@kinosec/cli 0.11.1 → 0.11.2

package/dist/cli.js

@@ -8435,28 +8435,111 @@ ${import_picocolors3.default.dim("use of its services.")}
 // src/commands/schedule.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 
-// src/lib/validate-mode.ts
-var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
-function validateScanMode(mode) {
-  if (!VALID_SCAN_MODES.includes(mode)) {
-    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
-    process.exit(2);
+// src/lib/validate-schedule.ts
+var SCHEDULE_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
+var SCHEDULE_MODES = ["quick", "full"];
+var TIME_OF_DAY = /^([01]?\d|2[0-3]):[0-5]\d$/;
+var DIGITS = /^\d+$/;
+var ONCE_AT = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d{3})?)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+function scheduleInputError(flags, now) {
+  const { pattern, mode, at, time, timezone, dayOfWeek, dayOfMonth } = flags;
+  if (pattern !== void 0 && !SCHEDULE_PATTERNS.includes(pattern)) {
+    return `Invalid --pattern "${pattern}". Must be one of: ${SCHEDULE_PATTERNS.join(", ")}.`;
+  }
+  if (mode !== void 0 && !SCHEDULE_MODES.includes(mode)) {
+    return `Invalid --mode "${mode}". Schedules support: ${SCHEDULE_MODES.join(", ")}.`;
+  }
+  if (at !== void 0) {
+    const atError = onceAtError(at, now);
+    if (atError) return atError;
+  }
+  if (time !== void 0 && !TIME_OF_DAY.test(time)) {
+    return `Invalid --time "${time}". Use 24-hour HH:MM, e.g. 09:00.`;
+  }
+  if (timezone !== void 0 && !isKnownTimezone(timezone)) {
+    return `Invalid --timezone "${timezone}". Use an IANA name, e.g. America/New_York.`;
+  }
+  if (dayOfWeek !== void 0 && !isWholeNumberIn(dayOfWeek, 0, 6)) {
+    return `Invalid --day-of-week "${dayOfWeek}". Use a whole number 0-6 (0=Sunday).`;
+  }
+  if (dayOfMonth !== void 0 && !isWholeNumberIn(dayOfMonth, 1, 31)) {
+    return `Invalid --day-of-month "${dayOfMonth}". Use a whole number 1-31.`;
+  }
+  if (pattern === void 0 && at !== void 0) return "--at requires --pattern once.";
+  if (pattern === void 0) return null;
+  return patternFitError(pattern, flags);
+}
+function patternFitError(pattern, flags) {
+  if (pattern === "once" && flags.at === void 0) {
+    return "--at is required for once schedules: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM.";
+  }
+  if (pattern === "once" && flags.time !== void 0) {
+    return "--time does not apply to once schedules; put the time in --at.";
+  }
+  if (pattern !== "once" && flags.at !== void 0) {
+    return "--at only applies to once schedules.";
+  }
+  const isWeekly = pattern === "weekly" || pattern === "biweekly";
+  if (isWeekly && flags.dayOfWeek === void 0) {
+    return `--day-of-week is required for ${pattern} schedules.`;
+  }
+  if (!isWeekly && flags.dayOfWeek !== void 0) {
+    return "--day-of-week only applies to weekly and biweekly schedules.";
   }
+  if (pattern === "monthly" && flags.dayOfMonth === void 0) {
+    return "--day-of-month is required for monthly schedules.";
+  }
+  if (pattern !== "monthly" && flags.dayOfMonth !== void 0) {
+    return "--day-of-month only applies to monthly schedules.";
+  }
+  return null;
+}
+function onceAtError(at, now) {
+  const match = ONCE_AT.exec(at);
+  const ms = Date.parse(at);
+  if (!match || Number.isNaN(ms) || !isCalendarDate(Number(match[1]), Number(match[2]), Number(match[3]))) {
+    return `Invalid --at "${at}". Use YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM, on a real date.`;
+  }
+  if (ms <= now.getTime()) return `--at "${at}" is in the past. Pick a future time.`;
+  return null;
+}
+function isCalendarDate(year, month, day) {
+  const date = new Date(Date.UTC(year, month - 1, day));
+  return date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
+function isKnownTimezone(timezone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+    return true;
+  } catch (error2) {
+    if (error2 instanceof RangeError) return false;
+    throw error2;
+  }
+}
+function isWholeNumberIn(value, min, max) {
+  if (!DIGITS.test(value)) return false;
+  const n = Number(value);
+  return n >= min && n <= max;
 }
 
 // src/commands/schedule.ts
-var VALID_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 function extractTime(scheduledAt) {
   if (!scheduledAt) return "\u2014";
   const d = new Date(scheduledAt);
   return d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", hour12: false });
 }
+function extractDate(scheduledAt) {
+  if (!scheduledAt) return "\u2014";
+  const d = new Date(scheduledAt);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
 function formatPattern(s) {
   const time = extractTime(s.scheduled_at);
   switch (s.recurrence_pattern) {
     case "once":
-      return `Once at ${time}`;
+      return `Once on ${extractDate(s.scheduled_at)} at ${time}`;
     case "daily":
       return `Daily at ${time}`;
     case "weekly":
@@ -8469,6 +8552,22 @@ function formatPattern(s) {
       return s.recurrence_pattern;
   }
 }
+function modeTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("mode") === "cli" ? String(pentestCmd.getOptionValue("mode")) : void 0;
+}
+function yesTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("yes") === "cli";
+}
+function exitOnInputError(flags) {
+  const error2 = scheduleInputError(flags, /* @__PURE__ */ new Date());
+  if (!error2) return;
+  console.error(error2);
+  process.exit(2);
+}
+function scheduleMode(mode) {
+  if (mode === "quick" || mode === "full") return mode;
+  throw new Error(`Unchecked schedule mode "${mode}".`);
+}
 function registerScheduleCommand(pentestCmd) {
   const schedule = pentestCmd.command("schedule").description("Manage scheduled pentests");
   schedule.command("list").description("List scheduled pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter: active, paused, or all", "all").addHelpText("after", `
@@ -8543,36 +8642,35 @@ Examples:
       handleError(error2);
     }
   });
-  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode (default: full)", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
+  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full (default: full)", "full").option("--at <datetime>", "Run time for --pattern once: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM").option("--time <HH:MM>", "Time of day, 24h, for recurring patterns (default: 09:00)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
 Examples:
   $ kinosec pentest schedule create --asset abc123 --pattern weekly --day-of-week 1 --time 09:00
   $ kinosec pentest schedule create --asset abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC`).action(async (options) => {
-    if (!VALID_PATTERNS.includes(options.pattern)) {
-      console.error(`Invalid pattern "${options.pattern}". Must be: ${VALID_PATTERNS.join(", ")}`);
-      process.exit(2);
-    }
-    validateScanMode(options.mode);
-    if ((options.pattern === "weekly" || options.pattern === "biweekly") && options.dayOfWeek === void 0) {
-      console.error(`--day-of-week is required for ${options.pattern} schedules.`);
-      process.exit(2);
-    }
-    if (options.pattern === "monthly" && options.dayOfMonth === void 0) {
-      console.error("--day-of-month is required for monthly schedules.");
-      process.exit(2);
-    }
+  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC
+  $ kinosec pentest schedule create --asset abc123 --pattern once --at 2099-12-01T09:00+01:00`).action(async (options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     try {
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const params = {
-        asset_id: options.domain_or_ip,
-        name: options.name ?? `${options.pattern} ${options.mode} pentest`,
-        scan_mode: options.mode,
+        asset_id: options.asset,
+        name: options.name ?? `${options.pattern} ${mode} pentest`,
+        scan_mode: scheduleMode(mode),
         recurrence_pattern: options.pattern,
-        time_of_day: options.time,
         timezone: options.timezone
       };
+      if (options.pattern === "once") params.once_at = new Date(options.at).toISOString();
+      else params.time_of_day = options.time ?? "09:00";
       if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
       if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
       const s = await client.schedules.create(params);
@@ -8590,17 +8688,26 @@ Manage: kinosec pentest schedule get ${s.id}`);
       handleError(error2);
     }
   });
-  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
+  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full").option("--at <datetime>", "Run time with --pattern once: ISO date and time with an offset").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
 Examples:
   $ kinosec pentest schedule update abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule update abc123 --time 14:00`).action(async (id, options) => {
+  $ kinosec pentest schedule update abc123 --time 14:00
+  $ kinosec pentest schedule update abc123 --pattern once --at 2099-12-01T09:00Z`).action(async (id, options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     const params = {};
     if (options.pattern) params.recurrence_pattern = options.pattern;
     if (options.name) params.name = options.name;
-    if (options.mode) {
-      validateScanMode(options.mode);
-      params.scan_mode = options.mode;
-    }
+    if (mode) params.scan_mode = scheduleMode(mode);
+    if (options.at !== void 0) params.once_at = new Date(options.at).toISOString();
     if (options.time) params.time_of_day = options.time;
     if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
     if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
@@ -8630,7 +8737,7 @@ Examples:
   $ kinosec pentest schedule delete abc123
   $ kinosec pentest schedule delete abc123 --yes`).action(async (id, options) => {
     try {
-      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes));
+      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes) || yesTypedOnPentest(pentestCmd));
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
@@ -11904,18 +12011,6 @@ function normalizeActivityHistory(raw) {
     return JSON.stringify(entry);
   });
 }
-function filterActivityForTier(entries, showFullDetails) {
-  if (showFullDetails) return entries;
-  return entries.filter((line) => !/^\s{4,}/.test(line)).map((line) => {
-    if (/\] Running:/.test(line)) {
-      return line.replace(
-        /Running:.*/,
-        "Running: [upgrade to Security Pro for full details]"
-      );
-    }
-    return line;
-  });
-}
 
 // src/lib/buzzwords.ts
 var SCAN_EXECUTION_PHRASES = [
@@ -12019,15 +12114,6 @@ function printActivityLines(entries, tty3) {
     console.log(`${prompt} ${text}`);
   }
 }
-async function resolveShowFullDetails(client) {
-  try {
-    const me = await client.me.get();
-    const slug = me.plan.slug;
-    return slug === "security_pro" || slug === "enterprise";
-  } catch {
-    return false;
-  }
-}
 async function watchPentest(client, profileId, options) {
   const { timeoutMs, intervalMs, useJson, showFindingsSummary } = options;
   const tty3 = isTTY();
@@ -12056,7 +12142,6 @@ async function watchPentest(client, profileId, options) {
     console.log("\nWatch cancelled. Pentest is still running.");
     process.exit(0);
   });
-  const showFullDetails = await resolveShowFullDetails(client);
   let consecutiveErrors = 0;
   const MAX_CONSECUTIVE_ERRORS = 2;
   let deferredExitCode = null;
@@ -12104,17 +12189,16 @@ ${icon2} Lost connection to pentest.`);
           JSON.stringify({ ...scanDetail, elapsed_seconds: elapsed }) + "\n"
         );
       } else {
-        const normalized = normalizeActivityHistory(scanDetail.activity_history);
-        const filtered = filterActivityForTier(normalized, showFullDetails);
-        if (printedCount > filtered.length) printedCount = 0;
-        const newEntries = filtered.slice(printedCount);
+        const entries = normalizeActivityHistory(scanDetail.activity_history);
+        if (printedCount > entries.length) printedCount = 0;
+        const newEntries = entries.slice(printedCount);
         if (newEntries.length > 0) {
           if (spinner) spinner.stop();
           printActivityLines(newEntries, tty3);
           printedCount += newEntries.length;
           if (spinner) spinner = ora({ color: "green", isEnabled: true, discardStdin: false }).start();
         }
-        currentPhase = extractPhase(filtered);
+        currentPhase = extractPhase(entries);
         updateSpinnerText();
       }
       const status = scanDetail.scan_status;
@@ -12317,6 +12401,15 @@ Timeout: Scout did not connect within ${secs}s.`);
   }
 }
 
+// src/lib/validate-mode.ts
+var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
+function validateScanMode(mode) {
+  if (!VALID_SCAN_MODES.includes(mode)) {
+    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
+    process.exit(2);
+  }
+}
+
 // src/lib/scope.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 
@@ -12778,12 +12871,10 @@ Examples:
   $ kinosec pentest -t target.htb --mode htb --source ./challenge.zip --zip-password hackthebox
 
 Graybox (--source):
-  Packs the target's source (paste-mode only) and folds it into the agent as authoritative
-  context. Works with --mode full and quick for any user's own asset; htb/defcon additionally
-  require admin access. Large source is delivered out-of-band, so there's no size ceiling to
-  fight \u2014 --budget just controls how much source is packed (bigger bundles add context and cost).
-  The source is sent over HTTPS, used only on the ephemeral scan droplet, and is NOT stored
-  server-side (the training log records just a "[GRAYBOX] N bytes injected" marker, never the source).`).action(async (options) => {
+  Packs the target's source and sends it with the pentest as extra context.
+  Works with --mode full and quick on your own assets. --budget controls how much
+  source is packed (bigger bundles add context and cost).
+  The source is sent over HTTPS, used only while the pentest runs, and is NOT stored.`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
@@ -13456,10 +13547,9 @@ Examples:
 // src/commands/asset.ts
 function registerAssetCommand(program3) {
   const asset = program3.command("asset").description("Manage assets");
-  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--search <term>", "Filter by asset value (substring match)").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
+  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
 Examples:
   $ kinosec asset list
-  $ kinosec asset list --search example.com
   $ kinosec asset list --type subdomain --status verified
   $ kinosec asset list --limit 50 --json`).action(async (options) => {
     try {
@@ -13469,7 +13559,6 @@ Examples:
       const result = await client.assets.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        search: options.search,
         status: options.status,
         type: options.type
       });
@@ -13704,7 +13793,7 @@ function registerFindingCommand(program3) {
   const finding = program3.command("finding").description("Manage findings");
   finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
 Examples:
-  $ kinosec finding list abc123
+  $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001
   $ kinosec finding list --limit 50 --json`).action(async (profileId, options) => {
     try {
       const opts = program3.opts();
@@ -13713,7 +13802,7 @@ Examples:
       const result = await client.findings.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        scan: profileId
+        scan_profile_id: profileId
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13970,6 +14059,7 @@ Examples:
 
 // src/commands/token.ts
 var import_picocolors13 = __toESM(require_picocolors(), 1);
+var WEB_APP_TOKENS_URL = "https://kinosec.ai/settings?tab=api-tokens";
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -14015,8 +14105,8 @@ More results available. Use --cursor ${result.next_cursor}`));
 Examples:
   $ kinosec token create --name "CI" --scopes assets:read,scans:create
   $ kinosec token create --name "Full" --scopes assets:read,scans:read --expires 30`).action(async (options) => {
+    const opts = program3.opts();
     try {
-      const opts = program3.opts();
       const { token: authToken, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token: authToken });
       const scopes = options.scopes.split(",").map((s) => s.trim());
@@ -14038,6 +14128,13 @@ Examples:
       console.log(`  Scopes: ${result.scopes.join(", ")}`);
       console.log(`  Expires: ${new Date(result.expires_at).toLocaleDateString()}`);
     } catch (error2) {
+      const isJson = opts.json || opts.output === "json";
+      if (error2 instanceof ApiError && error2.code === "pat_cannot_create_token" && !isJson) {
+        printWarning("API tokens can't create other API tokens.");
+        console.error("Create a new token in the KinoSec web app:");
+        console.error(`  ${WEB_APP_TOKENS_URL}`);
+        console.error("");
+      }
       handleError(error2);
     }
   });
@@ -14064,7 +14161,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.1", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.2", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -14073,10 +14170,9 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.1")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.2")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js:
   (*! MIT License © Sindre Sorhus *)
 */
-//# sourceMappingURL=cli.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinosec/cli",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Official KinoSec command-line interface",
   "type": "module",
   "bin": {