@chainpatrol/cli 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,132 @@
 # @chainpatrol/cli
 
+## 1.4.0
+
+### Minor Changes
+
+- ccd3811: Adds `reporterKind` and `reviewerKind` filters (`human` | `automation`) to organization report listing so callers can separate automation vs human report sources and approvals.
+
+  The previous `excludeAutomation` boolean remains supported as a deprecated alias for `reporterKind: "human"`. CLI adds `--reporter-kind` and `--reviewer-kind`.
+
+  Server-side work in `@chainpatrol/core`, `@chainpatrol/trpc`, and `@chainpatrol/external-trpc` backs the new filters; those packages are private and don't need version bumps.
+
+- 9dd02cf: Third and final tranche of the API-surface expansion — the join-required
+  slices. All additive, no removed fields.
+
+  **Takedowns — provider names on `listTakedowns` and `getTakedown`.** Each
+  `TakedownItem` and the `getTakedown` `takedown` object now carries
+  `domainRegistrar`, `hostingProvider`, and `tldRegistrar` (each
+  `{ id, name } | null`) alongside the existing `assignee` / `brand`.
+  Answers "who hosts phish.example?" without a follow-up call and unblocks
+  "which takedowns are stuck at registrar X?" cross-org queries. Distinct
+  from the per-task `takedownProvider` — the trio here is the
+  takedown-level assignment for the domain itself, whereas the task-level
+  provider is the entity handling the current step.
+
+  **Detection Configs — `lastResultAt` aggregate on
+  `listDetectionConfigs`.** Each `ConfigEntry` now carries `lastResultAt`
+  (nullable ISO timestamp) — the `MAX(createdAt)` of `ThreatDetectionResult`
+  rows tied to that config. Surfaces the same silent-config signal the
+  drift healthcheck already computes internally. A config with a stale
+  `lastResultAt` is going silent regardless of what its `updatedAt` says.
+
+  Computed with a single `groupBy` on `ThreatDetectionResult` scoped to the
+  response's config IDs — one extra query per call, index-friendly via
+  `ThreatDetectionResult.@@index([configId])`.
+
+  Server-side work in `@chainpatrol/external-trpc` and
+  `@chainpatrol/validation` supports the new fields; both are private
+  packages and don't need version bumps.
+
+- 725d32c: `listOrganizationReports` now calls `GET /organization/reports` instead of the deprecated `POST /public/getOrganizationReports`. Inputs, outputs, and the CLI's `reports list --org <slug>` behaviour are unchanged.
+
+  Server-side work in `@chainpatrol/external-trpc` makes the switch safe. `GET /organization/reports` now accepts an optional `slug`, authorized the same way the deprecated endpoint authorized it, so callers whose credentials cover more than one organization — user-scoped API keys, staff and member sessions, which is how `chainpatrol login` authenticates — can still choose an organization instead of having it derived from an org-scoped API key. It also fixes two query-string bugs that made the endpoint's filters unusable: `?<flag>=false` was read as `true`, and array filters passed once rather than repeated (`?brandIds=12`, `?assetTypes=URL`) were rejected with a validation error. `@chainpatrol/external-trpc` is private and does not need a version bump.
+
+- 725d32c: Adds a `needsCustomerReview` filter to organization report listing so callers can pull just the reports an organization still has to approve. CLI adds `--needs-customer-review` / `--no-needs-customer-review` to `reports list`.
+
+  The filter resolves what "waiting on the customer" means per organization: with Obligatory Organization Admin Approval on, every report with a pending proposal whose asset type is in the approval scope (all asset types when the scope is not narrowed) plus anything escalated to the customer; with it off, only reports escalated to the customer. Reports the organization submitted itself are excluded.
+
+  Server-side work in `@chainpatrol/core` and `@chainpatrol/external-trpc` backs the new filter; those packages are private and don't need version bumps.
+
+- e73955d: Fixes three problems with report search (`POST /reports/search`, `chainpatrol reports search`):
+
+  - **It did not work for logged-in CLI users.** The endpoint resolved the organization only from an organization-scoped API key, so anyone authenticated with the bearer token `chainpatrol login` issues got `API Organization not found. Invalid or missing API key.` It now accepts an optional `slug`, authorized the same way the rest of the API authorizes one, and the CLI passes the resolved organization.
+  - **Results were unbounded.** An asset content shared across many reports returned every one of them. Responses are now capped by a `limit` (default 50, max 100, newest first) and carry `totalCount` so callers can see when results were truncated. The CLI gains `--limit` and reports "Matched 3 of 41 report(s)".
+  - **The endpoint's purpose was unclear next to report listing.** Both endpoints' descriptions now state the question each answers and point at the other: search looks reports up by asset content in one batched call to avoid filing a duplicate; `GET /organization/reports` browses and filters an organization's reports with full records and pagination.
+
+  Server-side work in `@chainpatrol/external-trpc`, which is private and does not need a version bump.
+
+### Patch Changes
+
+- Updated dependencies [ccd3811]
+- Updated dependencies [9dd02cf]
+- Updated dependencies [725d32c]
+- Updated dependencies [725d32c]
+- Updated dependencies [e73955d]
+  - @chainpatrol/sdk@1.4.0
+
+## 1.3.0
+
+### Minor Changes
+
+- 08b9976: Broaden the public API surface across Reports, Takedowns, Detections,
+  Detection Configs, and Assets. Everything additive — no removed fields,
+  no renames — so existing callers are unaffected.
+
+  **Detections (`listDetections`)** — new fields on each `DetectionListItem`:
+  `reason` (free-text explanation of why the detection fired), `score` (raw
+  0–1 model score), `configId` (which `ThreatDetectionConfig` produced the
+  hit), `reportedAt` (when it transitioned to `REPORTED`, nullable), and
+  `brands[]` (brand associations).
+
+  **Detection Configs (`listDetectionConfigs`)** — each `ConfigEntry` now
+  carries `description` (nullable), `createdAt`, and `updatedAt` so
+  integrators can spot silent or stale configs.
+
+  **Reports** — `listOrganizationReports` gains `slaDueAt` (SLA deadline),
+  `externalSubmissionLink` (original external source URL when submitted from
+  a third-party surface), and `duplicateOfId` (canonical report ID when this
+  one is a duplicate). Type gaps are also closed: `imageDisplay`,
+  `favoritedAt`, `attachments[]`, and `proposals.asset.scans[]` were already
+  returned by the handler but omitted from the SDK type — they're now
+  declared. `searchReports` (`report/search-external`) response now
+  surfaces the `title` and `createdAt` fields the handler already fetched.
+
+  **Takedowns (`listTakedowns`)** — each `TakedownItem` gains `externalId`
+  (vendor's own reference — CleanDNS report ID / registrar ticket, for
+  reconciliation), `hasFilingDelay`, `hasLivenessCheckDelay` (staff-set
+  flags used by median-time metrics), and `asset.blockedAt`.
+
+  **Takedowns (`getTakedown`)** — the response was previously bare
+  (`{ assetContent, takedownStatus, createdAt, updatedAt }`). It's now
+  fully built out with `asset` details (id / content / type /
+  `livenessStatus` / `blockedAt`) and a nested `takedown` record (id /
+  status / `externalId` / delay flags / assignee / brand / tasks[]). The
+  original top-level fields (`takedownStatus`, `createdAt`, `updatedAt`)
+  are preserved for existing callers.
+
+  **Assets — `livenessStatus` + `blockedAt` parity.** `listAssets`,
+  `listOrganizationAssets`, `assetSearch` (`.asset`), and `listThreats`
+  (`livenessStatus` only, `blockedAt` already there) now consistently
+  return both fields. `listAssets` also fixes a bug where each returned
+  row's `id` was stripped from the response mapper (the column was already
+  selected). Note: `assetCheck` is intentionally deferred — its response
+  goes through `@chainpatrol/asset`'s own `checkAsset()` contract; parity
+  there needs a scoped follow-up in the asset package.
+
+  Server-side work in `@chainpatrol/external-trpc`, `@chainpatrol/core`,
+  `@chainpatrol/validation`, and `@chainpatrol/database` backs the new
+  fields; those are private packages and don't need version bumps. Also
+  adds a `/// @deprecated` doc-comment to `Report.threatLevel` in the
+  Prisma schema — the field is not surfaced through the public API and no
+  in-app UI reads it; the column stays for now, removal is a separate
+  destructive migration.
+
+### Patch Changes
+
+- Updated dependencies [08b9976]
+  - @chainpatrol/sdk@1.3.0
+
 ## 1.2.0
 
 ### Minor Changes

package/dist/cli.js

@@ -356,16 +356,19 @@ var HELP = {
     ]
   },
   "reports search": {
-    description: "Search existing reports in your organization by asset contents. Useful to check for an existing report before creating a duplicate.",
+    description: "Look up reports by asset content \u2014 'do reports already exist for these assets?'. Checks a batch of assets in one call, so it is the fast way to avoid filing a duplicate. To browse or filter an org's reports instead, use `reports list`.",
     usage: "chainpatrol reports search <content> [<content> ...]",
     options: [
+      "--org <slug>               Organization slug (defaults to saved/env)",
       "--asset <content>          Asset content (repeatable; alternative to positional args)",
       "--reported-by-customer     Match only customer-submitted reports",
-      "--no-reported-by-customer  Match only non-customer reports"
+      "--no-reported-by-customer  Match only non-customer reports",
+      "--limit <n>                Max reports to return, newest first (1-100, default 50)"
     ],
     examples: [
       "chainpatrol reports search https://bad.site",
-      "chainpatrol reports search https://a.site https://b.site --reported-by-customer"
+      "chainpatrol reports search https://a.site https://b.site --reported-by-customer",
+      "chainpatrol reports search https://bad.site --limit 100"
     ]
   },
   "reports create": {
@@ -388,7 +391,7 @@ var HELP = {
     ]
   },
   "reports list": {
-    description: "List recent reports for an organization with the same level of filtering as the app's Reports view.",
+    description: "List recent reports for an organization with the same level of filtering as the app's Reports view. To check whether a report already exists for specific assets, use `reports search` instead.",
     usage: "chainpatrol reports list --org <slug> [filters]",
     options: [
       "--org <slug>               Organization slug",
@@ -399,7 +402,11 @@ var HELP = {
       "--reporter-query <q>       Search reports by reporter name (legacy)",
       "--reported-by-customer     Show only customer-submitted reports",
       "--no-reported-by-customer  Show only non-customer reports",
-      "--exclude-automation       Exclude reports submitted by automation",
+      "--needs-customer-review    Show only reports awaiting the org's own approval",
+      "--no-needs-customer-review Show only reports not awaiting the org's approval",
+      "--exclude-automation       Deprecated; prefer --reporter-kind human",
+      "--reporter-kind <kind>     Filter by reporter: human|automation",
+      "--reviewer-kind <kind>     Filter by approver: human|automation",
       "--only-rejected            Only reports whose latest review decision was REJECT",
       "--review-status <list>     Comma list: APPROVE|REJECT|SKIP|ESCALATE",
       "--asset-type <list>        Comma list of asset types (URL,TWITTER,...)",
@@ -413,9 +420,10 @@ var HELP = {
     ],
     examples: [
       "chainpatrol reports list --org acme --status TODO --review-status REJECT",
-      "chainpatrol reports list --org acme --exclude-automation --reported-by-customer",
+      "chainpatrol reports list --org acme --reporter-kind human --reviewer-kind automation",
       "chainpatrol reports list --org acme --from 2026-05-01 --updated-from 2026-05-10",
-      "chainpatrol reports list --org acme --brand 12,34 --country-code US,GB"
+      "chainpatrol reports list --org acme --brand 12,34 --country-code US,GB",
+      "chainpatrol reports list --org acme --needs-customer-review"
     ]
   },
   queues: {
@@ -927,6 +935,7 @@ ${getTopLevelHelp()}
     status: { type: "string" },
     search: { type: "string" },
     reportedByCustomer: { type: "boolean" },
+    needsCustomerReview: { type: "boolean" },
     attachmentUrl: { type: "string" },
     contactInfo: { type: "string" },
     externalSubmissionLink: { type: "string" },
@@ -967,6 +976,8 @@ ${getTopLevelHelp()}
     hideAutomatedLivenessChecks: { type: "boolean" },
     reporterQuery: { type: "string" },
     excludeAutomation: { type: "boolean" },
+    reporterKind: { type: "string" },
+    reviewerKind: { type: "string" },
     onlyRejected: { type: "boolean" },
     reviewStatus: { type: "string" },
     reviewedByUserId: { type: "number" },
@@ -1073,6 +1084,17 @@ function parseCsvList(value) {
   const items = value.split(",").map((item) => item.trim()).filter(Boolean);
   return items.length > 0 ? items : void 0;
 }
+function parseActorKindFlag(value, flagName) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "human" || normalized === "automation") {
+    return normalized;
+  }
+  throw new CliExitError(
+    `--${flagName} must be "human" or "automation"; got '${value}'.`,
+    ExitCode.USAGE
+  );
+}
 function parseIntList(value, flagName) {
   const items = parseCsvList(value);
   if (!items) return void 0;
@@ -1469,7 +1491,7 @@ async function main() {
     case "reports": {
       if (subcommand === "list") {
         const org = await resolveOrg();
-        const { runReportsList } = await import("./list-TULFPPG3.js");
+        const { runReportsList } = await import("./list-WQBXC3QS.js");
         await runReportsList({
           org,
           limit: cli.flags.limit,
@@ -1478,7 +1500,10 @@ async function main() {
           searchQuery: cli.flags.search,
           reporterQuery: cli.flags.reporterQuery,
           reportedByCustomer: cli.flags.reportedByCustomer,
+          needsCustomerReview: cli.flags.needsCustomerReview,
           excludeAutomation: cli.flags.excludeAutomation,
+          reporterKind: parseActorKindFlag(cli.flags.reporterKind, "reporterKind"),
+          reviewerKind: parseActorKindFlag(cli.flags.reviewerKind, "reviewerKind"),
           onlyRejected: cli.flags.onlyRejected,
           reviewStatuses: parseCsvList(cli.flags.reviewStatus),
           assetTypes: parseCsvList(cli.flags.assetType),
@@ -1515,13 +1540,16 @@ async function main() {
         break;
       }
       if (subcommand === "search") {
+        const org = await tryResolveOrg();
         const positionals = cli.input.slice(2);
         const flagAssets = parseAssetInputs();
         const assetContents = [...positionals, ...flagAssets];
-        const { runReportsSearch } = await import("./search-5DOXBWPB.js");
+        const { runReportsSearch } = await import("./search-M6EKPO4D.js");
         await runReportsSearch({
           assetContents,
+          org,
           reportedByCustomer: cli.flags.reportedByCustomer,
+          limit: cli.flags.limit,
           json: jsonMode,
           outputFormat: cliContext.outputFormat
         });

package/dist/{list-TULFPPG3.js → list-WQBXC3QS.js}

@@ -75,7 +75,10 @@ async function runReportsList(options) {
     searchQuery: options.searchQuery,
     reporterQuery: options.reporterQuery,
     reportedByCustomer: options.reportedByCustomer,
+    needsCustomerReview: options.needsCustomerReview,
     excludeAutomation: options.excludeAutomation,
+    reporterKind: options.reporterKind,
+    reviewerKind: options.reviewerKind,
     onlyRejected: options.onlyRejected,
     reviewStatuses,
     assetTypes: options.assetTypes?.length ? options.assetTypes.map((t) => t.toUpperCase()) : void 0,
@@ -99,7 +102,8 @@ async function runReportsList(options) {
           cursor: options.cursor,
           status: options.status,
           searchQuery: options.searchQuery,
-          reportedByCustomer: options.reportedByCustomer
+          reportedByCustomer: options.reportedByCustomer,
+          needsCustomerReview: options.needsCustomerReview
         }
       } : void 0
     },

package/dist/{search-5DOXBWPB.js → search-M6EKPO4D.js}

@@ -29,10 +29,18 @@ async function runReportsSearch(options) {
       ExitCode.USAGE
     );
   }
+  if (options.limit !== void 0 && (options.limit < 1 || options.limit > 100)) {
+    throw new CliExitError(
+      "reports search requires --limit between 1 and 100.",
+      ExitCode.USAGE
+    );
+  }
   const client = options.apiClient ?? createApiClient();
   const input = {
     assetContents: options.assetContents,
-    reportedByCustomer: options.reportedByCustomer
+    slug: options.org,
+    reportedByCustomer: options.reportedByCustomer,
+    limit: options.limit
   };
   const result = await client.searchReports(input);
   const rows = result.reports.map(toRow);
@@ -43,7 +51,7 @@ async function runReportsSearch(options) {
       "# Report search results",
       "",
       `- Searched: ${options.assetContents.length} asset(s)`,
-      `- Matched: ${result.reports.length} report(s)`,
+      `- Matched: ${result.reports.length} of ${result.totalCount} report(s)`,
       "",
       ...rows.map(
         (row) => `- #${row.id} [${row.status}]${row.reportedByCustomer ? " (customer)" : ""} assets=${row.assets}`
@@ -56,12 +64,17 @@ async function runReportsSearch(options) {
         return;
       }
       console.log(
-        `Matched ${result.reports.length} report(s) for ${options.assetContents.length} asset(s)`
+        `Matched ${result.reports.length} of ${result.totalCount} report(s) for ${options.assetContents.length} asset(s)`
       );
       for (const row of rows) {
         const customerTag = row.reportedByCustomer ? " (customer)" : "";
         console.log(`#${row.id} [${row.status}]${customerTag} assets=${row.assets}`);
       }
+      if (result.totalCount > result.reports.length) {
+        console.log(
+          `Showing the ${result.reports.length} newest. Raise --limit (max 100) to see more.`
+        );
+      }
     }
   });
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@chainpatrol/cli",
   "description": "The official ChainPatrol CLI — terminal interface for threat detection",
   "author": "Umar Ahmed <umar@chainpatrol.io>",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "license": "UNLICENSED",
   "homepage": "https://chainpatrol.com/docs/cli",
   "keywords": [
@@ -33,7 +33,7 @@
     "lint": "npx oxlint ."
   },
   "dependencies": {
-    "@chainpatrol/sdk": "1.2.0",
+    "@chainpatrol/sdk": "1.4.0",
     "ink": "^7.0.1",
     "meow": "^14.1.0",
     "open": "^11.0.0",