@testchimp/cli 0.1.13 → 0.1.14

package/dist/cli/program.js

@@ -573,6 +573,102 @@ export function buildCliProgram() {
         const out = await runTool("get-release", { version: String(merged.version).trim() }, { postMcp });
         console.log(out);
     });
+    program
+        .command("get-security-scan-config")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "get-security-scan-config").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required (--id or --json-input {\"id\":\"...\"})");
+        }
+        const out = await runTool("get-security-scan-config", { id: String(merged.id).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("update-scan-progress")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "update-scan-progress").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--status <status>", "QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.status)
+            body.status = String(opts.status);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.status || String(merged.status).trim() === "") {
+            throw new Error("status is required (QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION)");
+        }
+        const out = await runTool("update-scan-progress", { id: String(merged.id).trim(), status: String(merged.status).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("report-dast-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-dast-findings").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to ZAP Traditional JSON report")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-dast-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("run-sast-scan")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-sast-scan").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        const out = await runTool("run-sast-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        console.log(out);
+    });
+    program
+        .command("run-deps-scan")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-deps-scan").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        const out = await runTool("run-deps-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        console.log(out);
+    });
+    program
+        .command("run-secrets-scan")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-secrets-scan").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        const out = await runTool("run-secrets-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        console.log(out);
+    });
     program
         .command("upsert-screen-states")
         .description(TOOL_DEFINITIONS.find((t) => t.kebab === "upsert-screen-states").description)

package/dist/core/schemas.d.ts

@@ -561,6 +561,25 @@ export declare const listScreenStatesInput: z.ZodObject<{
 export declare const getReleaseInput: z.ZodObject<{
     version: z.ZodString;
 }, z.core.$strip>;
+export declare const getSecurityScanConfigInput: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const updateScanProgressInput: z.ZodObject<{
+    id: z.ZodString;
+    status: z.ZodEnum<{
+        QUEUED: "QUEUED";
+        IN_PROGRESS: "IN_PROGRESS";
+        COMPLETED: "COMPLETED";
+        EXCEPTION: "EXCEPTION";
+    }>;
+}, z.core.$strip>;
+export declare const reportDastFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const stubSecurityScanInput: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /** UpsertScreenStatesRequest JSON (proto camelCase). */
 export declare const upsertScreenStatesInput: z.ZodObject<{
     screenStates: z.ZodArray<z.ZodObject<{

package/dist/core/schemas.js

@@ -239,6 +239,22 @@ export const getReleaseInput = z.object({
     /** Release catalog version / label — maps to McpGetReleaseRequest.version */
     version: z.string().min(1),
 });
+export const getSecurityScanConfigInput = z.object({
+    id: z.string().min(1),
+});
+export const updateScanProgressInput = z.object({
+    id: z.string().min(1),
+    /** ScanStatus enum name: QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION */
+    status: z.enum(["QUEUED", "IN_PROGRESS", "COMPLETED", "EXCEPTION"]),
+});
+export const reportDastFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to ZAP Traditional JSON report file */
+    reportFile: z.string().min(1),
+});
+export const stubSecurityScanInput = z.object({
+    id: z.string().min(1).optional(),
+});
 const screenStatesEntrySchema = z.object({
     screen: z.string().optional(),
     states: z.array(z.string()),

package/dist/core/tools.js

@@ -479,6 +479,63 @@ export const TOOL_DEFINITIONS = [
             return postMcp("/api/mcp/get_release", body);
         },
     },
+    {
+        kebab: "get-security-scan-config",
+        description: "Fetch security scan config by scan id (categories, environment, release label, status). " +
+            "Pass id (CLI: --id). Used by /testchimp run security scan.",
+        inputSchema: S.getSecurityScanConfigInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/get_security_scan_config", { scanId: a.id.trim() });
+        },
+    },
+    {
+        kebab: "update-scan-progress",
+        description: "Update a scan's status. status must be one of: QUEUED, IN_PROGRESS, COMPLETED, EXCEPTION. " +
+            "Call IN_PROGRESS when starting; COMPLETED when all selected categories finish; EXCEPTION on hard failure.",
+        inputSchema: S.updateScanProgressInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/update_scan_progress", {
+                scanId: a.id.trim(),
+                status: a.status,
+            });
+        },
+    },
+    {
+        kebab: "report-dast-findings",
+        description: "Upload a ZAP Traditional JSON report for a security scan. Pass --id and --report-file <path>. " +
+            "Backend parses alerts, dedupes by bug hash, and inserts new SECURITY bugs linked to the scan. " +
+            "Does not mark the scan COMPLETED.",
+        inputSchema: S.reportDastFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_dast_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
+    },
+    {
+        kebab: "run-sast-scan",
+        description: "Stub: Semgrep SAST scan is not implemented yet.",
+        inputSchema: S.stubSecurityScanInput,
+        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-sast-scan" }),
+    },
+    {
+        kebab: "run-deps-scan",
+        description: "Stub: Trivy dependency scan is not implemented yet.",
+        inputSchema: S.stubSecurityScanInput,
+        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-deps-scan" }),
+    },
+    {
+        kebab: "run-secrets-scan",
+        description: "Stub: Gitleaks secrets scan is not implemented yet.",
+        inputSchema: S.stubSecurityScanInput,
+        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-secrets-scan" }),
+    },
     {
         kebab: "upsert-screen-states",
         description: "Merge screen names and state strings into the project's relational atlas (idempotent upsert). " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",