@0dai-dev/cli 2.4.0 → 2.6.0

package/bin/0dai.js

@@ -7,7 +7,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 
-const VERSION = "2.4.0";
+const VERSION = "2.6.0";
 const API_URL = process.env.ODAI_API_URL || "https://api.0dai.dev";
 const T = process.stdout.isTTY ? "\x1b[38;2;45;212;168m" : ""; // teal
 const R = process.stdout.isTTY ? "\x1b[0m" : ""; // reset
@@ -259,6 +259,130 @@ async function cmdDetect(target) {
   console.log(`clis: ${(result.available_clis || []).join(",")}`);
 }
 
+function cmdAudit(target) {
+  const W = process.stdout.isTTY ? "\x1b[33m" : "";   // yellow
+  const RE = process.stdout.isTTY ? "\x1b[31m" : "";  // red
+  const G = process.stdout.isTTY ? "\x1b[32m" : "";   // green
+
+  // Secret patterns: [label, regex, severity]
+  const PATTERNS = [
+    ["Anthropic API key",  /sk-ant-api[0-9A-Za-z_-]{20,}/g,         "critical"],
+    ["OpenAI API key",     /sk-[A-Za-z0-9]{20,}/g,                   "critical"],
+    ["GitHub PAT (ghp)",   /ghp_[A-Za-z0-9]{36}/g,                   "critical"],
+    ["GitHub PAT (gho)",   /gho_[A-Za-z0-9]{36}/g,                   "critical"],
+    ["GitHub fine-grained",/github_pat_[A-Za-z0-9_]{59}/g,           "critical"],
+    ["AWS access key",     /AKIA[0-9A-Z]{16}/g,                       "critical"],
+    ["AWS secret key",     /aws_secret_access_key\s*[=:]\s*\S{20,}/gi,"critical"],
+    ["Google API key",     /AIza[0-9A-Za-z_-]{35}/g,                  "high"],
+    ["Bearer token",       /Bearer\s+[A-Za-z0-9_-]{32,}/g,           "high"],
+    ["Private key block",  /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY/g, "critical"],
+    ["Generic secret var", /(?:secret|password|passwd|pwd)\s*[=:]\s*["']?[A-Za-z0-9+/=_-]{12,}["']?/gi, "medium"],
+  ];
+
+  // Files to scan
+  const SCAN_FILES = [
+    "CLAUDE.md", "AGENTS.md", "GEMINI.md", ".cursorrules",
+    ".codex/config.md", ".codex/instructions.md",
+    "opencode.json", ".mcp.json",
+  ];
+
+  // Walk a directory recursively, return all file paths
+  function walk(dir, maxDepth = 6, _depth = 0) {
+    if (_depth > maxDepth) return [];
+    let results = [];
+    try {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith(".git") || entry.name === "node_modules") continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) results = results.concat(walk(full, maxDepth, _depth + 1));
+        else results.push(full);
+      }
+    } catch { /* skip unreadable */ }
+    return results;
+  }
+
+  const findings = []; // {file, line, label, severity, excerpt}
+
+  function scanContent(filePath, content) {
+    const lines = content.split("\n");
+    for (const [label, regex, severity] of PATTERNS) {
+      regex.lastIndex = 0;
+      for (let i = 0; i < lines.length; i++) {
+        let m;
+        regex.lastIndex = 0;
+        while ((m = regex.exec(lines[i])) !== null) {
+          const val = m[0];
+          // Redact: show first 6 + ... + last 4 chars
+          const excerpt = val.length > 14 ? val.slice(0, 6) + "..." + val.slice(-4) : val.slice(0, 4) + "...";
+          findings.push({ file: filePath, line: i + 1, label, severity, excerpt });
+        }
+      }
+    }
+  }
+
+  // Collect files to scan
+  const toScan = new Set();
+
+  for (const rel of SCAN_FILES) {
+    const p = path.join(target, rel);
+    if (fs.existsSync(p)) toScan.add(p);
+  }
+
+  const aiDir = path.join(target, "ai");
+  if (fs.existsSync(aiDir)) {
+    for (const f of walk(aiDir)) {
+      if (/\.(md|json|yaml|yml|txt|toml)$/.test(f)) toScan.add(f);
+    }
+  }
+
+  // Warn about .env files (don't scan content, just flag existence)
+  const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
+  const foundEnv = envFiles.filter(e => fs.existsSync(path.join(target, e)));
+
+  console.log(`\n  ${T}0dai audit${R} — scanning for leaked secrets\n`);
+  console.log(`  ${D}target: ${target}${R}`);
+  console.log(`  ${D}files:  ${toScan.size} scanned${R}\n`);
+
+  for (const filePath of toScan) {
+    try {
+      const content = fs.readFileSync(filePath, "utf8");
+      scanContent(filePath, content);
+    } catch { /* skip */ }
+  }
+
+  if (foundEnv.length > 0) {
+    console.log(`  ${W}WARN${R}  .env files detected — ensure they are in .gitignore`);
+    for (const e of foundEnv) console.log(`         ${D}${e}${R}`);
+    console.log();
+  }
+
+  if (findings.length === 0) {
+    console.log(`  ${G}✓ No secrets found${R} in scanned files\n`);
+    return;
+  }
+
+  const critical = findings.filter(f => f.severity === "critical");
+  const high = findings.filter(f => f.severity === "high");
+  const medium = findings.filter(f => f.severity === "medium");
+
+  const colorFor = (s) => s === "critical" ? RE : s === "high" ? W : D;
+
+  for (const f of findings) {
+    const c = colorFor(f.severity);
+    const rel = path.relative(target, f.file);
+    console.log(`  ${c}${f.severity.toUpperCase().padEnd(8)}${R} ${rel}:${f.line}`);
+    console.log(`           ${D}${f.label}: ${f.excerpt}${R}`);
+  }
+
+  console.log();
+  if (critical.length > 0) console.log(`  ${RE}${critical.length} critical${R} · ${W}${high.length} high${R} · ${D}${medium.length} medium${R}\n`);
+  else console.log(`  ${W}${high.length} high${R} · ${D}${medium.length} medium${R}\n`);
+
+  console.log(`  ${D}Tip: add secrets to .gitignore or use env vars, not plaintext files${R}\n`);
+
+  if (critical.length > 0) process.exit(1);
+}
+
 function cmdDoctor(target) {
   const ai = path.join(target, "ai");
   if (!fs.existsSync(ai)) { log("no ai/ layer. Run '0dai init' first."); return; }
@@ -768,6 +892,59 @@ function cmdSwarm(target, sub, args) {
     log(`task created: ${id} → ${forAgent}`);
     return;
   }
+  if (sub === "webhook") {
+    const webhooksFile = path.join(swarmDir, "webhooks.json");
+    const loadHooks = () => { try { return JSON.parse(fs.readFileSync(webhooksFile, "utf8")); } catch { return []; } };
+    const saveHooks = (h) => { fs.mkdirSync(swarmDir, { recursive: true }); fs.writeFileSync(webhooksFile, JSON.stringify(h, null, 2)); };
+    const action = args[2] || "";
+
+    if (action === "add") {
+      const url = args[3] || args.find((_, i) => args[i-1] === "--url");
+      const event = args.find((_, i) => args[i-1] === "--event") || "all";
+      const secret = args.find((_, i) => args[i-1] === "--secret") || "";
+      if (!url || !url.startsWith("http")) { log("Usage: 0dai swarm webhook add <url> [--event task_done|task_failed|all] [--secret TOKEN]"); return; }
+      const hooks = loadHooks();
+      if (hooks.find(h => h.url === url)) { log(`already registered: ${url}`); return; }
+      hooks.push({ url, event, secret: secret || undefined, added_at: new Date().toISOString() });
+      saveHooks(hooks);
+      log(`webhook added: ${url} (event: ${event})`);
+      return;
+    }
+    if (action === "list") {
+      const hooks = loadHooks();
+      if (hooks.length === 0) { log("no webhooks registered. Use: 0dai swarm webhook add <url>"); return; }
+      console.log(`\n  ${T}Registered webhooks${R}\n`);
+      hooks.forEach((h, i) => {
+        console.log(`  ${i+1}. ${h.url}`);
+        console.log(`     ${D}event: ${h.event}  added: ${h.added_at?.slice(0,10)}${R}`);
+      });
+      console.log();
+      return;
+    }
+    if (action === "remove") {
+      const url = args[3] || "";
+      if (!url) { log("Usage: 0dai swarm webhook remove <url>"); return; }
+      const hooks = loadHooks().filter(h => h.url !== url);
+      saveHooks(hooks);
+      log(`removed: ${url}`);
+      return;
+    }
+    if (action === "test") {
+      const url = args[3] || loadHooks()[0]?.url;
+      if (!url) { log("Usage: 0dai swarm webhook test <url>"); return; }
+      const payload = JSON.stringify({ event: "test", task_id: "test-ping", title: "Webhook test from 0dai", status: "done", timestamp: new Date().toISOString() });
+      const req = https.request(url, { method: "POST", headers: { "Content-Type": "application/json", "User-Agent": "0dai-swarm/1.0", "Content-Length": Buffer.byteLength(payload) } }, (res) => {
+        log(`test sent to ${url} → HTTP ${res.statusCode}`);
+      });
+      req.on("error", (e) => log(`test failed: ${e.message}`));
+      req.setTimeout(5000, () => { req.destroy(); log("test timed out"); });
+      req.write(payload);
+      req.end();
+      return;
+    }
+    console.log("Usage: 0dai swarm webhook [add|list|remove|test] <url> [--event all|task_done|task_failed] [--secret TOKEN]");
+    return;
+  }
   if (sub === "budget") {
     const budgetFile = path.join(swarmDir, "budget.json");
     if (!fs.existsSync(budgetFile)) { log("no budget data yet"); return; }
@@ -824,6 +1001,7 @@ async function main() {
   checkVersion();
 
   switch (cmd) {
+    case "audit": cmdAudit(target); break;
     case "init": await cmdInit(target); break;
     case "sync": await cmdSync(target); break;
     case "detect": await cmdDetect(target); break;
@@ -867,6 +1045,7 @@ async function main() {
     case "help": case "--help": case "-h":
       console.log(`\n  ${T}0dai${R} v${VERSION} — One config for 5 AI agent CLIs\n`);
       console.log("Commands:");
+      console.log("  audit          Scan ai/ and agent configs for leaked secrets");
       console.log("  init           Initialize ai/ layer (via API)");
       console.log("  sync           Update ai/ layer (via API)");
       console.log("  detect         Show detected stack");
@@ -874,7 +1053,10 @@ async function main() {
       console.log("  reflect        Session reflection: delivered, delegation rate, blockers");
       console.log("  status         Show maturity, swarm, session");
       console.log("  session save   Save session for roaming");
-      console.log("  swarm status   Task queue & delegation");
+      console.log("  swarm status       Task queue & delegation");
+      console.log("  swarm webhook add  Register webhook (fires on task done/failed)");
+      console.log("  swarm webhook list Show registered webhooks");
+      console.log("  swarm webhook test Send test ping to a webhook URL");
       console.log("  feedback push  Send feedback to 0dai");
       console.log("  models         Show model ratings (--fast/--balanced/--deep/--available)");
       console.log("  terminal       Launch interactive agent session");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0dai-dev/cli",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "One config layer for 5 AI agent CLIs — Claude Code, Codex, OpenCode, Gemini, Aider",
   "bin": {
     "0dai": "./bin/0dai.js"