@rafter-security/cli 0.5.1 → 0.5.3

package/README.md

@@ -566,7 +566,7 @@ Agent security settings are stored in `~/.rafter/config.json`. Key settings:
 
 **File Locations:**
 - Config: `~/.rafter/config.json`
-- Audit log: `~/.rafter/audit.log`
+- Audit log: `~/.rafter/audit.jsonl`
 - Binaries: `~/.rafter/bin/`
 - Patterns: `~/.rafter/patterns/`
 

package/dist/commands/agent/audit-skill.js

@@ -48,6 +48,9 @@ async function auditSkill(skillPath, opts) {
             rafterSkillInstalled
         };
         console.log(JSON.stringify(result, null, 2));
+        if (quickScan.secrets > 0 || quickScan.highRiskCommands.length > 0) {
+            process.exit(1);
+        }
         return;
     }
     // Check if we can use OpenClaw
@@ -85,6 +88,9 @@ async function auditSkill(skillPath, opts) {
         console.log("─".repeat(60));
     }
     console.log();
+    if (quickScan.secrets > 0 || quickScan.highRiskCommands.length > 0) {
+        process.exit(1);
+    }
 }
 async function runQuickScan(content) {
     // 1. Scan for secrets

package/dist/commands/agent/index.js

@@ -6,6 +6,8 @@ import { createConfigCommand } from "./config.js";
 import { createExecCommand } from "./exec.js";
 import { createAuditSkillCommand } from "./audit-skill.js";
 import { createInstallHookCommand } from "./install-hook.js";
+import { createVerifyCommand } from "./verify.js";
+import { createStatusCommand } from "./status.js";
 export function createAgentCommand() {
     const agent = new Command("agent")
         .description("Agent security features");
@@ -17,5 +19,7 @@ export function createAgentCommand() {
     agent.addCommand(createAuditCommand());
     agent.addCommand(createAuditSkillCommand());
     agent.addCommand(createInstallHookCommand());
+    agent.addCommand(createVerifyCommand());
+    agent.addCommand(createStatusCommand());
     return agent;
 }

package/dist/commands/agent/init.js

@@ -32,16 +32,25 @@ function installClaudeCodeHooks() {
         settings.hooks = {};
     if (!settings.hooks.PreToolUse)
         settings.hooks.PreToolUse = [];
-    const rafterHook = { type: "command", command: "rafter hook pretool" };
+    if (!settings.hooks.PostToolUse)
+        settings.hooks.PostToolUse = [];
+    const preHook = { type: "command", command: "rafter hook pretool" };
+    const postHook = { type: "command", command: "rafter hook posttool" };
     // Remove any existing Rafter hooks to avoid duplicates
     settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter((entry) => {
         const hooks = entry.hooks || [];
         return !hooks.some((h) => h.command === "rafter hook pretool");
     });
+    settings.hooks.PostToolUse = settings.hooks.PostToolUse.filter((entry) => {
+        const hooks = entry.hooks || [];
+        return !hooks.some((h) => h.command === "rafter hook posttool");
+    });
     // Add Rafter hooks
-    settings.hooks.PreToolUse.push({ matcher: "Bash", hooks: [rafterHook] }, { matcher: "Write|Edit", hooks: [rafterHook] });
+    settings.hooks.PreToolUse.push({ matcher: "Bash", hooks: [preHook] }, { matcher: "Write|Edit", hooks: [preHook] });
+    settings.hooks.PostToolUse.push({ matcher: ".*", hooks: [postHook] });
     fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
     console.log(fmt.success(`Installed PreToolUse hooks to ${settingsPath}`));
+    console.log(fmt.success(`Installed PostToolUse hooks to ${settingsPath}`));
 }
 async function installClaudeCodeSkills() {
     const homeDir = os.homedir();
@@ -125,49 +134,89 @@ export function createInitCommand() {
         }
         manager.set("agent.riskLevel", opts.riskLevel);
         console.log(fmt.success(`Set risk level: ${opts.riskLevel}`));
-        // Download Gitleaks binary (optional)
+        // Check / download Gitleaks binary (optional)
         if (!opts.skipGitleaks) {
             const binaryManager = new BinaryManager();
             const platformInfo = binaryManager.getPlatformInfo();
-            if (!platformInfo.supported) {
-                console.log(fmt.info(`Gitleaks not available for ${platformInfo.platform}/${platformInfo.arch}`));
-                console.log(fmt.success("Using pattern-based scanning (21 patterns)"));
-            }
-            else if (binaryManager.isGitleaksInstalled()) {
-                const version = await binaryManager.getGitleaksVersion();
-                console.log(fmt.success(`Gitleaks already installed (${version})`));
+            // Helper: show diagnostics for a failing binary (mirrors Python's agent init)
+            const showDiagnostics = async (binaryPath, verResult) => {
+                if (verResult.stderr) {
+                    console.log(fmt.info(`  stderr: ${verResult.stderr}`));
+                }
+                const diag = await binaryManager.collectBinaryDiagnostics(binaryPath);
+                if (diag) {
+                    console.log(fmt.info("Diagnostics:"));
+                    console.log(diag);
+                }
+                console.log(fmt.info("To fix: install gitleaks (https://github.com/gitleaks/gitleaks/releases) and ensure it is on PATH, then re-run 'rafter agent init'."));
+                console.log();
+            };
+            if (binaryManager.isGitleaksInstalled()) {
+                // Local binary exists — verify it actually works
+                const verResult = await binaryManager.verifyGitleaksVerbose();
+                if (verResult.ok) {
+                    console.log(fmt.success(`Gitleaks already installed (${verResult.stdout})`));
+                }
+                else {
+                    console.log(fmt.warning("Gitleaks binary found locally but failed to execute."));
+                    console.log(fmt.info(`  Binary: ${binaryManager.getGitleaksPath()}`));
+                    await showDiagnostics(binaryManager.getGitleaksPath(), verResult);
+                }
             }
             else {
-                console.log();
-                console.log(fmt.info("Downloading Gitleaks (enhanced secret detection)..."));
-                try {
-                    await binaryManager.downloadGitleaks((msg) => {
-                        console.log(`   ${msg}`);
-                    });
-                    console.log();
+                // Not installed locally — check PATH (mirrors Python's shutil.which)
+                const pathBinary = binaryManager.findGitleaksOnPath();
+                if (pathBinary) {
+                    const verResult = await binaryManager.verifyGitleaksVerbose(pathBinary);
+                    if (verResult.ok) {
+                        console.log(fmt.success(`Gitleaks available on PATH (${verResult.stdout})`));
+                    }
+                    else {
+                        console.log(fmt.warning("Gitleaks found on PATH but failed to execute."));
+                        console.log(fmt.info(`  Binary: ${pathBinary}`));
+                        await showDiagnostics(pathBinary, verResult);
+                    }
+                }
+                else if (!platformInfo.supported) {
+                    console.log(fmt.info(`Gitleaks not available for ${platformInfo.platform}/${platformInfo.arch}`));
+                    console.log(fmt.success("Using pattern-based scanning (21 patterns)"));
                 }
-                catch (e) {
-                    console.log(fmt.warning(`Failed to download Gitleaks: ${e}`));
-                    console.log(fmt.success("Falling back to pattern-based scanning"));
+                else {
+                    // Not on PATH, not installed locally — download
                     console.log();
+                    console.log(fmt.info("Downloading Gitleaks (enhanced secret detection)..."));
+                    try {
+                        await binaryManager.downloadGitleaks((msg) => {
+                            console.log(`   ${msg}`);
+                        });
+                        console.log();
+                    }
+                    catch (e) {
+                        console.log();
+                        console.log(fmt.error(`Gitleaks setup failed — pattern-based scanning will be used instead.`));
+                        console.log(fmt.warning(String(e)));
+                        console.log();
+                        console.log(fmt.info("To fix: install gitleaks manually (https://github.com/gitleaks/gitleaks/releases) and ensure it is on PATH, then re-run 'rafter agent init'."));
+                        console.log();
+                    }
                 }
             }
         }
         // Install OpenClaw skill if applicable
         if (hasOpenClaw && !opts.skipOpenclaw) {
-            try {
-                const skillManager = new SkillManager();
-                const installed = await skillManager.installRafterSkill();
-                if (installed) {
-                    console.log(fmt.success("Installed Rafter Security skill to ~/.openclaw/skills/rafter-security.md"));
-                    manager.set("agent.environments.openclaw.enabled", true);
-                }
-                else {
-                    console.log(fmt.warning("Failed to install Rafter Security skill"));
-                }
+            const skillManager = new SkillManager();
+            const result = await skillManager.installRafterSkillVerbose();
+            if (result.ok) {
+                console.log(fmt.success("Installed Rafter Security skill to ~/.openclaw/skills/rafter-security.md"));
+                manager.set("agent.environments.openclaw.enabled", true);
             }
-            catch (e) {
-                console.error(fmt.error(`Failed to install OpenClaw skill: ${e}`));
+            else {
+                console.log(fmt.error("Failed to install Rafter Security skill"));
+                console.log(fmt.warning(`  Source: ${result.sourcePath}`));
+                console.log(fmt.warning(`  Destination: ${result.destPath}`));
+                if (result.error) {
+                    console.log(fmt.warning(`  Error: ${result.error}`));
+                }
             }
         }
         // Install Claude Code skills + hooks if applicable

package/dist/commands/agent/install-hook.js

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import fs from "fs";
+import os from "os";
 import path from "path";
 import { execSync } from "child_process";
 import { fileURLToPath } from 'url';
@@ -81,7 +82,7 @@ async function installLocalHook() {
  */
 async function installGlobalHook() {
     // Create global hooks directory
-    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    const homeDir = os.homedir();
     if (!homeDir) {
         console.error("❌ Error: Could not determine home directory");
         process.exit(1);

package/dist/commands/agent/scan.js

@@ -12,6 +12,7 @@ export function createScanCommand() {
         .argument("[path]", "File or directory to scan", ".")
         .option("-q, --quiet", "Only output if secrets found")
         .option("--json", "Output as JSON")
+        .option("--format <format>", "Output format: text, json, sarif", "text")
         .option("--staged", "Scan only git staged files")
         .option("--diff <ref>", "Scan files changed since a git ref")
         .option("--engine <engine>", "Scan engine: gitleaks or patterns", "auto")
@@ -34,7 +35,7 @@ export function createScanCommand() {
         // Check if path exists
         if (!fs.existsSync(resolvedPath)) {
             console.error(`Error: Path not found: ${resolvedPath}`);
-            process.exit(1);
+            process.exit(2);
         }
         // Determine scan engine
         const engine = await selectEngine(opts.engine || "auto", opts.quiet || false);
@@ -56,12 +57,76 @@ export function createScanCommand() {
         outputScanResults(results, opts);
     });
 }
+/**
+ * Emit SARIF 2.1.0 JSON for GitHub/GitLab security tab integration
+ */
+function outputSarif(results) {
+    const rules = new Map();
+    const sarifResults = [];
+    for (const r of results) {
+        for (const m of r.matches) {
+            const ruleId = m.pattern.name.toLowerCase().replace(/\s+/g, "-");
+            if (!rules.has(ruleId)) {
+                rules.set(ruleId, {
+                    id: ruleId,
+                    name: m.pattern.name,
+                    shortDescription: m.pattern.description || m.pattern.name,
+                });
+            }
+            sarifResults.push({
+                ruleId,
+                level: m.pattern.severity === "critical" || m.pattern.severity === "high" ? "error" : "warning",
+                message: { text: `${m.pattern.name} detected` },
+                locations: [
+                    {
+                        physicalLocation: {
+                            artifactLocation: { uri: r.file.replace(/\\/g, "/"), uriBaseId: "%SRCROOT%" },
+                            region: m.line ? { startLine: m.line, startColumn: m.column ?? 1 } : undefined,
+                        },
+                    },
+                ],
+            });
+        }
+    }
+    const sarif = {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "rafter",
+                        informationUri: "https://rafter.so",
+                        rules: Array.from(rules.values()),
+                    },
+                },
+                results: sarifResults,
+            },
+        ],
+    };
+    console.log(JSON.stringify(sarif, null, 2));
+    process.exit(results.length > 0 ? 1 : 0);
+}
 /**
  * Shared output logic for scan results
  */
 function outputScanResults(results, opts, context) {
-    if (opts.json) {
-        console.log(JSON.stringify(results, null, 2));
+    const format = opts.format ?? (opts.json ? "json" : "text");
+    if (format === "sarif") {
+        outputSarif(results);
+        return;
+    }
+    if (format === "json" || opts.json) {
+        const out = results.map((r) => ({
+            file: r.file,
+            matches: r.matches.map((m) => ({
+                pattern: { name: m.pattern.name, severity: m.pattern.severity, description: m.pattern.description || "" },
+                line: m.line ?? null,
+                column: m.column ?? null,
+                redacted: m.redacted || "",
+            })),
+        }));
+        console.log(JSON.stringify(out, null, 2));
         process.exit(results.length > 0 ? 1 : 0);
     }
     if (results.length === 0) {
@@ -131,7 +196,7 @@ async function scanDiffFiles(ref, opts, scanCfg) {
     catch (error) {
         if (error.status === 128) {
             console.error("Error: Not in a git repository or invalid ref");
-            process.exit(1);
+            process.exit(2);
         }
         throw error;
     }
@@ -172,7 +237,7 @@ async function scanStagedFiles(opts, scanCfg) {
     catch (error) {
         if (error.status === 128) {
             console.error("Error: Not in a git repository");
-            process.exit(1);
+            process.exit(2);
         }
         throw error;
     }

package/dist/commands/agent/status.js

@@ -0,0 +1,115 @@
+import { Command } from "commander";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { execSync } from "child_process";
+import { getRafterDir, getAuditLogPath, getBinDir } from "../../core/config-defaults.js";
+import { AuditLogger } from "../../core/audit-logger.js";
+import { ConfigManager } from "../../core/config-manager.js";
+export function createStatusCommand() {
+    return new Command("status")
+        .description("Show agent security status dashboard")
+        .action(async () => {
+        const rafterDir = getRafterDir();
+        const auditPath = getAuditLogPath();
+        const home = os.homedir();
+        console.log("Rafter Agent Status");
+        console.log("=".repeat(50));
+        // --- Config ---
+        const configPath = path.join(rafterDir, "config.json");
+        if (fs.existsSync(configPath)) {
+            try {
+                const cfg = new ConfigManager().load();
+                console.log(`\nConfig:       ${configPath}`);
+                console.log(`Risk level:   ${cfg.agent?.riskLevel ?? "moderate"}`);
+            }
+            catch {
+                console.log(`\nConfig:       ${configPath} (parse error)`);
+            }
+        }
+        else {
+            console.log(`\nConfig:       not found — run: rafter agent init`);
+        }
+        // --- Gitleaks ---
+        const localGitleaks = path.join(getBinDir(), "gitleaks");
+        let gitleaksStatus = "not found — run: rafter agent init";
+        try {
+            const ver = execSync("gitleaks version", { timeout: 5000, encoding: "utf-8" }).trim();
+            gitleaksStatus = `${ver} (PATH)`;
+        }
+        catch {
+            if (fs.existsSync(localGitleaks)) {
+                try {
+                    const ver = execSync(`"${localGitleaks}" version`, { timeout: 5000, encoding: "utf-8" }).trim();
+                    gitleaksStatus = `${ver} (local)`;
+                }
+                catch {
+                    gitleaksStatus = `${localGitleaks} (binary error)`;
+                }
+            }
+        }
+        console.log(`Gitleaks:     ${gitleaksStatus}`);
+        // --- Claude Code hooks ---
+        const settingsPath = path.join(home, ".claude", "settings.json");
+        let pretoolOk = false;
+        let posttoolOk = false;
+        if (fs.existsSync(settingsPath)) {
+            try {
+                const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+                const hooks = settings.hooks ?? {};
+                for (const entry of hooks.PreToolUse ?? []) {
+                    for (const h of entry.hooks ?? []) {
+                        if (String(h.command ?? "").includes("rafter hook pretool"))
+                            pretoolOk = true;
+                    }
+                }
+                for (const entry of hooks.PostToolUse ?? []) {
+                    for (const h of entry.hooks ?? []) {
+                        if (String(h.command ?? "").includes("rafter hook posttool"))
+                            posttoolOk = true;
+                    }
+                }
+            }
+            catch {
+                // unreadable settings
+            }
+        }
+        console.log(`PreToolUse:   ${pretoolOk ? "installed" : "not installed — run: rafter agent init"}`);
+        console.log(`PostToolUse:  ${posttoolOk ? "installed" : "not installed — run: rafter agent init"}`);
+        // --- OpenClaw skill ---
+        const skillPath = path.join(home, ".openclaw", "skills", "rafter-security.md");
+        const openclawDir = path.join(home, ".openclaw");
+        if (fs.existsSync(skillPath)) {
+            console.log(`OpenClaw:     skill installed (${skillPath})`);
+        }
+        else if (fs.existsSync(openclawDir)) {
+            console.log("OpenClaw:     detected but skill missing — run: rafter agent init");
+        }
+        else {
+            console.log("OpenClaw:     not detected (optional)");
+        }
+        // --- Audit log summary ---
+        console.log(`\nAudit log:    ${auditPath}`);
+        if (fs.existsSync(auditPath)) {
+            const logger = new AuditLogger();
+            const allEntries = logger.read();
+            const total = allEntries.length;
+            const secrets = allEntries.filter((e) => e.eventType === "secret_detected").length;
+            const blocked = allEntries.filter((e) => e.eventType === "command_intercepted" && e.resolution?.actionTaken === "blocked").length;
+            console.log(`Total events: ${total}  |  Secrets detected: ${secrets}  |  Commands blocked: ${blocked}`);
+            const recent = logger.read({ limit: 5 });
+            if (recent.length > 0) {
+                console.log("\nRecent events:");
+                for (const e of [...recent].reverse()) {
+                    const ts = (e.timestamp ?? "").slice(0, 19).replace("T", " ");
+                    const action = e.resolution?.actionTaken ?? "";
+                    console.log(`  ${ts}  ${e.eventType}  [${action}]`);
+                }
+            }
+        }
+        else {
+            console.log("No events logged yet.");
+        }
+        console.log();
+    });
+}

package/dist/commands/agent/verify.js

@@ -0,0 +1,117 @@
+import { Command } from "commander";
+import { BinaryManager } from "../../utils/binary-manager.js";
+import { SkillManager } from "../../utils/skill-manager.js";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { fmt } from "../../utils/formatter.js";
+async function checkGitleaks() {
+    const binaryManager = new BinaryManager();
+    const name = "Gitleaks";
+    // Check PATH first (e.g. Homebrew), then fall back to ~/.rafter/bin
+    const pathBinary = binaryManager.findGitleaksOnPath();
+    const hasBinary = pathBinary !== null || binaryManager.isGitleaksInstalled();
+    if (!hasBinary) {
+        return { name, passed: false, detail: `Not found on PATH or at ${binaryManager.getGitleaksPath()}` };
+    }
+    const binaryPath = pathBinary ?? binaryManager.getGitleaksPath();
+    const { ok, stdout, stderr } = await binaryManager.verifyGitleaksVerbose(binaryPath);
+    if (!ok) {
+        const diag = await binaryManager.collectBinaryDiagnostics(binaryPath);
+        return { name, passed: false, detail: `Binary found at ${binaryPath} but failed to execute\n${stdout ? `  stdout: ${stdout}\n` : ""}${stderr ? `  stderr: ${stderr}\n` : ""}${diag}` };
+    }
+    return { name, passed: true, detail: `${stdout} (${binaryPath})` };
+}
+function checkConfig() {
+    const name = "Config";
+    const configPath = path.join(os.homedir(), ".rafter", "config.json");
+    if (!fs.existsSync(configPath)) {
+        return { name, passed: false, detail: `Not found: ${configPath}` };
+    }
+    try {
+        const content = fs.readFileSync(configPath, "utf-8");
+        JSON.parse(content);
+        return { name, passed: true, detail: configPath };
+    }
+    catch (e) {
+        return { name, passed: false, detail: `Invalid JSON: ${configPath} — ${e}` };
+    }
+}
+function checkClaudeCode() {
+    const name = "Claude Code";
+    const homeDir = os.homedir();
+    // optional: warn if absent but don't fail exit code
+    const claudeDir = path.join(homeDir, ".claude");
+    if (!fs.existsSync(claudeDir)) {
+        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init --claude-code' to enable` };
+    }
+    const settingsPath = path.join(claudeDir, "settings.json");
+    if (!fs.existsSync(settingsPath)) {
+        return { name, passed: false, optional: true, detail: `Settings file not found: ${settingsPath}` };
+    }
+    try {
+        const settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+        const hooks = settings?.hooks?.PreToolUse || [];
+        const hasRafterHook = hooks.some((entry) => (entry.hooks || []).some((h) => h.command === "rafter hook pretool"));
+        if (!hasRafterHook) {
+            return { name, passed: false, optional: true, detail: "Rafter hooks not installed — run 'rafter agent init --claude-code'" };
+        }
+        return { name, passed: true, detail: "Hooks installed" };
+    }
+    catch (e) {
+        return { name, passed: false, optional: true, detail: `Cannot read settings: ${e}` };
+    }
+}
+function checkOpenClaw() {
+    const name = "OpenClaw";
+    const skillManager = new SkillManager();
+    if (!skillManager.isOpenClawInstalled()) {
+        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init' to enable` };
+    }
+    if (!skillManager.isRafterSkillInstalled()) {
+        return { name, passed: false, optional: true, detail: `Rafter skill not installed — run 'rafter agent init'` };
+    }
+    const version = skillManager.getInstalledVersion();
+    return { name, passed: true, detail: `Rafter skill installed${version ? ` (v${version})` : ""}` };
+}
+export function createVerifyCommand() {
+    return new Command("verify")
+        .description("Check agent security integration status")
+        .action(async () => {
+        console.log(fmt.header("Rafter Agent Verify"));
+        console.log(fmt.divider());
+        console.log();
+        const results = [
+            checkConfig(),
+            await checkGitleaks(),
+            checkClaudeCode(),
+            checkOpenClaw(),
+        ];
+        for (const r of results) {
+            if (r.passed) {
+                console.log(fmt.success(`${r.name}: ${r.detail}`));
+            }
+            else if (r.optional) {
+                console.log(fmt.warning(`${r.name}: ${r.detail}`));
+            }
+            else {
+                console.log(fmt.error(`${r.name}: FAIL — ${r.detail}`));
+            }
+        }
+        console.log();
+        const hardFailed = results.filter((r) => !r.passed && !r.optional);
+        const warned = results.filter((r) => !r.passed && r.optional);
+        const passed = results.filter((r) => r.passed);
+        if (hardFailed.length === 0) {
+            const warnNote = warned.length > 0 ? ` (${warned.length} optional check${warned.length > 1 ? "s" : ""} not configured)` : "";
+            console.log(fmt.success(`${passed.length}/${results.length} core checks passed${warnNote}`));
+        }
+        else {
+            console.log(fmt.error(`${hardFailed.length} check${hardFailed.length > 1 ? "s" : ""} failed`));
+        }
+        console.log();
+        if (hardFailed.length > 0) {
+            process.exit(1);
+        }
+    });
+}