@kinosec/cli 0.8.0 → 0.10.0

package/dist/cli.js

@@ -6389,6 +6389,9 @@ var ScansResource = class {
   async cancel(id) {
     return this.api.post(`v1/scans/${id}/cancel`, { json: {} }).json();
   }
+  async scoutStatus(profileId) {
+    return this.api.get(`v1/scans/${profileId}/scout-status`).json();
+  }
 };
 var SchedulesResource = class {
   constructor(api) {
@@ -7772,7 +7775,7 @@ Examples:
 }
 
 // src/commands/pentest.ts
-var import_picocolors6 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 
 // src/lib/confirm.ts
 var import_picocolors3 = __toESM(require_picocolors(), 1);
@@ -7832,8 +7835,21 @@ ${import_picocolors3.default.dim("use of its services.")}
 
 // src/commands/schedule.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
+
+// src/lib/validate-mode.ts
+function validateScanMode(mode) {
+  if (mode === "quick") {
+    console.error("Quick mode is temporarily unavailable. Please use --mode full (the default).");
+    process.exit(2);
+  }
+  if (mode !== "full") {
+    console.error(`Invalid mode "${mode}". Must be: full`);
+    process.exit(2);
+  }
+}
+
+// src/commands/schedule.ts
 var VALID_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
-var VALID_MODES = ["quick", "full"];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 function extractTime(scheduledAt) {
   if (!scheduledAt) return "\u2014";
@@ -7931,19 +7947,16 @@ Examples:
       handleError(error2);
     }
   });
-  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
+  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode (default: full)", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
 Examples:
   $ kinosec pentest schedule create --asset abc123 --pattern weekly --day-of-week 1 --time 09:00
-  $ kinosec pentest schedule create --asset abc123 --pattern daily --mode quick --time 14:00
+  $ kinosec pentest schedule create --asset abc123 --pattern daily --time 14:00
   $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC`).action(async (options) => {
     if (!VALID_PATTERNS.includes(options.pattern)) {
       console.error(`Invalid pattern "${options.pattern}". Must be: ${VALID_PATTERNS.join(", ")}`);
       process.exit(2);
     }
-    if (!VALID_MODES.includes(options.mode)) {
-      console.error(`Invalid mode "${options.mode}". Must be: ${VALID_MODES.join(", ")}`);
-      process.exit(2);
-    }
+    validateScanMode(options.mode);
     if ((options.pattern === "weekly" || options.pattern === "biweekly") && options.dayOfWeek === void 0) {
       console.error(`--day-of-week is required for ${options.pattern} schedules.`);
       process.exit(2);
@@ -7981,14 +7994,17 @@ Manage: kinosec pentest schedule get ${s.id}`);
       handleError(error2);
     }
   });
-  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
+  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
 Examples:
   $ kinosec pentest schedule update abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule update abc123 --mode quick`).action(async (id, options) => {
+  $ kinosec pentest schedule update abc123 --time 14:00`).action(async (id, options) => {
     const params = {};
     if (options.pattern) params.recurrence_pattern = options.pattern;
     if (options.name) params.name = options.name;
-    if (options.mode) params.scan_mode = options.mode;
+    if (options.mode) {
+      validateScanMode(options.mode);
+      params.scan_mode = options.mode;
+    }
     if (options.time) params.time_of_day = options.time;
     if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
     if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
@@ -11527,6 +11543,320 @@ async function printFindingsSummary(client, profileId, tty3) {
   }
 }
 
+// src/lib/scout.ts
+var import_picocolors6 = __toESM(require_picocolors(), 1);
+var UNICODE2 = isUnicodeSupported();
+var sym2 = {
+  success: UNICODE2 ? "\u2713" : "v",
+  fail: UNICODE2 ? "\u2717" : "x",
+  warn: UNICODE2 ? "\u26A0" : "!"
+};
+function printOnPremInstructions(result) {
+  const tty3 = isTTY();
+  const header = tty3 ? import_picocolors6.default.bold("On-Prem Scout Setup") : "On-Prem Scout Setup";
+  console.log(`
+  ${header}
+`);
+  console.log(`  Session ID:  ${result.session_id}`);
+  console.log(`  Profile ID:  ${result.scan_profile_id}`);
+  const curlCmd = `curl -fsSL https://api.kinosec.ai/functions/v1/scout-bootstrap/launch/${result.bootstrap_token} | bash`;
+  if (tty3) {
+    console.log(`
+  Run on target host:
+`);
+    console.log(`  ${import_picocolors6.default.cyan(curlCmd)}
+`);
+    console.log(`  ${import_picocolors6.default.yellow(sym2.warn)}  Token expires in ${import_picocolors6.default.bold("15 minutes")}.`);
+  } else {
+    console.log(`
+  Run on target host:
+`);
+    console.log(`  ${curlCmd}
+`);
+    console.log(`  ${sym2.warn}  Token expires in 15 minutes.`);
+  }
+}
+async function waitForScoutConnection(client, profileId, options) {
+  const { timeoutMs, intervalMs, useJson } = options;
+  const tty3 = isTTY();
+  const loopStart = Date.now();
+  let spinner = null;
+  if (!useJson && tty3) {
+    spinner = ora({
+      text: "Waiting for Scout connection...",
+      color: "green",
+      isEnabled: true
+    }).start();
+  }
+  const cleanup = () => {
+    if (spinner) spinner.stop();
+  };
+  const onSigint = () => {
+    cleanup();
+    console.log("\nWatch cancelled. Pentest is waiting for Scout connection.");
+    process.exit(0);
+  };
+  process.once("SIGINT", onSigint);
+  while (true) {
+    const status = await client.scans.scoutStatus(profileId);
+    if (useJson) {
+      const elapsed = Math.round((Date.now() - loopStart) / 1e3);
+      process.stdout.write(
+        JSON.stringify({ ...status, elapsed_seconds: elapsed }) + "\n"
+      );
+    }
+    switch (status.status) {
+      case "pending":
+        if (spinner) spinner.text = import_picocolors6.default.green("Waiting for Scout bootstrap...");
+        break;
+      case "bootstrapped":
+        if (spinner) spinner.text = import_picocolors6.default.green("Scout bootstrapped, establishing connection...");
+        break;
+      case "connected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        if (!useJson) {
+          const icon = tty3 ? import_picocolors6.default.green(sym2.success) : sym2.success;
+          console.log(`${icon} Scout connected`);
+          if (status.hostname) {
+            console.log(`  Hostname: ${status.hostname}`);
+          }
+          if (status.tools.length > 0) {
+            console.log(`  Tools: ${status.tools.join(", ")}`);
+          }
+        }
+        return;
+      }
+      case "expired": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout bootstrap token expired.`);
+        console.error("Start a new pentest to get a fresh token.");
+        process.exit(1);
+      }
+      case "disconnected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout disconnected unexpectedly.`);
+        console.error(`Check status: kinosec pentest get ${profileId}`);
+        process.exit(1);
+      }
+    }
+    if (Date.now() - loopStart > timeoutMs) {
+      cleanup();
+      process.removeListener("SIGINT", onSigint);
+      const secs = Math.round(timeoutMs / 1e3);
+      console.error(`
+Timeout: Scout did not connect within ${secs}s.`);
+      console.error("The bootstrap token may have expired. Start a new pentest.");
+      process.exit(3);
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+
+// src/lib/scope.ts
+var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/lib/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+async function promptMasked(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  process.stderr.write(`${label}: `);
+  return new Promise((resolve, reject) => {
+    const chars = [];
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf-8");
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          resolve(chars.join(""));
+          return;
+        } else if (ch === "") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          reject(new Error("Cancelled"));
+          return;
+        } else if (ch === "\x7F" || ch === "\b") {
+          if (chars.length > 0) {
+            chars.pop();
+            process.stderr.write("\b \b");
+          }
+        } else if (ch >= " ") {
+          chars.push(ch);
+          process.stderr.write("*");
+        }
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function promptText(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question(`${label}: `, resolve);
+  });
+  rl.close();
+  return answer;
+}
+async function promptSelect(message, options) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error("Cannot show interactive menu in non-interactive mode. Use flags instead.");
+    process.exit(2);
+  }
+  console.error(`
+${message}`);
+  for (let i = 0; i < options.length; i++) {
+    console.error(`  ${i + 1}. ${options[i].label} \u2014 ${options[i].description}`);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question("> ", resolve);
+  });
+  rl.close();
+  const index = parseInt(answer, 10) - 1;
+  if (isNaN(index) || index < 0 || index >= options.length) {
+    console.error("Invalid selection.");
+    process.exit(2);
+  }
+  return options[index].value;
+}
+
+// src/lib/scope.ts
+var HOSTNAME_RE = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/i;
+var MAX_SCOPE_HOSTS = 50;
+function parseScopeHosts(input) {
+  return input.split(",").map((h) => h.trim()).filter(Boolean);
+}
+function validateScopeHosts(hosts) {
+  for (const host of hosts) {
+    if (!HOSTNAME_RE.test(host)) {
+      console.error(`Error: Invalid hostname "${host}". Must be a valid domain (e.g., api.example.com).`);
+      process.exit(2);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const host of hosts) {
+    const lower = host.toLowerCase();
+    if (seen.has(lower)) {
+      console.error(`Error: Duplicate hostname "${host}" in list.`);
+      process.exit(2);
+    }
+    seen.add(lower);
+  }
+}
+function validateScopeFlags(options) {
+  if (options.include && options.exclude) {
+    console.error("Error: --include and --exclude cannot be used together. Use one or the other.");
+    process.exit(2);
+  }
+  if (options.scopeClear && (options.include || options.exclude)) {
+    console.error("Error: --clear cannot be combined with --include or --exclude.");
+    process.exit(2);
+  }
+}
+function validateTotalHostCount(existingCount, newCount) {
+  const total = existingCount + newCount;
+  if (total > MAX_SCOPE_HOSTS) {
+    console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${total}.`);
+    process.exit(2);
+  }
+}
+function displayScope(asset) {
+  if (!asset.scope_filter || !asset.scope_hosts?.length) {
+    console.error(`Scope: ${isTTY() ? import_picocolors7.default.dim("all subdomains") : "all subdomains"}`);
+    return;
+  }
+  const label = asset.scope_filter === "include" ? "include only" : "exclude";
+  const hosts = asset.scope_hosts.join(", ");
+  console.error(`Scope: ${label} \u2014 ${hosts}`);
+}
+async function resolveScopeUpdate(asset, mode, newHosts) {
+  const existingMode = asset.scope_filter;
+  const existingHosts = asset.scope_hosts ?? [];
+  if (!existingMode || existingHosts.length === 0) {
+    validateScopeHosts(newHosts);
+    if (newHosts.length > MAX_SCOPE_HOSTS) {
+      console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+      process.exit(2);
+    }
+    return { scope_filter: mode, scope_hosts: newHosts };
+  }
+  if (existingMode !== mode) {
+    console.error(`
+Existing ${existingMode} scope:`);
+    for (const host of existingHosts) {
+      console.error(`  - ${host}`);
+    }
+    const answer2 = await promptSelect(
+      `You have an existing ${existingMode} scope. Using --${mode} will replace it. Continue?`,
+      [
+        { value: "switch", label: `Yes, switch to ${mode}`, description: `Replace ${existingMode} list with new ${mode} list` },
+        { value: "cancel", label: "Cancel", description: "Keep existing scope" }
+      ]
+    );
+    if (answer2 === "cancel") {
+      console.error("Cancelled.");
+      return null;
+    }
+    validateScopeHosts(newHosts);
+    if (newHosts.length > MAX_SCOPE_HOSTS) {
+      console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+      process.exit(2);
+    }
+    return { scope_filter: mode, scope_hosts: newHosts };
+  }
+  console.error(`
+Existing ${existingMode} scope:`);
+  for (const host of existingHosts) {
+    console.error(`  - ${host}`);
+  }
+  const answer = await promptSelect(
+    `You have existing subdomains in your ${mode} list. What would you like to do?`,
+    [
+      { value: "add", label: "Add to existing list", description: "Append new hosts to the current list" },
+      { value: "replace", label: "Replace with new list", description: "Remove existing hosts and use only the new ones" }
+    ]
+  );
+  if (answer === "add") {
+    validateScopeHosts(newHosts);
+    const existingLower = new Set(existingHosts.map((h) => h.toLowerCase()));
+    const deduped = newHosts.filter((h) => !existingLower.has(h.toLowerCase()));
+    if (deduped.length === 0) {
+      console.error("All provided hosts are already in the list.");
+      return { scope_filter: mode, scope_hosts: existingHosts };
+    }
+    validateScopeHosts(deduped);
+    validateTotalHostCount(existingHosts.length, deduped.length);
+    const merged = [...existingHosts, ...deduped];
+    return { scope_filter: mode, scope_hosts: merged };
+  }
+  validateScopeHosts(newHosts);
+  if (newHosts.length > MAX_SCOPE_HOSTS) {
+    console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+    process.exit(2);
+  }
+  return { scope_filter: mode, scope_hosts: newHosts };
+}
+
 // src/commands/pentest.ts
 function stripProtocol(input) {
   const match = input.match(/^https?:\/\/(.+)/i);
@@ -11537,15 +11867,40 @@ function isValidDomain(value) {
   return value.includes(".") && !/\s/.test(value);
 }
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: quick or full", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
-  $ kinosec pentest --target delikado.org --mode quick
-  $ kinosec pentest --profile abc123`).action(async (options) => {
+  $ kinosec pentest --profile abc123
+  $ kinosec pentest -t internal.corp --deployment on-prem
+  $ kinosec pentest -t example.com --include api.example.com,app.example.com
+  $ kinosec pentest -t example.com --exclude staging.example.com
+  $ kinosec pentest -t example.com --scope clear`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
     }
+    if (options.deployment) {
+      options.deployment = options.deployment.replace(/-/g, "_");
+    }
+    if (options.deployment !== "cloud" && options.deployment !== "on_prem") {
+      console.error("Invalid deployment type. Must be: cloud or on-prem.");
+      process.exit(2);
+    }
+    validateScanMode(options.mode);
+    const scopeClear = options.scope === "clear";
+    if (options.scope && options.scope !== "clear") {
+      console.error("Invalid --scope value. Must be: clear");
+      process.exit(2);
+    }
+    validateScopeFlags({
+      include: options.include,
+      exclude: options.exclude,
+      scopeClear
+    });
+    if (options.profile && (options.include || options.exclude || scopeClear)) {
+      console.error("Error: Scope flags are only supported with --target, not --profile.");
+      process.exit(2);
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
@@ -11582,10 +11937,48 @@ Examples:
           }
         }
         targetDisplay = domain;
-        params = { asset_id: asset.id, scan_mode: options.mode };
+        const assetParams = {
+          asset_id: asset.id,
+          scan_mode: options.mode
+        };
+        if (options.deployment !== "cloud") {
+          assetParams.deployment_type = options.deployment;
+        }
+        params = assetParams;
+        if (scopeClear) {
+          if (asset.asset_type !== "domain") {
+            console.error("Error: Scope filtering is only available for domain assets.");
+            process.exit(2);
+          }
+          await client.assets.update(asset.id, {
+            scope_filter: null,
+            scope_hosts: null
+          });
+          console.error("Scope settings cleared. Scans will now cover all subdomains by default.");
+          asset = await client.assets.get(asset.id);
+        } else if (options.include || options.exclude) {
+          if (asset.asset_type !== "domain") {
+            console.error("Error: Scope filtering is only available for domain assets.");
+            process.exit(2);
+          }
+          const mode = options.include ? "include" : "exclude";
+          const rawHosts = parseScopeHosts(options.include ?? options.exclude);
+          validateScopeHosts(rawHosts);
+          const scopeResult = await resolveScopeUpdate(asset, mode, rawHosts);
+          if (!scopeResult) {
+            process.exit(0);
+          }
+          await client.assets.update(asset.id, {
+            scope_filter: scopeResult.scope_filter,
+            scope_hosts: scopeResult.scope_hosts
+          });
+          asset = await client.assets.get(asset.id);
+        }
+        displayScope(asset);
       }
       await confirmAuthorization(targetDisplay, Boolean(options.yes));
       const result = await client.scans.create(params);
+      const isOnPrem = result.deployment_type === "on_prem";
       if (opts.json || opts.output === "json") {
         printJson(result);
         return;
@@ -11593,13 +11986,37 @@ Examples:
       printSuccess(`Pentest started: ${result.domain_or_ip}`);
       console.log(`  Profile ID: ${result.scan_profile_id}`);
       console.log(`  Mode: ${result.scan_mode}`);
+      if (isOnPrem) {
+        printOnPremInstructions(result);
+        if (options.watch && isTTY()) {
+          const divider2 = import_picocolors8.default.dim("\u2500".repeat(37));
+          console.log(`
+${divider2}
+`);
+          await waitForScoutConnection(client, result.scan_profile_id, {
+            timeoutMs: 15 * 60 * 1e3,
+            intervalMs: 5 * 1e3,
+            useJson: false
+          });
+          await watchPentest(client, result.scan_profile_id, {
+            timeoutMs: 1800 * 1e3,
+            intervalMs: 5 * 1e3,
+            useJson: false,
+            showFindingsSummary: true
+          });
+        } else {
+          console.log(`
+Watch connection: kinosec pentest watch ${result.scan_profile_id}`);
+        }
+        return;
+      }
       if (!options.watch || !isTTY()) {
         console.log(`  Status: ${result.scan_status}`);
         console.log(`
 Watch progress: kinosec pentest watch ${result.scan_profile_id}`);
         return;
       }
-      const divider = isTTY() ? import_picocolors6.default.dim("\u2500".repeat(37)) : "-".repeat(37);
+      const divider = isTTY() ? import_picocolors8.default.dim("\u2500".repeat(37)) : "-".repeat(37);
       console.log(`
 ${divider}
 `);
@@ -11645,7 +12062,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors6.default.dim(`
+        console.log(import_picocolors8.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -11672,6 +12089,7 @@ Examples:
           ["Target", detail.domain_or_ip],
           ["Mode", detail.scan_mode],
           ["Type", detail.scan_type],
+          ...detail.deployment_type ? [["Deployment", detail.deployment_type === "on_prem" ? "On-Prem" : "Cloud"]] : [],
           ["Status", detail.scan_status],
           ["Activity", detail.current_activity || "(none)"],
           ["Created", detail.created_at],
@@ -11708,10 +12126,25 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      const useJson = Boolean(opts.json || opts.output === "json");
+      const detail = await client.scans.get(id);
+      if (detail.deployment_type === "on_prem") {
+        try {
+          const scout = await client.scans.scoutStatus(id);
+          if (scout.status !== "connected") {
+            await waitForScoutConnection(client, id, {
+              timeoutMs: 15 * 60 * 1e3,
+              intervalMs: parseInt(options.interval, 10) * 1e3,
+              useJson
+            });
+          }
+        } catch {
+        }
+      }
       await watchPentest(client, id, {
         timeoutMs: parseInt(options.timeout, 10) * 1e3,
         intervalMs: parseInt(options.interval, 10) * 1e3,
-        useJson: Boolean(opts.json || opts.output === "json"),
+        useJson,
         showFindingsSummary: true
       });
     } catch (error2) {
@@ -11721,10 +12154,10 @@ Examples:
 }
 
 // src/commands/asset.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 
 // src/commands/asset-auth.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // src/lib/resolve-asset.ts
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-/i;
@@ -11750,84 +12183,6 @@ or use pentest which auto-creates the asset:
   }
 }
 
-// src/lib/prompt.ts
-import { createInterface as createInterface2 } from "readline";
-async function promptMasked(label) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
-    process.exit(2);
-  }
-  process.stderr.write(`${label}: `);
-  return new Promise((resolve, reject) => {
-    const chars = [];
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding("utf-8");
-    const onData = (chunk) => {
-      for (const ch of chunk) {
-        if (ch === "\r" || ch === "\n") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          process.stderr.write("\n");
-          resolve(chars.join(""));
-          return;
-        } else if (ch === "") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          process.stderr.write("\n");
-          reject(new Error("Cancelled"));
-          return;
-        } else if (ch === "\x7F" || ch === "\b") {
-          if (chars.length > 0) {
-            chars.pop();
-            process.stderr.write("\b \b");
-          }
-        } else if (ch >= " ") {
-          chars.push(ch);
-          process.stderr.write("*");
-        }
-      }
-    };
-    process.stdin.on("data", onData);
-  });
-}
-async function promptText(label) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
-    process.exit(2);
-  }
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve) => {
-    rl.question(`${label}: `, resolve);
-  });
-  rl.close();
-  return answer;
-}
-async function promptSelect(message, options) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error("Cannot show interactive menu in non-interactive mode. Use flags instead.");
-    process.exit(2);
-  }
-  console.error(`
-${message}`);
-  for (let i = 0; i < options.length; i++) {
-    console.error(`  ${i + 1}. ${options[i].label} \u2014 ${options[i].description}`);
-  }
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve) => {
-    rl.question("> ", resolve);
-  });
-  rl.close();
-  const index = parseInt(answer, 10) - 1;
-  if (isNaN(index) || index < 0 || index >= options.length) {
-    console.error("Invalid selection.");
-    process.exit(2);
-  }
-  return options[index].value;
-}
-
 // src/commands/asset-auth.ts
 var VALID_AUTH_TYPES = ["bearer", "basic", "apikey", "session", "cookie"];
 var AUTH_TYPE_OPTIONS = [
@@ -11981,7 +12336,7 @@ Examples:
       }
       if (!creds.has_credentials) {
         console.log(`Asset:           ${asset.asset_value}`);
-        console.log(`Auth Type:       ${import_picocolors7.default.dim("(none)")}`);
+        console.log(`Auth Type:       ${import_picocolors9.default.dim("(none)")}`);
         console.log(`Has Credentials: no`);
         return;
       }
@@ -12002,9 +12357,9 @@ Examples:
         const hasAny = ta.has_username || ta.has_cookie || ta.has_bearer_token || ta.has_apikey;
         if (hasAny) {
           const detail = ta.has_username ? "username" : ta.has_bearer_token ? "bearer token" : ta.has_cookie ? "cookie" : "API key";
-          console.log(`Target Account:  ${import_picocolors7.default.green("configured")} (${detail})`);
+          console.log(`Target Account:  ${import_picocolors9.default.green("configured")} (${detail})`);
         } else {
-          console.log(`Target Account:  ${import_picocolors7.default.dim("not configured")}`);
+          console.log(`Target Account:  ${import_picocolors9.default.dim("not configured")}`);
         }
       }
     } catch (error2) {
@@ -12145,17 +12500,18 @@ Examples:
         return;
       }
       printTable(
-        ["ID", "Value", "Type", "Status", "Created"],
+        ["ID", "Value", "Type", "Status", "Scope", "Created"],
         result.items.map((a) => [
           a.id,
           truncate(a.asset_value, 40),
           a.asset_type,
           a.verification_status,
+          a.scope_filter ?? "all",
           new Date(a.created_at).toLocaleDateString()
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors8.default.dim(`
+        console.log(import_picocolors10.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12263,11 +12619,84 @@ Examples:
       handleError(error2);
     }
   });
+  asset.command("scope").description("View or configure subdomain scope for an asset").argument("<id>", "Asset ID or domain").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--clear", "Clear scope settings").addHelpText("after", `
+Examples:
+  $ kinosec asset scope abc123
+  $ kinosec asset scope example.com --include api.example.com,app.example.com
+  $ kinosec asset scope abc123 --exclude staging.example.com
+  $ kinosec asset scope abc123 --clear`).action(async (id, options) => {
+    try {
+      validateScopeFlags({
+        include: options.include,
+        exclude: options.exclude,
+        scopeClear: options.clear
+      });
+      const opts = program3.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset2 = await resolveAsset(client, id);
+      if (asset2.asset_type !== "domain") {
+        console.error("Error: Scope filtering is only available for domain assets.");
+        process.exit(2);
+      }
+      if (!options.include && !options.exclude && !options.clear) {
+        if (opts.json || opts.output === "json") {
+          printJson({
+            scope_filter: asset2.scope_filter,
+            scope_hosts: asset2.scope_hosts
+          });
+          return;
+        }
+        if (!asset2.scope_filter || !asset2.scope_hosts?.length) {
+          console.log("Scope: all subdomains");
+        } else {
+          console.log(`Scope: ${asset2.scope_filter}`);
+          console.log("Hosts:");
+          for (const host of asset2.scope_hosts) {
+            console.log(`  - ${host}`);
+          }
+        }
+        return;
+      }
+      if (options.clear) {
+        await client.assets.update(asset2.id, {
+          scope_filter: null,
+          scope_hosts: null
+        });
+        if (opts.json || opts.output === "json") {
+          printJson({ scope_filter: null, scope_hosts: null });
+          return;
+        }
+        printSuccess("Scope settings cleared. Scans will now cover all subdomains by default.");
+        return;
+      }
+      const mode = options.include ? "include" : "exclude";
+      const rawHosts = parseScopeHosts(options.include ?? options.exclude);
+      validateScopeHosts(rawHosts);
+      const result = await resolveScopeUpdate(asset2, mode, rawHosts);
+      if (!result) return;
+      await client.assets.update(asset2.id, {
+        scope_filter: result.scope_filter,
+        scope_hosts: result.scope_hosts
+      });
+      if (opts.json || opts.output === "json") {
+        printJson(result);
+        return;
+      }
+      printSuccess(`Scope updated: ${result.scope_filter}`);
+      console.log("Hosts:");
+      for (const host of result.scope_hosts) {
+        console.log(`  - ${host}`);
+      }
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
   registerAssetAuthCommand(asset);
 }
 
 // src/commands/finding.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 function formatPoc(poc) {
   if (poc == null) return null;
   if (typeof poc === "string") return poc.trim() || null;
@@ -12308,7 +12737,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors9.default.dim(`
+        console.log(import_picocolors11.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12396,7 +12825,7 @@ Examples:
 }
 
 // src/commands/report.ts
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function renderMarkdown(data) {
   const { scan, findings } = data;
   const lines = [];
@@ -12473,7 +12902,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors10.default.dim(`
+        console.log(import_picocolors12.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12544,7 +12973,7 @@ Examples:
 }
 
 // src/commands/token.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -12579,7 +13008,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors11.default.dim(`
+        console.log(import_picocolors13.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12606,7 +13035,7 @@ Examples:
       }
       printSuccess(`Token created: ${result.name}`);
       console.log("");
-      console.log(import_picocolors11.default.bold("  Token: ") + result.token);
+      console.log(import_picocolors13.default.bold("  Token: ") + result.token);
       console.log("");
       printWarning("Save this token \u2014 it will not be shown again.");
       console.log(`  ID: ${result.id}`);
@@ -12639,7 +13068,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.8.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -12648,7 +13077,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.8.0")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.0")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: