},M={class:"actor"},R={class:"time"},V={class:"body"};function D(c,d,t,r,i,l){const o=h("a-tag");return u(),S("div",{class:B(["chat-row",{mine:r.isMine}])},[n("div",T,[n("div",q,[n("span",M,a(r.actorLabel),1),n("span",R,a(r.formattedTime),1)]),n("div",V,a(r.messageText),1),t.event.source.adapter?(u(),y(o,{key:0,class:"src",color:r.adapterColor},{default:C(()=>[x(a(t.event.source.adapter),1)]),_:1},8,["color"])):w("v-if",!0)])],2)}const A=k(N,[["render",D],["__scopeId","data-v-49238629"],["__file","/tmp/cc-web-panel-GZtvqb/repo/packages/web-panel/src/components/pdh/renderers/ChatBubbleRenderer.vue"]]);export{A as default};

package/src/assets/web-panel/assets/Compliance-T8EtTecW.js

@@ -1 +0,0 @@
-import{I as p,J as m,U as g,R as r,c as a,K as o,V as c,S as _,o as ne,a as X,b as E,r as h,P as s,Q as b,F as R,Z,$ as ie}from"./vendor-BvqAck49.js";import{t as G,_ as he,u as re,b as se,d as v}from"./index-UUMCA2Sq.js";import{s as _e,am as ke,ak as xe,G as ze,Z as Ae,b2 as Se,D as Te,b3 as Ce,as as Oe,R as Fe}from"./icons-DP3uiYxy.js";const Re=Object.freeze(["file-md5","file-sha1","file-sha256","file-sha512","ipv4","ipv6","domain","url","email"]);function T(e,l=0){return typeof e=="number"&&Number.isFinite(e)?e:l}function ye(e,l=0){if(!e||typeof e!="object")return null;const d=e.id||"";if(!d)return null;const t=Array.isArray(e.labels)?e.labels:[];return{key:d,id:d,type:String(e.type||""),value:String(e.value||""),labels:t,confidence:e.confidence!=null?T(e.confidence,null):null,sourceId:e.sourceId??e.source_id??null,sourceName:e.sourceName??e.source_name??null,validFrom:e.validFrom??e.valid_from??null,validUntil:e.validUntil??e.valid_until??null,firstSeenAt:e.firstSeenAt??e.first_seen_at??null,lastSeenAt:e.lastSeenAt??e.last_seen_at??null,_idx:l}}function ce(e){const l=G(e);return Array.isArray(l)?l.map(ye).filter(Boolean):[]}function ue(e){const l=G(e);return!l||typeof l!="object"||Array.isArray(l)?null:{matched:!!l.matched,type:String(l.type||"unknown"),indicator:l.indicator?ye(l.indicator):null}}function de(e){const l={total:0,byType:{}},d=G(e);if(!d||typeof d!="object"||Array.isArray(d))return l;if(l.total=T(d.total,0),d.byType&&typeof d.byType=="object")for(const[t,C]of Object.entries(d.byType))typeof C=="number"&&Number.isFinite(C)&&(l.byType[t]=C);return l}function we(e,l=0){if(!e||typeof e!="object")return null;const d=e.entity||"";return d?{key:d,entity:d,eventCount:T(e.eventCount??e.event_count,0),failureRate:T(e.failureRate??e.failure_rate,0),uniqueResources:T(e.uniqueResources??e.unique_resources,0),uniqueActions:T(e.uniqueActions??e.unique_actions,0),burstiness:T(e.burstiness,0),riskScore:T(e.riskScore??e.risk_score,0),_idx:l}:null}function me(e){const l=G(e);return Array.isArray(l)?l.map(we).filter(Boolean):[]}function Ue(e,l=0){return!e||typeof e!="object"?null:{key:l,score:T(e.score,0),reasons:Array.isArray(e.reasons)?e.reasons:[],event:e.event&&typeof e.event=="object"?e.event:null,_idx:l}}function pe(e){const l=G(e);return Array.isArray(l)?l.map(Ue).filter(Boolean):[]}function $(e){if(!e)return{noAuditLog:!1,error:""};const l=/no such table:\s*audit_log/i.test(e),d=e.match(/Failed:\s*(.+?)(?:\r?\n|$)/i);return{noAuditLog:l,error:d?d[1].trim():""}}function je(e){if(e==null||e==="")return"—";const l=typeof e=="number"?new Date(e):new Date(String(e));return isNaN(l.getTime())?String(e):l.toLocaleString("zh-CN",{hour12:!1})}const Be={__name:"Compliance",setup(e,{expose:l}){l();const d=re(),{t}=se(),C=h(!1),J=h(!1),w=h(!1),U=h(!1),I=h([]),M=h({total:0,byType:{}}),L=h([]),z=h([]),k=h({noAuditLog:!1,error:""}),S=h("threat"),D=h(""),x=h(!1),j=h(!1),N=h(!1),H=X({observable:""}),B=h(null),O=X({entity:"",days:30}),A=X({entity:"",threshold:.7,days:1}),ee=E(()=>[{title:t("compliance.cols.type"),key:"type",width:"120px"},{title:t("compliance.cols.value"),key:"value"},{title:t("compliance.cols.labels"),key:"labels",width:"160px"},{title:t("compliance.cols.confidence"),key:"confidence",width:"90px"},{title:t("compliance.cols.source"),key:"source",width:"160px"},{title:t("compliance.cols.lastSeen"),key:"lastSeen",width:"160px"},{title:t("compliance.cols.action"),key:"action",width:"90px"}]),te=E(()=>[{title:t("compliance.cols.entity"),key:"entity",width:"180px"},{title:t("compliance.cols.riskScore"),key:"riskScore"},{title:t("compliance.cols.eventCount"),key:"eventCount",width:"90px"},{title:t("compliance.cols.failureRate"),key:"failureRate",width:"90px"},{title:t("compliance.cols.uniqueResources"),key:"uniqueResources",width:"90px"},{title:t("compliance.cols.burstiness"),key:"burstiness",width:"90px"}]),ae=E(()=>D.value?I.value.filter(i=>i.type===D.value):I.value),oe=E(()=>Object.keys(M.value.byType).length),W=E(()=>Object.entries(M.value.byType).sort((i,y)=>y[1]-i[1])),F=E(()=>L.value.filter(i=>i.riskScore>=70).length),P={ipv4:"blue",ipv6:"cyan",domain:"purple",url:"magenta",email:"gold","file-md5":"orange","file-sha1":"orange","file-sha256":"red","file-sha512":"red",unknown:"default"};function V(i){return P[i]||"default"}function K(i){return i>=80?"#ff4d4f":i>=50?"#faad14":"#52c41a"}function n(i){return i>=70?"#ff4d4f":i>=40?"#faad14":"#52c41a"}function u(i,y){return i?i.length>y?i.slice(0,y)+"...":i:""}function Y({key:i}){i==="match"?(B.value=null,x.value=!0):i==="ueba-build"?j.value=!0:i==="ueba-analyze"&&(N.value=!0)}async function Q(){C.value=!0;try{const[i,y,f]=await Promise.all([d.execute("compliance threat-intel list --limit 200 --json",1e4).catch(()=>({output:""})),d.execute("compliance threat-intel stats --json",8e3).catch(()=>({output:""})),d.execute("compliance ueba top --top-k 20 --json",1e4).catch(()=>({output:""}))]);I.value=ce(i.output),M.value=de(y.output),k.value=$(f.output),L.value=k.value.noAuditLog?[]:me(f.output)}catch(i){v.error(t("compliance.msg.loadFailed")+": "+(i?.message||i))}finally{C.value=!1}}async function fe(){const i=H.observable.trim();if(!i){v.warning(t("compliance.msg.matchEmpty"));return}J.value=!0,B.value=null;try{const y=`compliance threat-intel match "${i.replace(/"/g,'\\"')}" --json`,{output:f}=await d.execute(y,8e3),q=ue(f);if(!q){v.error(t("compliance.msg.matchFailed")+": "+f.slice(0,120));return}B.value=q,q.matched?v.warning(t("compliance.msg.matchHit",{type:q.type})):q.type==="unknown"?v.info(t("compliance.msg.matchUnknownType")):v.success(t("compliance.msg.matchMiss",{type:q.type}))}catch(y){v.error(t("compliance.msg.matchFailed")+": "+(y?.message||y))}finally{J.value=!1}}async function be(i){try{const y=`compliance threat-intel remove ${i.type} "${i.value.replace(/"/g,'\\"')}" --json`,{output:f}=await d.execute(y,8e3);if(/error|失败/i.test(f)&&!/"removed"/.test(f)){v.error(t("compliance.msg.deleteFailed")+": "+f.slice(0,120));return}v.success(t("compliance.msg.deleteSuccess")),await Q()}catch(y){v.error(t("compliance.msg.deleteFailed")+": "+(y?.message||y))}}async function ve(){w.value=!0;try{const i=["compliance ueba baseline"];O.entity.trim()&&i.push(`--entity "${O.entity.trim().replace(/"/g,'\\"')}"`),O.days!=null&&i.push(`--days ${O.days}`),i.push("--json");const{output:y}=await d.execute(i.join(" "),3e4),f=$(y);if(f.noAuditLog){k.value=f,v.warning(t("compliance.msg.auditEmptyBuild")),j.value=!1;return}if(f.error){v.error(t("compliance.msg.buildFailed")+": "+f.error);return}v.success(t("compliance.msg.buildSuccess")),j.value=!1,S.value="ueba",await Q()}catch(i){v.error(t("compliance.msg.buildFailed")+": "+(i?.message||i))}finally{w.value=!1}}async function ge(){U.value=!0;try{const i=["compliance ueba analyze"];A.entity.trim()&&i.push(`--entity "${A.entity.trim().replace(/"/g,'\\"')}"`),A.threshold!=null&&i.push(`--threshold ${A.threshold}`),A.days!=null&&i.push(`--days ${A.days}`),i.push("--json");const{output:y}=await d.execute(i.join(" "),3e4),f=$(y);if(f.noAuditLog){k.value=f,v.warning(t("compliance.msg.auditEmptyAnalyze")),N.value=!1;return}if(f.error&&!y.includes("[")){v.error(t("compliance.msg.analyzeFailed")+": "+f.error);return}z.value=pe(y),v.success(t("compliance.msg.analyzeSuccess",{n:z.value.length})),N.value=!1,S.value="ueba"}catch(i){v.error(t("compliance.msg.analyzeFailed")+": "+(i?.message||i))}finally{U.value=!1}}ne(Q);const le={ws:d,t,loading:C,matching:J,building:w,analyzing:U,indicators:I,threatStats:M,uebaTop:L,anomalies:z,uebaError:k,activeTab:S,iocTypeFilter:D,showMatchModal:x,showBuildModal:j,showAnalyzeModal:N,matchForm:H,matchResult:B,buildForm:O,analyzeForm:A,indicatorColumns:ee,uebaColumns:te,filteredIndicators:ae,threatTypeCount:oe,typeBreakdown:W,highRiskCount:F,IOC_TYPE_COLORS:P,iocTypeColor:V,confidenceColor:K,riskColor:n,truncate:u,handleNewClick:Y,loadAll:Q,matchObservable:fe,removeIndicator:be,buildBaseline:ve,runAnalyze:ge,ref:h,computed:E,onMounted:ne,reactive:X,get ReloadOutlined(){return Fe},get PlusOutlined(){return Oe},get AimOutlined(){return Ce},get DatabaseOutlined(){return Te},get FundOutlined(){return Se},get SafetyCertificateOutlined(){return Ae},get BlockOutlined(){return ze},get UserOutlined(){return xe},get WarningOutlined(){return ke},get AlertOutlined(){return _e},get message(){return v},get useI18n(){return se},get useWsStore(){return re},get parseIndicators(){return ce},get parseMatchResult(){return ue},get parseThreatIntelStats(){return de},get parseUebaTop(){return me},get parseAnomalies(){return pe},get detectUebaError(){return $},get formatComplianceTime(){return je},get IOC_TYPES(){return Re}};return Object.defineProperty(le,"__isScriptSetup",{enumerable:!1,value:!0}),le}},Ee={style:{display:"flex","align-items":"center","justify-content":"space-between","margin-bottom":"24px"}},Ie={class:"page-title"},Me={class:"page-sub"},Le={class:"filter-bar"},Ne={key:1,style:{color:"var(--text-primary)","font-family":"monospace","font-size":"12px","word-break":"break-all"}},Pe={key:0,style:{color:"var(--text-muted)"}},qe={key:1,style:{color:"var(--text-muted)"}},De={key:0,style:{color:"var(--text-secondary)","font-size":"12px"}},We={key:1,style:{color:"var(--text-muted)"}},Ve={key:5,style:{color:"var(--text-secondary)","font-size":"11px"}},Ke={style:{padding:"40px",color:"var(--text-muted)","text-align":"center"}},Ye={style:{color:"var(--text-primary)",margin:"16px 0 8px","font-size":"14px"}},Ze={key:0,style:{color:"var(--text-primary)","font-family":"monospace","font-weight":"500"}},Ge={key:2,style:{color:"var(--text-secondary)"}},Je={key:5,style:{color:"var(--text-secondary)","font-family":"monospace","font-size":"11px"}},He={style:{padding:"30px",color:"var(--text-muted)","text-align":"center"}},Qe={key:2,style:{color:"var(--text-primary)",margin:"24px 0 8px","font-size":"14px"}},Xe={style:{flex:"1"}},$e={style:{display:"flex",gap:"8px","align-items":"center"}},et={key:0,style:{color:"var(--text-primary)","font-family":"monospace","font-size":"12px"}},tt={key:1,style:{color:"var(--text-secondary)","font-size":"11px"}},at={key:0,style:{"margin-top":"4px"}},ot={style:{"margin-top":"8px","font-size":"12px",color:"var(--text-secondary)"}},lt={key:0,style:{"margin-top":"12px","font-size":"12px"}},nt={style:{color:"var(--text-secondary)"}},it={style:{color:"var(--text-secondary)"}},rt={key:0,style:{"margin-top":"4px"}},st={style:{color:"var(--text-secondary)","font-size":"12px",margin:"0"}},ct={style:{color:"var(--text-secondary)","font-size":"12px",margin:"0"}};function ut(e,l,d,t,C,J){const w=p("a-button"),U=p("a-menu-item"),I=p("a-menu"),M=p("a-dropdown"),L=p("a-space"),z=p("a-statistic"),k=p("a-card"),S=p("a-col"),D=p("a-row"),x=p("a-tag"),j=p("a-radio-button"),N=p("a-radio-group"),H=p("a-popconfirm"),B=p("a-table"),O=p("a-tab-pane"),A=p("a-alert"),ee=p("a-progress"),te=p("a-list-item"),ae=p("a-list"),oe=p("a-tabs"),W=p("a-input"),F=p("a-form-item"),P=p("a-form"),V=p("a-modal"),K=p("a-input-number");return s(),m("div",null,[g("div",Ee,[g("div",null,[g("h2",Ie,r(e.$t("compliance.title")),1),g("p",Me,r(e.$t("compliance.subtitle")),1)]),a(L,null,{default:o(()=>[a(w,{loading:t.loading,onClick:t.loadAll},{icon:o(()=>[a(t.ReloadOutlined)]),default:o(()=>[b(" "+r(e.$t("compliance.refresh")),1)]),_:1},8,["loading"]),a(M,{trigger:["click"]},{overlay:o(()=>[a(I,{onClick:t.handleNewClick},{default:o(()=>[a(U,{key:"match"},{default:o(()=>[a(t.AimOutlined),b(" "+r(e.$t("compliance.actions.match")),1)]),_:1}),a(U,{key:"ueba-build"},{default:o(()=>[a(t.DatabaseOutlined),b(" "+r(e.$t("compliance.actions.uebaBuild")),1)]),_:1}),a(U,{key:"ueba-analyze"},{default:o(()=>[a(t.FundOutlined),b(" "+r(e.$t("compliance.actions.uebaAnalyze")),1)]),_:1})]),_:1})]),default:o(()=>[a(w,{type:"primary"},{icon:o(()=>[a(t.PlusOutlined)]),default:o(()=>[b(" "+r(e.$t("compliance.actionDropdown")),1)]),_:1})]),_:1})]),_:1})]),c(" Stats overview "),a(D,{gutter:[16,16],style:{"margin-bottom":"20px"}},{default:o(()=>[a(S,{xs:12,sm:8,lg:5},{default:o(()=>[a(k,{style:{background:"var(--bg-card)","border-color":"var(--border-color)"}},{default:o(()=>[a(z,{title:e.$t("compliance.stats.iocTotal"),value:t.threatStats.total,"value-style":{color:"#1677ff",fontSize:"20px"}},{prefix:o(()=>[a(t.SafetyCertificateOutlined)]),_:1},8,["title","value"])]),_:1})]),_:1}),a(S,{xs:12,sm:8,lg:5},{default:o(()=>[a(k,{style:{background:"var(--bg-card)","border-color":"var(--border-color)"}},{default:o(()=>[a(z,{title:e.$t("compliance.stats.iocTypes"),value:t.threatTypeCount,"value-style":{color:"#13c2c2",fontSize:"20px"}},{prefix:o(()=>[a(t.BlockOutlined)]),_:1},8,["title","value"])]),_:1})]),_:1}),a(S,{xs:12,sm:8,lg:5},{default:o(()=>[a(k,{style:{background:"var(--bg-card)","border-color":"var(--border-color)"}},{default:o(()=>[a(z,{title:e.$t("compliance.stats.riskEntities"),value:t.uebaTop.length,"value-style":{color:"#722ed1",fontSize:"20px"}},{prefix:o(()=>[a(t.UserOutlined)]),_:1},8,["title","value"])]),_:1})]),_:1}),a(S,{xs:12,sm:8,lg:5},{default:o(()=>[a(k,{style:{background:"var(--bg-card)","border-color":"var(--border-color)"}},{default:o(()=>[a(z,{title:e.$t("compliance.stats.highRisk"),value:t.highRiskCount,"value-style":{color:t.highRiskCount>0?"#ff4d4f":"#52c41a",fontSize:"20px"}},{prefix:o(()=>[a(t.WarningOutlined)]),_:1},8,["title","value","value-style"])]),_:1})]),_:1}),a(S,{xs:24,sm:8,lg:4},{default:o(()=>[a(k,{style:{background:"var(--bg-card)","border-color":"var(--border-color)"}},{default:o(()=>[a(z,{title:e.$t("compliance.stats.recentAnomalies"),value:t.anomalies.length,"value-style":{color:"#faad14",fontSize:"20px"}},{prefix:o(()=>[a(t.AlertOutlined)]),_:1},8,["title","value"])]),_:1})]),_:1})]),_:1}),c(" Type breakdown "),t.threatStats.total>0?(s(),_(k,{key:0,title:e.$t("compliance.typeBreakdown"),size:"small",style:{background:"var(--bg-card)","border-color":"var(--border-color)","margin-bottom":"20px"},"body-style":{padding:"12px 16px"}},{default:o(()=>[a(L,{size:[12,8],wrap:""},{default:o(()=>[(s(!0),m(R,null,Z(t.typeBreakdown,([n,u])=>(s(),_(x,{key:n,color:t.iocTypeColor(n)},{default:o(()=>[b(r(n)+": "+r(u),1)]),_:2},1032,["color"]))),128))]),_:1})]),_:1},8,["title"])):c("v-if",!0),c(" Tabs "),a(oe,{activeKey:t.activeTab,"onUpdate:activeKey":l[1]||(l[1]=n=>t.activeTab=n),class:"compliance-tabs"},{default:o(()=>[c(" ── Threat Intel tab ──────────────────────────────────────── "),a(O,{key:"threat",tab:e.$t("compliance.tabs.threat")},{default:o(()=>[g("div",Le,[a(N,{value:t.iocTypeFilter,"onUpdate:value":l[0]||(l[0]=n=>t.iocTypeFilter=n),size:"small"},{default:o(()=>[a(j,{value:""},{default:o(()=>[b(r(e.$t("compliance.filter.all")),1)]),_:1}),(s(!0),m(R,null,Z(t.IOC_TYPES,n=>(s(),_(j,{key:n,value:n},{default:o(()=>[b(r(n),1)]),_:2},1032,["value"]))),128))]),_:1},8,["value"])]),a(B,{columns:t.indicatorColumns,"data-source":t.filteredIndicators,pagination:{pageSize:20,showTotal:n=>e.$t("compliance.table.totalSuffix",{n})},size:"small",loading:t.loading,style:{background:"var(--bg-card)"}},{bodyCell:o(({column:n,record:u})=>[n.key==="type"?(s(),_(x,{key:0,color:t.iocTypeColor(u.type),style:{"font-family":"monospace"}},{default:o(()=>[b(r(u.type),1)]),_:2},1032,["color"])):c("v-if",!0),n.key==="value"?(s(),m("span",Ne,r(t.truncate(u.value,64)),1)):c("v-if",!0),n.key==="labels"?(s(),m(R,{key:2},[(s(!0),m(R,null,Z(u.labels,Y=>(s(),_(x,{key:Y,color:"orange",style:{"font-size":"10px",margin:"1px"}},{default:o(()=>[b(r(Y),1)]),_:2},1024))),128)),u.labels.length?c("v-if",!0):(s(),m("span",Pe,"—"))],64)):c("v-if",!0),n.key==="confidence"?(s(),m(R,{key:3},[u.confidence!=null?(s(),m("span",{key:0,style:ie({color:t.confidenceColor(u.confidence),fontWeight:500})},r(u.confidence),5)):(s(),m("span",qe,"—"))],64)):c("v-if",!0),n.key==="source"?(s(),m(R,{key:4},[u.sourceName?(s(),m("span",De,r(u.sourceName),1)):(s(),m("span",We,"—"))],64)):c("v-if",!0),n.key==="lastSeen"?(s(),m("span",Ve,r(t.formatComplianceTime(u.lastSeenAt)),1)):c("v-if",!0),n.key==="action"?(s(),_(H,{key:6,title:e.$t("compliance.table.deleteConfirm"),"ok-text":e.$t("compliance.table.deleteOk"),"cancel-text":e.$t("compliance.table.cancel"),onConfirm:Y=>t.removeIndicator(u)},{default:o(()=>[a(w,{size:"small",type:"link",danger:""},{default:o(()=>[b(r(e.$t("compliance.table.delete")),1)]),_:1})]),_:1},8,["title","ok-text","cancel-text","onConfirm"])):c("v-if",!0)]),emptyText:o(()=>[g("div",Ke,[a(t.SafetyCertificateOutlined,{style:{"font-size":"36px","margin-bottom":"10px",display:"block"}}),b(" "+r(e.$t("compliance.table.emptyThreatsLine1"))+" ",1),l[11]||(l[11]=g("code",{style:{"font-size":"11px"}},"cc compliance threat-intel import <file.json>",-1))])]),_:1},8,["columns","data-source","pagination","loading"])]),_:1},8,["tab"]),c(" ── UEBA tab ──────────────────────────────────────────────── "),a(O,{key:"ueba",tab:e.$t("compliance.tabs.ueba")},{default:o(()=>[t.uebaError.noAuditLog?(s(),_(A,{key:0,type:"info","show-icon":"",message:e.$t("compliance.ueba.noAuditLog"),description:e.$t("compliance.ueba.noAuditLogDesc"),style:{"margin-bottom":"16px"}},null,8,["message","description"])):t.uebaError.error?(s(),_(A,{key:1,type:"error","show-icon":"",message:e.$t("compliance.ueba.errorMessage",{err:t.uebaError.error}),style:{"margin-bottom":"16px"}},null,8,["message"])):c("v-if",!0),g("h3",Ye,r(e.$t("compliance.ueba.topRiskTitle",{count:t.uebaTop.length})),1),a(B,{columns:t.uebaColumns,"data-source":t.uebaTop,pagination:!1,size:"small",loading:t.loading,style:{background:"var(--bg-card)"}},{bodyCell:o(({column:n,record:u})=>[n.key==="entity"?(s(),m("span",Ze,r(u.entity),1)):c("v-if",!0),n.key==="riskScore"?(s(),_(ee,{key:1,percent:Math.min(u.riskScore,100),"stroke-color":t.riskColor(u.riskScore),size:"small",format:()=>u.riskScore.toFixed(1)},null,8,["percent","stroke-color","format"])):c("v-if",!0),n.key==="eventCount"?(s(),m("span",Ge,r(u.eventCount),1)):c("v-if",!0),n.key==="failureRate"?(s(),m("span",{key:3,style:ie({color:u.failureRate>.3?"#ff4d4f":"var(--text-secondary)",fontFamily:"monospace"})},r((u.failureRate*100).toFixed(1))+"% ",5)):c("v-if",!0),n.key==="uniqueResources"?(s(),_(x,{key:4,color:"cyan",style:{"font-size":"11px"}},{default:o(()=>[b(r(u.uniqueResources),1)]),_:2},1024)):c("v-if",!0),n.key==="burstiness"?(s(),m("span",Je,r((u.burstiness*100).toFixed(0))+"% ",1)):c("v-if",!0)]),emptyText:o(()=>[g("div",He,[a(t.UserOutlined,{style:{"font-size":"32px","margin-bottom":"8px",display:"block"}}),b(" "+r(t.uebaError.noAuditLog?e.$t("compliance.table.emptyAuditEntities"):e.$t("compliance.table.emptyRiskEntities")),1)])]),_:1},8,["columns","data-source","loading"]),t.anomalies.length?(s(),m("h3",Qe,r(e.$t("compliance.ueba.anomalyTitle",{count:t.anomalies.length})),1)):c("v-if",!0),t.anomalies.length?(s(),_(ae,{key:3,size:"small","data-source":t.anomalies,locale:{emptyText:e.$t("compliance.table.noAnomalies")}},{renderItem:o(({item:n})=>[a(te,{style:{background:"var(--bg-card)",padding:"10px 16px"}},{default:o(()=>[g("div",Xe,[g("div",$e,[a(x,{color:t.riskColor(n.score*100)},{default:o(()=>[b("score "+r(n.score.toFixed(2)),1)]),_:2},1032,["color"]),n.event?.entity?(s(),m("span",et,r(n.event.entity),1)):c("v-if",!0),n.event?.action?(s(),m("span",tt," → "+r(n.event.action),1)):c("v-if",!0)]),n.reasons.length?(s(),m("div",at,[(s(!0),m(R,null,Z(n.reasons,u=>(s(),_(x,{key:u,color:"volcano",style:{"font-size":"10px",margin:"1px"}},{default:o(()=>[b(r(u),1)]),_:2},1024))),128))])):c("v-if",!0)])]),_:2},1024)]),_:1},8,["data-source","locale"])):c("v-if",!0)]),_:1},8,["tab"])]),_:1},8,["activeKey"]),c(" ── Match modal ───────────────────────────────────────────── "),a(V,{open:t.showMatchModal,"onUpdate:open":l[3]||(l[3]=n=>t.showMatchModal=n),title:e.$t("compliance.match.modalTitle"),"confirm-loading":t.matching,width:500,"ok-text":e.$t("compliance.match.ok"),"cancel-text":e.$t("compliance.match.close"),onOk:t.matchObservable},{default:o(()=>[a(P,{"label-col":{span:5},"wrapper-col":{span:19},style:{"margin-top":"16px"}},{default:o(()=>[a(F,{label:e.$t("compliance.match.label"),required:""},{default:o(()=>[a(W,{value:t.matchForm.observable,"onUpdate:value":l[2]||(l[2]=n=>t.matchForm.observable=n),placeholder:e.$t("compliance.match.placeholder"),"allow-clear":""},null,8,["value","placeholder"])]),_:1},8,["label"])]),_:1}),t.matchResult?(s(),_(k,{key:0,size:"small",style:{background:"var(--bg-base)","margin-top":"8px"}},{default:o(()=>[a(z,{title:e.$t("compliance.match.result"),value:t.matchResult.matched?e.$t("compliance.match.hit"):e.$t("compliance.match.miss"),"value-style":{color:t.matchResult.matched?"#ff4d4f":"#52c41a"}},null,8,["title","value","value-style"]),g("div",ot,[b(r(e.$t("compliance.match.detectType"))+" ",1),a(x,{color:t.iocTypeColor(t.matchResult.type)},{default:o(()=>[b(r(t.matchResult.type),1)]),_:1},8,["color"])]),t.matchResult.indicator?(s(),m("div",lt,[g("div",nt,r(e.$t("compliance.match.sourcePrefix"))+" "+r(t.matchResult.indicator.sourceName||"—"),1),g("div",it,r(e.$t("compliance.match.confidencePrefix"))+" "+r(t.matchResult.indicator.confidence??"—"),1),t.matchResult.indicator.labels.length?(s(),m("div",rt,[(s(!0),m(R,null,Z(t.matchResult.indicator.labels,n=>(s(),_(x,{key:n,color:"orange",style:{"font-size":"10px"}},{default:o(()=>[b(r(n),1)]),_:2},1024))),128))])):c("v-if",!0)])):c("v-if",!0)]),_:1})):c("v-if",!0)]),_:1},8,["open","title","confirm-loading","ok-text","cancel-text"]),c(" ── UEBA build baseline modal ─────────────────────────────── "),a(V,{open:t.showBuildModal,"onUpdate:open":l[6]||(l[6]=n=>t.showBuildModal=n),title:e.$t("compliance.build.modalTitle"),"confirm-loading":t.building,width:480,"ok-text":e.$t("compliance.build.ok"),"cancel-text":e.$t("compliance.build.cancel"),onOk:t.buildBaseline},{default:o(()=>[a(P,{"label-col":{span:6},"wrapper-col":{span:18},style:{"margin-top":"16px"}},{default:o(()=>[a(F,{label:e.$t("compliance.build.entityLabel")},{default:o(()=>[a(W,{value:t.buildForm.entity,"onUpdate:value":l[4]||(l[4]=n=>t.buildForm.entity=n),placeholder:e.$t("compliance.build.entityPlaceholder")},null,8,["value","placeholder"])]),_:1},8,["label"]),a(F,{label:e.$t("compliance.build.daysLabel")},{default:o(()=>[a(K,{value:t.buildForm.days,"onUpdate:value":l[5]||(l[5]=n=>t.buildForm.days=n),min:1,max:365,placeholder:e.$t("compliance.build.daysPlaceholder"),style:{width:"100%"}},null,8,["value","placeholder"])]),_:1},8,["label"])]),_:1}),g("p",st,r(e.$t("compliance.build.footnote")),1)]),_:1},8,["open","title","confirm-loading","ok-text","cancel-text"]),c(" ── UEBA analyze modal ────────────────────────────────────── "),a(V,{open:t.showAnalyzeModal,"onUpdate:open":l[10]||(l[10]=n=>t.showAnalyzeModal=n),title:e.$t("compliance.analyze.modalTitle"),"confirm-loading":t.analyzing,width:480,"ok-text":e.$t("compliance.analyze.ok"),"cancel-text":e.$t("compliance.analyze.cancel"),onOk:t.runAnalyze},{default:o(()=>[a(P,{"label-col":{span:6},"wrapper-col":{span:18},style:{"margin-top":"16px"}},{default:o(()=>[a(F,{label:e.$t("compliance.analyze.entityLabel")},{default:o(()=>[a(W,{value:t.analyzeForm.entity,"onUpdate:value":l[7]||(l[7]=n=>t.analyzeForm.entity=n),placeholder:e.$t("compliance.analyze.entityPlaceholder")},null,8,["value","placeholder"])]),_:1},8,["label"]),a(F,{label:e.$t("compliance.analyze.thresholdLabel")},{default:o(()=>[a(K,{value:t.analyzeForm.threshold,"onUpdate:value":l[8]||(l[8]=n=>t.analyzeForm.threshold=n),min:0,max:1,step:.05,style:{width:"100%"}},null,8,["value"])]),_:1},8,["label"]),a(F,{label:e.$t("compliance.analyze.daysLabel")},{default:o(()=>[a(K,{value:t.analyzeForm.days,"onUpdate:value":l[9]||(l[9]=n=>t.analyzeForm.days=n),min:1,max:30,style:{width:"100%"}},null,8,["value"])]),_:1},8,["label"])]),_:1}),g("p",ct,r(e.$t("compliance.analyze.footnote")),1)]),_:1},8,["open","title","confirm-loading","ok-text","cancel-text"])])}const yt=he(Be,[["render",ut],["__scopeId","data-v-d3ffc3f8"],["__file","/tmp/cc-web-panel-GZtvqb/repo/packages/web-panel/src/views/Compliance.vue"]]);export{yt as default};