@testchimp/cli 0.1.14 → 0.1.15

package/dist/cli/program.js

@@ -634,39 +634,69 @@ export function buildCliProgram() {
         console.log(out);
     });
     program
-        .command("run-sast-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-sast-scan").description)
+        .command("report-sast-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-sast-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Semgrep CLI JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-sast-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-sast-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program
-        .command("run-deps-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-deps-scan").description)
+        .command("report-secrets-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-secrets-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Gitleaks JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-deps-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-secrets-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program
-        .command("run-secrets-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-secrets-scan").description)
+        .command("report-deps-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-deps-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Trivy JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-secrets-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-deps-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program

package/dist/core/schemas.d.ts

@@ -577,8 +577,17 @@ export declare const reportDastFindingsInput: z.ZodObject<{
     id: z.ZodString;
     reportFile: z.ZodString;
 }, z.core.$strip>;
-export declare const stubSecurityScanInput: z.ZodObject<{
-    id: z.ZodOptional<z.ZodString>;
+export declare const reportSastFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportSecretsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportDepsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
 }, z.core.$strip>;
 /** UpsertScreenStatesRequest JSON (proto camelCase). */
 export declare const upsertScreenStatesInput: z.ZodObject<{

package/dist/core/schemas.js

@@ -252,8 +252,20 @@ export const reportDastFindingsInput = z.object({
     /** Path to ZAP Traditional JSON report file */
     reportFile: z.string().min(1),
 });
-export const stubSecurityScanInput = z.object({
-    id: z.string().min(1).optional(),
+export const reportSastFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Semgrep CLI JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportSecretsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Gitleaks JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportDepsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Trivy JSON report file */
+    reportFile: z.string().min(1),
 });
 const screenStatesEntrySchema = z.object({
     screen: z.string().optional(),

package/dist/core/tools.js

@@ -481,8 +481,10 @@ export const TOOL_DEFINITIONS = [
     },
     {
         kebab: "get-security-scan-config",
-        description: "Fetch security scan config by scan id (categories, environment, release label, status). " +
-            "Pass id (CLI: --id). Used by /testchimp run security scan.",
+        description: "Fetch security scan config by scan id (detail.dastCheckConfig / detail.sastCheckConfig / " +
+            "detail.depsCheckConfig / detail.leaksCheckConfig, release label, status). Pass id (CLI: --id). " +
+            "Used by /testchimp run security scan. For DAST honour allowActiveScan / useEphemeralSandbox / scope " +
+            "on dastCheckConfig.",
         inputSchema: S.getSecurityScanConfigInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -492,7 +494,8 @@ export const TOOL_DEFINITIONS = [
     {
         kebab: "update-scan-progress",
         description: "Update a scan's status. status must be one of: QUEUED, IN_PROGRESS, COMPLETED, EXCEPTION. " +
-            "Call IN_PROGRESS when starting; COMPLETED when all selected categories finish; EXCEPTION on hard failure.",
+            "Call IN_PROGRESS when starting. Each scan is a single checker type: the category playbook " +
+            "sets COMPLETED after a successful report-*-findings (or EXCEPTION on hard failure).",
         inputSchema: S.updateScanProgressInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -506,7 +509,7 @@ export const TOOL_DEFINITIONS = [
         kebab: "report-dast-findings",
         description: "Upload a ZAP Traditional JSON report for a security scan. Pass --id and --report-file <path>. " +
             "Backend parses alerts, dedupes by bug hash, and inserts new SECURITY bugs linked to the scan. " +
-            "Does not mark the scan COMPLETED.",
+            "Does not mark the scan COMPLETED — the DAST playbook calls update-scan-progress COMPLETED after this.",
         inputSchema: S.reportDastFindingsInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -519,22 +522,52 @@ export const TOOL_DEFINITIONS = [
         },
     },
     {
-        kebab: "run-sast-scan",
-        description: "Stub: Semgrep SAST scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-sast-scan" }),
+        kebab: "report-sast-findings",
+        description: "Upload a full Semgrep CLI JSON report for a SAST security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the raw report, parses results, dedupes by bug hash, and inserts new SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the SAST playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSastFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_sast_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
-        kebab: "run-deps-scan",
-        description: "Stub: Trivy dependency scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-deps-scan" }),
+        kebab: "report-secrets-findings",
+        description: "Upload a full Gitleaks JSON report for a secrets security scan. Pass --id and --report-file <path>. " +
+            "Backend redacts secret payloads, stores the report, dedupes by bug hash, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the secrets playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSecretsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_secrets_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
-        kebab: "run-secrets-scan",
-        description: "Stub: Gitleaks secrets scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-secrets-scan" }),
+        kebab: "report-deps-findings",
+        description: "Upload a full Trivy JSON report for a dependency security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the report, filters by security profile / ignore-unfixed, dedupes, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the deps playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportDepsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_deps_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
         kebab: "upsert-screen-states",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",