@bussolabs/closeyourit-cli 0.17.1 → 0.19.0

package/README.md

@@ -79,6 +79,12 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `errors list --project <id\|key> [--status] [--page]` | List error groups. |
 | `errors show <id> --project <id\|key>` | Show one error group. |
 | `errors resolve\|reopen\|mute\|unmute <id> --project <id\|key>` | Triage an error group. |
+| `vulnerabilities list [--project <id\|key>] [--severity] [--status] [--package] [--page]` | List known dependency vulnerabilities across every visible project, worst first. |
+| `vulnerabilities show <id>` | Show one: advisory, package, manifest, fixing version. |
+| `vulnerabilities ignore <id> [--note]` / `reopen <id>` | Accept living with the risk, or change your mind (requires vulnerabilities.triage). |
+| `vulnerabilities promote <id>` | Open a ticket from it — automatic promotion only fires on high/critical. |
+| `vulnerabilities rescan --project <id\|key>` | Rescan now, without waiting for the nightly run. |
+| `vulnerabilities runtimes [--project <id\|key>] [--page]` | Support state of the declared runtimes (Ruby, Node, Flutter…). |
 | `tokens list --project <id\|key>` | List ingest tokens. |
 | `tokens create --project <id\|key> --name <name> --environment-id <id>` | Create a token (secret shown once). |
 | `tokens provision --project <id\|key> --name <name> --environment-id <code\|id> --to-project <id\|key> --to-environment-id <code\|id> --secret-name <NAME>` | Generate and deliver a token without revealing its value. GitHub sync is enabled by default; use `--no-sync-github` for vault-only delivery. |

package/dist/commands/servers/ignored-containers.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class ServersIgnoredContainers extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        clear: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        set: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+    private render;
+    private split;
+}

package/dist/commands/servers/ignored-containers.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+// CYRA-519 — i nomi che su una macchina NON sono servizi (container di compilazione e test, che
+// nascono e muoiono a ogni lavorazione) si scrivevano solo dalla pagina web: chi lavora da terminale
+// doveva aprire il browser per una lista di due righe.
+//
+// Senza flag il comando legge; --set sostituisce l'elenco, --clear lo svuota. Sostituisce e non
+// accoda: un elenco di due nomi si riscrive per intero, e "aggiungi" andrebbe letto prima.
+class ServersIgnoredContainers extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Server id', required: true }),
+    };
+    static description = 'Read or set the container names this server does not treat as services';
+    static examples = [
+        '<%= config.bin %> servers ignored-containers <server-id>',
+        '<%= config.bin %> servers ignored-containers <server-id> --set buildkit,runner',
+        '<%= config.bin %> servers ignored-containers <server-id> --clear',
+    ];
+    static flags = {
+        clear: core_1.Flags.boolean({ description: 'Remove every ignored container name', exclusive: ['set'] }),
+        set: core_1.Flags.string({ description: 'Comma-separated names to ignore (replaces the list)' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServersIgnoredContainers);
+        const path = `/cli/v1/servers/${encodeURIComponent(args.id)}`;
+        if (flags.set === undefined && !flags.clear) {
+            const res = await this.api.get(path);
+            if (!this.jsonEnabled())
+                this.log(this.render(res.data));
+            return res;
+        }
+        const patterns = flags.clear ? [] : this.split(flags.set ?? '');
+        const res = await this.api.put(path, { ignored_container_patterns: patterns });
+        if (!this.jsonEnabled())
+            this.log(this.render(res.data));
+        return res;
+    }
+    render(data) {
+        const patterns = data?.ignored_container_patterns ?? [];
+        return patterns.length === 0 ? 'No ignored container names' : patterns.join('\n');
+    }
+    split(value) {
+        return value
+            .split(',')
+            .map((name) => name.trim())
+            .filter(Boolean);
+    }
+}
+exports.default = ServersIgnoredContainers;

package/dist/commands/vulnerabilities/ignore.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesIgnore extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        note: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/ignore.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class VulnerabilitiesIgnore extends base_1.BaseCommand {
+    static aliases = ['vulns:ignore'];
+    static description = 'Ignore a vulnerability: you accept living with the risk';
+    static examples = [
+        '<%= config.bin %> vulnerabilities ignore <finding-id>',
+        '<%= config.bin %> vulnerabilities ignore <finding-id> --note "Not reachable from our code."',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Vulnerability finding id', required: true }),
+    };
+    static flags = {
+        note: core_1.Flags.string({ description: 'Why you are keeping it (shown alongside the ignored row)' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(VulnerabilitiesIgnore);
+        const res = await this.api.put(`/cli/v1/vulnerabilities/${args.id}/ignore`, { triage_note: flags.note });
+        if (!this.jsonEnabled()) {
+            // An ignored row never reopens on its own: the next scan won't undo a decision already taken.
+            this.log(`Vulnerability ${args.id} ignored.`);
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesIgnore;

package/dist/commands/vulnerabilities/list.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesList extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        severity: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        package: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/list.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class VulnerabilitiesList extends base_1.BaseCommand {
+    static aliases = ['vulns:list'];
+    static description = 'List known vulnerabilities of the project dependencies (cross-project)';
+    static examples = [
+        '<%= config.bin %> vulnerabilities list',
+        '<%= config.bin %> vulnerabilities list --severity critical',
+        '<%= config.bin %> vulnerabilities list --project acme-api --status open',
+        '<%= config.bin %> vulnerabilities list --package nokogiri --json',
+    ];
+    static flags = {
+        // Optional here (the endpoint is cross-project): without it, the list spans every visible project.
+        project: core_1.Flags.string({ char: 'p', description: 'Filter by project id (UUID) or key' }),
+        severity: core_1.Flags.string({ description: 'Filter by severity (critical, high, moderate, low, unknown)' }),
+        status: core_1.Flags.string({ description: 'Filter by status (open, resolved, ignored)' }),
+        package: core_1.Flags.string({ description: 'Filter by package name (partial match)' }),
+        ...base_1.pageFlag,
+    };
+    async run() {
+        const { flags } = await this.parse(VulnerabilitiesList);
+        const query = new URLSearchParams({ page: String(flags.page) });
+        if (flags.project)
+            query.set('project_id', await this.resolveProjectId(flags.project));
+        if (flags.severity)
+            query.set('severity', flags.severity);
+        if (flags.status)
+            query.set('status', flags.status);
+        if (flags.package)
+            query.set('package', flags.package);
+        const res = await this.api.get(`/cli/v1/vulnerabilities?${query.toString()}`);
+        const findings = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(
+            // ID first, like `errors list`: every other subcommand takes it as its argument, so a table
+            // without it forces `--json` just to triage what you are already looking at.
+            ['ID', 'PROJECT', 'PACKAGE', 'SEVERITY', 'STATUS', 'FIXED IN', 'ADVISORY'], findings.map((finding) => [
+                String(finding.id ?? ''),
+                String(finding.project?.key ?? ''),
+                String(finding.package?.coordinates ?? ''),
+                (0, output_1.statusCell)(finding.advisory?.severity),
+                (0, output_1.statusCell)(finding.status),
+                // No fixed version means OSV declares none: the only move is dropping or replacing the dep.
+                String(finding.fixed_version ?? '—'),
+                String(finding.advisory?.display_id ?? ''),
+            ])));
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesList;

package/dist/commands/vulnerabilities/promote.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesPromote extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/promote.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class VulnerabilitiesPromote extends base_1.BaseCommand {
+    static aliases = ['vulns:promote'];
+    static description = 'Open a ticket from a vulnerability (automatic promotion only fires on high/critical)';
+    static examples = ['<%= config.bin %> vulnerabilities promote <finding-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Vulnerability finding id', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(VulnerabilitiesPromote);
+        // Idempotent server-side: promoting twice returns R422-VULN-001, never a second ticket.
+        const res = await this.api.put(`/cli/v1/vulnerabilities/${args.id}/promotion`);
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderRecord)(res.data ?? {}));
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesPromote;

package/dist/commands/vulnerabilities/reopen.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesReopen extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/reopen.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class VulnerabilitiesReopen extends base_1.BaseCommand {
+    static aliases = ['vulns:reopen'];
+    static description = 'Reopen an ignored vulnerability: you changed your mind';
+    static examples = ['<%= config.bin %> vulnerabilities reopen <finding-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Vulnerability finding id', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(VulnerabilitiesReopen);
+        // Reopening is deleting the ignore, not a verb of its own — hence DELETE on the same resource.
+        const res = await this.api.delete(`/cli/v1/vulnerabilities/${args.id}/ignore`);
+        if (!this.jsonEnabled()) {
+            this.log(`Vulnerability ${args.id} reopened.`);
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesReopen;

package/dist/commands/vulnerabilities/rescan.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesRescan extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/rescan.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+class VulnerabilitiesRescan extends base_1.BaseCommand {
+    static aliases = ['vulns:rescan'];
+    static description = 'Rescan a project now, without waiting for the nightly run';
+    static examples = ['<%= config.bin %> vulnerabilities rescan --project acme-api'];
+    // Required here, unlike the other subcommands: a scan always targets one project.
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { flags } = await this.parse(VulnerabilitiesRescan);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.post('/cli/v1/vulnerabilities/rescan', { project_id: projectId });
+        if (!this.jsonEnabled()) {
+            this.log(`Scan queued for project ${flags.project}.`);
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesRescan;

package/dist/commands/vulnerabilities/runtimes.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesRuntimes extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/runtimes.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class VulnerabilitiesRuntimes extends base_1.BaseCommand {
+    static aliases = ['vulns:runtimes'];
+    static description = 'List the support state of the declared runtimes (Ruby, Node, Flutter…)';
+    static examples = [
+        '<%= config.bin %> vulnerabilities runtimes',
+        '<%= config.bin %> vulnerabilities runtimes --project acme-api --json',
+    ];
+    static flags = {
+        project: core_1.Flags.string({ char: 'p', description: 'Filter by project id (UUID) or key' }),
+        ...base_1.pageFlag,
+    };
+    async run() {
+        const { flags } = await this.parse(VulnerabilitiesRuntimes);
+        const query = new URLSearchParams({ page: String(flags.page) });
+        if (flags.project)
+            query.set('project_id', await this.resolveProjectId(flags.project));
+        const res = await this.api.get(`/cli/v1/vulnerabilities/runtimes?${query.toString()}`);
+        const runtimes = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['PROJECT', 'RUNTIME', 'VERSION', 'STATE', 'EOL', 'LATEST'], runtimes.map((runtime) => [
+                String(runtime.project?.key ?? ''),
+                String(runtime.name ?? ''),
+                String(runtime.version ?? ''),
+                (0, output_1.statusCell)(runtime.state),
+                // No EOL date means endoflife.date doesn't know the product: no alarm is possible.
+                String(runtime.eol_on ?? '—'),
+                String(runtime.latest ?? '—'),
+            ])));
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesRuntimes;

package/dist/commands/vulnerabilities/show.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class VulnerabilitiesShow extends BaseCommand {
+    static aliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vulnerabilities/show.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+/** A nested object of the payload, or `{}` when the field is absent. */
+function nested(data, key) {
+    const value = data[key];
+    return value && typeof value === 'object' ? value : {};
+}
+class VulnerabilitiesShow extends base_1.BaseCommand {
+    static aliases = ['vulns:show'];
+    static description = 'Show a single vulnerability: advisory, package, manifest and the fixing version';
+    static examples = ['<%= config.bin %> vulnerabilities show <finding-id>'];
+    static args = {
+        id: core_1.Args.string({ description: 'Vulnerability finding id', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(VulnerabilitiesShow);
+        const res = await this.api.get(`/cli/v1/vulnerabilities/${args.id}`);
+        if (!this.jsonEnabled()) {
+            const data = res.data ?? {};
+            // Same blocks the promoted ticket carries: whoever reads either one decides with the same facts.
+            this.log((0, output_1.renderRecord)(data));
+            this.log((0, output_1.section)('Project', '📦'));
+            this.log((0, output_1.renderRecord)(nested(data, 'project')));
+            this.log((0, output_1.section)('Package', '🧩'));
+            this.log((0, output_1.renderRecord)({ ...nested(data, 'package'), manifest: nested(data, 'manifest').path ?? null }));
+            this.log((0, output_1.section)('Advisory', '🔒'));
+            this.log((0, output_1.renderRecord)(nested(data, 'advisory')));
+        }
+        return res;
+    }
+}
+exports.default = VulnerabilitiesShow;

package/dist/lib/alert-events.d.ts

@@ -1,2 +1,9 @@
-/** Event types accepted by alert rules — mirror of the backend enum (Alerting::Rule). */
+/**
+ * Event types accepted by alert rules — mirror of the backend enum (Alerting::Rule).
+ *
+ * CYRA-519: the list had stopped at the first fifteen, so `--event-type` rejected every type added
+ * since (containers, replication, inodes, automation, vulnerabilities…) — the flag looked broken
+ * while the backend accepted them. Keep this in the same order as the backend enum: appending there
+ * means appending here.
+ */
 export declare const ALERT_EVENT_TYPES: string[];

package/dist/lib/alert-events.js

@@ -1,7 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ALERT_EVENT_TYPES = void 0;
-/** Event types accepted by alert rules — mirror of the backend enum (Alerting::Rule). */
+/**
+ * Event types accepted by alert rules — mirror of the backend enum (Alerting::Rule).
+ *
+ * CYRA-519: the list had stopped at the first fifteen, so `--event-type` rejected every type added
+ * since (containers, replication, inodes, automation, vulnerabilities…) — the flag looked broken
+ * while the backend accepted them. Keep this in the same order as the backend enum: appending there
+ * means appending here.
+ */
 exports.ALERT_EVENT_TYPES = [
     'error_new',
     'error_regression',
@@ -18,4 +25,32 @@ exports.ALERT_EVENT_TYPES = [
     'server_temp',
     'server_service_failed',
     'server_smart_failing',
+    'error_spike',
+    'log_alert',
+    'server_db_down',
+    'server_db_connections',
+    'server_replication_lag',
+    'agents_stalled',
+    'server_container_down',
+    'agents_host_failing',
+    'uptime_slow',
+    'analytics_traffic_drop',
+    'analytics_traffic_spike',
+    'idea_created',
+    'idea_commented',
+    'workload_due_soon',
+    'dataset_training_completed',
+    'dataset_training_failed',
+    'agents_host_stale',
+    'vulnerability_new',
+    'runtime_eol',
+    'embedding_down',
+    'server_container_up',
+    'server_db_connection_usage',
+    'server_data_volume_disk',
+    'server_inode',
+    'server_replication_down',
+    'server_replication_up',
+    'server_container_restart_loop',
+    'server_container_stable',
 ];

package/dist/lib/output.js

@@ -142,6 +142,16 @@ const STATUS_TONE = {
     active: 'ok',
     expired: 'neutral',
     revoked: 'neutral',
+    // vulnerability advisory severity (GHSA scale). `unknown` is already neutral above — which is the
+    // right reading: an advisory OSV didn't classify is not a severe advisory.
+    critical: 'down',
+    high: 'down',
+    moderate: 'warn',
+    low: 'neutral',
+    // runtime support state
+    ending_soon: 'warn',
+    eol: 'down',
+    supported: 'ok',
 };
 /**
  * Badge colour (Tailwind family name) → tone. Ticket status/priority labels are org-customisable,