fix!: require hostname or computerId for audit file history (WYREAI-386)

[asachs01]

Summary

EpiOn threatlocker_audit_file_history fails with HTTP 417 because auditLog.getFileHistory only sent fullPath. Linked from WYREAI-386 (ThreatLocker file-history 417, not the Automate pin).

GET /portalapi/ActionLog/ActionLogGetAllForFileHistoryV2 ("Get All File History by hostname and fullpath") takes query params fullPath, hostname, computerId (UUID), and optional sourceTableId, pageNumber, pageSize. The published OpenAPI spec marks every parameter optional. The live Portal API returns HTTP 417 Missing Parameters. Unable to load details. unless fullPath plus either hostname or computerId is present.

This SDK method previously called that endpoint with { fullPath } only, which is the 417.

Change

• getFileHistory now takes { fullPath, hostname?, computerId?, sourceTableId?, pageNumber?, pageSize? }.
• It throws client-side, and does not send the request, when fullPath is blank or both hostname and computerId are missing (including the old string call getFileHistory(fullPath)).
• When both identifiers are set, both are sent. Optional paging / sourceTableId are forwarded when provided.
• A bare JSON array response is unwrapped. The previous { logs } shape is still accepted.

BREAKING: callers must pass an object. @wyre-ai/node-threatlocker@^1.0.7 will not pick up the major this commit requests.

Tests

npm run lint and npm test (33 tests) passed locally. Contract tests cover hostname, computerId, both identifiers, optional query params, { logs } and bare-array bodies, and client-side rejection with zero requests.

Follow-up (not in this repo)

WYRE-AI/threatlocker-mcp still requires only fullPath and calls client.auditLog.getFileHistory(fullPath) (src/domains/audit_log.ts, asserted in src/__tests__/audit_log.test.ts). It depends on @wyre-ai/node-threatlocker@^1.0.7. After this SDK release:

1. Bump the MCP dependency to the new major.
2. Require hostname or computerId on threatlocker_audit_file_history and pass { fullPath, hostname } or { fullPath, computerId }.
3. Repin the threatlocker image in the Conduit fleet.

Do not merge this PR from the agent.

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a2cde6d7-90f3-4706-90e7-0566e1a72931

📥 Commits

Reviewing files that changed from the base of the PR and between 75db3b1 and d57f69e.

📒 Files selected for processing (6)

• CHANGELOG.md
• README.md
• src/resources/audit-log.ts
• src/types/index.ts
• tests/mocks/handlers.ts
• tests/unit/real-api-contracts.test.ts

 _______________________________________________________________
< Ghost in the Shell (Script): Stand Alone Complex Code Review. >
 ---------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀