@rivora/cli 0.1.2 → 0.1.3

package/dist/index.js

@@ -180050,6 +180050,18 @@ class RestClient {
     }
     return { data: response.data, status: response.statusCode || 200 };
   }
+  async sendAgentMessage(body) {
+    const response = await this.makeRequest({
+      method: "POST",
+      path: "/api/agent/message",
+      body
+    });
+    if (!response.success) {
+      const errorMsg = typeof response.error === "string" ? response.error : response.error?.message || "Agent request failed";
+      throw new Error(errorMsg);
+    }
+    return response.data;
+  }
   async put(path52, body, options) {
     const response = await this.makeRequest({
       method: "PUT",
@@ -186412,7 +186424,7 @@ function createTestCommand() {
   });
 }
 init_source();
-var version = "0.0.2";
+var version = "0.1.3";
 var execAsync = promisify(exec);
 var CLI_BASE_URL = process.env.RIVORA_CLI_URL || "https://cli.rivora.dev/releases/latest";
 async function fetchLatestVersion() {
@@ -186838,7 +186850,7 @@ trainingCommand.command("config").description("Show training configuration [INTE
 init_source();
 var import_cli_table34 = __toESM2(require_table(), 1);
 init_auth_service();
-var modelsCommand = new Command2("models").description("Manage metrics contribution for Rivora ML models");
+var modelsCommand = new Command2("models").description("Manage Rivora ML models and metrics contribution");
 async function ensureAuth6() {
   const isAuthenticated = await authService.isAuthenticated();
   if (!isAuthenticated) {
@@ -186848,6 +186860,149 @@ async function ensureAuth6() {
   }
   return authService.getAccessToken();
 }
+function renderModelStatus(model) {
+  if (model.update_policy === "pinned") {
+    return source_default.blue("Pinned");
+  }
+  if (model.update_available) {
+    return source_default.yellow("Update available");
+  }
+  return source_default.green("Up to date");
+}
+modelsCommand.command("status").description("Show model status and versions").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    await ensureAuth6();
+    const spinner = ora("Fetching model status...").start();
+    try {
+      const response = await restClient.get("/api/models/status");
+      spinner.succeed("Model status retrieved");
+      if (options.json) {
+        console.log(JSON.stringify(response.data, null, 2));
+        return;
+      }
+      const data = response.data;
+      console.log();
+      console.log(source_default.bold("Model Status"));
+      const table = new import_cli_table34.default({
+        head: [
+          source_default.bold("Family"),
+          source_default.bold("Global"),
+          source_default.bold("Tenant"),
+          source_default.bold("Policy"),
+          source_default.bold("Status")
+        ],
+        style: { head: [], border: [] },
+        chars: {
+          top: "\u2500",
+          "top-mid": "\u252C",
+          "top-left": "\u250C",
+          "top-right": "\u2510",
+          bottom: "\u2500",
+          "bottom-mid": "\u2534",
+          "bottom-left": "\u2514",
+          "bottom-right": "\u2518",
+          left: "\u2502",
+          "left-mid": "\u251C",
+          mid: "\u2500",
+          "mid-mid": "\u253C",
+          right: "\u2502",
+          "right-mid": "\u2524",
+          middle: "\u2502"
+        }
+      });
+      for (const model of data.models) {
+        table.push([
+          model.family,
+          model.global_version,
+          model.tenant_version,
+          model.update_policy,
+          renderModelStatus(model)
+        ]);
+      }
+      console.log(table.toString());
+      console.log();
+      console.log(`Metrics contribution: ${data.contribute_metrics ? source_default.green("Enabled") : source_default.dim("Disabled")}`);
+      if (data.consent_timestamp) {
+        console.log(`Consent timestamp: ${source_default.dim(new Date(data.consent_timestamp).toLocaleString())}`);
+      }
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to fetch model status");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error(source_default.red("Error:"), error.message);
+    process.exit(1);
+  }
+});
+modelsCommand.command("update").description("Update model families to the latest stable versions").option("--family <name>", "Update specific model family (prioritizer, anomaly)").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    await ensureAuth6();
+    const spinner = ora("Updating models...").start();
+    try {
+      const body = {};
+      if (options.family) {
+        body.family = options.family;
+      }
+      const response = await restClient.post("/api/models/update", body);
+      spinner.succeed("Models checked");
+      if (options.json) {
+        console.log(JSON.stringify(response.data, null, 2));
+        return;
+      }
+      const data = response.data;
+      console.log();
+      if (!data.updated || data.updates.length === 0) {
+        console.log(source_default.green("\u2713 All models are up to date"));
+        console.log();
+        return;
+      }
+      console.log(source_default.bold("Updated Models"));
+      for (const update of data.updates) {
+        console.log(`  ${source_default.cyan(update.family)}: ${source_default.dim(update.from_version)} -> ${source_default.green(update.to_version)}`);
+      }
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to update models");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error(source_default.red("Error:"), error.message);
+    process.exit(1);
+  }
+});
+modelsCommand.command("pin").description("Pin a model family to a specific version").argument("<family>", "Model family to pin (prioritizer, anomaly)").argument("<version>", "Version to pin (e.g. 1.0.0)").option("--json", "Output as JSON").action(async (family, version2, options) => {
+  try {
+    await ensureAuth6();
+    const spinner = ora(`Pinning ${family} to ${version2}...`).start();
+    try {
+      const response = await restClient.post("/api/models/pin", {
+        family,
+        version: version2
+      });
+      spinner.succeed("Model pinned");
+      if (options.json) {
+        console.log(JSON.stringify(response.data, null, 2));
+        return;
+      }
+      console.log();
+      console.log(source_default.green(`\u2713 ${family} pinned to ${version2}`));
+      if (response.data.message) {
+        console.log(source_default.dim(`  ${response.data.message}`));
+      }
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to pin model");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error(source_default.red("Error:"), error.message);
+    process.exit(1);
+  }
+});
 modelsCommand.command("contribute").description("Enable or disable metrics contribution").option("--enable", "Enable metrics contribution").option("--disable", "Disable metrics contribution").option("--json", "Output as JSON").action(async (options) => {
   try {
     await ensureAuth6();
@@ -186892,9 +187047,7 @@ modelsCommand.command("contribute").description("Enable or disable metrics contr
       }
       const spinner = ora("Enabling metrics contribution...").start();
       try {
-        const response = await restClient.post("/api/models/consent", {
-          consent: true
-        });
+        const response = await restClient.post("/api/models/consent", {});
         spinner.succeed("Metrics contribution enabled");
         if (options.json) {
           console.log(JSON.stringify(response.data, null, 2));
@@ -186902,6 +187055,9 @@ modelsCommand.command("contribute").description("Enable or disable metrics contr
         }
         console.log();
         console.log(source_default.green("\u2713 Thank you for contributing to Rivora!"));
+        if (response.data?.consent_timestamp) {
+          console.log(source_default.dim(`  Consent recorded: ${new Date(response.data.consent_timestamp).toLocaleString()}`));
+        }
         console.log(source_default.dim("  Preview what's shared: rivora models metrics-preview"));
         console.log();
       } catch (error) {
@@ -186920,8 +187076,8 @@ modelsCommand.command("contribute").description("Enable or disable metrics contr
         }
         console.log();
         console.log(source_default.green("\u2713 Metrics contribution disabled"));
-        if (response.data.data_deleted) {
-          console.log(source_default.dim("  Previously shared data has been deleted."));
+        if (response.data?.metrics_deleted) {
+          console.log(source_default.dim(`  Deleted ${response.data.deleted_count} metrics file(s).`));
         }
         console.log();
       } catch (error) {
@@ -186947,11 +187103,16 @@ modelsCommand.command("metrics-preview").description("Preview metrics that would
         return;
       }
       const data = response.data;
+      const rows = data.rule_stats ?? data.rules ?? [];
+      const periodStart = data.period_start ?? data.date_range?.start;
+      const periodEnd = data.period_end ?? data.date_range?.end;
       console.log();
       console.log(source_default.bold("Metrics Preview"));
-      console.log(source_default.dim(`Date range: ${data.date_range.start} to ${data.date_range.end}`));
+      if (periodStart && periodEnd) {
+        console.log(source_default.dim(`Date range: ${periodStart} to ${periodEnd}`));
+      }
       console.log();
-      if (data.rules.length === 0) {
+      if (rows.length === 0) {
         console.log(source_default.dim("No metrics available yet."));
         console.log(source_default.dim("Metrics are collected after running scans and reviewing findings."));
         console.log();
@@ -186960,9 +187121,9 @@ modelsCommand.command("metrics-preview").description("Preview metrics that would
       const table = new import_cli_table34.default({
         head: [
           source_default.bold("Rule ID"),
-          source_default.bold("Invocations"),
-          source_default.bold("True Positives"),
-          source_default.bold("False Positives")
+          source_default.bold("Triggers"),
+          source_default.bold("Severity"),
+          source_default.bold("Avg Priority")
         ],
         style: { head: [], border: [] },
         chars: {
@@ -186983,20 +187144,25 @@ modelsCommand.command("metrics-preview").description("Preview metrics that would
           middle: "\u2502"
         }
       });
-      for (const rule of data.rules) {
+      for (const row of rows) {
+        const triggerCount = row.trigger_count ?? row.invocations ?? 0;
+        const severity = row.severity_distribution ? Object.entries(row.severity_distribution).map(([key, value]) => `${key}:${value}`).join(", ") : "-";
+        const avgPriority = row.avg_priority_score == null ? "-" : row.avg_priority_score.toFixed(3);
         table.push([
-          rule.rule_id,
-          rule.invocations.toString(),
-          source_default.green(rule.true_positives.toString()),
-          source_default.red(rule.false_positives.toString())
+          row.rule_id,
+          triggerCount.toString(),
+          severity,
+          avgPriority
         ]);
       }
       console.log(table.toString());
       console.log();
       console.log(`Total findings: ${source_default.bold(data.total_findings)}`);
       console.log();
-      console.log(source_default.dim("This data helps improve model accuracy for all users."));
-      console.log(source_default.dim("Enable contribution: rivora models contribute --enable"));
+      if (data.would_share !== undefined) {
+        console.log(`Would share now: ${data.would_share ? source_default.green("Yes") : source_default.yellow("No")}`);
+        console.log();
+      }
       console.log();
     } catch (error) {
       spinner.fail("Failed to fetch metrics preview");
@@ -187699,7 +187865,7 @@ async function manageConfig(options) {
   }
 }
 var argocdCommand = createArgocdCommand();
-var version2 = "0.0.2";
+var version2 = "0.1.3";
 var rcaCommand = new Command2("rca").description("Root cause analysis (5 Whys)");
 function displayRCAReport(report) {
   console.log();
@@ -187839,8 +188005,682 @@ rcaCommand.command("feedback").description("Accept or reject an RCA root cause")
     process.exit(1);
   }
 });
+function extractOptimizationService(ruleId) {
+  if (!ruleId)
+    return "unknown";
+  const parts = ruleId.split("-");
+  if (parts.length >= 3 && parts[0] === "opt")
+    return parts[1];
+  return "unknown";
+}
+async function resolveOptimizationFindingId(token, idOrRuleId) {
+  if (!idOrRuleId.startsWith("opt-")) {
+    return idOrRuleId;
+  }
+  const response = await restClient.get("/findings?category=optimization", { headers: { Authorization: `Bearer ${token}` } });
+  const match = (response.data || []).find((f) => f.rule_id === idOrRuleId);
+  if (!match) {
+    throw new Error(`No open optimization finding found for rule ${idOrRuleId}`);
+  }
+  return match.id;
+}
+var optimizeCommand = new Command2("optimize").description("Configuration optimization recommendations");
+optimizeCommand.command("aws").description("List optimization recommendations for AWS resources").option("--impact <level>", "Filter by impact (high, medium, low)").option("--service <service>", "Filter by service (eks, s3, ec2, ecs, iam)").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    const token = await ensureAuthDrift();
+    const spinner = ora("Fetching optimization recommendations...").start();
+    try {
+      const params = new URLSearchParams;
+      params.set("category", "optimization");
+      if (options.impact)
+        params.set("severity", options.impact.toLowerCase());
+      const summaryParams = new URLSearchParams;
+      summaryParams.set("notify", "true");
+      if (options.service)
+        summaryParams.set("service", options.service.toLowerCase());
+      const findingsResponse = await restClient.get(`/findings?${params.toString()}`, { headers: { Authorization: `Bearer ${token}` } });
+      try {
+        await restClient.get(`/findings/optimize/summary?${summaryParams.toString()}`, { headers: { Authorization: `Bearer ${token}` } });
+      } catch (_err) {}
+      const allFindings = findingsResponse.data || [];
+      const serviceFilter = options.service ? options.service.toLowerCase() : null;
+      const findings = allFindings.filter((f) => {
+        const service = extractOptimizationService(f.rule_id);
+        return !serviceFilter || service === serviceFilter;
+      });
+      spinner.succeed(`Found ${findings.length} recommendation(s)`);
+      if (options.json) {
+        console.log(JSON.stringify(findings, null, 2));
+        return;
+      }
+      if (findings.length === 0) {
+        console.log();
+        console.log(source_default.green("\u2713 No optimization recommendations match your filters"));
+        console.log();
+        return;
+      }
+      console.log();
+      console.log(source_default.bold("\u26A1 Configuration Optimization \u2014 AWS"));
+      console.log();
+      const table = new Table3({
+        head: [
+          source_default.bold("ID"),
+          source_default.bold("Recommendation"),
+          source_default.bold("Impact"),
+          source_default.bold("Resource")
+        ],
+        style: { head: [], border: [] }
+      });
+      let high = 0;
+      let medium = 0;
+      let low = 0;
+      for (const finding of findings) {
+        const sev = (finding.severity || "").toLowerCase();
+        if (sev === "high" || sev === "critical")
+          high++;
+        else if (sev === "medium")
+          medium++;
+        else
+          low++;
+        table.push([
+          finding.id,
+          `${finding.title} (${finding.rule_id})`,
+          sev.toUpperCase(),
+          finding.resource_id || "n/a"
+        ]);
+      }
+      console.log(table.toString());
+      console.log();
+      console.log(`${findings.length} recommendations (${high} High, ${medium} Medium, ${low} Low)`);
+      console.log(source_default.dim("Run `rivora optimize get <id>` for details or `rivora optimize plan <id>` for remediation steps."));
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to fetch optimization recommendations");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    if (error instanceof Error) {
+      console.error(source_default.red("Error:"), error.message);
+    }
+    process.exit(1);
+  }
+});
+optimizeCommand.command("get").description("Get optimization recommendation details").argument("<id>", "Finding ID").option("--json", "Output as JSON").action(async (id, options) => {
+  try {
+    const token = await ensureAuthDrift();
+    const findingId = await resolveOptimizationFindingId(token, id);
+    const spinner = ora("Fetching recommendation details...").start();
+    try {
+      const response = await restClient.get(`/findings/${findingId}`, { headers: { Authorization: `Bearer ${token}` } });
+      spinner.succeed("Recommendation loaded");
+      if (options.json) {
+        console.log(JSON.stringify(response.data, null, 2));
+        return;
+      }
+      const finding = response.data;
+      console.log();
+      console.log(source_default.bold(`\u26A1 ${finding.title}`));
+      console.log(source_default.dim(`ID: ${finding.id}`));
+      console.log(source_default.dim(`Rule: ${finding.rule_id}`));
+      console.log(source_default.dim(`Impact: ${(finding.severity || "").toUpperCase()}`));
+      console.log(source_default.dim(`Resource: ${finding.resource_type || "unknown"}/${finding.resource_id || "unknown"}`));
+      console.log();
+      console.log(finding.description);
+      if (finding.recommendation) {
+        console.log();
+        console.log(source_default.bold("Recommendation"));
+        console.log(finding.recommendation);
+      }
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to fetch recommendation");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    if (error instanceof Error) {
+      console.error(source_default.red("Error:"), error.message);
+    }
+    process.exit(1);
+  }
+});
+optimizeCommand.command("plan").description("Generate remediation plan for an optimization recommendation").argument("<id>", "Finding ID").option("--format <format>", "Output format (cli, terraform, json)", "cli").option("--json", "Output as JSON").action(async (id, options) => {
+  try {
+    const token = await ensureAuthDrift();
+    const findingId = await resolveOptimizationFindingId(token, id);
+    const spinner = ora("Generating optimization plan...").start();
+    try {
+      const response = await restClient.post(`/findings/${findingId}/plan`, { format: options.format }, { headers: { Authorization: `Bearer ${token}` } });
+      spinner.succeed("Plan generated");
+      if (options.json) {
+        console.log(JSON.stringify(response.data, null, 2));
+        return;
+      }
+      const plan = response.data;
+      console.log();
+      console.log(source_default.bold(`Plan ${plan.id}`));
+      console.log(source_default.dim(`Finding: ${plan.finding_id}`));
+      console.log();
+      if (plan.steps && plan.steps.length > 0) {
+        for (const [idx, step] of plan.steps.entries()) {
+          console.log(`${idx + 1}. ${step}`);
+        }
+      } else {
+        console.log(source_default.dim("No plan steps returned."));
+      }
+      console.log();
+    } catch (error) {
+      spinner.fail("Failed to generate plan");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    if (error instanceof Error) {
+      console.error(source_default.red("Error:"), error.message);
+    }
+    process.exit(1);
+  }
+});
+optimizeCommand.command("dismiss").description("Dismiss an optimization recommendation").argument("<id>", "Finding ID").requiredOption("--reason <reason>", "Reason for dismissing").action(async (id, options) => {
+  try {
+    const token = await ensureAuthDrift();
+    const findingId = await resolveOptimizationFindingId(token, id);
+    const spinner = ora("Dismissing recommendation...").start();
+    try {
+      await restClient.post(`/findings/${findingId}/status?status=ignored`, {}, { headers: { Authorization: `Bearer ${token}` } });
+      spinner.succeed("Recommendation dismissed");
+      console.log(source_default.dim(`Reason: ${options.reason}`));
+    } catch (error) {
+      spinner.fail("Failed to dismiss recommendation");
+      console.error(source_default.red(error.message));
+      process.exit(1);
+    }
+  } catch (error) {
+    if (error instanceof Error) {
+      console.error(source_default.red("Error:"), error.message);
+    }
+    process.exit(1);
+  }
+});
+var ConnectedProvider = /* @__PURE__ */ (() => {
+  return function ConnectedProvider(name, type, connected) {
+    this.name = name;
+    this.type = type;
+    this.connected = connected;
+  };
+})();
+var AgentMessage = /* @__PURE__ */ (() => {
+  return function AgentMessage(role, content, name) {
+    this.role = role;
+    this.content = content;
+    if (name !== undefined) {
+      this.name = name;
+    }
+  };
+})();
+var AgentSession = /* @__PURE__ */ (() => {
+  function AgentSession2() {
+    this.messages = [];
+    this.recentFindings = [];
+    this.connectedProviders = [];
+    this.loadConnectedProviders();
+  }
+  AgentSession2.prototype.loadConnectedProviders = function() {
+    var providers = [];
+    var config = configManager.getConfig();
+    if (config.cloud && config.cloud.aws) {
+      providers.push(new ConnectedProvider("AWS", "aws", true));
+    }
+    if (config.cloud && config.cloud.k8s) {
+      providers.push(new ConnectedProvider("Kubernetes", "k8s", true));
+    }
+    if (config.cloud && config.cloud.slack) {
+      providers.push(new ConnectedProvider("Slack", "slack", configManager.isSlackConnected()));
+    }
+    if (config.cloud && config.cloud.linear) {
+      providers.push(new ConnectedProvider("Linear", "linear", configManager.isLinearConnected()));
+    }
+    if (config.cloud && config.cloud.github) {
+      providers.push(new ConnectedProvider("GitHub", "github", configManager.isGitHubConnected()));
+    }
+    if (config.cloud && config.cloud.agent) {
+      providers.push(new ConnectedProvider("Agent", "agent", configManager.isAgentDeployed()));
+    }
+    this.connectedProviders = providers;
+  };
+  AgentSession2.prototype.addMessage = function(role, content, name) {
+    var message2 = new AgentMessage(role, content);
+    if (name !== undefined) {
+      message2.name = name;
+    }
+    this.messages.push(message2);
+  };
+  AgentSession2.prototype.getMessages = function() {
+    return this.messages.slice(0);
+  };
+  AgentSession2.prototype.truncate = function(maxMessages) {
+    var systemMessages = this.messages.filter(function(m) {
+      return m.role === "system";
+    });
+    var nonSystemMessages = this.messages.filter(function(m) {
+      return m.role !== "system";
+    });
+    var keepCount = Math.min(maxMessages - systemMessages.length, nonSystemMessages.length);
+    var recentNonSystem = nonSystemMessages.slice(-keepCount);
+    this.messages = systemMessages.concat(recentNonSystem);
+  };
+  AgentSession2.prototype.reset = function() {
+    this.messages = [];
+    this.recentFindings = [];
+    this.loadConnectedProviders();
+  };
+  AgentSession2.prototype.addFinding = function(findingId) {
+    if (!this.recentFindings.includes(findingId)) {
+      this.recentFindings.push(findingId);
+    }
+  };
+  AgentSession2.prototype.getRecentFindings = function() {
+    return this.recentFindings.slice(0);
+  };
+  AgentSession2.prototype.getConnectedProviders = function() {
+    return this.connectedProviders.slice(0);
+  };
+  AgentSession2.prototype.getSystemPrompt = function() {
+    var connectedList = this.connectedProviders.filter(function(p) {
+      return p.connected;
+    }).map(function(p) {
+      return p.name;
+    }).join(", ");
+    var findingsContext = this.recentFindings.length > 0 ? `
+
+Recent finding IDs in session: ` + this.recentFindings.join(", ") : "";
+    return `You are Rivora, an AI assistant that helps manage cloud security and infrastructure.
+
+Connected providers: ` + (connectedList || "None") + findingsContext;
+  };
+  return AgentSession2;
+})();
+var AgentRenderer = /* @__PURE__ */ (() => {
+  function AgentRenderer2() {
+    this.spinner = null;
+  }
+  AgentRenderer2.prototype.renderResponse = function(result) {
+    switch (result.status) {
+      case "completed":
+        this.renderCompleted(result.message || "", result.iterations);
+        break;
+      case "approval_required":
+        this.renderApprovalRequired(result.pending_tool, result.message || "");
+        break;
+      case "failed":
+        this.renderError(result.message || "Unknown error", result.iterations);
+        break;
+      case "message":
+        if (result.message) {
+          console.log(result.message);
+        }
+        break;
+    }
+  };
+  AgentRenderer2.prototype.renderCompleted = function(message2, iterations) {
+    console.log();
+    console.log(source_default.bold.green("\u2713 Agent Completed"));
+    console.log(source_default.dim("\u2500".repeat(60)));
+    console.log();
+    console.log(message2);
+    console.log();
+    if (iterations !== undefined) {
+      console.log(source_default.dim("Iterations: " + iterations));
+    }
+  };
+  AgentRenderer2.prototype.renderApprovalRequired = function(pendingTool, message2) {
+    console.log();
+    console.log(source_default.bold.yellow("\u26A0\uFE0F  Approval Required"));
+    console.log(source_default.dim("\u2500".repeat(60)));
+    console.log();
+    console.log(source_default.bold("Skill:") + " " + pendingTool.skill);
+    console.log(source_default.bold("Risk Level:") + " " + this.getRiskColor(pendingTool.risk));
+    console.log(source_default.bold("Call ID:") + " " + source_default.cyan(pendingTool.call_id));
+    console.log();
+    console.log(source_default.bold("Arguments:"));
+    var __loop = function(key2) {
+      console.log("  " + source_default.dim(key2) + ": " + JSON.stringify(pendingTool.args[key2]));
+    };
+    for (var key in pendingTool.args) {
+      __loop(key);
+    }
+    console.log();
+    if (message2) {
+      console.log(source_default.bold("Message:"));
+      console.log("  " + message2);
+      console.log();
+    }
+    console.log(source_default.dim("\u2500".repeat(60)));
+    console.log(source_default.yellow("To approve this action, use the approval endpoint"));
+    console.log();
+  };
+  AgentRenderer2.prototype.renderError = function(message2, iterations) {
+    console.log();
+    console.log(source_default.bold.red("\u2717 Agent Failed"));
+    console.log(source_default.dim("\u2500".repeat(60)));
+    console.log();
+    console.log(source_default.red(message2));
+    console.log();
+    if (iterations !== undefined) {
+      console.log(source_default.dim("Iterations: " + iterations));
+    }
+  };
+  AgentRenderer2.prototype.getRiskColor = function(risk) {
+    switch (risk) {
+      case "low":
+        return source_default.blue("LOW");
+      case "medium":
+        return source_default.yellow("MEDIUM");
+      case "high":
+        return source_default.red.bold("HIGH");
+      default:
+        return risk;
+    }
+  };
+  return AgentRenderer2;
+})();
+var AVAILABLE_PRESETS = ["security-sweep", "reliability-audit", "drift-detection"];
+var AgentREPL = /* @__PURE__ */ (() => {
+  function AgentREPL2(session, renderer) {
+    this.rl = null;
+    this.spinner = null;
+    this.running = false;
+    this.session = session;
+    this.renderer = renderer;
+  }
+  AgentREPL2.prototype.start = async function() {
+    await this.ensureAuthenticated();
+    this.running = true;
+    console.log();
+    console.log(source_default.bold.cyan("\uD83E\uDD16 Rivora Agent REPL"));
+    console.log(source_default.dim("\u2500".repeat(60)));
+    console.log();
+    console.log(source_default.dim("Type /help for available commands"));
+    console.log();
+    var rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    this.rl = rl;
+    await this.replLoop();
+  };
+  AgentREPL2.prototype.replLoop = async function() {
+    while (this.running) {
+      try {
+        var input = await this.prompt();
+        if (!input) {
+          continue;
+        }
+        var trimmed = input.trim();
+        if (this.isExitCommand(trimmed)) {
+          this.exit();
+          break;
+        }
+        if (trimmed.startsWith("/")) {
+          await this.handleCommand(trimmed);
+        } else {
+          await this.runOneShot(trimmed);
+        }
+      } catch (error) {
+        if (error.message === "EXIT") {
+          this.exit();
+          break;
+        }
+        console.error(source_default.red("Error: " + error.message));
+      }
+    }
+  };
+  AgentREPL2.prototype.prompt = function() {
+    var self2 = this;
+    return new Promise(function(resolve2) {
+      self2.rl.question("rivora> ", function(answer) {
+        resolve2(answer);
+      });
+    });
+  };
+  AgentREPL2.prototype.isExitCommand = function(input) {
+    var cmd = input.toLowerCase();
+    return cmd === "/exit" || cmd === "/quit";
+  };
+  AgentREPL2.prototype.exit = function() {
+    this.running = false;
+    console.log(source_default.dim(`
+Goodbye!`));
+    if (this.rl) {
+      this.rl.close();
+    }
+    process.exit(0);
+  };
+  AgentREPL2.prototype.handleCommand = async function(input) {
+    var parts = input.split(/\s+/);
+    var command = (parts[0] || "").toLowerCase();
+    var args = parts.slice(1).join(" ");
+    switch (command) {
+      case "/help":
+        this.showHelp();
+        break;
+      case "/preset":
+        if (!args) {
+          console.log(source_default.yellow("Usage: /preset <name>"));
+          console.log(source_default.dim("Available presets: " + AVAILABLE_PRESETS.join(", ")));
+        } else {
+          await this.runPreset(args);
+        }
+        break;
+      case "/clear":
+        this.session.reset();
+        console.log(source_default.green("Session cleared"));
+        break;
+      case "/exit":
+      case "/quit":
+        this.exit();
+        break;
+      default:
+        console.log(source_default.yellow("Unknown command: " + command));
+        console.log(source_default.dim("Type /help for available commands"));
+    }
+  };
+  AgentREPL2.prototype.showHelp = function() {
+    console.log();
+    console.log(source_default.bold("Available Commands:"));
+    console.log(source_default.dim("\u2500".repeat(40)));
+    console.log("  " + source_default.cyan("/help") + "              Show this help message");
+    console.log("  " + source_default.cyan("/preset <name>") + "     Run a preset (" + AVAILABLE_PRESETS.join(", ") + ")");
+    console.log("  " + source_default.cyan("/clear") + "            Clear the session");
+    console.log("  " + source_default.cyan("/exit") + "             Exit the REPL");
+    console.log("  " + source_default.cyan("/quit") + "             Exit the REPL");
+    console.log();
+  };
+  AgentREPL2.prototype.runOneShot = async function(query) {
+    await this.ensureAuthenticated();
+    var spinner = ora("Thinking...").start();
+    try {
+      var result = await this.sendMessage(query);
+      spinner.stop();
+      await this.handleAgentResponse(result);
+    } catch (error) {
+      spinner.fail("Request failed");
+      throw error;
+    }
+  };
+  AgentREPL2.prototype.runPreset = async function(presetName) {
+    await this.ensureAuthenticated();
+    if (!AVAILABLE_PRESETS.includes(presetName)) {
+      console.log(source_default.yellow("Unknown preset: " + presetName));
+      console.log(source_default.dim("Available presets: " + AVAILABLE_PRESETS.join(", ")));
+      return;
+    }
+    var spinner = ora("Running preset: " + presetName + "...").start();
+    try {
+      var result = await restClient.sendAgentMessage({
+        message: "Run the " + presetName + " preset",
+        preset: presetName,
+        messages: [{ role: "system", content: this.session.getSystemPrompt() }]
+      });
+      spinner.stop();
+      await this.handleAgentResponse(result);
+    } catch (error) {
+      spinner.fail("Preset execution failed");
+      throw error;
+    }
+  };
+  AgentREPL2.prototype.sendMessage = async function(message2, approvals) {
+    var messages = this.session.getMessages();
+    if (messages.length === 0) {
+      this.session.addMessage("system", this.session.getSystemPrompt());
+    }
+    this.session.addMessage("user", message2);
+    var result = await restClient.sendAgentMessage({
+      message: message2,
+      messages: this.session.getMessages(),
+      approvals
+    });
+    if (result.messages) {
+      var __loop2 = function(msg) {
+        if (msg.role !== "user" && msg.role !== "system") {
+          this2.session.addMessage(msg.role, msg.content, msg.name);
+        }
+      };
+      var this2 = this;
+      for (var __i2 = 0;__i2 < result.messages.length; __i2++) {
+        __loop2(result.messages[__i2]);
+      }
+    }
+    return result;
+  };
+  AgentREPL2.prototype.handleAgentResponse = async function(result) {
+    switch (result.status) {
+      case "completed":
+        this.renderer.renderCompleted(result.message, result.iterations);
+        break;
+      case "approval_required":
+        await this.handleApprovalRequired(result.pending_tool, result.message);
+        break;
+      case "failed":
+        this.renderer.renderError(result.message, result.iterations);
+        break;
+      default:
+        if (result.message) {
+          console.log(result.message);
+        }
+    }
+  };
+  AgentREPL2.prototype.handleApprovalRequired = async function(pendingTool, message2) {
+    this.renderer.renderApprovalRequired(pendingTool, message2);
+    var approvalRetries = 0;
+    var maxRetries = 3;
+    while (approvalRetries < maxRetries) {
+      var approved = await this.promptApproval(pendingTool);
+      var spinner = ora("Submitting " + (approved ? "approval" : "denial") + "...").start();
+      try {
+        var result = await this.sendMessage("", [
+          { call_id: pendingTool.call_id, approved }
+        ]);
+        spinner.stop();
+        if (result.status === "completed") {
+          this.renderer.renderCompleted(result.message, result.iterations);
+          return;
+        } else if (result.status === "approval_required") {
+          approvalRetries++;
+          if (approvalRetries >= maxRetries) {
+            console.log(source_default.yellow("Max approval retries reached"));
+            return;
+          }
+          await this.handleApprovalRequired(result.pending_tool, result.message);
+          return;
+        } else if (result.status === "failed") {
+          this.renderer.renderError(result.message, result.iterations);
+          return;
+        }
+      } catch (error) {
+        spinner.fail("Failed to submit approval");
+        throw error;
+      }
+    }
+  };
+  AgentREPL2.prototype.promptApproval = function(pendingTool) {
+    var self2 = this;
+    return new Promise(function(resolve2) {
+      var riskColor = pendingTool.risk === "high" ? source_default.red : pendingTool.risk === "medium" ? source_default.yellow : source_default.blue;
+      process.stdout.write(source_default.bold("Skill:") + " " + pendingTool.skill + " " + source_default.dim("|") + " " + source_default.bold("Risk:") + riskColor(pendingTool.risk.toUpperCase()) + `
+`);
+      process.stdout.write(source_default.bold("Approve? (y/n) "));
+      self2.rl.question("", function(answer) {
+        var trimmed = answer.trim().toLowerCase();
+        if (trimmed === "y" || trimmed === "yes") {
+          resolve2(true);
+        } else {
+          resolve2(false);
+        }
+      });
+    });
+  };
+  AgentREPL2.prototype.ensureAuthenticated = async function() {
+    var isAuth = await authService.isAuthenticated();
+    if (!isAuth) {
+      console.log(source_default.yellow("\u26A0\uFE0F  Authentication required"));
+      console.log(source_default.dim("   Run: rivora auth login"));
+      throw new Error("EXIT");
+    }
+  };
+  return AgentREPL2;
+})();
+var VALID_PRESETS = ["security-sweep", "reliability-audit", "drift-detection"];
+var VALID_MODELS = ["qwen3-30b", "glm-flash", "llama-70b"];
+var agentCommand = new Command2("agent").description("Start an interactive AI agent or run a query/preset").argument("[query]", "One-shot query to run").option("-p, --preset <name>", `Run a preset (${VALID_PRESETS.join(", ")})`).option("-m, --model <model>", `Model to use (${VALID_MODELS.join(", ")})`).option("--json", "Output as JSON (for one-shot mode)").action(async (query, options) => {
+  try {
+    if (!authService.isAuthenticated()) {
+      console.log(source_default.yellow("\u26A0\uFE0F  Authentication required"));
+      console.log(source_default.dim("   Run: rivora auth login"));
+      process.exit(1);
+    }
+    const session = new AgentSession;
+    const renderer = new AgentRenderer;
+    const repl = new AgentREPL(session, renderer);
+    if (query && query.trim()) {
+      const spinner = ora("Processing query...").start();
+      try {
+        await repl.runOneShot(query);
+        spinner.succeed("Query completed");
+      } catch (error) {
+        spinner.fail("Query failed");
+        console.error(source_default.red(error.message));
+        process.exit(1);
+      }
+    } else if (options.preset) {
+      const presetName = options.preset;
+      if (!VALID_PRESETS.includes(presetName)) {
+        console.error(source_default.red(`Invalid preset: ${presetName}`));
+        console.log(source_default.dim(`Valid presets: ${VALID_PRESETS.join(", ")}`));
+        process.exit(1);
+      }
+      const spinner = ora(`Running preset: ${presetName}...`).start();
+      try {
+        await repl.runPreset(presetName);
+        spinner.succeed("Preset completed");
+      } catch (error) {
+        spinner.fail("Preset execution failed");
+        console.error(source_default.red(error.message));
+        process.exit(1);
+      }
+    } else {
+      await repl.start();
+    }
+  } catch (error) {
+    if (error instanceof Error) {
+      console.error(source_default.red("Error:"), error.message);
+    }
+    process.exit(1);
+  }
+});
 var program3 = new Command;
-program3.name("rivora").description("Rivora - Infrastructure Intelligence Layer").version(version2).addCommand(authCommand).addCommand(connectCommand).addCommand(inventoryCommand).addCommand(findingsCommand).addCommand(planCommand).addCommand(remediateCommand).addCommand(helpCommand).addCommand(regionsCommand).addCommand(slackCommand).addCommand(ciCommand).addCommand(updateCommand).addCommand(modelsCommand).addCommand(adminCommand).addCommand(argocdCommand).addCommand(driftCommand).addCommand(backlogCommand).addCommand(rcaCommand);
+program3.name("rivora").description("Rivora - Infrastructure Intelligence Layer").version(version2).addCommand(authCommand).addCommand(connectCommand).addCommand(inventoryCommand).addCommand(findingsCommand).addCommand(planCommand).addCommand(remediateCommand).addCommand(helpCommand).addCommand(regionsCommand).addCommand(slackCommand).addCommand(ciCommand).addCommand(updateCommand).addCommand(modelsCommand).addCommand(adminCommand).addCommand(argocdCommand).addCommand(driftCommand).addCommand(backlogCommand).addCommand(rcaCommand).addCommand(optimizeCommand).addCommand(agentCommand);
 if (process.env.RIVORA_INTERNAL === "1") {
   program3.addCommand(trainingCommand);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rivora/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Rivora CLI - Infrastructure Intelligence Layer",
   "main": "dist/index.js",
   "module": "dist/index.js",