[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (silas-1.7-pro) — high/critical — please review

Summary: Tier 3: DB permission migration plus manual SOAR trigger; secret masking fail-open, global frontend cache, duplicated components, and locale key removals need review.

• high backend/migrations/000007_soar_execute.up.sql:8 — Migration hardcodes the admin role UUID and grants a new permission directly. Verify this is safe for all production tenants and has a clear roll-forward/rollback plan; prefer a role lookup or documented fixed UUID.
• high backend/modules/soar/usecase/execution.go:121 — Secret masking is fail-open: if MaskSecrets errors, the raw command is persisted. This is a secret-handling regression; fail closed or preserve the previous masked/empty behavior.
• medium backend/modules/soar/usecase/execution.go:70 — Manual trigger bypasses the flow Active() guard. If disabled flows must not run, enforce the same guard for manual execution or explicitly document the exception.
• medium backend/modules/soar/usecase/execution.go:175 — agentOverride only fills in when alert.dataSource is empty, but the interface and UI imply it should override the alert source. Align the resolution order with the documented contract.
• medium frontend/src/features/soar/hooks/use-common-response.ts:29 — New module-level mutable flowsCache is a disguised singleton with no invalidation. Use React Query, a service-level cache, or component-scoped state.
• medium frontend/src/features/soar/pages/components/FlowColumns.tsx:1 — Duplicate FlowColumns and FlowKpis components were added under pages/components while components/ versions are used. Remove the duplicate or consolidate into one shared location.
• medium frontend/src/shared/i18n/locales/en.json:6631 — Existing locale keys were removed from en.json. Verify they are truly unused; otherwise restore them to avoid breaking other UI surfaces.
• low frontend/src/features/soar/services/soar-flows.service.ts:22 — trigger() is typed as returning Flow, but the endpoint returns FlowTriggerResponse. Define and use the correct response type.
• low backend/modules/soar/connectors/usecase.go:29 — ExecutionUsecase interface was extended. This is an internal contract change; ensure all implementations and test doubles are updated.
• low frontend/src/features/soar/lib/common-response.ts:10 — SOAR logic imports templateFor from the liveops feature, creating cross-feature coupling. Move shared template/platform resolution into a shared module.

🛑 bugs (silas-1.7-pro) — high/critical — please review

Summary: Test file has a compile error (missing arg), agentOverride logic is inverted from its documented contract, and osOf misclassifies MacBook Pro hosts as Windows.

• high backend/modules/soar/usecase/execution_startflow_test.go:82 — All four calls to uc.StartFlow pass 5 arguments but the method signature requires 6 (the trailing manual bool is missing). This is a compile error — the entire test package will fail to build. Example: uc.StartFlow(ctx, "restart.yaml", json.RawMessage(...), "", "admin@example.com") needs a sixth argument (true or false). Reproduce: go test ./backend/modules/soar/usecase/.
• high backend/modules/soar/usecase/execution.go:175 — agentOverride does not actually override alert.dataSource. The interface comment states 'agentOverride wins over alert.dataSource for shell roots', but the code only falls back to agentOverride when dataSource is empty: src := gjson.GetBytes(alertJSON, "dataSource").String(); if src == "" { src = agentOverride }. In FlowTriggerModal, if a user explicitly selects a different agent while the alert has a dataSource, the user's choice is silently ignored. Fix: check agentOverride first, then fall back to dataSource.
• medium frontend/src/features/soar/lib/common-response.ts:17 — osOf() classifies hosts matching /\b(wks|mbp)\b/ as 'windows', but 'mbp' is MacBook Pro (macOS). A host named 'mbp-001' will be routed to a Windows SOAR flow instead of a macOS one. Remove 'mbp' from the Windows regex (or add it to the macOS check). The subsequent n.includes('mac') line never fires for 'mbp' hosts because the Windows check returns first.
• medium frontend/src/shared/i18n/locales/en.json:6634 — Approximately 60 narrative-template keys (scExec, scPayload, capUe0–capUe3, titleUe, capSd0–capSd3, titleSd, capPh0–capPh3, titlePh, capPi0–capPi3, titlePi, capCd0–capCd3, titleCd, capDd0–capDd3, titleDd, capTd0–capTd3, titleTd, capCt0–capCt3, titleCt, etc.) are deleted. These are unrelated to the manual-trigger feature and appear to be an accidental out-of-context change. If any component still references these keys, users will see raw key names instead of translated text.
• low frontend/src/features/soar/pages/components/FlowColumns.tsx:1 — This file (and the sibling FlowKpis.tsx in the same directory) is dead code — FlowsPage.tsx imports buildFlowColumns and FlowKpis from '../components/' (i.e. frontend/src/features/soar/components/), not from 'pages/components/'. These duplicates should be removed to avoid confusion.

🛑 security (silas-1.7-pro) — high/critical — please review

Summary: New SOAR manual trigger adds an admin execution path; findings include disabled-flow bypass, fail-open secret masking, and agent-override logic that can target unintended hosts.

• medium backend/modules/soar/usecase/execution.go:70 — Manual trigger passes manual=true, so StartFlow skips sf.Active() and can execute disabled flows. Respect the enabled state for manual runs or require an explicit override permission.
• medium backend/modules/soar/usecase/execution.go:119 — If VariableUsecase.MaskSecrets fails, the code falls back to the unmasked command and persists it in SoarExecution.Command. Fail closed or ensure secrets are masked before storing/executing.
• low backend/modules/soar/usecase/execution.go:175 — agentOverride is used only when alert.dataSource is empty, despite docs saying it wins over dataSource. A manual trigger may run on the alert's original agent instead of the operator-selected one. Prefer agentOverride when non-empty.

🔴 go-deps — pending updates

🔍 Discovered 31 Go projects

📦 Dependencies with updates available:

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./collectors/as400:
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./installer:
     - github.com/cloudfoundry/gosigar: v1.3.128 → v1.3.130

  📁 ./backend:
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.2 → v1.8.3
     - github.com/aws/aws-sdk-go-v2/config: v1.33.12 → v1.33.13
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.12 → v1.20.13
     - github.com/gin-contrib/cors: v1.7.9 → v1.7.10
     - github.com/jackc/pgx/v5: v5.11.0 → v5.12.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2/config: v1.33.12 → v1.33.13
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.12 → v1.20.13
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.90.3 → v1.91.0

  📁 ./plugins/azure:
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.2 → v1.8.3

❌ Please update dependencies before merging.