@testchimp/cli 0.1.13 → 0.1.15

package/dist/cli/program.js

@@ -573,6 +573,132 @@ export function buildCliProgram() {
         const out = await runTool("get-release", { version: String(merged.version).trim() }, { postMcp });
         console.log(out);
     });
+    program
+        .command("get-security-scan-config")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "get-security-scan-config").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required (--id or --json-input {\"id\":\"...\"})");
+        }
+        const out = await runTool("get-security-scan-config", { id: String(merged.id).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("update-scan-progress")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "update-scan-progress").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--status <status>", "QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.status)
+            body.status = String(opts.status);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.status || String(merged.status).trim() === "") {
+            throw new Error("status is required (QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION)");
+        }
+        const out = await runTool("update-scan-progress", { id: String(merged.id).trim(), status: String(merged.status).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("report-dast-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-dast-findings").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to ZAP Traditional JSON report")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-dast-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("report-sast-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-sast-findings").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Semgrep CLI JSON report")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-sast-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("report-secrets-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-secrets-findings").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Gitleaks JSON report")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-secrets-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("report-deps-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-deps-findings").description)
+        .addOption(jsonInputOption())
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Trivy JSON report")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.id)
+            body.id = String(opts.id);
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-deps-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
+        console.log(out);
+    });
     program
         .command("upsert-screen-states")
         .description(TOOL_DEFINITIONS.find((t) => t.kebab === "upsert-screen-states").description)

package/dist/core/schemas.d.ts

@@ -561,6 +561,34 @@ export declare const listScreenStatesInput: z.ZodObject<{
 export declare const getReleaseInput: z.ZodObject<{
     version: z.ZodString;
 }, z.core.$strip>;
+export declare const getSecurityScanConfigInput: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const updateScanProgressInput: z.ZodObject<{
+    id: z.ZodString;
+    status: z.ZodEnum<{
+        QUEUED: "QUEUED";
+        IN_PROGRESS: "IN_PROGRESS";
+        COMPLETED: "COMPLETED";
+        EXCEPTION: "EXCEPTION";
+    }>;
+}, z.core.$strip>;
+export declare const reportDastFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportSastFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportSecretsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportDepsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
 /** UpsertScreenStatesRequest JSON (proto camelCase). */
 export declare const upsertScreenStatesInput: z.ZodObject<{
     screenStates: z.ZodArray<z.ZodObject<{

package/dist/core/schemas.js

@@ -239,6 +239,34 @@ export const getReleaseInput = z.object({
     /** Release catalog version / label — maps to McpGetReleaseRequest.version */
     version: z.string().min(1),
 });
+export const getSecurityScanConfigInput = z.object({
+    id: z.string().min(1),
+});
+export const updateScanProgressInput = z.object({
+    id: z.string().min(1),
+    /** ScanStatus enum name: QUEUED | IN_PROGRESS | COMPLETED | EXCEPTION */
+    status: z.enum(["QUEUED", "IN_PROGRESS", "COMPLETED", "EXCEPTION"]),
+});
+export const reportDastFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to ZAP Traditional JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportSastFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Semgrep CLI JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportSecretsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Gitleaks JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportDepsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Trivy JSON report file */
+    reportFile: z.string().min(1),
+});
 const screenStatesEntrySchema = z.object({
     screen: z.string().optional(),
     states: z.array(z.string()),

package/dist/core/tools.js

@@ -479,6 +479,96 @@ export const TOOL_DEFINITIONS = [
             return postMcp("/api/mcp/get_release", body);
         },
     },
+    {
+        kebab: "get-security-scan-config",
+        description: "Fetch security scan config by scan id (detail.dastCheckConfig / detail.sastCheckConfig / " +
+            "detail.depsCheckConfig / detail.leaksCheckConfig, release label, status). Pass id (CLI: --id). " +
+            "Used by /testchimp run security scan. For DAST honour allowActiveScan / useEphemeralSandbox / scope " +
+            "on dastCheckConfig.",
+        inputSchema: S.getSecurityScanConfigInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/get_security_scan_config", { scanId: a.id.trim() });
+        },
+    },
+    {
+        kebab: "update-scan-progress",
+        description: "Update a scan's status. status must be one of: QUEUED, IN_PROGRESS, COMPLETED, EXCEPTION. " +
+            "Call IN_PROGRESS when starting. Each scan is a single checker type: the category playbook " +
+            "sets COMPLETED after a successful report-*-findings (or EXCEPTION on hard failure).",
+        inputSchema: S.updateScanProgressInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/update_scan_progress", {
+                scanId: a.id.trim(),
+                status: a.status,
+            });
+        },
+    },
+    {
+        kebab: "report-dast-findings",
+        description: "Upload a ZAP Traditional JSON report for a security scan. Pass --id and --report-file <path>. " +
+            "Backend parses alerts, dedupes by bug hash, and inserts new SECURITY bugs linked to the scan. " +
+            "Does not mark the scan COMPLETED — the DAST playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportDastFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_dast_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
+    },
+    {
+        kebab: "report-sast-findings",
+        description: "Upload a full Semgrep CLI JSON report for a SAST security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the raw report, parses results, dedupes by bug hash, and inserts new SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the SAST playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSastFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_sast_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
+    },
+    {
+        kebab: "report-secrets-findings",
+        description: "Upload a full Gitleaks JSON report for a secrets security scan. Pass --id and --report-file <path>. " +
+            "Backend redacts secret payloads, stores the report, dedupes by bug hash, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the secrets playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSecretsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_secrets_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
+    },
+    {
+        kebab: "report-deps-findings",
+        description: "Upload a full Trivy JSON report for a dependency security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the report, filters by security profile / ignore-unfixed, dedupes, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the deps playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportDepsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_deps_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
+    },
     {
         kebab: "upsert-screen-states",
         description: "Merge screen names and state strings into the project's relational atlas (idempotent upsert). " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",