@kinosec/cli 0.11.1 → 0.12.0

package/dist/cli.js

@@ -6944,6 +6944,10 @@ var ReportsResource = class {
   async export(params) {
     return this.api.post("v1/reports", { json: params }).json();
   }
+  /** The API's own markdown rendering of a report (`text/markdown`), returned as is. */
+  async exportMarkdown(scanReportId) {
+    return this.api.post("v1/reports", { json: { scan_report_id: scanReportId, format: "markdown" } }).text();
+  }
 };
 var TokensResource = class {
   constructor(api) {
@@ -8435,28 +8439,111 @@ ${import_picocolors3.default.dim("use of its services.")}
 // src/commands/schedule.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 
-// src/lib/validate-mode.ts
-var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
-function validateScanMode(mode) {
-  if (!VALID_SCAN_MODES.includes(mode)) {
-    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
-    process.exit(2);
+// src/lib/validate-schedule.ts
+var SCHEDULE_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
+var SCHEDULE_MODES = ["quick", "full"];
+var TIME_OF_DAY = /^([01]?\d|2[0-3]):[0-5]\d$/;
+var DIGITS = /^\d+$/;
+var ONCE_AT = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d{3})?)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+function scheduleInputError(flags, now) {
+  const { pattern, mode, at, time, timezone, dayOfWeek, dayOfMonth } = flags;
+  if (pattern !== void 0 && !SCHEDULE_PATTERNS.includes(pattern)) {
+    return `Invalid --pattern "${pattern}". Must be one of: ${SCHEDULE_PATTERNS.join(", ")}.`;
+  }
+  if (mode !== void 0 && !SCHEDULE_MODES.includes(mode)) {
+    return `Invalid --mode "${mode}". Schedules support: ${SCHEDULE_MODES.join(", ")}.`;
+  }
+  if (at !== void 0) {
+    const atError = onceAtError(at, now);
+    if (atError) return atError;
+  }
+  if (time !== void 0 && !TIME_OF_DAY.test(time)) {
+    return `Invalid --time "${time}". Use 24-hour HH:MM, e.g. 09:00.`;
+  }
+  if (timezone !== void 0 && !isKnownTimezone(timezone)) {
+    return `Invalid --timezone "${timezone}". Use an IANA name, e.g. America/New_York.`;
+  }
+  if (dayOfWeek !== void 0 && !isWholeNumberIn(dayOfWeek, 0, 6)) {
+    return `Invalid --day-of-week "${dayOfWeek}". Use a whole number 0-6 (0=Sunday).`;
   }
+  if (dayOfMonth !== void 0 && !isWholeNumberIn(dayOfMonth, 1, 31)) {
+    return `Invalid --day-of-month "${dayOfMonth}". Use a whole number 1-31.`;
+  }
+  if (pattern === void 0 && at !== void 0) return "--at requires --pattern once.";
+  if (pattern === void 0) return null;
+  return patternFitError(pattern, flags);
+}
+function patternFitError(pattern, flags) {
+  if (pattern === "once" && flags.at === void 0) {
+    return "--at is required for once schedules: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM.";
+  }
+  if (pattern === "once" && flags.time !== void 0) {
+    return "--time does not apply to once schedules; put the time in --at.";
+  }
+  if (pattern !== "once" && flags.at !== void 0) {
+    return "--at only applies to once schedules.";
+  }
+  const isWeekly = pattern === "weekly" || pattern === "biweekly";
+  if (isWeekly && flags.dayOfWeek === void 0) {
+    return `--day-of-week is required for ${pattern} schedules.`;
+  }
+  if (!isWeekly && flags.dayOfWeek !== void 0) {
+    return "--day-of-week only applies to weekly and biweekly schedules.";
+  }
+  if (pattern === "monthly" && flags.dayOfMonth === void 0) {
+    return "--day-of-month is required for monthly schedules.";
+  }
+  if (pattern !== "monthly" && flags.dayOfMonth !== void 0) {
+    return "--day-of-month only applies to monthly schedules.";
+  }
+  return null;
+}
+function onceAtError(at, now) {
+  const match = ONCE_AT.exec(at);
+  const ms = Date.parse(at);
+  if (!match || Number.isNaN(ms) || !isCalendarDate(Number(match[1]), Number(match[2]), Number(match[3]))) {
+    return `Invalid --at "${at}". Use YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM, on a real date.`;
+  }
+  if (ms <= now.getTime()) return `--at "${at}" is in the past. Pick a future time.`;
+  return null;
+}
+function isCalendarDate(year, month, day) {
+  const date = new Date(Date.UTC(year, month - 1, day));
+  return date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
+function isKnownTimezone(timezone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+    return true;
+  } catch (error2) {
+    if (error2 instanceof RangeError) return false;
+    throw error2;
+  }
+}
+function isWholeNumberIn(value, min, max) {
+  if (!DIGITS.test(value)) return false;
+  const n = Number(value);
+  return n >= min && n <= max;
 }
 
 // src/commands/schedule.ts
-var VALID_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 function extractTime(scheduledAt) {
   if (!scheduledAt) return "\u2014";
   const d = new Date(scheduledAt);
   return d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", hour12: false });
 }
+function extractDate(scheduledAt) {
+  if (!scheduledAt) return "\u2014";
+  const d = new Date(scheduledAt);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
 function formatPattern(s) {
   const time = extractTime(s.scheduled_at);
   switch (s.recurrence_pattern) {
     case "once":
-      return `Once at ${time}`;
+      return `Once on ${extractDate(s.scheduled_at)} at ${time}`;
     case "daily":
       return `Daily at ${time}`;
     case "weekly":
@@ -8469,6 +8556,22 @@ function formatPattern(s) {
       return s.recurrence_pattern;
   }
 }
+function modeTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("mode") === "cli" ? String(pentestCmd.getOptionValue("mode")) : void 0;
+}
+function yesTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("yes") === "cli";
+}
+function exitOnInputError(flags) {
+  const error2 = scheduleInputError(flags, /* @__PURE__ */ new Date());
+  if (!error2) return;
+  console.error(error2);
+  process.exit(2);
+}
+function scheduleMode(mode) {
+  if (mode === "quick" || mode === "full") return mode;
+  throw new Error(`Unchecked schedule mode "${mode}".`);
+}
 function registerScheduleCommand(pentestCmd) {
   const schedule = pentestCmd.command("schedule").description("Manage scheduled pentests");
   schedule.command("list").description("List scheduled pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter: active, paused, or all", "all").addHelpText("after", `
@@ -8543,36 +8646,35 @@ Examples:
       handleError(error2);
     }
   });
-  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode (default: full)", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
+  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full (default: full)", "full").option("--at <datetime>", "Run time for --pattern once: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM").option("--time <HH:MM>", "Time of day, 24h, for recurring patterns (default: 09:00)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
 Examples:
   $ kinosec pentest schedule create --asset abc123 --pattern weekly --day-of-week 1 --time 09:00
   $ kinosec pentest schedule create --asset abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC`).action(async (options) => {
-    if (!VALID_PATTERNS.includes(options.pattern)) {
-      console.error(`Invalid pattern "${options.pattern}". Must be: ${VALID_PATTERNS.join(", ")}`);
-      process.exit(2);
-    }
-    validateScanMode(options.mode);
-    if ((options.pattern === "weekly" || options.pattern === "biweekly") && options.dayOfWeek === void 0) {
-      console.error(`--day-of-week is required for ${options.pattern} schedules.`);
-      process.exit(2);
-    }
-    if (options.pattern === "monthly" && options.dayOfMonth === void 0) {
-      console.error("--day-of-month is required for monthly schedules.");
-      process.exit(2);
-    }
+  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC
+  $ kinosec pentest schedule create --asset abc123 --pattern once --at 2099-12-01T09:00+01:00`).action(async (options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     try {
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const params = {
-        asset_id: options.domain_or_ip,
-        name: options.name ?? `${options.pattern} ${options.mode} pentest`,
-        scan_mode: options.mode,
+        asset_id: options.asset,
+        name: options.name ?? `${options.pattern} ${mode} pentest`,
+        scan_mode: scheduleMode(mode),
         recurrence_pattern: options.pattern,
-        time_of_day: options.time,
         timezone: options.timezone
       };
+      if (options.pattern === "once") params.once_at = new Date(options.at).toISOString();
+      else params.time_of_day = options.time ?? "09:00";
       if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
       if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
       const s = await client.schedules.create(params);
@@ -8590,17 +8692,26 @@ Manage: kinosec pentest schedule get ${s.id}`);
       handleError(error2);
     }
   });
-  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
+  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full").option("--at <datetime>", "Run time with --pattern once: ISO date and time with an offset").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
 Examples:
   $ kinosec pentest schedule update abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule update abc123 --time 14:00`).action(async (id, options) => {
+  $ kinosec pentest schedule update abc123 --time 14:00
+  $ kinosec pentest schedule update abc123 --pattern once --at 2099-12-01T09:00Z`).action(async (id, options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     const params = {};
     if (options.pattern) params.recurrence_pattern = options.pattern;
     if (options.name) params.name = options.name;
-    if (options.mode) {
-      validateScanMode(options.mode);
-      params.scan_mode = options.mode;
-    }
+    if (mode) params.scan_mode = scheduleMode(mode);
+    if (options.at !== void 0) params.once_at = new Date(options.at).toISOString();
     if (options.time) params.time_of_day = options.time;
     if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
     if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
@@ -8630,7 +8741,7 @@ Examples:
   $ kinosec pentest schedule delete abc123
   $ kinosec pentest schedule delete abc123 --yes`).action(async (id, options) => {
     try {
-      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes));
+      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes) || yesTypedOnPentest(pentestCmd));
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
@@ -11904,17 +12015,32 @@ function normalizeActivityHistory(raw) {
     return JSON.stringify(entry);
   });
 }
-function filterActivityForTier(entries, showFullDetails) {
-  if (showFullDetails) return entries;
-  return entries.filter((line) => !/^\s{4,}/.test(line)).map((line) => {
-    if (/\] Running:/.test(line)) {
-      return line.replace(
-        /Running:.*/,
-        "Running: [upgrade to Security Pro for full details]"
-      );
-    }
-    return line;
-  });
+
+// src/lib/failure-reason.ts
+var REASON_SENTENCES = {
+  timeout: "The pentest stopped reporting progress for longer than we allow, so we shut it down to be safe. We could not see why it went quiet.",
+  no_results: "The pentest ran but produced no results, so there was nothing to report.",
+  worker_image_broken: "The pentest machine started with a broken image on our side. This is our fault, not yours.",
+  worker_startup_failed: "The pentest worker could not start up, so testing never began.",
+  scan_error: "The pentest engine hit an error while testing the target and could not continue.",
+  ad_credentials_invalid: "The Active Directory credentials you supplied were rejected by the domain controller. Update them and try again.",
+  no_dc_reachable: "No domain controller could be reached inside the scope you gave us. Check that the scope covers the domain controller's subnet and that the scout can route to it, then try again.",
+  target_not_authorized: "We could not confirm you are authorized to test this target. Confirm authorization in your dashboard and try again.",
+  mfa_required: "Starting this pentest requires two-factor authentication. Sign in with your second factor and try again.",
+  egress_not_ready: "The network route we use to reach your target was not ready. Please try again in a few minutes.",
+  launch_conflict: "Another launch of this same pentest was already in progress. Refresh your dashboard and try again.",
+  launch_error: "The pentest could not be started. This is usually a temporary problem on our side.",
+  scheduled_launch_error: "A scheduled pentest could not be started at its scheduled time.",
+  schedule_cancelled: "The pentest was stopped because its schedule was cancelled while it was running."
+};
+var UNKNOWN_SENTENCE = "We could not determine the exact cause.";
+function isKnownReason(code) {
+  return Object.hasOwn(REASON_SENTENCES, code);
+}
+function failureSentence(rawReason) {
+  if (typeof rawReason !== "string") return UNKNOWN_SENTENCE;
+  const code = rawReason.split(":")[0].trim().toLowerCase();
+  return isKnownReason(code) ? REASON_SENTENCES[code] : UNKNOWN_SENTENCE;
 }
 
 // src/lib/buzzwords.ts
@@ -12019,15 +12145,6 @@ function printActivityLines(entries, tty3) {
     console.log(`${prompt} ${text}`);
   }
 }
-async function resolveShowFullDetails(client) {
-  try {
-    const me = await client.me.get();
-    const slug = me.plan.slug;
-    return slug === "security_pro" || slug === "enterprise";
-  } catch {
-    return false;
-  }
-}
 async function watchPentest(client, profileId, options) {
   const { timeoutMs, intervalMs, useJson, showFindingsSummary } = options;
   const tty3 = isTTY();
@@ -12056,7 +12173,6 @@ async function watchPentest(client, profileId, options) {
     console.log("\nWatch cancelled. Pentest is still running.");
     process.exit(0);
   });
-  const showFullDetails = await resolveShowFullDetails(client);
   let consecutiveErrors = 0;
   const MAX_CONSECUTIVE_ERRORS = 2;
   let deferredExitCode = null;
@@ -12104,17 +12220,16 @@ ${icon2} Lost connection to pentest.`);
           JSON.stringify({ ...scanDetail, elapsed_seconds: elapsed }) + "\n"
         );
       } else {
-        const normalized = normalizeActivityHistory(scanDetail.activity_history);
-        const filtered = filterActivityForTier(normalized, showFullDetails);
-        if (printedCount > filtered.length) printedCount = 0;
-        const newEntries = filtered.slice(printedCount);
+        const entries = normalizeActivityHistory(scanDetail.activity_history);
+        if (printedCount > entries.length) printedCount = 0;
+        const newEntries = entries.slice(printedCount);
         if (newEntries.length > 0) {
           if (spinner) spinner.stop();
           printActivityLines(newEntries, tty3);
           printedCount += newEntries.length;
           if (spinner) spinner = ora({ color: "green", isEnabled: true, discardStdin: false }).start();
         }
-        currentPhase = extractPhase(filtered);
+        currentPhase = extractPhase(entries);
         updateSpinnerText();
       }
       const status = scanDetail.scan_status;
@@ -12151,7 +12266,7 @@ ${icon2} Pentest completed: ${domain}    ${dur}`);
       }
       if (status === "Failed") {
         const icon2 = tty3 ? import_picocolors5.default.red(sym.fail) : sym.fail;
-        const reason = scanDetail.failure_reason || "unknown reason";
+        const reason = failureSentence(scanDetail.failure_reason);
         console.log(`
 ${icon2} Pentest failed: ${reason}`);
         deferredExitCode = 1;
@@ -12189,8 +12304,8 @@ ${icon} Unexpected status: ${status}`);
 }
 async function printFindingsSummary(client, profileId, tty3) {
   try {
-    const reports = await client.reports.list({ limit: 20 });
-    const report = reports.items.find((r) => r.scan_profile_id === profileId);
+    const reports = await client.reports.list({ scan_profile_id: profileId, limit: 1 });
+    const report = reports.items[0];
     if (report?.severity_counts) {
       const label = tty3 ? import_picocolors5.default.dim("Findings:") : "Findings:";
       const summary = renderFindingsSummary(report.severity_counts);
@@ -12317,6 +12432,15 @@ Timeout: Scout did not connect within ${secs}s.`);
   }
 }
 
+// src/lib/validate-mode.ts
+var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
+function validateScanMode(mode) {
+  if (!VALID_SCAN_MODES.includes(mode)) {
+    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
+    process.exit(2);
+  }
+}
+
 // src/lib/scope.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 
@@ -12762,14 +12886,26 @@ function ensurePasteBundle(result) {
     process.exit(1);
   }
 }
+var STATUS_FILTERS = {
+  "not-started": "Not Yet Started",
+  running: "Running...",
+  completed: "Completed",
+  failed: "Failed",
+  stopping: "Stopping...",
+  scheduled: "Scheduled"
+};
+function isStatusFilter(value) {
+  return Object.hasOwn(STATUS_FILTERS, value);
+}
 function isUserDataTooLarge(err) {
   return err.status === 413 || /user-?data too large/i.test(err.detail);
 }
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only (default: full; a --profile rerun keeps its saved mode)").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
   $ kinosec pentest --profile abc123
+  $ kinosec pentest --profile abc123 --mode quick
   $ kinosec pentest -t internal.corp --deployment on-prem
   $ kinosec pentest -t example.com --include api.example.com,app.example.com
   $ kinosec pentest -t example.com --exclude staging.example.com
@@ -12778,12 +12914,10 @@ Examples:
   $ kinosec pentest -t target.htb --mode htb --source ./challenge.zip --zip-password hackthebox
 
 Graybox (--source):
-  Packs the target's source (paste-mode only) and folds it into the agent as authoritative
-  context. Works with --mode full and quick for any user's own asset; htb/defcon additionally
-  require admin access. Large source is delivered out-of-band, so there's no size ceiling to
-  fight \u2014 --budget just controls how much source is packed (bigger bundles add context and cost).
-  The source is sent over HTTPS, used only on the ephemeral scan droplet, and is NOT stored
-  server-side (the training log records just a "[GRAYBOX] N bytes injected" marker, never the source).`).action(async (options) => {
+  Packs the target's source and sends it with the pentest as extra context.
+  Works with --mode full and quick on your own assets. --budget controls how much
+  source is packed (bigger bundles add context and cost).
+  The source is sent over HTTPS, used only while the pentest runs, and is NOT stored.`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
@@ -12795,7 +12929,7 @@ Graybox (--source):
       console.error("Invalid deployment type. Must be: cloud or on-prem.");
       process.exit(2);
     }
-    validateScanMode(options.mode);
+    if (options.mode !== void 0) validateScanMode(options.mode);
     let sourceBudget = DEFAULT_SOURCE_BUDGET;
     if (options.source) {
       sourceBudget = parseInt(options.budget, 10);
@@ -12838,7 +12972,11 @@ Graybox (--source):
       if (options.profile) {
         const detail = await client.scans.get(options.profile);
         targetDisplay = detail.domain_or_ip;
-        params = { scan_profile_id: options.profile };
+        const profileParams = { scan_profile_id: options.profile };
+        if (options.mode !== void 0) {
+          profileParams.scan_mode = options.mode;
+        }
+        params = profileParams;
       } else {
         const parsed = parseTarget(options.target);
         for (const warning2 of parsed.warnings) {
@@ -12869,7 +13007,7 @@ Graybox (--source):
         targetDisplay = parsed.hostname;
         const assetParams = {
           asset_id: asset.id,
-          scan_mode: options.mode
+          scan_mode: options.mode ?? "full"
         };
         if (options.mode === "defcon") {
           assetParams.flag_format = options.flag ?? "HTB";
@@ -13013,17 +13151,36 @@ ${divider}
     }
   });
   registerScheduleCommand(pentest);
-  pentest.command("list").description("List pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  pentest.command("list").description("List pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", `Only pentests with this status: ${Object.keys(STATUS_FILTERS).join(", ")}`).option("-t, --target <host>", "Only pentests of this exact host").addHelpText("after", `
 Examples:
   $ kinosec pentest list
-  $ kinosec pentest list --limit 5 --json`).action(async (options) => {
+  $ kinosec pentest list --limit 5 --json
+  $ kinosec pentest list --status failed
+  $ kinosec pentest list -t example.com`).action(async (options) => {
+    const status = options.status;
+    if (status !== void 0 && !isStatusFilter(status)) {
+      console.error(`Invalid --status "${status}". Must be one of: ${Object.keys(STATUS_FILTERS).join(", ")}.`);
+      process.exit(2);
+    }
+    const typedTarget = pentest.opts().target ?? options.target;
+    let target;
+    if (typedTarget !== void 0) {
+      try {
+        target = parseTarget(typedTarget).hostname;
+      } catch (error2) {
+        console.error(error2 instanceof Error ? error2.message : String(error2));
+        process.exit(2);
+      }
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const result = await client.scans.list({
         limit: parseInt(options.limit, 10),
-        cursor: options.cursor
+        cursor: options.cursor,
+        status: status === void 0 ? void 0 : STATUS_FILTERS[status],
+        domain_or_ip: target
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13044,8 +13201,9 @@ Examples:
         ])
       );
       if (result.next_cursor) {
+        const filters = `${status ? ` --status ${status}` : ""}${target ? ` --target ${target}` : ""}`;
         console.log(import_picocolors8.default.dim(`
-More results available. Use --cursor ${result.next_cursor}`));
+More results available: kinosec pentest list${filters} --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
       handleError(error2);
@@ -13078,6 +13236,10 @@ Examples:
           ["Updated", detail.updated_at]
         ]
       );
+      if (detail.scan_status === "Failed") {
+        console.log(`
+Failure: ${failureSentence(detail.failure_reason)}`);
+      }
     } catch (error2) {
       handleError(error2);
     }
@@ -13453,13 +13615,206 @@ Examples:
   });
 }
 
+// src/lib/asset-import.ts
+import { createReadStream } from "fs";
+
+// src/lib/asset-value.ts
+var REASON_TEXT = {
+  empty: "Empty",
+  too_long: "Too long",
+  non_ascii_host: "Non-ASCII characters are not supported",
+  invalid_port: "Invalid port",
+  invalid_ip: "Invalid IP address",
+  malformed_host: "Not a valid host",
+  apex_public_suffix: "Public suffix, add a full domain",
+  network_range: "Network ranges aren't supported by asset import"
+};
+var MAX_HOST_LENGTH = 253;
+var MAX_LABEL_LENGTH = 63;
+var INVISIBLE_CHARS_RE = /[\u200B-\u200D\u2060\uFEFF\u00AD\u202A-\u202E\u2066-\u2069\u00A0]/g;
+var IPV4_STRICT_RE = /^(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)){3}$/;
+var HOSTNAME_RE2 = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/;
+var RANGE_RE = /^\d{1,3}(?:\.\d{1,3}){3}\/\d/;
+function splitValues(text) {
+  return text.split(/\r\n|\r|\n/).flatMap(
+    (lineText, index) => lineText.split(/[,;\s]+/).filter((raw) => raw.length > 0).map((raw) => ({ raw, line: index + 1 }))
+  );
+}
+function clean(raw) {
+  return raw.replace(INVISIBLE_CHARS_RE, "").normalize("NFC").trim().replace(/^https?:\/\//i, "");
+}
+function normalize2(raw) {
+  const withoutScheme = clean(raw);
+  const slash = withoutScheme.indexOf("/");
+  const host = slash === -1 ? withoutScheme : withoutScheme.slice(0, slash);
+  return dropTrailingDots(host.toLowerCase()).trim();
+}
+function dropTrailingDots(text) {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === ".") end--;
+  return text.slice(0, end);
+}
+function invalid(reason) {
+  return { valid: false, reason };
+}
+function isTooLong(value) {
+  const host = value.replace(/:\d+$/, "");
+  return host.length > MAX_HOST_LENGTH || host.split(".").some((label) => label.length > MAX_LABEL_LENGTH);
+}
+function checkValue(raw) {
+  if (RANGE_RE.test(clean(raw))) return invalid("network_range");
+  const value = normalize2(raw);
+  if (value.length === 0) return invalid("empty");
+  if (isTooLong(value)) return invalid("too_long");
+  if (/[\u0080-\uFFFF]/.test(value)) return invalid("non_ascii_host");
+  const colons = value.split(":").length - 1;
+  if (colons >= 2) return invalid("invalid_ip");
+  let host = value;
+  if (colons === 1) {
+    const at = value.lastIndexOf(":");
+    const port = value.slice(at + 1);
+    if (!/^\d+$/.test(port) || Number(port) < 1 || Number(port) > 65535) return invalid("invalid_port");
+    host = value.slice(0, at);
+  }
+  if (/^[\d.]+$/.test(host)) {
+    return IPV4_STRICT_RE.test(host) ? { valid: true, value, type: "ip" } : invalid("invalid_ip");
+  }
+  if (!HOSTNAME_RE2.test(host)) return invalid("malformed_host");
+  if (MULTI_LEVEL_TLDS.has(host) || isPublicSuffix(host)) return invalid("apex_public_suffix");
+  return { valid: true, value, type: detectAssetType(value) };
+}
+
+// src/lib/asset-import.ts
+var MAX_BYTES = 1048576;
+var MAX_VALUES = 1e4;
+var PAGE_SIZE = 100;
+function exitWithInputError(message) {
+  console.error(message);
+  process.exit(2);
+}
+function readFailure(error2) {
+  if (error2 instanceof Error && "code" in error2) {
+    if (error2.code === "ENOENT") return "no such file";
+    if (error2.code === "EACCES") return "permission denied";
+    if (error2.code === "EISDIR") return "it is a folder";
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function readCapped(source) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of source) {
+    const part = chunk;
+    const buffer = Buffer.isBuffer(part) ? part : Buffer.from(String(part));
+    chunks.push(buffer);
+    size += buffer.length;
+    if (size > MAX_BYTES) break;
+  }
+  return Buffer.concat(chunks);
+}
+function isUtf16(bytes) {
+  return bytes.length >= 2 && (bytes[0] === 255 && bytes[1] === 254 || bytes[0] === 254 && bytes[1] === 255);
+}
+async function readImportValues(file) {
+  const name = file === "-" ? "stdin" : file;
+  let bytes;
+  try {
+    bytes = await readCapped(file === "-" ? process.stdin : createReadStream(file, { end: MAX_BYTES }));
+  } catch (error2) {
+    exitWithInputError(`Cannot read ${name}: ${readFailure(error2)}.`);
+  }
+  if (bytes.length > MAX_BYTES) exitWithInputError(`${name} is larger than 1 MB.`);
+  if (isUtf16(bytes)) exitWithInputError(`${name} is UTF-16. Save it as UTF-8 and try again.`);
+  const values = splitValues(new TextDecoder("utf-8").decode(bytes));
+  if (values.length > MAX_VALUES) {
+    exitWithInputError(`${name} has ${values.length.toLocaleString("en-US")} values. The limit is 10,000.`);
+  }
+  if (values.length === 0) exitWithInputError(`${name} has no values to import.`);
+  return values;
+}
+async function orgAssetValues(client) {
+  const values = /* @__PURE__ */ new Set();
+  let cursor;
+  do {
+    const page = await client.assets.list({ limit: PAGE_SIZE, cursor });
+    for (const item of page.items) values.add(item.asset_value);
+    cursor = page.next_cursor ?? void 0;
+  } while (cursor);
+  return values;
+}
+function asError(error2) {
+  return error2 instanceof Error ? error2 : new Error(String(error2));
+}
+function isAuthError(error2) {
+  return error2 instanceof ApiError && (error2.status === 401 || error2.status === 403);
+}
+async function importOne(job) {
+  const { client, input: { raw, line }, seen, existing } = job;
+  const check = checkValue(raw);
+  if (!check.valid) return { kind: "invalid", line, value: raw, reason: check.reason };
+  const { value, type } = check;
+  if (seen.has(value)) return { kind: "skipped", line, value, reason: "repeated" };
+  seen.add(value);
+  if (existing.has(value)) return { kind: "skipped", line, value, reason: "exists" };
+  try {
+    const asset = await client.assets.create({
+      asset_type: type,
+      asset_value: value,
+      parent_domain: deriveParentDomain(value),
+      verification_method: "dns"
+    });
+    return { kind: "created", line, value, id: asset.id };
+  } catch (error2) {
+    if (error2 instanceof ApiError && error2.code === "asset_already_exists") {
+      return { kind: "skipped", line, value, reason: "exists" };
+    }
+    if (isAuthError(error2) || !(error2 instanceof ApiError)) throw error2;
+    return { kind: "failed", line, value, error: asError(error2).message };
+  }
+}
+function record(result, entry) {
+  if (entry.kind === "created") result.created.push({ line: entry.line, value: entry.value, id: entry.id });
+  if (entry.kind === "skipped") result.skipped.push({ line: entry.line, value: entry.value, reason: entry.reason });
+  if (entry.kind === "invalid") result.invalid.push({ line: entry.line, value: entry.value, reason: entry.reason });
+  if (entry.kind === "failed") result.failed.push({ line: entry.line, value: entry.value, error: entry.error });
+}
+async function importAssets(client, options) {
+  const result = { created: [], skipped: [], invalid: [], failed: [] };
+  const seen = /* @__PURE__ */ new Set();
+  for (const input of options.values) {
+    let entry;
+    try {
+      entry = await importOne({ client, input, seen, existing: options.existing });
+    } catch (error2) {
+      return { result, stopError: asError(error2) };
+    }
+    record(result, entry);
+    options.onEntry?.(entry);
+  }
+  return { result, stopError: null };
+}
+function printable(text) {
+  return text.replace(/\p{Cc}/gu, "?");
+}
+function entryLine(entry) {
+  if (entry.kind === "created") return `Created ${entry.value}`;
+  if (entry.kind === "invalid") {
+    return `Invalid ${printable(entry.value)} (line ${entry.line}): ${REASON_TEXT[entry.reason]}`;
+  }
+  if (entry.kind === "failed") return `Failed ${entry.value}: ${entry.error}`;
+  return entry.reason === "exists" ? `Skipped ${entry.value}: already exists` : `Skipped ${entry.value} (line ${entry.line}): repeated in file`;
+}
+function summaryLine(result) {
+  const { created, skipped, invalid: invalid2, failed } = result;
+  return `Created ${created.length}, skipped ${skipped.length}, invalid ${invalid2.length}, failed ${failed.length}.`;
+}
+
 // src/commands/asset.ts
 function registerAssetCommand(program3) {
   const asset = program3.command("asset").description("Manage assets");
-  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--search <term>", "Filter by asset value (substring match)").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
+  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
 Examples:
   $ kinosec asset list
-  $ kinosec asset list --search example.com
   $ kinosec asset list --type subdomain --status verified
   $ kinosec asset list --limit 50 --json`).action(async (options) => {
     try {
@@ -13469,7 +13824,6 @@ Examples:
       const result = await client.assets.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        search: options.search,
         status: options.status,
         type: options.type
       });
@@ -13570,6 +13924,42 @@ Verify: kinosec asset verify ${result.id}`);
       handleError(error2);
     }
   });
+  asset.command("import").description("Add many assets from a text or CSV file").argument("<file>", "File to read, or - to read stdin").addHelpText("after", `
+Each value is a domain, subdomain or IPv4 address; its type is detected. A
+:port (example.com:8443) is kept as part of the value. Separate values with
+newlines, commas, semicolons or spaces. Network ranges are not supported.
+Limits: UTF-8, 1 MB and 10,000 values per file.
+
+Values already in your organization are skipped. Assets are created one
+request at a time, so a long file takes a while. Safe to rerun: values added
+by an earlier run show as "already exists".
+
+Token permissions needed: assets:read, assets:write.
+
+Examples:
+  $ kinosec asset import assets.txt
+  $ cat assets.csv | kinosec asset import -`).action(async (file) => {
+    const values = await readImportValues(file);
+    const opts = program3.opts();
+    const useJson = opts.json || opts.output === "json";
+    let outcome;
+    try {
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const existing = await orgAssetValues(client);
+      outcome = await importAssets(client, {
+        values,
+        existing,
+        onEntry: useJson ? void 0 : (entry) => console.log(entryLine(entry))
+      });
+    } catch (error2) {
+      handleError(error2);
+    }
+    if (useJson) printJson(outcome.result);
+    else console.log(summaryLine(outcome.result));
+    if (outcome.stopError) handleError(outcome.stopError);
+    if (outcome.result.invalid.length > 0 || outcome.result.failed.length > 0) process.exit(1);
+  });
   asset.command("delete").description("Delete an asset").argument("<id>", "Asset ID").option("-y, --yes", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ kinosec asset delete abc123
@@ -13700,12 +14090,39 @@ function formatPoc(poc) {
   return json === "{}" || json === "[]" ? null : json;
 }
 var VALID_STATUSES = ["open", "fixed", "false_positive", "accepted_risk", "resolved"];
+var SEVERITY_FILTERS = ["critical", "high", "medium", "low", "info"];
+var STATUS_FILTERS2 = [
+  "open",
+  "fixed",
+  "false_positive",
+  "accepted_risk",
+  "investigating",
+  "wont_fix",
+  "resolved"
+];
+function isSeverityFilter(value) {
+  return SEVERITY_FILTERS.some((level) => level === value);
+}
+function isStatusFilter2(value) {
+  return STATUS_FILTERS2.some((status) => status === value);
+}
 function registerFindingCommand(program3) {
   const finding = program3.command("finding").description("Manage findings");
-  finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--severity <level>", `Only findings of this severity: ${SEVERITY_FILTERS.join(", ")}`).option("--status <status>", `Only findings with this status: ${STATUS_FILTERS2.join(", ")}`).addHelpText("after", `
 Examples:
-  $ kinosec finding list abc123
+  $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001
+  $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001 --severity critical --status open
   $ kinosec finding list --limit 50 --json`).action(async (profileId, options) => {
+    const severity = options.severity;
+    if (severity !== void 0 && !isSeverityFilter(severity)) {
+      console.error(`Invalid --severity "${severity}". Must be one of: ${SEVERITY_FILTERS.join(", ")}.`);
+      process.exit(2);
+    }
+    const status = options.status;
+    if (status !== void 0 && !isStatusFilter2(status)) {
+      console.error(`Invalid --status "${status}". Must be one of: ${STATUS_FILTERS2.join(", ")}.`);
+      process.exit(2);
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
@@ -13713,7 +14130,9 @@ Examples:
       const result = await client.findings.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        scan: profileId
+        scan_profile_id: profileId,
+        impact_level: severity,
+        status
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13733,8 +14152,9 @@ Examples:
         ])
       );
       if (result.next_cursor) {
+        const scope = `${profileId ? ` ${profileId}` : ""}${severity ? ` --severity ${severity}` : ""}${status ? ` --status ${status}` : ""}`;
         console.log(import_picocolors11.default.dim(`
-More results available. Use --cursor ${result.next_cursor}`));
+More results available: kinosec finding list${scope} --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
       handleError(error2);
@@ -13822,69 +14242,163 @@ Examples:
 
 // src/commands/report.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
-function renderMarkdown(data) {
-  const { scan, findings } = data;
-  const lines = [];
-  lines.push(`# Security Report: ${scan.domain_or_ip}`);
-  lines.push("");
-  lines.push(`**Report:** ${scan.report_name}`);
-  lines.push(`**Scan Mode:** ${scan.scan_mode}`);
-  lines.push(`**Completed:** ${scan.scan_completed_at}`);
-  lines.push("");
-  if (scan.severity_counts && Object.keys(scan.severity_counts).length > 0) {
-    lines.push("## Severity Summary");
-    lines.push("");
-    lines.push("| Severity | Count |");
-    lines.push("|----------|-------|");
-    for (const [severity, count] of Object.entries(scan.severity_counts)) {
-      lines.push(`| ${severity} | ${count} |`);
-    }
-    lines.push("");
-  }
-  if (findings.length > 0) {
-    lines.push("## Findings");
-    lines.push("");
-    for (let i = 0; i < findings.length; i++) {
-      const f = findings[i];
-      lines.push(`### ${i + 1}. ${f.finding_name} (${f.impact_level})`);
-      lines.push("");
-      if (f.finding_description) {
-        lines.push(`**Description:** ${f.finding_description}`);
-        lines.push("");
-      }
-      if (f.finding_solution) {
-        lines.push(`**Solution:** ${f.finding_solution}`);
-        lines.push("");
-      }
-    }
-  } else {
-    lines.push("## Findings");
-    lines.push("");
-    lines.push("No findings.");
-    lines.push("");
+
+// src/lib/report-summary.ts
+var POSTURES = ["critical", "high", "medium", "low", "secure", "indeterminate"];
+var NOT_FINAL_FALLBACK = "Some findings from this scan could not be saved, so this report is not a complete assessment. Re-run the scan for accurate results \u2014 a clean result here does not mean the target is secure.";
+var PARTIAL_FALLBACK = "This scan did not fully complete, so some findings may be missing. The findings in this report are real \u2014 re-run the scan for complete coverage.";
+function indented(text) {
+  return text.trim().split("\n").map((line) => `  ${line}`);
+}
+function postureLine(summary) {
+  const posture = summary.security_posture;
+  if (posture === void 0) return [];
+  if (summary.incomplete && posture === "secure") return ["Security posture: indeterminate"];
+  return [`Security posture: ${POSTURES.includes(posture) ? posture : "unknown"}`];
+}
+function incompleteLines(summary) {
+  if (!summary.incomplete) return [];
+  if (summary.security_posture === "indeterminate") {
+    return ["Scan incomplete: results not final.", summary.incomplete_reason || NOT_FINAL_FALLBACK];
+  }
+  return ["Results may be partial.", summary.incomplete_reason || PARTIAL_FALLBACK];
+}
+function summaryLines(summary) {
+  if (!summary) return ["No executive summary for this report."];
+  const sections = [
+    [...postureLine(summary), ...incompleteLines(summary)],
+    summary.executive_summary ? ["Executive summary:", ...indented(summary.executive_summary)] : [],
+    summary.key_concerns?.length ? ["Key concerns:", ...summary.key_concerns.map((c) => `  - ${c}`)] : [],
+    summary.immediate_actions ? ["Immediate actions:", ...indented(summary.immediate_actions)] : []
+  ].filter((section) => section.length > 0);
+  if (sections.length === 0) return ["No executive summary for this report."];
+  return sections.flatMap((section, i) => i === 0 ? section : ["", ...section]);
+}
+
+// src/lib/uuid.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+  return UUID_RE2.test(value);
+}
+
+// src/lib/export-reports.ts
+import { existsSync as existsSync4 } from "fs";
+import { mkdir, rename, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+var EXPORT_FORMATS = ["json", "markdown"];
+var EXTENSIONS = { json: "json", markdown: "md" };
+var PAGE_SIZE2 = 100;
+function asError2(error2) {
+  return error2 instanceof Error ? error2 : new Error(String(error2));
+}
+function isAuthError2(error2) {
+  return error2 instanceof ApiError && (error2.status === 401 || error2.status === 403);
+}
+async function saveReport(client, id, format2, path) {
+  const content = format2 === "markdown" ? await client.reports.exportMarkdown(id) : JSON.stringify(await client.reports.export({ scan_report_id: id, format: "json" }), null, 2) + "\n";
+  const partial = `${path}.partial`;
+  await writeFile(partial, content);
+  await rename(partial, path);
+}
+async function exportOne(job) {
+  const { client, options, id, isNewest } = job;
+  if (!isUuid(id)) return { kind: "failed", id, error: "not a valid report ID" };
+  const path = join4(options.outDir, `${id}.${EXTENSIONS[options.format]}`);
+  if (options.skipNewest && isNewest) return { kind: "skipped", id, reason: "running" };
+  if (!options.overwrite && existsSync4(path)) return { kind: "skipped", id, reason: "exists" };
+  try {
+    await saveReport(client, id, options.format, path);
+    return { kind: "written", id, path };
+  } catch (error2) {
+    if (isAuthError2(error2)) throw error2;
+    return { kind: "failed", id, error: asError2(error2).message };
+  }
+}
+function record2(result, entry) {
+  if (entry.kind === "written") result.written.push({ id: entry.id, path: entry.path });
+  if (entry.kind === "skipped") result.skipped.push({ id: entry.id, reason: entry.reason });
+  if (entry.kind === "failed") result.failed.push({ id: entry.id, error: entry.error });
+}
+async function exportReports(client, options) {
+  const result = { written: [], skipped: [], failed: [] };
+  try {
+    await mkdir(options.outDir, { recursive: true });
+    let cursor;
+    let isNewest = true;
+    do {
+      const page = await client.reports.list({ scan_profile_id: options.profileId, limit: PAGE_SIZE2, cursor });
+      for (const { id } of page.items) {
+        const entry = await exportOne({ client, options, id, isNewest });
+        isNewest = false;
+        record2(result, entry);
+        options.onEntry?.(entry);
+      }
+      cursor = page.next_cursor ?? void 0;
+    } while (cursor);
+  } catch (error2) {
+    return { result, stopError: asError2(error2) };
+  }
+  return { result, stopError: null };
+}
+function entryLine2(entry) {
+  if (entry.kind === "written") return `Wrote ${entry.path}`;
+  if (entry.kind === "failed") return `Failed ${entry.id}: ${entry.error}`;
+  return entry.reason === "exists" ? `Skipped ${entry.id}: already exists` : `Skipped ${entry.id}: pentest still running`;
+}
+function summaryLine2(result) {
+  return `Exported ${result.written.length}, skipped ${result.skipped.length}, failed ${result.failed.length}.`;
+}
+
+// src/commands/report.ts
+var RUNNING_STATUSES = ["Running...", "Stopping..."];
+var NO_SCANS_SCOPE_NOTE = "Can't tell whether this pentest is running: this token lacks scans:read.";
+function exitOnBadPentestId(value) {
+  if (isUuid(value)) return;
+  console.error(`Pentest ID must be a full UUID, got "${value}".`);
+  process.exit(2);
+}
+function exitOnBadFormat(value) {
+  if (EXPORT_FORMATS.some((f) => f === value)) return;
+  console.error(`Invalid format "${value}". Valid: ${EXPORT_FORMATS.join(", ")}`);
+  process.exit(2);
+}
+function isRunning(scanStatus) {
+  return RUNNING_STATUSES.includes(scanStatus);
+}
+async function pentestRunState(client, profileId) {
+  try {
+    const scan = await client.scans.get(profileId);
+    return isRunning(scan.scan_status) ? "running" : "idle";
+  } catch (error2) {
+    if (error2 instanceof ApiError && error2.status === 403) return "unknown";
+    throw error2;
   }
-  return lines.join("\n");
 }
 function registerReportCommand(program3) {
   const report = program3.command("report").description("Manage reports");
-  report.command("list").description("List reports").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  report.command("list").description("List reports").argument("[profile-id]", "Only this pentest's reports (pentest profile ID)").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
 Examples:
   $ kinosec report list
-  $ kinosec report list --limit 10 --json`).action(async (options) => {
+  $ kinosec report list 550e8400-e29b-41d4-a716-446655440000
+  $ kinosec report list --limit 10 --json`).action(async (profileId, options) => {
+    if (profileId !== void 0) exitOnBadPentestId(profileId);
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const result = await client.reports.list({
         limit: parseInt(options.limit, 10),
-        cursor: options.cursor
+        cursor: options.cursor,
+        scan_profile_id: profileId
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
         return;
       }
+      const runState = profileId ? await pentestRunState(client, profileId) : "idle";
       if (result.items.length === 0) {
-        console.log("No reports found.");
+        console.log(runState === "running" ? "No reports yet. This pentest is still running." : "No reports found.");
+        if (runState === "unknown") console.log(NO_SCANS_SCOPE_NOTE);
         return;
       }
       printTable(
@@ -13894,11 +14408,17 @@ Examples:
           truncate(r.domain_or_ip, 30),
           r.scan_mode,
           formatFindings(r.severity_counts),
-          r.scan_completed_at ? new Date(r.scan_completed_at).toLocaleDateString() : "(pending)"
+          r.scan_completed_at ? new Date(r.scan_completed_at).toLocaleDateString() : "-"
         ])
       );
+      if (runState === "running") {
+        console.log("\nThis pentest is running. Its newest report may still be filling in.");
+      }
+      if (runState === "unknown") console.log(`
+${NO_SCANS_SCOPE_NOTE}`);
       if (result.next_cursor) {
-        console.log(import_picocolors12.default.dim(`
+        console.log(import_picocolors12.default.dim(profileId ? `
+More results available: kinosec report list ${profileId} --cursor ${result.next_cursor}` : `
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -13926,7 +14446,7 @@ Examples:
           ["Target", detail.domain_or_ip],
           ["Profile", detail.scan_profile_name],
           ["Mode", detail.scan_mode],
-          ["Completed", detail.scan_completed_at ?? "(pending)"],
+          ["Completed", detail.scan_completed_at ?? "-"],
           ["Created", detail.created_at]
         ]
       );
@@ -13936,6 +14456,8 @@ Examples:
           console.log(`  ${severity}: ${count}`);
         }
       }
+      console.log();
+      for (const line of summaryLines(detail.ai_summary)) console.log(line);
     } catch (error2) {
       handleError(error2);
     }
@@ -13944,32 +14466,67 @@ Examples:
 Examples:
   $ kinosec report export abc123 --format json > report.json
   $ kinosec report export abc123 --format markdown > report.md`).action(async (id, options) => {
-    const validFormats = ["json", "markdown"];
-    if (!validFormats.includes(options.format)) {
-      console.error(`Invalid format "${options.format}". Valid: ${validFormats.join(", ")}`);
-      process.exit(2);
-    }
+    exitOnBadFormat(options.format);
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
-      const result = await client.reports.export({
-        scan_report_id: id,
-        format: "json"
-      });
       if (options.format === "markdown" && !(opts.json || opts.output === "json")) {
-        process.stdout.write(renderMarkdown(result));
-      } else {
-        printJson(result);
+        process.stdout.write(await client.reports.exportMarkdown(id));
+        return;
       }
+      printJson(await client.reports.export({ scan_report_id: id, format: "json" }));
     } catch (error2) {
       handleError(error2);
     }
   });
+  report.command("export-all").description("Save every report of a pentest to a folder").argument("<profile-id>", "Pentest profile ID").option("--out <dir>", "Folder to save the reports in (created if missing)").option("--format <format>", "File format: json or markdown", "json").option("--overwrite", "Replace report files already in the folder").addHelpText("after", `
+Files are named <report-id>.json or <report-id>.md. Reports already saved in
+the folder are skipped unless --overwrite is given; other files are never
+touched. While the pentest runs, its newest report is skipped: run again later.
+Just after a pentest completes, its newest report can take about a minute to
+finish. If you exported it then, run again with --overwrite.
+
+Token permissions needed: reports:read, reports:export, scans:read.
+
+Examples:
+  $ kinosec report export-all 550e8400-e29b-41d4-a716-446655440000 --out ./reports
+  $ kinosec report export-all 550e8400-e29b-41d4-a716-446655440000 --out ./reports --format markdown`).action(async (profileId, options) => {
+    exitOnBadPentestId(profileId);
+    const format2 = options.format;
+    exitOnBadFormat(format2);
+    if (typeof options.out !== "string" || options.out.trim() === "") {
+      console.error("--out <dir> is required.");
+      process.exit(2);
+    }
+    const opts = program3.opts();
+    const useJson = opts.json || opts.output === "json";
+    let outcome;
+    try {
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const scan = await client.scans.get(profileId);
+      outcome = await exportReports(client, {
+        profileId,
+        format: format2,
+        outDir: options.out,
+        overwrite: options.overwrite === true,
+        skipNewest: isRunning(scan.scan_status),
+        onEntry: useJson ? void 0 : (entry) => console.log(entryLine2(entry))
+      });
+    } catch (error2) {
+      handleError(error2);
+    }
+    if (useJson) printJson(outcome.result);
+    else console.log(summaryLine2(outcome.result));
+    if (outcome.stopError) handleError(outcome.stopError);
+    if (outcome.result.failed.length > 0) process.exit(1);
+  });
 }
 
 // src/commands/token.ts
 var import_picocolors13 = __toESM(require_picocolors(), 1);
+var WEB_APP_TOKENS_URL = "https://kinosec.ai/settings?tab=api-tokens";
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -14015,8 +14572,8 @@ More results available. Use --cursor ${result.next_cursor}`));
 Examples:
   $ kinosec token create --name "CI" --scopes assets:read,scans:create
   $ kinosec token create --name "Full" --scopes assets:read,scans:read --expires 30`).action(async (options) => {
+    const opts = program3.opts();
     try {
-      const opts = program3.opts();
       const { token: authToken, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token: authToken });
       const scopes = options.scopes.split(",").map((s) => s.trim());
@@ -14038,6 +14595,13 @@ Examples:
       console.log(`  Scopes: ${result.scopes.join(", ")}`);
       console.log(`  Expires: ${new Date(result.expires_at).toLocaleDateString()}`);
     } catch (error2) {
+      const isJson = opts.json || opts.output === "json";
+      if (error2 instanceof ApiError && error2.code === "pat_cannot_create_token" && !isJson) {
+        printWarning("API tokens can't create other API tokens.");
+        console.error("Create a new token in the KinoSec web app:");
+        console.error(`  ${WEB_APP_TOKENS_URL}`);
+        console.error("");
+      }
       handleError(error2);
     }
   });
@@ -14064,7 +14628,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.1", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.12.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -14073,10 +14637,9 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.1")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.12.0")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js:
   (*! MIT License © Sindre Sorhus *)
 */
-//# sourceMappingURL=cli.js.map