@rafter-security/cli 0.5.5 → 0.6.1

package/dist/commands/agent/scan.js

@@ -2,11 +2,15 @@ import { Command } from "commander";
 import { RegexScanner } from "../../scanners/regex-scanner.js";
 import { GitleaksScanner } from "../../scanners/gitleaks.js";
 import { ConfigManager } from "../../core/config-manager.js";
+import { AuditLogger } from "../../core/audit-logger.js";
 import { execSync, execFileSync } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
 import { fmt } from "../../utils/formatter.js";
+import { createRequire } from "module";
+const _require = createRequire(import.meta.url);
+const { version: CLI_VERSION } = _require("../../../package.json");
 function loadBaselineEntries() {
     const baselinePath = path.join(os.homedir(), ".rafter", "baseline.json");
     if (!fs.existsSync(baselinePath))
@@ -42,7 +46,28 @@ export function createScanCommand() {
         .option("--diff <ref>", "Scan files changed since a git ref")
         .option("--engine <engine>", "Scan engine: gitleaks or patterns", "auto")
         .option("--baseline", "Filter findings present in the saved baseline")
+        .option("--watch", "Watch for file changes and re-scan on change")
         .action(async (scanPath, opts) => {
+        // Validate flags before doing any work
+        const validEngines = ["auto", "gitleaks", "patterns"];
+        const engineValue = opts.engine || "auto";
+        if (!validEngines.includes(engineValue)) {
+            console.error(`Invalid engine: ${engineValue}. Valid values: ${validEngines.join(", ")}`);
+            process.exit(2);
+        }
+        const format = opts.format ?? (opts.json ? "json" : "text");
+        const validFormats = ["text", "json", "sarif"];
+        if (!validFormats.includes(format)) {
+            console.error(`Invalid format: ${format}. Valid values: ${validFormats.join(", ")}`);
+            process.exit(2);
+        }
+        // Deprecation notice — only when invoked as `rafter agent scan`, not as `rafter scan local`
+        const argv = process.argv;
+        const isAgentScan = argv.includes("agent") && argv.includes("scan") &&
+            argv.indexOf("agent") < argv.indexOf("scan");
+        if (isAgentScan) {
+            process.stderr.write("Warning: rafter agent scan is deprecated and will be removed in a future major version. Use rafter scan local instead.\n");
+        }
         // Load policy-merged config for excludePaths/customPatterns
         const manager = new ConfigManager();
         const cfg = manager.loadWithPolicy();
@@ -64,6 +89,11 @@ export function createScanCommand() {
             console.error(`Error: Path not found: ${resolvedPath}`);
             process.exit(2);
         }
+        // Handle --watch flag
+        if (opts.watch) {
+            await watchAndScan(resolvedPath, opts, scanCfg);
+            return;
+        }
         // Determine scan engine
         const engine = await selectEngine(opts.engine || "auto", opts.quiet || false);
         // Determine if path is file or directory
@@ -123,7 +153,7 @@ function outputSarif(results) {
                 tool: {
                     driver: {
                         name: "rafter",
-                        version: "0.5.5",
+                        version: CLI_VERSION,
                         informationUri: "https://rafter.so",
                         rules: Array.from(rules.values()),
                     },
@@ -138,7 +168,7 @@ function outputSarif(results) {
 /**
  * Shared output logic for scan results
  */
-function outputScanResults(results, opts, context) {
+function outputScanResults(results, opts, context, exitOnFindings = true) {
     const format = opts.format ?? (opts.json ? "json" : "text");
     if (!["text", "json", "sarif"].includes(format)) {
         console.error(`Invalid format: ${format}. Valid values: text, json, sarif`);
@@ -159,14 +189,18 @@ function outputScanResults(results, opts, context) {
             })),
         }));
         console.log(JSON.stringify(out, null, 2));
-        process.exit(results.length > 0 ? 1 : 0);
+        if (exitOnFindings)
+            process.exit(results.length > 0 ? 1 : 0);
+        return;
     }
     if (results.length === 0) {
         if (!opts.quiet) {
             const msg = context ? `No secrets detected in ${context}` : "No secrets detected";
             console.log(`\n${fmt.success(msg)}\n`);
         }
-        process.exit(0);
+        if (exitOnFindings)
+            process.exit(0);
+        return;
     }
     console.log(`\n${fmt.warning(`Found secrets in ${results.length} file(s):`)}\n`);
     let totalMatches = 0;
@@ -187,10 +221,11 @@ function outputScanResults(results, opts, context) {
     if (context === "staged files") {
         console.log(`${fmt.error("Commit blocked. Remove secrets before committing.")}\n`);
     }
-    else {
+    else if (exitOnFindings) {
         console.log(`Run 'rafter agent audit' to see the security log.\n`);
     }
-    process.exit(1);
+    if (exitOnFindings)
+        process.exit(1);
 }
 /**
  * Scan files changed since a git ref
@@ -202,19 +237,21 @@ async function scanDiffFiles(ref, opts, scanCfg, baselineEntries = []) {
             stdio: ["pipe", "pipe", "ignore"],
         }).trim();
         if (!diffOutput) {
-            if (!opts.quiet) {
-                console.log(fmt.success(`No files changed since ${ref}`));
-            }
-            process.exit(0);
+            outputScanResults([], opts, `files changed since ${ref}`);
+            return;
         }
         const changedFiles = diffOutput.split("\n").map(f => f.trim()).filter(f => f);
         if (!opts.quiet) {
             console.error(`Scanning ${changedFiles.length} file(s) changed since ${ref}...`);
         }
+        const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "ignore"],
+        }).trim();
         const engine = await selectEngine(opts.engine || "auto", opts.quiet || false);
         const allResults = [];
         for (const file of changedFiles) {
-            const filePath = path.resolve(file);
+            const filePath = path.resolve(repoRoot, file);
             if (!fs.existsSync(filePath))
                 continue;
             const stats = fs.statSync(filePath);
@@ -243,19 +280,21 @@ async function scanStagedFiles(opts, scanCfg, baselineEntries = []) {
             stdio: ["pipe", "pipe", "ignore"]
         }).trim();
         if (!stagedFilesOutput) {
-            if (!opts.quiet) {
-                console.log(fmt.success("No files staged for commit"));
-            }
-            process.exit(0);
+            outputScanResults([], opts, "staged files");
+            return;
         }
         const stagedFiles = stagedFilesOutput.split("\n").map(f => f.trim()).filter(f => f);
         if (!opts.quiet) {
             console.error(`Scanning ${stagedFiles.length} staged file(s)...`);
         }
+        const repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "ignore"],
+        }).trim();
         const engine = await selectEngine(opts.engine || "auto", opts.quiet || false);
         const allResults = [];
         for (const file of stagedFiles) {
-            const filePath = path.resolve(file);
+            const filePath = path.resolve(repoRoot, file);
             if (!fs.existsSync(filePath))
                 continue;
             const stats = fs.statSync(filePath);
@@ -292,6 +331,10 @@ async function selectEngine(preference, quiet) {
         }
         return "gitleaks";
     }
+    if (preference !== "auto") {
+        console.error(`Invalid engine: ${preference}. Valid values: auto, gitleaks, patterns`);
+        process.exit(2);
+    }
     // Auto mode: try Gitleaks, fall back to patterns
     const gitleaks = new GitleaksScanner();
     const available = await gitleaks.isAvailable();
@@ -340,3 +383,104 @@ async function scanDirectory(dirPath, engine, scanCfg) {
         return scanner.scanDirectory(dirPath, { excludePaths: scanCfg?.excludePaths });
     }
 }
+/**
+ * Watch a path for changes and re-scan on each change
+ */
+async function watchAndScan(watchPath, opts, scanCfg) {
+    const { watch } = await import("chokidar");
+    const logger = new AuditLogger();
+    const engine = await selectEngine(opts.engine || "auto", opts.quiet || false);
+    if (!opts.quiet) {
+        console.error(fmt.info(`Watching ${watchPath} for changes (${engine}). Press Ctrl+C to exit.`));
+    }
+    // Do an initial scan
+    const stats = fs.statSync(watchPath);
+    const initialResults = stats.isDirectory()
+        ? await scanDirectory(watchPath, engine, scanCfg)
+        : await scanFile(watchPath, engine, scanCfg);
+    if (initialResults.length > 0) {
+        console.log(fmt.warning(`\n[Initial scan] Found secrets:`));
+        outputScanResults(initialResults, { ...opts, quiet: false }, undefined, /* exitOnFindings= */ false);
+        logWatchFindings(logger, initialResults);
+    }
+    else if (!opts.quiet) {
+        console.log(fmt.success(`[Initial scan] No secrets detected`));
+    }
+    const watcher = watch(watchPath, {
+        ignoreInitial: true,
+        persistent: true,
+        ignored: /(^|[/\\])\../,
+    });
+    watcher.on("change", async (filePath) => {
+        const timestamp = new Date().toLocaleTimeString();
+        if (!opts.quiet) {
+            console.error(`\n[${timestamp}] Changed: ${filePath}`);
+        }
+        if (!fs.existsSync(filePath))
+            return;
+        const fileStats = fs.statSync(filePath);
+        if (!fileStats.isFile())
+            return;
+        const results = await scanFile(filePath, engine, scanCfg);
+        if (results.length > 0) {
+            outputScanResults(results, { ...opts, quiet: false }, undefined, /* exitOnFindings= */ false);
+            logWatchFindings(logger, results);
+        }
+        else if (!opts.quiet) {
+            console.log(fmt.success(`  No secrets detected`));
+        }
+    });
+    watcher.on("add", async (filePath) => {
+        const timestamp = new Date().toLocaleTimeString();
+        if (!opts.quiet) {
+            console.error(`\n[${timestamp}] Added: ${filePath}`);
+        }
+        const fileStats = fs.statSync(filePath);
+        if (!fileStats.isFile())
+            return;
+        const results = await scanFile(filePath, engine, scanCfg);
+        if (results.length > 0) {
+            outputScanResults(results, { ...opts, quiet: false }, undefined, /* exitOnFindings= */ false);
+            logWatchFindings(logger, results);
+        }
+        else if (!opts.quiet) {
+            console.log(fmt.success(`  No secrets detected`));
+        }
+    });
+    // Keep process alive until Ctrl+C
+    await new Promise((resolve) => {
+        process.on("SIGINT", () => {
+            if (!opts.quiet) {
+                console.log(fmt.info("\nWatch mode stopped."));
+            }
+            watcher.close();
+            resolve();
+        });
+    });
+}
+/**
+ * Log watch findings to audit log
+ */
+function logWatchFindings(logger, results) {
+    for (const result of results) {
+        for (const match of result.matches) {
+            logger.log({
+                eventType: "secret_detected",
+                securityCheck: {
+                    passed: false,
+                    reason: `${match.pattern.name} detected in ${result.file}`,
+                    details: {
+                        file: result.file,
+                        line: match.line,
+                        pattern: match.pattern.name,
+                        severity: match.pattern.severity,
+                        watchMode: true,
+                    },
+                },
+                resolution: {
+                    actionTaken: "allowed",
+                },
+            });
+        }
+    }
+}

package/dist/commands/agent/status.js

@@ -32,7 +32,7 @@ export function createStatusCommand() {
         }
         // --- Gitleaks ---
         const localGitleaks = path.join(getBinDir(), "gitleaks");
-        let gitleaksStatus = "not found — run: rafter agent init";
+        let gitleaksStatus = "not found — run: rafter agent init --with-gitleaks";
         try {
             const ver = execSync("gitleaks version", { timeout: 5000, encoding: "utf-8" }).trim();
             gitleaksStatus = `${ver} (PATH)`;
@@ -74,8 +74,8 @@ export function createStatusCommand() {
                 // unreadable settings
             }
         }
-        console.log(`PreToolUse:   ${pretoolOk ? "installed" : "not installed — run: rafter agent init"}`);
-        console.log(`PostToolUse:  ${posttoolOk ? "installed" : "not installed — run: rafter agent init"}`);
+        console.log(`PreToolUse:   ${pretoolOk ? "installed" : "not installed — run: rafter agent init --with-claude-code"}`);
+        console.log(`PostToolUse:  ${posttoolOk ? "installed" : "not installed — run: rafter agent init --with-claude-code"}`);
         // --- OpenClaw skill ---
         const skillPath = path.join(home, ".openclaw", "skills", "rafter-security.md");
         const openclawDir = path.join(home, ".openclaw");
@@ -83,11 +83,72 @@ export function createStatusCommand() {
             console.log(`OpenClaw:     skill installed (${skillPath})`);
         }
         else if (fs.existsSync(openclawDir)) {
-            console.log("OpenClaw:     detected but skill missing — run: rafter agent init");
+            console.log("OpenClaw:     detected but skill missing — run: rafter agent init --with-openclaw");
         }
         else {
             console.log("OpenClaw:     not detected (optional)");
         }
+        // --- Codex CLI skills ---
+        const codexDir = path.join(home, ".codex");
+        const codexSkillPath = path.join(home, ".agents", "skills", "rafter", "SKILL.md");
+        if (fs.existsSync(codexSkillPath)) {
+            console.log(`Codex CLI:    skills installed (${path.join(home, ".agents", "skills")})`);
+        }
+        else if (fs.existsSync(codexDir)) {
+            console.log("Codex CLI:    detected but skills missing — run: rafter agent init --with-codex");
+        }
+        else {
+            console.log("Codex CLI:    not detected (optional)");
+        }
+        // --- MCP-native AI engine integrations ---
+        const mcpAgents = [
+            { name: "Gemini CLI", flag: "--with-gemini", configDir: path.join(home, ".gemini"), configFile: path.join(home, ".gemini", "settings.json"), needle: "rafter" },
+            { name: "Cursor", flag: "--with-cursor", configDir: path.join(home, ".cursor"), configFile: path.join(home, ".cursor", "mcp.json"), needle: "rafter" },
+            { name: "Windsurf", flag: "--with-windsurf", configDir: path.join(home, ".codeium", "windsurf"), configFile: path.join(home, ".codeium", "windsurf", "mcp_config.json"), needle: "rafter" },
+            { name: "Continue.dev", flag: "--with-continue", configDir: path.join(home, ".continue"), configFile: path.join(home, ".continue", "config.json"), needle: "rafter" },
+        ];
+        for (const agent of mcpAgents) {
+            const label = `${agent.name}:`.padEnd(14);
+            if (fs.existsSync(agent.configFile)) {
+                try {
+                    const content = fs.readFileSync(agent.configFile, "utf-8");
+                    if (content.includes(agent.needle)) {
+                        console.log(`${label}MCP installed (${agent.configFile})`);
+                    }
+                    else {
+                        console.log(`${label}detected but MCP missing — run: rafter agent init ${agent.flag}`);
+                    }
+                }
+                catch {
+                    console.log(`${label}config unreadable (${agent.configFile})`);
+                }
+            }
+            else if (fs.existsSync(agent.configDir)) {
+                console.log(`${label}detected but MCP missing — run: rafter agent init ${agent.flag}`);
+            }
+            else {
+                console.log(`${label}not detected (optional)`);
+            }
+        }
+        // --- Aider ---
+        const aiderConfig = path.join(home, ".aider.conf.yml");
+        if (fs.existsSync(aiderConfig)) {
+            try {
+                const content = fs.readFileSync(aiderConfig, "utf-8");
+                if (content.includes("rafter mcp serve")) {
+                    console.log(`Aider:        MCP installed (${aiderConfig})`);
+                }
+                else {
+                    console.log("Aider:        detected but MCP missing — run: rafter agent init --with-aider");
+                }
+            }
+            catch {
+                console.log(`Aider:        config unreadable (${aiderConfig})`);
+            }
+        }
+        else {
+            console.log("Aider:        not detected (optional)");
+        }
         // --- Audit log summary ---
         console.log(`\nAudit log:    ${auditPath}`);
         if (fs.existsSync(auditPath)) {

package/dist/commands/agent/verify.js

@@ -43,7 +43,7 @@ function checkClaudeCode() {
     // optional: warn if absent but don't fail exit code
     const claudeDir = path.join(homeDir, ".claude");
     if (!fs.existsSync(claudeDir)) {
-        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init --claude-code' to enable` };
+        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init --with-claude-code' to enable` };
     }
     const settingsPath = path.join(claudeDir, "settings.json");
     if (!fs.existsSync(settingsPath)) {
@@ -54,7 +54,7 @@ function checkClaudeCode() {
         const hooks = settings?.hooks?.PreToolUse || [];
         const hasRafterHook = hooks.some((entry) => (entry.hooks || []).some((h) => h.command === "rafter hook pretool"));
         if (!hasRafterHook) {
-            return { name, passed: false, optional: true, detail: "Rafter hooks not installed — run 'rafter agent init --claude-code'" };
+            return { name, passed: false, optional: true, detail: "Rafter hooks not installed — run 'rafter agent init --with-claude-code'" };
         }
         return { name, passed: true, detail: "Hooks installed" };
     }
@@ -66,14 +66,27 @@ function checkOpenClaw() {
     const name = "OpenClaw";
     const skillManager = new SkillManager();
     if (!skillManager.isOpenClawInstalled()) {
-        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init' to enable` };
+        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init --with-openclaw' to enable` };
     }
     if (!skillManager.isRafterSkillInstalled()) {
-        return { name, passed: false, optional: true, detail: `Rafter skill not installed — run 'rafter agent init'` };
+        return { name, passed: false, optional: true, detail: `Rafter skill not installed — run 'rafter agent init --with-openclaw'` };
     }
     const version = skillManager.getInstalledVersion();
     return { name, passed: true, detail: `Rafter skill installed${version ? ` (v${version})` : ""}` };
 }
+function checkCodex() {
+    const name = "Codex CLI";
+    const homeDir = os.homedir();
+    const codexDir = path.join(homeDir, ".codex");
+    if (!fs.existsSync(codexDir)) {
+        return { name, passed: false, optional: true, detail: `Not detected — run 'rafter agent init --with-codex' to enable` };
+    }
+    const skillPath = path.join(homeDir, ".agents", "skills", "rafter", "SKILL.md");
+    if (!fs.existsSync(skillPath)) {
+        return { name, passed: false, optional: true, detail: `Rafter skills not installed — run 'rafter agent init --with-codex'` };
+    }
+    return { name, passed: true, detail: `Skills installed (${path.join(homeDir, ".agents", "skills")})` };
+}
 export function createVerifyCommand() {
     return new Command("verify")
         .description("Check agent security integration status")
@@ -86,6 +99,7 @@ export function createVerifyCommand() {
             await checkGitleaks(),
             checkClaudeCode(),
             checkOpenClaw(),
+            checkCodex(),
         ];
         for (const r of results) {
             if (r.passed) {

package/dist/commands/backend/run.js

@@ -2,25 +2,49 @@ import { Command } from "commander";
 import axios from "axios";
 import ora from "ora";
 import { detectRepo } from "../../utils/git.js";
-import { API, resolveKey, EXIT_GENERAL_ERROR, EXIT_QUOTA_EXHAUSTED } from "../../utils/api.js";
+import { API, resolveKey, EXIT_GENERAL_ERROR, EXIT_QUOTA_EXHAUSTED, EXIT_INSUFFICIENT_SCOPE, handleScopeError } from "../../utils/api.js";
 import { handleScanStatus } from "./scan-status.js";
-export function createRunCommand() {
-    return new Command("run")
-        .alias("scan")
-        .option("-r, --repo <repo>", "org/repo (default: current)")
-        .option("-b, --branch <branch>", "branch (default: current else main)")
-        .option("-k, --api-key <key>", "API key or RAFTER_API_KEY env var")
-        .option("-f, --format <format>", "json | md", "md")
-        .option("--skip-interactive", "do not wait for scan to complete")
-        .option("--quiet", "suppress status messages")
-        .action(async (opts) => {
-        const key = resolveKey(opts.apiKey);
-        let repo, branch;
+/**
+ * Shared handler for the remote backend scan (used by both `rafter run` and `rafter scan` / `rafter scan remote`).
+ */
+export async function runRemoteScan(opts) {
+    const key = resolveKey(opts.apiKey);
+    let repo, branch;
+    try {
+        ({ repo, branch } = detectRepo({ repo: opts.repo, branch: opts.branch, quiet: opts.quiet }));
+    }
+    catch (e) {
+        if (e instanceof Error) {
+            console.error(e.message);
+        }
+        else {
+            console.error(e);
+        }
+        process.exit(EXIT_GENERAL_ERROR);
+    }
+    if (!opts.quiet) {
+        const spinner = ora("Submitting scan").start();
         try {
-            ({ repo, branch } = detectRepo({ repo: opts.repo, branch: opts.branch, quiet: opts.quiet }));
+            const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
+            spinner.succeed(`Scan ID: ${data.scan_id}`);
+            if (opts.skipInteractive)
+                return;
+            const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format ?? "md", opts.quiet);
+            process.exit(exitCode);
         }
         catch (e) {
-            if (e instanceof Error) {
+            spinner.fail("Request failed");
+            if (handleScopeError(e)) {
+                process.exit(EXIT_INSUFFICIENT_SCOPE);
+            }
+            else if (e.response?.status === 429) {
+                console.error("Quota exhausted");
+                process.exit(EXIT_QUOTA_EXHAUSTED);
+            }
+            else if (e.response?.data) {
+                console.error(e.response.data);
+            }
+            else if (e instanceof Error) {
                 console.error(e.message);
             }
             else {
@@ -28,57 +52,47 @@ export function createRunCommand() {
             }
             process.exit(EXIT_GENERAL_ERROR);
         }
-        if (!opts.quiet) {
-            const spinner = ora("Submitting scan").start();
-            try {
-                const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
-                spinner.succeed(`Scan ID: ${data.scan_id}`);
-                if (opts.skipInteractive)
-                    return;
-                const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format, opts.quiet);
-                process.exit(exitCode);
+    }
+    else {
+        try {
+            const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
+            if (opts.skipInteractive)
+                return;
+            const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format ?? "md", opts.quiet);
+            process.exit(exitCode);
+        }
+        catch (e) {
+            if (handleScopeError(e)) {
+                process.exit(EXIT_INSUFFICIENT_SCOPE);
             }
-            catch (e) {
-                spinner.fail("Request failed");
-                if (e.response?.status === 429) {
-                    console.error("Quota exhausted");
-                    process.exit(EXIT_QUOTA_EXHAUSTED);
-                }
-                else if (e.response?.data) {
-                    console.error(e.response.data);
-                }
-                else if (e instanceof Error) {
-                    console.error(e.message);
-                }
-                else {
-                    console.error(e);
-                }
-                process.exit(EXIT_GENERAL_ERROR);
+            else if (e.response?.status === 429) {
+                process.exit(EXIT_QUOTA_EXHAUSTED);
             }
-        }
-        else {
-            try {
-                const { data } = await axios.post(`${API}/static/scan`, { repository_name: repo, branch_name: branch }, { headers: { "x-api-key": key } });
-                if (opts.skipInteractive)
-                    return;
-                const exitCode = await handleScanStatus(data.scan_id, { "x-api-key": key }, opts.format, opts.quiet);
-                process.exit(exitCode);
+            else if (e.response?.data) {
+                console.error(e.response.data);
+            }
+            else if (e instanceof Error) {
+                console.error(e.message);
             }
-            catch (e) {
-                if (e.response?.status === 429) {
-                    process.exit(EXIT_QUOTA_EXHAUSTED);
-                }
-                else if (e.response?.data) {
-                    console.error(e.response.data);
-                }
-                else if (e instanceof Error) {
-                    console.error(e.message);
-                }
-                else {
-                    console.error(e);
-                }
-                process.exit(EXIT_GENERAL_ERROR);
+            else {
+                console.error(e);
             }
+            process.exit(EXIT_GENERAL_ERROR);
         }
+    }
+}
+function addRunOptions(cmd) {
+    return cmd
+        .option("-r, --repo <repo>", "org/repo (default: current)")
+        .option("-b, --branch <branch>", "branch (default: current else main)")
+        .option("-k, --api-key <key>", "API key or RAFTER_API_KEY env var")
+        .option("-f, --format <format>", "json | md", "md")
+        .option("--skip-interactive", "do not wait for scan to complete")
+        .option("--quiet", "suppress status messages");
+}
+export function createRunCommand() {
+    return addRunOptions(new Command("run")
+        .description("Trigger a remote backend security scan")).action(async (opts) => {
+        await runRemoteScan(opts);
     });
 }

package/dist/commands/ci/init.js

@@ -44,6 +44,12 @@ export function createCiInitCommand() {
             }
         }
         console.log(`  ${opts.withBackend ? "3" : "2"}. Commit and push to trigger the pipeline`);
+        if (platform === "github") {
+            console.log();
+            console.log("Alternatives:");
+            console.log("  - GitHub Action: uses: Raftersecurity/rafter-cli@v0");
+            console.log("  - Pre-commit:  https://github.com/Raftersecurity/rafter-cli#pre-commit-framework");
+        }
         console.log();
     });
 }
@@ -68,6 +74,7 @@ function generateTemplate(platform, withBackend) {
 }
 function githubTemplate(withBackend) {
     let yaml = `# Generated by: rafter ci init
+# Alternative: uses: Raftersecurity/rafter-cli@v0
 name: Rafter Security
 
 on:
@@ -89,7 +96,7 @@ jobs:
         run: npm install -g @rafter-security/cli
 
       - name: Scan for secrets
-        run: rafter agent scan . --quiet
+        run: rafter scan local . --quiet
 `;
     if (withBackend) {
         yaml += `
@@ -120,7 +127,7 @@ secret-scan:
   image: node:20
   script:
     - npm install -g @rafter-security/cli
-    - rafter agent scan . --quiet
+    - rafter scan local . --quiet
   rules:
     - if: $CI_PIPELINE_SOURCE == "push"
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
@@ -158,7 +165,7 @@ jobs:
           command: npm install -g @rafter-security/cli
       - run:
           name: Scan for secrets
-          command: rafter agent scan . --quiet
+          command: rafter scan local . --quiet
 `;
     if (withBackend) {
         yaml += `