@kinosec/cli 0.11.2 → 0.12.0

package/dist/cli.js

@@ -6944,6 +6944,10 @@ var ReportsResource = class {
   async export(params) {
     return this.api.post("v1/reports", { json: params }).json();
   }
+  /** The API's own markdown rendering of a report (`text/markdown`), returned as is. */
+  async exportMarkdown(scanReportId) {
+    return this.api.post("v1/reports", { json: { scan_report_id: scanReportId, format: "markdown" } }).text();
+  }
 };
 var TokensResource = class {
   constructor(api) {
@@ -12012,6 +12016,33 @@ function normalizeActivityHistory(raw) {
   });
 }
 
+// src/lib/failure-reason.ts
+var REASON_SENTENCES = {
+  timeout: "The pentest stopped reporting progress for longer than we allow, so we shut it down to be safe. We could not see why it went quiet.",
+  no_results: "The pentest ran but produced no results, so there was nothing to report.",
+  worker_image_broken: "The pentest machine started with a broken image on our side. This is our fault, not yours.",
+  worker_startup_failed: "The pentest worker could not start up, so testing never began.",
+  scan_error: "The pentest engine hit an error while testing the target and could not continue.",
+  ad_credentials_invalid: "The Active Directory credentials you supplied were rejected by the domain controller. Update them and try again.",
+  no_dc_reachable: "No domain controller could be reached inside the scope you gave us. Check that the scope covers the domain controller's subnet and that the scout can route to it, then try again.",
+  target_not_authorized: "We could not confirm you are authorized to test this target. Confirm authorization in your dashboard and try again.",
+  mfa_required: "Starting this pentest requires two-factor authentication. Sign in with your second factor and try again.",
+  egress_not_ready: "The network route we use to reach your target was not ready. Please try again in a few minutes.",
+  launch_conflict: "Another launch of this same pentest was already in progress. Refresh your dashboard and try again.",
+  launch_error: "The pentest could not be started. This is usually a temporary problem on our side.",
+  scheduled_launch_error: "A scheduled pentest could not be started at its scheduled time.",
+  schedule_cancelled: "The pentest was stopped because its schedule was cancelled while it was running."
+};
+var UNKNOWN_SENTENCE = "We could not determine the exact cause.";
+function isKnownReason(code) {
+  return Object.hasOwn(REASON_SENTENCES, code);
+}
+function failureSentence(rawReason) {
+  if (typeof rawReason !== "string") return UNKNOWN_SENTENCE;
+  const code = rawReason.split(":")[0].trim().toLowerCase();
+  return isKnownReason(code) ? REASON_SENTENCES[code] : UNKNOWN_SENTENCE;
+}
+
 // src/lib/buzzwords.ts
 var SCAN_EXECUTION_PHRASES = [
   "DEEP SCAN",
@@ -12235,7 +12266,7 @@ ${icon2} Pentest completed: ${domain}    ${dur}`);
       }
       if (status === "Failed") {
         const icon2 = tty3 ? import_picocolors5.default.red(sym.fail) : sym.fail;
-        const reason = scanDetail.failure_reason || "unknown reason";
+        const reason = failureSentence(scanDetail.failure_reason);
         console.log(`
 ${icon2} Pentest failed: ${reason}`);
         deferredExitCode = 1;
@@ -12273,8 +12304,8 @@ ${icon} Unexpected status: ${status}`);
 }
 async function printFindingsSummary(client, profileId, tty3) {
   try {
-    const reports = await client.reports.list({ limit: 20 });
-    const report = reports.items.find((r) => r.scan_profile_id === profileId);
+    const reports = await client.reports.list({ scan_profile_id: profileId, limit: 1 });
+    const report = reports.items[0];
     if (report?.severity_counts) {
       const label = tty3 ? import_picocolors5.default.dim("Findings:") : "Findings:";
       const summary = renderFindingsSummary(report.severity_counts);
@@ -12855,14 +12886,26 @@ function ensurePasteBundle(result) {
     process.exit(1);
   }
 }
+var STATUS_FILTERS = {
+  "not-started": "Not Yet Started",
+  running: "Running...",
+  completed: "Completed",
+  failed: "Failed",
+  stopping: "Stopping...",
+  scheduled: "Scheduled"
+};
+function isStatusFilter(value) {
+  return Object.hasOwn(STATUS_FILTERS, value);
+}
 function isUserDataTooLarge(err) {
   return err.status === 413 || /user-?data too large/i.test(err.detail);
 }
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only (default: full; a --profile rerun keeps its saved mode)").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
   $ kinosec pentest --profile abc123
+  $ kinosec pentest --profile abc123 --mode quick
   $ kinosec pentest -t internal.corp --deployment on-prem
   $ kinosec pentest -t example.com --include api.example.com,app.example.com
   $ kinosec pentest -t example.com --exclude staging.example.com
@@ -12886,7 +12929,7 @@ Graybox (--source):
       console.error("Invalid deployment type. Must be: cloud or on-prem.");
       process.exit(2);
     }
-    validateScanMode(options.mode);
+    if (options.mode !== void 0) validateScanMode(options.mode);
     let sourceBudget = DEFAULT_SOURCE_BUDGET;
     if (options.source) {
       sourceBudget = parseInt(options.budget, 10);
@@ -12929,7 +12972,11 @@ Graybox (--source):
       if (options.profile) {
         const detail = await client.scans.get(options.profile);
         targetDisplay = detail.domain_or_ip;
-        params = { scan_profile_id: options.profile };
+        const profileParams = { scan_profile_id: options.profile };
+        if (options.mode !== void 0) {
+          profileParams.scan_mode = options.mode;
+        }
+        params = profileParams;
       } else {
         const parsed = parseTarget(options.target);
         for (const warning2 of parsed.warnings) {
@@ -12960,7 +13007,7 @@ Graybox (--source):
         targetDisplay = parsed.hostname;
         const assetParams = {
           asset_id: asset.id,
-          scan_mode: options.mode
+          scan_mode: options.mode ?? "full"
         };
         if (options.mode === "defcon") {
           assetParams.flag_format = options.flag ?? "HTB";
@@ -13104,17 +13151,36 @@ ${divider}
     }
   });
   registerScheduleCommand(pentest);
-  pentest.command("list").description("List pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  pentest.command("list").description("List pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", `Only pentests with this status: ${Object.keys(STATUS_FILTERS).join(", ")}`).option("-t, --target <host>", "Only pentests of this exact host").addHelpText("after", `
 Examples:
   $ kinosec pentest list
-  $ kinosec pentest list --limit 5 --json`).action(async (options) => {
+  $ kinosec pentest list --limit 5 --json
+  $ kinosec pentest list --status failed
+  $ kinosec pentest list -t example.com`).action(async (options) => {
+    const status = options.status;
+    if (status !== void 0 && !isStatusFilter(status)) {
+      console.error(`Invalid --status "${status}". Must be one of: ${Object.keys(STATUS_FILTERS).join(", ")}.`);
+      process.exit(2);
+    }
+    const typedTarget = pentest.opts().target ?? options.target;
+    let target;
+    if (typedTarget !== void 0) {
+      try {
+        target = parseTarget(typedTarget).hostname;
+      } catch (error2) {
+        console.error(error2 instanceof Error ? error2.message : String(error2));
+        process.exit(2);
+      }
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const result = await client.scans.list({
         limit: parseInt(options.limit, 10),
-        cursor: options.cursor
+        cursor: options.cursor,
+        status: status === void 0 ? void 0 : STATUS_FILTERS[status],
+        domain_or_ip: target
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13135,8 +13201,9 @@ Examples:
         ])
       );
       if (result.next_cursor) {
+        const filters = `${status ? ` --status ${status}` : ""}${target ? ` --target ${target}` : ""}`;
         console.log(import_picocolors8.default.dim(`
-More results available. Use --cursor ${result.next_cursor}`));
+More results available: kinosec pentest list${filters} --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
       handleError(error2);
@@ -13169,6 +13236,10 @@ Examples:
           ["Updated", detail.updated_at]
         ]
       );
+      if (detail.scan_status === "Failed") {
+        console.log(`
+Failure: ${failureSentence(detail.failure_reason)}`);
+      }
     } catch (error2) {
       handleError(error2);
     }
@@ -13544,6 +13615,200 @@ Examples:
   });
 }
 
+// src/lib/asset-import.ts
+import { createReadStream } from "fs";
+
+// src/lib/asset-value.ts
+var REASON_TEXT = {
+  empty: "Empty",
+  too_long: "Too long",
+  non_ascii_host: "Non-ASCII characters are not supported",
+  invalid_port: "Invalid port",
+  invalid_ip: "Invalid IP address",
+  malformed_host: "Not a valid host",
+  apex_public_suffix: "Public suffix, add a full domain",
+  network_range: "Network ranges aren't supported by asset import"
+};
+var MAX_HOST_LENGTH = 253;
+var MAX_LABEL_LENGTH = 63;
+var INVISIBLE_CHARS_RE = /[\u200B-\u200D\u2060\uFEFF\u00AD\u202A-\u202E\u2066-\u2069\u00A0]/g;
+var IPV4_STRICT_RE = /^(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)){3}$/;
+var HOSTNAME_RE2 = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/;
+var RANGE_RE = /^\d{1,3}(?:\.\d{1,3}){3}\/\d/;
+function splitValues(text) {
+  return text.split(/\r\n|\r|\n/).flatMap(
+    (lineText, index) => lineText.split(/[,;\s]+/).filter((raw) => raw.length > 0).map((raw) => ({ raw, line: index + 1 }))
+  );
+}
+function clean(raw) {
+  return raw.replace(INVISIBLE_CHARS_RE, "").normalize("NFC").trim().replace(/^https?:\/\//i, "");
+}
+function normalize2(raw) {
+  const withoutScheme = clean(raw);
+  const slash = withoutScheme.indexOf("/");
+  const host = slash === -1 ? withoutScheme : withoutScheme.slice(0, slash);
+  return dropTrailingDots(host.toLowerCase()).trim();
+}
+function dropTrailingDots(text) {
+  let end = text.length;
+  while (end > 0 && text[end - 1] === ".") end--;
+  return text.slice(0, end);
+}
+function invalid(reason) {
+  return { valid: false, reason };
+}
+function isTooLong(value) {
+  const host = value.replace(/:\d+$/, "");
+  return host.length > MAX_HOST_LENGTH || host.split(".").some((label) => label.length > MAX_LABEL_LENGTH);
+}
+function checkValue(raw) {
+  if (RANGE_RE.test(clean(raw))) return invalid("network_range");
+  const value = normalize2(raw);
+  if (value.length === 0) return invalid("empty");
+  if (isTooLong(value)) return invalid("too_long");
+  if (/[\u0080-\uFFFF]/.test(value)) return invalid("non_ascii_host");
+  const colons = value.split(":").length - 1;
+  if (colons >= 2) return invalid("invalid_ip");
+  let host = value;
+  if (colons === 1) {
+    const at = value.lastIndexOf(":");
+    const port = value.slice(at + 1);
+    if (!/^\d+$/.test(port) || Number(port) < 1 || Number(port) > 65535) return invalid("invalid_port");
+    host = value.slice(0, at);
+  }
+  if (/^[\d.]+$/.test(host)) {
+    return IPV4_STRICT_RE.test(host) ? { valid: true, value, type: "ip" } : invalid("invalid_ip");
+  }
+  if (!HOSTNAME_RE2.test(host)) return invalid("malformed_host");
+  if (MULTI_LEVEL_TLDS.has(host) || isPublicSuffix(host)) return invalid("apex_public_suffix");
+  return { valid: true, value, type: detectAssetType(value) };
+}
+
+// src/lib/asset-import.ts
+var MAX_BYTES = 1048576;
+var MAX_VALUES = 1e4;
+var PAGE_SIZE = 100;
+function exitWithInputError(message) {
+  console.error(message);
+  process.exit(2);
+}
+function readFailure(error2) {
+  if (error2 instanceof Error && "code" in error2) {
+    if (error2.code === "ENOENT") return "no such file";
+    if (error2.code === "EACCES") return "permission denied";
+    if (error2.code === "EISDIR") return "it is a folder";
+  }
+  return error2 instanceof Error ? error2.message : String(error2);
+}
+async function readCapped(source) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of source) {
+    const part = chunk;
+    const buffer = Buffer.isBuffer(part) ? part : Buffer.from(String(part));
+    chunks.push(buffer);
+    size += buffer.length;
+    if (size > MAX_BYTES) break;
+  }
+  return Buffer.concat(chunks);
+}
+function isUtf16(bytes) {
+  return bytes.length >= 2 && (bytes[0] === 255 && bytes[1] === 254 || bytes[0] === 254 && bytes[1] === 255);
+}
+async function readImportValues(file) {
+  const name = file === "-" ? "stdin" : file;
+  let bytes;
+  try {
+    bytes = await readCapped(file === "-" ? process.stdin : createReadStream(file, { end: MAX_BYTES }));
+  } catch (error2) {
+    exitWithInputError(`Cannot read ${name}: ${readFailure(error2)}.`);
+  }
+  if (bytes.length > MAX_BYTES) exitWithInputError(`${name} is larger than 1 MB.`);
+  if (isUtf16(bytes)) exitWithInputError(`${name} is UTF-16. Save it as UTF-8 and try again.`);
+  const values = splitValues(new TextDecoder("utf-8").decode(bytes));
+  if (values.length > MAX_VALUES) {
+    exitWithInputError(`${name} has ${values.length.toLocaleString("en-US")} values. The limit is 10,000.`);
+  }
+  if (values.length === 0) exitWithInputError(`${name} has no values to import.`);
+  return values;
+}
+async function orgAssetValues(client) {
+  const values = /* @__PURE__ */ new Set();
+  let cursor;
+  do {
+    const page = await client.assets.list({ limit: PAGE_SIZE, cursor });
+    for (const item of page.items) values.add(item.asset_value);
+    cursor = page.next_cursor ?? void 0;
+  } while (cursor);
+  return values;
+}
+function asError(error2) {
+  return error2 instanceof Error ? error2 : new Error(String(error2));
+}
+function isAuthError(error2) {
+  return error2 instanceof ApiError && (error2.status === 401 || error2.status === 403);
+}
+async function importOne(job) {
+  const { client, input: { raw, line }, seen, existing } = job;
+  const check = checkValue(raw);
+  if (!check.valid) return { kind: "invalid", line, value: raw, reason: check.reason };
+  const { value, type } = check;
+  if (seen.has(value)) return { kind: "skipped", line, value, reason: "repeated" };
+  seen.add(value);
+  if (existing.has(value)) return { kind: "skipped", line, value, reason: "exists" };
+  try {
+    const asset = await client.assets.create({
+      asset_type: type,
+      asset_value: value,
+      parent_domain: deriveParentDomain(value),
+      verification_method: "dns"
+    });
+    return { kind: "created", line, value, id: asset.id };
+  } catch (error2) {
+    if (error2 instanceof ApiError && error2.code === "asset_already_exists") {
+      return { kind: "skipped", line, value, reason: "exists" };
+    }
+    if (isAuthError(error2) || !(error2 instanceof ApiError)) throw error2;
+    return { kind: "failed", line, value, error: asError(error2).message };
+  }
+}
+function record(result, entry) {
+  if (entry.kind === "created") result.created.push({ line: entry.line, value: entry.value, id: entry.id });
+  if (entry.kind === "skipped") result.skipped.push({ line: entry.line, value: entry.value, reason: entry.reason });
+  if (entry.kind === "invalid") result.invalid.push({ line: entry.line, value: entry.value, reason: entry.reason });
+  if (entry.kind === "failed") result.failed.push({ line: entry.line, value: entry.value, error: entry.error });
+}
+async function importAssets(client, options) {
+  const result = { created: [], skipped: [], invalid: [], failed: [] };
+  const seen = /* @__PURE__ */ new Set();
+  for (const input of options.values) {
+    let entry;
+    try {
+      entry = await importOne({ client, input, seen, existing: options.existing });
+    } catch (error2) {
+      return { result, stopError: asError(error2) };
+    }
+    record(result, entry);
+    options.onEntry?.(entry);
+  }
+  return { result, stopError: null };
+}
+function printable(text) {
+  return text.replace(/\p{Cc}/gu, "?");
+}
+function entryLine(entry) {
+  if (entry.kind === "created") return `Created ${entry.value}`;
+  if (entry.kind === "invalid") {
+    return `Invalid ${printable(entry.value)} (line ${entry.line}): ${REASON_TEXT[entry.reason]}`;
+  }
+  if (entry.kind === "failed") return `Failed ${entry.value}: ${entry.error}`;
+  return entry.reason === "exists" ? `Skipped ${entry.value}: already exists` : `Skipped ${entry.value} (line ${entry.line}): repeated in file`;
+}
+function summaryLine(result) {
+  const { created, skipped, invalid: invalid2, failed } = result;
+  return `Created ${created.length}, skipped ${skipped.length}, invalid ${invalid2.length}, failed ${failed.length}.`;
+}
+
 // src/commands/asset.ts
 function registerAssetCommand(program3) {
   const asset = program3.command("asset").description("Manage assets");
@@ -13659,6 +13924,42 @@ Verify: kinosec asset verify ${result.id}`);
       handleError(error2);
     }
   });
+  asset.command("import").description("Add many assets from a text or CSV file").argument("<file>", "File to read, or - to read stdin").addHelpText("after", `
+Each value is a domain, subdomain or IPv4 address; its type is detected. A
+:port (example.com:8443) is kept as part of the value. Separate values with
+newlines, commas, semicolons or spaces. Network ranges are not supported.
+Limits: UTF-8, 1 MB and 10,000 values per file.
+
+Values already in your organization are skipped. Assets are created one
+request at a time, so a long file takes a while. Safe to rerun: values added
+by an earlier run show as "already exists".
+
+Token permissions needed: assets:read, assets:write.
+
+Examples:
+  $ kinosec asset import assets.txt
+  $ cat assets.csv | kinosec asset import -`).action(async (file) => {
+    const values = await readImportValues(file);
+    const opts = program3.opts();
+    const useJson = opts.json || opts.output === "json";
+    let outcome;
+    try {
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const existing = await orgAssetValues(client);
+      outcome = await importAssets(client, {
+        values,
+        existing,
+        onEntry: useJson ? void 0 : (entry) => console.log(entryLine(entry))
+      });
+    } catch (error2) {
+      handleError(error2);
+    }
+    if (useJson) printJson(outcome.result);
+    else console.log(summaryLine(outcome.result));
+    if (outcome.stopError) handleError(outcome.stopError);
+    if (outcome.result.invalid.length > 0 || outcome.result.failed.length > 0) process.exit(1);
+  });
   asset.command("delete").description("Delete an asset").argument("<id>", "Asset ID").option("-y, --yes", "Skip confirmation prompt").addHelpText("after", `
 Examples:
   $ kinosec asset delete abc123
@@ -13789,12 +14090,39 @@ function formatPoc(poc) {
   return json === "{}" || json === "[]" ? null : json;
 }
 var VALID_STATUSES = ["open", "fixed", "false_positive", "accepted_risk", "resolved"];
+var SEVERITY_FILTERS = ["critical", "high", "medium", "low", "info"];
+var STATUS_FILTERS2 = [
+  "open",
+  "fixed",
+  "false_positive",
+  "accepted_risk",
+  "investigating",
+  "wont_fix",
+  "resolved"
+];
+function isSeverityFilter(value) {
+  return SEVERITY_FILTERS.some((level) => level === value);
+}
+function isStatusFilter2(value) {
+  return STATUS_FILTERS2.some((status) => status === value);
+}
 function registerFindingCommand(program3) {
   const finding = program3.command("finding").description("Manage findings");
-  finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--severity <level>", `Only findings of this severity: ${SEVERITY_FILTERS.join(", ")}`).option("--status <status>", `Only findings with this status: ${STATUS_FILTERS2.join(", ")}`).addHelpText("after", `
 Examples:
   $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001
+  $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001 --severity critical --status open
   $ kinosec finding list --limit 50 --json`).action(async (profileId, options) => {
+    const severity = options.severity;
+    if (severity !== void 0 && !isSeverityFilter(severity)) {
+      console.error(`Invalid --severity "${severity}". Must be one of: ${SEVERITY_FILTERS.join(", ")}.`);
+      process.exit(2);
+    }
+    const status = options.status;
+    if (status !== void 0 && !isStatusFilter2(status)) {
+      console.error(`Invalid --status "${status}". Must be one of: ${STATUS_FILTERS2.join(", ")}.`);
+      process.exit(2);
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
@@ -13802,7 +14130,9 @@ Examples:
       const result = await client.findings.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        scan_profile_id: profileId
+        scan_profile_id: profileId,
+        impact_level: severity,
+        status
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13822,8 +14152,9 @@ Examples:
         ])
       );
       if (result.next_cursor) {
+        const scope = `${profileId ? ` ${profileId}` : ""}${severity ? ` --severity ${severity}` : ""}${status ? ` --status ${status}` : ""}`;
         console.log(import_picocolors11.default.dim(`
-More results available. Use --cursor ${result.next_cursor}`));
+More results available: kinosec finding list${scope} --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
       handleError(error2);
@@ -13911,69 +14242,163 @@ Examples:
 
 // src/commands/report.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
-function renderMarkdown(data) {
-  const { scan, findings } = data;
-  const lines = [];
-  lines.push(`# Security Report: ${scan.domain_or_ip}`);
-  lines.push("");
-  lines.push(`**Report:** ${scan.report_name}`);
-  lines.push(`**Scan Mode:** ${scan.scan_mode}`);
-  lines.push(`**Completed:** ${scan.scan_completed_at}`);
-  lines.push("");
-  if (scan.severity_counts && Object.keys(scan.severity_counts).length > 0) {
-    lines.push("## Severity Summary");
-    lines.push("");
-    lines.push("| Severity | Count |");
-    lines.push("|----------|-------|");
-    for (const [severity, count] of Object.entries(scan.severity_counts)) {
-      lines.push(`| ${severity} | ${count} |`);
-    }
-    lines.push("");
-  }
-  if (findings.length > 0) {
-    lines.push("## Findings");
-    lines.push("");
-    for (let i = 0; i < findings.length; i++) {
-      const f = findings[i];
-      lines.push(`### ${i + 1}. ${f.finding_name} (${f.impact_level})`);
-      lines.push("");
-      if (f.finding_description) {
-        lines.push(`**Description:** ${f.finding_description}`);
-        lines.push("");
-      }
-      if (f.finding_solution) {
-        lines.push(`**Solution:** ${f.finding_solution}`);
-        lines.push("");
-      }
-    }
-  } else {
-    lines.push("## Findings");
-    lines.push("");
-    lines.push("No findings.");
-    lines.push("");
+
+// src/lib/report-summary.ts
+var POSTURES = ["critical", "high", "medium", "low", "secure", "indeterminate"];
+var NOT_FINAL_FALLBACK = "Some findings from this scan could not be saved, so this report is not a complete assessment. Re-run the scan for accurate results \u2014 a clean result here does not mean the target is secure.";
+var PARTIAL_FALLBACK = "This scan did not fully complete, so some findings may be missing. The findings in this report are real \u2014 re-run the scan for complete coverage.";
+function indented(text) {
+  return text.trim().split("\n").map((line) => `  ${line}`);
+}
+function postureLine(summary) {
+  const posture = summary.security_posture;
+  if (posture === void 0) return [];
+  if (summary.incomplete && posture === "secure") return ["Security posture: indeterminate"];
+  return [`Security posture: ${POSTURES.includes(posture) ? posture : "unknown"}`];
+}
+function incompleteLines(summary) {
+  if (!summary.incomplete) return [];
+  if (summary.security_posture === "indeterminate") {
+    return ["Scan incomplete: results not final.", summary.incomplete_reason || NOT_FINAL_FALLBACK];
+  }
+  return ["Results may be partial.", summary.incomplete_reason || PARTIAL_FALLBACK];
+}
+function summaryLines(summary) {
+  if (!summary) return ["No executive summary for this report."];
+  const sections = [
+    [...postureLine(summary), ...incompleteLines(summary)],
+    summary.executive_summary ? ["Executive summary:", ...indented(summary.executive_summary)] : [],
+    summary.key_concerns?.length ? ["Key concerns:", ...summary.key_concerns.map((c) => `  - ${c}`)] : [],
+    summary.immediate_actions ? ["Immediate actions:", ...indented(summary.immediate_actions)] : []
+  ].filter((section) => section.length > 0);
+  if (sections.length === 0) return ["No executive summary for this report."];
+  return sections.flatMap((section, i) => i === 0 ? section : ["", ...section]);
+}
+
+// src/lib/uuid.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+  return UUID_RE2.test(value);
+}
+
+// src/lib/export-reports.ts
+import { existsSync as existsSync4 } from "fs";
+import { mkdir, rename, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+var EXPORT_FORMATS = ["json", "markdown"];
+var EXTENSIONS = { json: "json", markdown: "md" };
+var PAGE_SIZE2 = 100;
+function asError2(error2) {
+  return error2 instanceof Error ? error2 : new Error(String(error2));
+}
+function isAuthError2(error2) {
+  return error2 instanceof ApiError && (error2.status === 401 || error2.status === 403);
+}
+async function saveReport(client, id, format2, path) {
+  const content = format2 === "markdown" ? await client.reports.exportMarkdown(id) : JSON.stringify(await client.reports.export({ scan_report_id: id, format: "json" }), null, 2) + "\n";
+  const partial = `${path}.partial`;
+  await writeFile(partial, content);
+  await rename(partial, path);
+}
+async function exportOne(job) {
+  const { client, options, id, isNewest } = job;
+  if (!isUuid(id)) return { kind: "failed", id, error: "not a valid report ID" };
+  const path = join4(options.outDir, `${id}.${EXTENSIONS[options.format]}`);
+  if (options.skipNewest && isNewest) return { kind: "skipped", id, reason: "running" };
+  if (!options.overwrite && existsSync4(path)) return { kind: "skipped", id, reason: "exists" };
+  try {
+    await saveReport(client, id, options.format, path);
+    return { kind: "written", id, path };
+  } catch (error2) {
+    if (isAuthError2(error2)) throw error2;
+    return { kind: "failed", id, error: asError2(error2).message };
+  }
+}
+function record2(result, entry) {
+  if (entry.kind === "written") result.written.push({ id: entry.id, path: entry.path });
+  if (entry.kind === "skipped") result.skipped.push({ id: entry.id, reason: entry.reason });
+  if (entry.kind === "failed") result.failed.push({ id: entry.id, error: entry.error });
+}
+async function exportReports(client, options) {
+  const result = { written: [], skipped: [], failed: [] };
+  try {
+    await mkdir(options.outDir, { recursive: true });
+    let cursor;
+    let isNewest = true;
+    do {
+      const page = await client.reports.list({ scan_profile_id: options.profileId, limit: PAGE_SIZE2, cursor });
+      for (const { id } of page.items) {
+        const entry = await exportOne({ client, options, id, isNewest });
+        isNewest = false;
+        record2(result, entry);
+        options.onEntry?.(entry);
+      }
+      cursor = page.next_cursor ?? void 0;
+    } while (cursor);
+  } catch (error2) {
+    return { result, stopError: asError2(error2) };
+  }
+  return { result, stopError: null };
+}
+function entryLine2(entry) {
+  if (entry.kind === "written") return `Wrote ${entry.path}`;
+  if (entry.kind === "failed") return `Failed ${entry.id}: ${entry.error}`;
+  return entry.reason === "exists" ? `Skipped ${entry.id}: already exists` : `Skipped ${entry.id}: pentest still running`;
+}
+function summaryLine2(result) {
+  return `Exported ${result.written.length}, skipped ${result.skipped.length}, failed ${result.failed.length}.`;
+}
+
+// src/commands/report.ts
+var RUNNING_STATUSES = ["Running...", "Stopping..."];
+var NO_SCANS_SCOPE_NOTE = "Can't tell whether this pentest is running: this token lacks scans:read.";
+function exitOnBadPentestId(value) {
+  if (isUuid(value)) return;
+  console.error(`Pentest ID must be a full UUID, got "${value}".`);
+  process.exit(2);
+}
+function exitOnBadFormat(value) {
+  if (EXPORT_FORMATS.some((f) => f === value)) return;
+  console.error(`Invalid format "${value}". Valid: ${EXPORT_FORMATS.join(", ")}`);
+  process.exit(2);
+}
+function isRunning(scanStatus) {
+  return RUNNING_STATUSES.includes(scanStatus);
+}
+async function pentestRunState(client, profileId) {
+  try {
+    const scan = await client.scans.get(profileId);
+    return isRunning(scan.scan_status) ? "running" : "idle";
+  } catch (error2) {
+    if (error2 instanceof ApiError && error2.status === 403) return "unknown";
+    throw error2;
   }
-  return lines.join("\n");
 }
 function registerReportCommand(program3) {
   const report = program3.command("report").description("Manage reports");
-  report.command("list").description("List reports").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
+  report.command("list").description("List reports").argument("[profile-id]", "Only this pentest's reports (pentest profile ID)").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
 Examples:
   $ kinosec report list
-  $ kinosec report list --limit 10 --json`).action(async (options) => {
+  $ kinosec report list 550e8400-e29b-41d4-a716-446655440000
+  $ kinosec report list --limit 10 --json`).action(async (profileId, options) => {
+    if (profileId !== void 0) exitOnBadPentestId(profileId);
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const result = await client.reports.list({
         limit: parseInt(options.limit, 10),
-        cursor: options.cursor
+        cursor: options.cursor,
+        scan_profile_id: profileId
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
         return;
       }
+      const runState = profileId ? await pentestRunState(client, profileId) : "idle";
       if (result.items.length === 0) {
-        console.log("No reports found.");
+        console.log(runState === "running" ? "No reports yet. This pentest is still running." : "No reports found.");
+        if (runState === "unknown") console.log(NO_SCANS_SCOPE_NOTE);
         return;
       }
       printTable(
@@ -13983,11 +14408,17 @@ Examples:
           truncate(r.domain_or_ip, 30),
           r.scan_mode,
           formatFindings(r.severity_counts),
-          r.scan_completed_at ? new Date(r.scan_completed_at).toLocaleDateString() : "(pending)"
+          r.scan_completed_at ? new Date(r.scan_completed_at).toLocaleDateString() : "-"
         ])
       );
+      if (runState === "running") {
+        console.log("\nThis pentest is running. Its newest report may still be filling in.");
+      }
+      if (runState === "unknown") console.log(`
+${NO_SCANS_SCOPE_NOTE}`);
       if (result.next_cursor) {
-        console.log(import_picocolors12.default.dim(`
+        console.log(import_picocolors12.default.dim(profileId ? `
+More results available: kinosec report list ${profileId} --cursor ${result.next_cursor}` : `
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -14015,7 +14446,7 @@ Examples:
           ["Target", detail.domain_or_ip],
           ["Profile", detail.scan_profile_name],
           ["Mode", detail.scan_mode],
-          ["Completed", detail.scan_completed_at ?? "(pending)"],
+          ["Completed", detail.scan_completed_at ?? "-"],
           ["Created", detail.created_at]
         ]
       );
@@ -14025,6 +14456,8 @@ Examples:
           console.log(`  ${severity}: ${count}`);
         }
       }
+      console.log();
+      for (const line of summaryLines(detail.ai_summary)) console.log(line);
     } catch (error2) {
       handleError(error2);
     }
@@ -14033,27 +14466,61 @@ Examples:
 Examples:
   $ kinosec report export abc123 --format json > report.json
   $ kinosec report export abc123 --format markdown > report.md`).action(async (id, options) => {
-    const validFormats = ["json", "markdown"];
-    if (!validFormats.includes(options.format)) {
-      console.error(`Invalid format "${options.format}". Valid: ${validFormats.join(", ")}`);
-      process.exit(2);
-    }
+    exitOnBadFormat(options.format);
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
-      const result = await client.reports.export({
-        scan_report_id: id,
-        format: "json"
-      });
       if (options.format === "markdown" && !(opts.json || opts.output === "json")) {
-        process.stdout.write(renderMarkdown(result));
-      } else {
-        printJson(result);
+        process.stdout.write(await client.reports.exportMarkdown(id));
+        return;
       }
+      printJson(await client.reports.export({ scan_report_id: id, format: "json" }));
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+  report.command("export-all").description("Save every report of a pentest to a folder").argument("<profile-id>", "Pentest profile ID").option("--out <dir>", "Folder to save the reports in (created if missing)").option("--format <format>", "File format: json or markdown", "json").option("--overwrite", "Replace report files already in the folder").addHelpText("after", `
+Files are named <report-id>.json or <report-id>.md. Reports already saved in
+the folder are skipped unless --overwrite is given; other files are never
+touched. While the pentest runs, its newest report is skipped: run again later.
+Just after a pentest completes, its newest report can take about a minute to
+finish. If you exported it then, run again with --overwrite.
+
+Token permissions needed: reports:read, reports:export, scans:read.
+
+Examples:
+  $ kinosec report export-all 550e8400-e29b-41d4-a716-446655440000 --out ./reports
+  $ kinosec report export-all 550e8400-e29b-41d4-a716-446655440000 --out ./reports --format markdown`).action(async (profileId, options) => {
+    exitOnBadPentestId(profileId);
+    const format2 = options.format;
+    exitOnBadFormat(format2);
+    if (typeof options.out !== "string" || options.out.trim() === "") {
+      console.error("--out <dir> is required.");
+      process.exit(2);
+    }
+    const opts = program3.opts();
+    const useJson = opts.json || opts.output === "json";
+    let outcome;
+    try {
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const scan = await client.scans.get(profileId);
+      outcome = await exportReports(client, {
+        profileId,
+        format: format2,
+        outDir: options.out,
+        overwrite: options.overwrite === true,
+        skipNewest: isRunning(scan.scan_status),
+        onEntry: useJson ? void 0 : (entry) => console.log(entryLine2(entry))
+      });
     } catch (error2) {
       handleError(error2);
     }
+    if (useJson) printJson(outcome.result);
+    else console.log(summaryLine2(outcome.result));
+    if (outcome.stopError) handleError(outcome.stopError);
+    if (outcome.result.failed.length > 0) process.exit(1);
   });
 }
 
@@ -14161,7 +14628,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.2", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.12.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -14170,7 +14637,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.2")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.12.0")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinosec/cli",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "description": "Official KinoSec command-line interface",
   "type": "module",
   "bin": {