@rafter-security/cli 0.1.0 → 0.4.0

package/dist/index.js

@@ -1,281 +1,26 @@
 #!/usr/bin/env node
 import { Command } from "commander";
-import axios from "axios";
-import ora from "ora";
 import * as dotenv from "dotenv";
-import { execSync } from "child_process";
+import { createRunCommand } from "./commands/backend/run.js";
+import { createGetCommand } from "./commands/backend/get.js";
+import { createUsageCommand } from "./commands/backend/usage.js";
+import { createAgentCommand } from "./commands/agent/index.js";
+import { checkForUpdate } from "./utils/update-checker.js";
 dotenv.config();
+const VERSION = "0.4.0";
 const program = new Command()
     .name("rafter")
     .description("Rafter CLI")
-    .version("0.1.0");
-const API = "https://rafter.so/api/";
-// Exit codes
-const EXIT_SUCCESS = 0;
-const EXIT_GENERAL_ERROR = 1;
-const EXIT_SCAN_NOT_FOUND = 2;
-const EXIT_QUOTA_EXHAUSTED = 3;
-function resolveKey(cliKey) {
-    if (cliKey)
-        return cliKey;
-    if (process.env.RAFTER_API_KEY)
-        return process.env.RAFTER_API_KEY;
-    console.error("No API key provided. Use --api-key or set RAFTER_API_KEY");
-    process.exit(EXIT_GENERAL_ERROR);
-}
-function writePayload(data, fmt, quiet) {
-    const payload = fmt === "md" && data.markdown ? data.markdown : JSON.stringify(data, null, quiet ? 0 : 2);
-    // Stream to stdout for pipelines
-    process.stdout.write(payload);
-    return EXIT_SUCCESS;
-}
-function git(cmd) {
-    return execSync(`git ${cmd}`, { stdio: ["ignore", "pipe", "ignore"] })
-        .toString()
-        .trim();
-}
-function safeBranch(gitFn) {
-    try {
-        return gitFn("symbolic-ref --quiet --short HEAD");
-    }
-    catch {
-        return gitFn("rev-parse --short HEAD");
-    }
-}
-function parseRemote(url) {
-    url = url.replace(/^(https?:\/\/|git@)/, "").replace(":", "/");
-    if (url.endsWith(".git"))
-        url = url.slice(0, -4);
-    const parts = url.split("/");
-    return parts.slice(-2).join("/"); // owner/repo
-}
-function detectRepo(opts) {
-    if (opts.repo && opts.branch)
-        return opts;
-    const repoEnv = process.env.GITHUB_REPOSITORY || process.env.CI_REPOSITORY;
-    const branchEnv = process.env.GITHUB_REF_NAME || process.env.CI_COMMIT_BRANCH || process.env.CI_BRANCH;
-    let repoSlug = opts.repo || repoEnv;
-    let branch = opts.branch || branchEnv;
-    try {
-        if (!repoSlug || !branch) {
-            if (git("rev-parse --is-inside-work-tree") !== "true")
-                throw new Error("not a repo");
-            if (!repoSlug)
-                repoSlug = parseRemote(git("remote get-url origin"));
-            if (!branch) {
-                try {
-                    branch = safeBranch(git);
-                }
-                catch {
-                    branch = "main";
-                }
-            }
-        }
-        if ((!opts.repo || !opts.branch) && !opts.quiet) {
-            console.error(`Repo auto-detected: ${repoSlug} @ ${branch} (note: scanning remote)`);
-        }
-        return { repo: repoSlug, branch };
-    }
-    catch {
-        throw new Error("Could not auto-detect Git repository. Please pass --repo and --branch explicitly.");
-    }
-}
-async function handleScanStatus(scan_id, headers, fmt, quiet) {
-    // First poll
-    let poll;
-    try {
-        poll = await axios.get(`${API}/static/scan`, { params: { scan_id, format: fmt }, headers });
-    }
-    catch (e) {
-        if (e.response?.status === 404) {
-            console.error(`Scan '${scan_id}' not found`);
-            return EXIT_SCAN_NOT_FOUND;
-        }
-        console.error(`Error: ${e.response?.data || e.message}`);
-        return EXIT_GENERAL_ERROR;
-    }
-    let status = poll.data.status;
-    if (["queued", "pending", "processing"].includes(status)) {
-        if (!quiet) {
-            const spinner = ora("Waiting for scan to complete... (this could take several minutes)").start();
-            while (["queued", "pending", "processing"].includes(status)) {
-                await new Promise((r) => setTimeout(r, 10000));
-                poll = await axios.get(`${API}/static/scan`, { params: { scan_id, format: fmt }, headers });
-                status = poll.data.status;
-                if (status === "completed") {
-                    spinner.succeed("Scan completed");
-                    return writePayload(poll.data, fmt, quiet);
-                }
-                else if (status === "failed") {
-                    spinner.fail("Scan failed");
-                    return EXIT_GENERAL_ERROR;
-                }
-            }
-            console.error(`Scan status: ${status}`);
-        }
-        else {
-            while (["queued", "pending", "processing"].includes(status)) {
-                await new Promise((r) => setTimeout(r, 10000));
-                poll = await axios.get(`${API}/static/scan`, { params: { scan_id, format: fmt }, headers });
-                status = poll.data.status;
-                if (status === "completed") {
-                    return writePayload(poll.data, fmt, quiet);
-                }
-                else if (status === "failed") {
-                    return EXIT_GENERAL_ERROR;
-                }
-            }
-        }
-    }
-    else if (status === "completed") {
-        if (!quiet) {
-            console.error("Scan completed");
-        }
-        return writePayload(poll.data, fmt, quiet);
-    }
-    else if (status === "failed") {
-        console.error("Scan failed");
-        return EXIT_GENERAL_ERROR;
-    }
-    else {
-        if (!quiet) {
-            console.error(`Scan status: ${status}`);
-        }
-    }
-    return writePayload(poll.data, fmt, quiet);
-}
-program
-    .name("rafter")
-    .description("Rafter CLI");
-program
-    .command("run")
-    .option("-r, --repo <repo>", "org/repo (default: current)")
-    .option("-b, --branch <branch>", "branch (default: current else main)")
-    .option("-k, --api-key <key>", "API key or RAFTER_API_KEY env var")
-    .option("-f, --format <format>", "json | md", "json")
-    .option("--skip-interactive", "do not wait for scan to complete")
-    .option("--quiet", "suppress status messages")
-    .action(async (opts) => {
-    const key = resolveKey(opts.apiKey);
-    let repo, branch;
-    try {
-        ({ repo, branch } = detectRepo({ repo: opts.repo, branch: opts.branch, quiet: opts.quiet }));
-    }
-    catch (e) {
-        if (e instanceof Error) {
-            console.error(e.message);
-        }
-        else {
-            console.error(e);
-        }
-        process.exit(EXIT_GENERAL_ERROR);
-    }
-    if (!opts.quiet) {
-        const spinner = ora("Submitting scan").start();
-        try {
-            const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
-            spinner.succeed(`Scan ID: ${data.scan_id}`);
-            if (opts.skipInteractive)
-                return;
-            const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format, opts.quiet);
-            process.exit(exitCode);
-        }
-        catch (e) {
-            spinner.fail("Request failed");
-            if (e.response?.status === 429) {
-                console.error("Quota exhausted");
-                process.exit(EXIT_QUOTA_EXHAUSTED);
-            }
-            else if (e.response?.data) {
-                console.error(e.response.data);
-            }
-            else if (e instanceof Error) {
-                console.error(e.message);
-            }
-            else {
-                console.error(e);
-            }
-            process.exit(EXIT_GENERAL_ERROR);
-        }
-    }
-    else {
-        try {
-            const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
-            if (opts.skipInteractive)
-                return;
-            const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format, opts.quiet);
-            process.exit(exitCode);
-        }
-        catch (e) {
-            if (e.response?.status === 429) {
-                process.exit(EXIT_QUOTA_EXHAUSTED);
-            }
-            else if (e.response?.data) {
-                console.error(e.response.data);
-            }
-            else if (e instanceof Error) {
-                console.error(e.message);
-            }
-            else {
-                console.error(e);
-            }
-            process.exit(EXIT_GENERAL_ERROR);
-        }
-    }
-});
-program
-    .command("get")
-    .argument("<scan_id>")
-    .option("-k, --api-key <key>", "API key or RAFTER_API_KEY env var")
-    .option("-f, --format <format>", "json | md", "json")
-    .option("--interactive", "poll until done")
-    .option("--quiet", "suppress status messages")
-    .action(async (scan_id, opts) => {
-    const key = resolveKey(opts.apiKey);
-    if (!opts.interactive) {
-        try {
-            const { data } = await axios.get(`${API}/static/scan`, { params: { scan_id, format: opts.format }, headers: { "x-api-key": key } });
-            const exitCode = writePayload(data, opts.format, opts.quiet);
-            process.exit(exitCode);
-        }
-        catch (e) {
-            if (e.response?.status === 404) {
-                console.error(`Scan '${scan_id}' not found`);
-                process.exit(EXIT_SCAN_NOT_FOUND);
-            }
-            else if (e.response?.data) {
-                console.error(e.response.data);
-            }
-            else if (e instanceof Error) {
-                console.error(e.message);
-            }
-            else {
-                console.error(e);
-            }
-            process.exit(EXIT_GENERAL_ERROR);
-        }
-        return;
-    }
-    const exitCode = await handleScanStatus(scan_id, { "x-api-key": key }, opts.format, opts.quiet);
-    process.exit(exitCode);
-});
-program
-    .command("usage")
-    .option("-k, --api-key <key>", "API key or RAFTER_API_KEY env var")
-    .action(async (opts) => {
-    const key = resolveKey(opts.apiKey);
-    try {
-        const { data } = await axios.get(`${API}/static/usage`, { headers: { "x-api-key": key } });
-        console.log(JSON.stringify(data, null, 2));
-    }
-    catch (e) {
-        if (e.response?.data) {
-            console.error(e.response.data);
-        }
-        else {
-            console.error(e.message);
-        }
-        process.exit(EXIT_GENERAL_ERROR);
-    }
+    .version(VERSION);
+// Backend commands (existing)
+program.addCommand(createRunCommand());
+program.addCommand(createGetCommand());
+program.addCommand(createUsageCommand());
+// Agent commands
+program.addCommand(createAgentCommand());
+// Non-blocking update check — runs after command, prints to stderr
+checkForUpdate(VERSION).then((notice) => {
+    if (notice)
+        process.stderr.write(notice);
 });
 program.parse();

package/dist/scanners/gitleaks.js

@@ -0,0 +1,205 @@
+import { exec } from "child_process";
+import { promisify } from "util";
+import { BinaryManager } from "../utils/binary-manager.js";
+import fs from "fs";
+import path from "path";
+const execAsync = promisify(exec);
+export class GitleaksScanner {
+    constructor() {
+        this.binaryManager = new BinaryManager();
+    }
+    /**
+     * Check if Gitleaks is available
+     */
+    async isAvailable() {
+        if (!this.binaryManager.isGitleaksInstalled()) {
+            return false;
+        }
+        return await this.binaryManager.verifyGitleaks();
+    }
+    /**
+     * Scan a file with Gitleaks
+     */
+    async scanFile(filePath) {
+        if (!await this.isAvailable()) {
+            throw new Error("Gitleaks not available");
+        }
+        const gitleaksPath = this.binaryManager.getGitleaksPath();
+        const tmpReport = path.join("/tmp", `gitleaks-${Date.now()}.json`);
+        try {
+            // Run gitleaks detect on file
+            await execAsync(`"${gitleaksPath}" detect --no-git -f json -r "${tmpReport}" -s "${filePath}"`, { timeout: 30000 });
+            // If no leaks found, gitleaks exits 0 with empty report
+            if (!fs.existsSync(tmpReport)) {
+                return { file: filePath, matches: [] };
+            }
+            const results = this.parseResults(tmpReport);
+            // Clean up report
+            fs.unlinkSync(tmpReport);
+            // Convert to our format
+            return {
+                file: filePath,
+                matches: results.map(r => this.convertToPatternMatch(r))
+            };
+        }
+        catch (e) {
+            // Clean up report
+            if (fs.existsSync(tmpReport)) {
+                fs.unlinkSync(tmpReport);
+            }
+            // Gitleaks exits with code 1 when leaks found
+            if (e.code === 1 && fs.existsSync(tmpReport)) {
+                const results = this.parseResults(tmpReport);
+                fs.unlinkSync(tmpReport);
+                return {
+                    file: filePath,
+                    matches: results.map(r => this.convertToPatternMatch(r))
+                };
+            }
+            throw new Error(`Gitleaks scan failed: ${e.message}`);
+        }
+    }
+    /**
+     * Scan multiple files
+     */
+    async scanFiles(filePaths) {
+        const results = [];
+        for (const filePath of filePaths) {
+            try {
+                const result = await this.scanFile(filePath);
+                if (result.matches.length > 0) {
+                    results.push(result);
+                }
+            }
+            catch {
+                // Skip files that can't be scanned
+            }
+        }
+        return results;
+    }
+    /**
+     * Scan a directory
+     */
+    async scanDirectory(dirPath) {
+        if (!await this.isAvailable()) {
+            throw new Error("Gitleaks not available");
+        }
+        const gitleaksPath = this.binaryManager.getGitleaksPath();
+        const tmpReport = path.join("/tmp", `gitleaks-${Date.now()}.json`);
+        try {
+            // Run gitleaks detect on directory
+            await execAsync(`"${gitleaksPath}" detect --no-git -f json -r "${tmpReport}" -s "${dirPath}"`, { timeout: 60000 });
+            // No leaks found
+            if (!fs.existsSync(tmpReport)) {
+                return [];
+            }
+            const results = this.parseResults(tmpReport);
+            fs.unlinkSync(tmpReport);
+            // Group by file
+            return this.groupByFile(results);
+        }
+        catch (e) {
+            // Clean up report
+            if (fs.existsSync(tmpReport)) {
+                const results = this.parseResults(tmpReport);
+                fs.unlinkSync(tmpReport);
+                // Gitleaks exits 1 when leaks found
+                if (e.code === 1) {
+                    return this.groupByFile(results);
+                }
+            }
+            throw new Error(`Gitleaks scan failed: ${e.message}`);
+        }
+    }
+    /**
+     * Parse Gitleaks JSON report
+     */
+    parseResults(reportPath) {
+        try {
+            const content = fs.readFileSync(reportPath, "utf-8");
+            if (!content.trim()) {
+                return [];
+            }
+            return JSON.parse(content);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Convert Gitleaks result to our PatternMatch format
+     */
+    convertToPatternMatch(result) {
+        // Map Gitleaks severity to our levels
+        const severity = this.getSeverity(result.RuleID, result.Tags);
+        return {
+            pattern: {
+                name: result.RuleID || result.Description,
+                regex: "", // Gitleaks doesn't expose the regex
+                severity,
+                description: result.Description
+            },
+            match: result.Secret || result.Match,
+            line: result.StartLine,
+            column: result.StartColumn,
+            redacted: this.redact(result.Secret || result.Match)
+        };
+    }
+    /**
+     * Determine severity from Gitleaks rule ID and tags
+     */
+    getSeverity(ruleID, tags) {
+        const lowerID = ruleID.toLowerCase();
+        // Critical: Private keys, passwords, database credentials
+        if (lowerID.includes("private-key") ||
+            lowerID.includes("password") ||
+            lowerID.includes("database") ||
+            tags.includes("key") && tags.includes("secret")) {
+            return "critical";
+        }
+        // High: API keys, access tokens
+        if (lowerID.includes("api-key") ||
+            lowerID.includes("access-token") ||
+            lowerID.includes("secret-key") ||
+            tags.includes("api")) {
+            return "high";
+        }
+        // Medium: Generic secrets
+        if (lowerID.includes("generic") ||
+            tags.includes("generic")) {
+            return "medium";
+        }
+        // Default to high for safety
+        return "high";
+    }
+    /**
+     * Redact a secret
+     */
+    redact(match) {
+        if (match.length <= 8) {
+            return "*".repeat(match.length);
+        }
+        const visibleChars = 4;
+        const start = match.substring(0, visibleChars);
+        const end = match.substring(match.length - visibleChars);
+        const middle = "*".repeat(match.length - (visibleChars * 2));
+        return start + middle + end;
+    }
+    /**
+     * Group results by file
+     */
+    groupByFile(results) {
+        const grouped = new Map();
+        for (const result of results) {
+            const file = result.File;
+            if (!grouped.has(file)) {
+                grouped.set(file, []);
+            }
+            grouped.get(file).push(this.convertToPatternMatch(result));
+        }
+        return Array.from(grouped.entries()).map(([file, matches]) => ({
+            file,
+            matches
+        }));
+    }
+}

package/dist/scanners/regex-scanner.js

@@ -0,0 +1,125 @@
+import fs from "fs";
+import path from "path";
+import { PatternEngine } from "../core/pattern-engine.js";
+import { DEFAULT_SECRET_PATTERNS } from "./secret-patterns.js";
+export class RegexScanner {
+    constructor() {
+        this.engine = new PatternEngine(DEFAULT_SECRET_PATTERNS);
+    }
+    /**
+     * Scan a single file for secrets
+     */
+    scanFile(filePath) {
+        try {
+            const content = fs.readFileSync(filePath, "utf-8");
+            const matches = this.engine.scanWithPosition(content);
+            return {
+                file: filePath,
+                matches
+            };
+        }
+        catch (e) {
+            // If file can't be read (binary, permissions, etc.), return empty matches
+            return {
+                file: filePath,
+                matches: []
+            };
+        }
+    }
+    /**
+     * Scan multiple files
+     */
+    scanFiles(filePaths) {
+        const results = [];
+        for (const filePath of filePaths) {
+            const result = this.scanFile(filePath);
+            if (result.matches.length > 0) {
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    /**
+     * Scan a directory recursively
+     */
+    scanDirectory(dirPath, options) {
+        const exclude = options?.exclude || [
+            "node_modules",
+            ".git",
+            "dist",
+            "build",
+            ".next",
+            "coverage",
+            ".vscode",
+            ".idea"
+        ];
+        const files = this.walkDirectory(dirPath, exclude, options?.maxDepth || 10);
+        return this.scanFiles(files);
+    }
+    /**
+     * Scan text content directly
+     */
+    scanText(text) {
+        return this.engine.scan(text);
+    }
+    /**
+     * Redact secrets from text
+     */
+    redact(text) {
+        return this.engine.redactText(text);
+    }
+    /**
+     * Check if text contains secrets
+     */
+    hasSecrets(text) {
+        return this.engine.hasMatches(text);
+    }
+    /**
+     * Walk directory and collect file paths
+     */
+    walkDirectory(dir, exclude, maxDepth, currentDepth = 0) {
+        if (currentDepth >= maxDepth) {
+            return [];
+        }
+        const files = [];
+        try {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(dir, entry.name);
+                // Skip excluded directories
+                if (exclude.includes(entry.name)) {
+                    continue;
+                }
+                if (entry.isDirectory()) {
+                    files.push(...this.walkDirectory(fullPath, exclude, maxDepth, currentDepth + 1));
+                }
+                else if (entry.isFile()) {
+                    // Skip binary files by extension
+                    if (!this.isBinaryFile(entry.name)) {
+                        files.push(fullPath);
+                    }
+                }
+            }
+        }
+        catch (e) {
+            // Skip directories we can't read
+        }
+        return files;
+    }
+    /**
+     * Check if file is likely binary based on extension
+     */
+    isBinaryFile(filename) {
+        const binaryExtensions = [
+            ".jpg", ".jpeg", ".png", ".gif", ".bmp", ".ico",
+            ".pdf", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx",
+            ".zip", ".tar", ".gz", ".rar", ".7z",
+            ".exe", ".dll", ".so", ".dylib",
+            ".mp3", ".mp4", ".avi", ".mov",
+            ".woff", ".woff2", ".ttf", ".eot",
+            ".pyc", ".class", ".o", ".a"
+        ];
+        const ext = path.extname(filename).toLowerCase();
+        return binaryExtensions.includes(ext);
+    }
+}