@kinosec/cli 0.7.1 → 0.9.0

package/dist/cli.js

@@ -6289,6 +6289,7 @@ var KinoSecClient = class {
   reports;
   tokens;
   me;
+  credits;
   audit;
   constructor(config) {
     const prefixPathname = new URL(config.apiUrl).pathname.replace(/\/?$/, "/");
@@ -6338,6 +6339,7 @@ var KinoSecClient = class {
     this.reports = new ReportsResource(this.api);
     this.tokens = new TokensResource(this.api);
     this.me = new MeResource(this.api);
+    this.credits = new CreditsResource(this.api);
     this.audit = new AuditResource(this.api);
   }
 };
@@ -6387,6 +6389,9 @@ var ScansResource = class {
   async cancel(id) {
     return this.api.post(`v1/scans/${id}/cancel`, { json: {} }).json();
   }
+  async scoutStatus(profileId) {
+    return this.api.get(`v1/scans/${profileId}/scout-status`).json();
+  }
 };
 var SchedulesResource = class {
   constructor(api) {
@@ -6472,6 +6477,15 @@ var MeResource = class {
     return this.api.get("v1/me").json();
   }
 };
+var CreditsResource = class {
+  constructor(api) {
+    this.api = api;
+  }
+  api;
+  async get() {
+    return this.api.get("v1/credits").json();
+  }
+};
 var AuditResource = class {
   constructor(api) {
     this.api = api;
@@ -7353,6 +7367,32 @@ ${content}`);
 // src/lib/errors.ts
 function handleError(error2) {
   if (error2 instanceof ApiError) {
+    if (error2.code === "insufficient_credits") {
+      if (shouldUseJson()) {
+        process.stderr.write(
+          JSON.stringify({
+            error: {
+              status: error2.status,
+              code: error2.code,
+              detail: error2.detail,
+              request_id: error2.requestId
+            }
+          }) + "\n"
+        );
+      } else if (isTTY()) {
+        console.error(import_picocolors2.default.red("\u2717 Insufficient credits"));
+        console.error();
+        console.error("  You don't have enough credits for this scan.");
+        console.error("  Check your balance:");
+        console.error();
+        console.error(`  ${import_picocolors2.default.cyan("kinosec credits")}`);
+        console.error();
+        console.error(`  Need more? Contact ${import_picocolors2.default.bold("sales@kinosec.com")}`);
+      } else {
+        console.error("Insufficient credits. Check your balance: kinosec credits. Contact sales@kinosec.com");
+      }
+      process.exit(77);
+    }
     if (shouldUseJson()) {
       process.stderr.write(
         JSON.stringify({
@@ -7704,8 +7744,38 @@ Examples:
   });
 }
 
+// src/commands/credits.ts
+function registerCreditsCommand(program3) {
+  program3.command("credits").description("Show your credit balance").addHelpText("after", `
+Examples:
+  $ kinosec credits
+  $ kinosec credits --json`).action(async () => {
+    try {
+      const opts = program3.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const credits = await client.credits.get();
+      if (opts.json || opts.output === "json") {
+        printJson(credits);
+        return;
+      }
+      const fields = [
+        { label: "Pentest credits", value: String(credits.pentest_credits) },
+        { label: "Quick credits", value: String(credits.quick_pentest_credits) },
+        { label: "Free quick credit", value: String(credits.free_quick_pentest_credits) }
+      ];
+      if (credits.source?.type === "org_pool" && credits.source.org_name) {
+        fields.push({ label: "Source", value: `${credits.source.org_name} org pool` });
+      }
+      printDetail(fields);
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
+}
+
 // src/commands/pentest.ts
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors7 = __toESM(require_picocolors(), 1);
 
 // src/lib/confirm.ts
 var import_picocolors3 = __toESM(require_picocolors(), 1);
@@ -11460,6 +11530,122 @@ async function printFindingsSummary(client, profileId, tty3) {
   }
 }
 
+// src/lib/scout.ts
+var import_picocolors6 = __toESM(require_picocolors(), 1);
+var UNICODE2 = isUnicodeSupported();
+var sym2 = {
+  success: UNICODE2 ? "\u2713" : "v",
+  fail: UNICODE2 ? "\u2717" : "x",
+  warn: UNICODE2 ? "\u26A0" : "!"
+};
+function printOnPremInstructions(result) {
+  const tty3 = isTTY();
+  const header = tty3 ? import_picocolors6.default.bold("On-Prem Scout Setup") : "On-Prem Scout Setup";
+  console.log(`
+  ${header}
+`);
+  console.log(`  Session ID:  ${result.session_id}`);
+  console.log(`  Profile ID:  ${result.scan_profile_id}`);
+  const curlCmd = `curl -fsSL https://api.kinosec.ai/functions/v1/scout-bootstrap/launch/${result.bootstrap_token} | bash`;
+  if (tty3) {
+    console.log(`
+  Run on target host:
+`);
+    console.log(`  ${import_picocolors6.default.cyan(curlCmd)}
+`);
+    console.log(`  ${import_picocolors6.default.yellow(sym2.warn)}  Token expires in ${import_picocolors6.default.bold("15 minutes")}.`);
+  } else {
+    console.log(`
+  Run on target host:
+`);
+    console.log(`  ${curlCmd}
+`);
+    console.log(`  ${sym2.warn}  Token expires in 15 minutes.`);
+  }
+}
+async function waitForScoutConnection(client, profileId, options) {
+  const { timeoutMs, intervalMs, useJson } = options;
+  const tty3 = isTTY();
+  const loopStart = Date.now();
+  let spinner = null;
+  if (!useJson && tty3) {
+    spinner = ora({
+      text: "Waiting for Scout connection...",
+      color: "green",
+      isEnabled: true
+    }).start();
+  }
+  const cleanup = () => {
+    if (spinner) spinner.stop();
+  };
+  const onSigint = () => {
+    cleanup();
+    console.log("\nWatch cancelled. Pentest is waiting for Scout connection.");
+    process.exit(0);
+  };
+  process.once("SIGINT", onSigint);
+  while (true) {
+    const status = await client.scans.scoutStatus(profileId);
+    if (useJson) {
+      const elapsed = Math.round((Date.now() - loopStart) / 1e3);
+      process.stdout.write(
+        JSON.stringify({ ...status, elapsed_seconds: elapsed }) + "\n"
+      );
+    }
+    switch (status.status) {
+      case "pending":
+        if (spinner) spinner.text = import_picocolors6.default.green("Waiting for Scout bootstrap...");
+        break;
+      case "bootstrapped":
+        if (spinner) spinner.text = import_picocolors6.default.green("Scout bootstrapped, establishing connection...");
+        break;
+      case "connected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        if (!useJson) {
+          const icon = tty3 ? import_picocolors6.default.green(sym2.success) : sym2.success;
+          console.log(`${icon} Scout connected`);
+          if (status.hostname) {
+            console.log(`  Hostname: ${status.hostname}`);
+          }
+          if (status.tools.length > 0) {
+            console.log(`  Tools: ${status.tools.join(", ")}`);
+          }
+        }
+        return;
+      }
+      case "expired": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout bootstrap token expired.`);
+        console.error("Start a new pentest to get a fresh token.");
+        process.exit(1);
+      }
+      case "disconnected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout disconnected unexpectedly.`);
+        console.error(`Check status: kinosec pentest get ${profileId}`);
+        process.exit(1);
+      }
+    }
+    if (Date.now() - loopStart > timeoutMs) {
+      cleanup();
+      process.removeListener("SIGINT", onSigint);
+      const secs = Math.round(timeoutMs / 1e3);
+      console.error(`
+Timeout: Scout did not connect within ${secs}s.`);
+      console.error("The bootstrap token may have expired. Start a new pentest.");
+      process.exit(3);
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+
 // src/commands/pentest.ts
 function stripProtocol(input) {
   const match = input.match(/^https?:\/\/(.+)/i);
@@ -11470,15 +11656,23 @@ function isValidDomain(value) {
   return value.includes(".") && !/\s/.test(value);
 }
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: quick or full", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: quick or full", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
   $ kinosec pentest --target delikado.org --mode quick
-  $ kinosec pentest --profile abc123`).action(async (options) => {
+  $ kinosec pentest --profile abc123
+  $ kinosec pentest -t internal.corp --deployment on-prem`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
     }
+    if (options.deployment) {
+      options.deployment = options.deployment.replace(/-/g, "_");
+    }
+    if (options.deployment !== "cloud" && options.deployment !== "on_prem") {
+      console.error("Invalid deployment type. Must be: cloud or on-prem.");
+      process.exit(2);
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
@@ -11515,10 +11709,18 @@ Examples:
           }
         }
         targetDisplay = domain;
-        params = { asset_id: asset.id, scan_mode: options.mode };
+        const assetParams = {
+          asset_id: asset.id,
+          scan_mode: options.mode
+        };
+        if (options.deployment !== "cloud") {
+          assetParams.deployment_type = options.deployment;
+        }
+        params = assetParams;
       }
       await confirmAuthorization(targetDisplay, Boolean(options.yes));
       const result = await client.scans.create(params);
+      const isOnPrem = result.deployment_type === "on_prem";
       if (opts.json || opts.output === "json") {
         printJson(result);
         return;
@@ -11526,13 +11728,37 @@ Examples:
       printSuccess(`Pentest started: ${result.domain_or_ip}`);
       console.log(`  Profile ID: ${result.scan_profile_id}`);
       console.log(`  Mode: ${result.scan_mode}`);
+      if (isOnPrem) {
+        printOnPremInstructions(result);
+        if (options.watch && isTTY()) {
+          const divider2 = import_picocolors7.default.dim("\u2500".repeat(37));
+          console.log(`
+${divider2}
+`);
+          await waitForScoutConnection(client, result.scan_profile_id, {
+            timeoutMs: 15 * 60 * 1e3,
+            intervalMs: 5 * 1e3,
+            useJson: false
+          });
+          await watchPentest(client, result.scan_profile_id, {
+            timeoutMs: 1800 * 1e3,
+            intervalMs: 5 * 1e3,
+            useJson: false,
+            showFindingsSummary: true
+          });
+        } else {
+          console.log(`
+Watch connection: kinosec pentest watch ${result.scan_profile_id}`);
+        }
+        return;
+      }
       if (!options.watch || !isTTY()) {
         console.log(`  Status: ${result.scan_status}`);
         console.log(`
 Watch progress: kinosec pentest watch ${result.scan_profile_id}`);
         return;
       }
-      const divider = isTTY() ? import_picocolors6.default.dim("\u2500".repeat(37)) : "-".repeat(37);
+      const divider = isTTY() ? import_picocolors7.default.dim("\u2500".repeat(37)) : "-".repeat(37);
       console.log(`
 ${divider}
 `);
@@ -11578,7 +11804,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors6.default.dim(`
+        console.log(import_picocolors7.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -11605,6 +11831,7 @@ Examples:
           ["Target", detail.domain_or_ip],
           ["Mode", detail.scan_mode],
           ["Type", detail.scan_type],
+          ...detail.deployment_type ? [["Deployment", detail.deployment_type === "on_prem" ? "On-Prem" : "Cloud"]] : [],
           ["Status", detail.scan_status],
           ["Activity", detail.current_activity || "(none)"],
           ["Created", detail.created_at],
@@ -11641,10 +11868,25 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      const useJson = Boolean(opts.json || opts.output === "json");
+      const detail = await client.scans.get(id);
+      if (detail.deployment_type === "on_prem") {
+        try {
+          const scout = await client.scans.scoutStatus(id);
+          if (scout.status !== "connected") {
+            await waitForScoutConnection(client, id, {
+              timeoutMs: 15 * 60 * 1e3,
+              intervalMs: parseInt(options.interval, 10) * 1e3,
+              useJson
+            });
+          }
+        } catch {
+        }
+      }
       await watchPentest(client, id, {
         timeoutMs: parseInt(options.timeout, 10) * 1e3,
         intervalMs: parseInt(options.interval, 10) * 1e3,
-        useJson: Boolean(opts.json || opts.output === "json"),
+        useJson,
         showFindingsSummary: true
       });
     } catch (error2) {
@@ -11654,10 +11896,10 @@ Examples:
 }
 
 // src/commands/asset.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // src/commands/asset-auth.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 
 // src/lib/resolve-asset.ts
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-/i;
@@ -11914,7 +12156,7 @@ Examples:
       }
       if (!creds.has_credentials) {
         console.log(`Asset:           ${asset.asset_value}`);
-        console.log(`Auth Type:       ${import_picocolors7.default.dim("(none)")}`);
+        console.log(`Auth Type:       ${import_picocolors8.default.dim("(none)")}`);
         console.log(`Has Credentials: no`);
         return;
       }
@@ -11935,9 +12177,9 @@ Examples:
         const hasAny = ta.has_username || ta.has_cookie || ta.has_bearer_token || ta.has_apikey;
         if (hasAny) {
           const detail = ta.has_username ? "username" : ta.has_bearer_token ? "bearer token" : ta.has_cookie ? "cookie" : "API key";
-          console.log(`Target Account:  ${import_picocolors7.default.green("configured")} (${detail})`);
+          console.log(`Target Account:  ${import_picocolors8.default.green("configured")} (${detail})`);
         } else {
-          console.log(`Target Account:  ${import_picocolors7.default.dim("not configured")}`);
+          console.log(`Target Account:  ${import_picocolors8.default.dim("not configured")}`);
         }
       }
     } catch (error2) {
@@ -12088,7 +12330,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors8.default.dim(`
+        console.log(import_picocolors9.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12200,7 +12442,7 @@ Examples:
 }
 
 // src/commands/finding.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 function formatPoc(poc) {
   if (poc == null) return null;
   if (typeof poc === "string") return poc.trim() || null;
@@ -12241,7 +12483,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors9.default.dim(`
+        console.log(import_picocolors10.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12329,7 +12571,7 @@ Examples:
 }
 
 // src/commands/report.ts
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 function renderMarkdown(data) {
   const { scan, findings } = data;
   const lines = [];
@@ -12406,7 +12648,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors10.default.dim(`
+        console.log(import_picocolors11.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12477,7 +12719,7 @@ Examples:
 }
 
 // src/commands/token.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -12512,7 +12754,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors11.default.dim(`
+        console.log(import_picocolors12.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12539,7 +12781,7 @@ Examples:
       }
       printSuccess(`Token created: ${result.name}`);
       console.log("");
-      console.log(import_picocolors11.default.bold("  Token: ") + result.token);
+      console.log(import_picocolors12.default.bold("  Token: ") + result.token);
       console.log("");
       printWarning("Save this token \u2014 it will not be shown again.");
       console.log(`  ID: ${result.id}`);
@@ -12572,15 +12814,16 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.7.1", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.9.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
+registerCreditsCommand(program2);
 registerPentestCommand(program2);
 registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.7.1")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.9.0")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: