@testchimp/cli 0.1.14 → 0.1.16

package/dist/cli/program.js

@@ -269,6 +269,53 @@ export function buildCliProgram() {
         const out = await runTool("get-manual-session-details", merged, { postMcp });
         console.log(out);
     });
+    program
+        .command("get-issue-details")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "get-issue-details").description)
+        .addOption(jsonInputOption())
+        .option("--issue-id <id>", "Issue ordinal id (#B-123, B-123, B123, or 123)")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.issueId)
+            body.issueId = String(opts.issueId).trim();
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.issueId || String(merged.issueId).trim() === "") {
+            throw new Error("issueId is required (--issue-id)");
+        }
+        const out = await runTool("get-issue-details", { issueId: String(merged.issueId).trim() }, { postMcp });
+        console.log(out);
+    });
+    program
+        .command("update-issue-status")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "update-issue-status").description)
+        .addOption(jsonInputOption())
+        .option("--issue-id <id>", "Issue ordinal id (#B-123, B-123, B123, or 123)")
+        .option("--status <status>", "ACTIVE | IGNORED | FIXED | DUPLICATE | IN_PROGRESS_BUG | ARCHIVED_BUG | BLOCKED")
+        .option("--ignore-reason <reason>", "When status=IGNORED: INTENDED_BEHAVIOUR | INACCURATE_ASSESSMENT | NOT_IMPORTANT")
+        .action(async (opts) => {
+        const body = {};
+        if (opts.issueId)
+            body.issueId = String(opts.issueId).trim();
+        if (opts.status)
+            body.status = String(opts.status).trim();
+        if (opts.ignoreReason)
+            body.ignoreReason = String(opts.ignoreReason).trim();
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.issueId || String(merged.issueId).trim() === "") {
+            throw new Error("issueId is required (--issue-id)");
+        }
+        if (!merged.status || String(merged.status).trim() === "") {
+            throw new Error("status is required (ACTIVE | IGNORED | FIXED | DUPLICATE | IN_PROGRESS_BUG | ARCHIVED_BUG | BLOCKED)");
+        }
+        const out = await runTool("update-issue-status", {
+            issueId: String(merged.issueId).trim(),
+            status: String(merged.status).trim(),
+            ...(merged.ignoreReason
+                ? { ignoreReason: String(merged.ignoreReason).trim() }
+                : {}),
+        }, { postMcp });
+        console.log(out);
+    });
     program
         .command("mark-plan-items-implementation-done")
         .description(TOOL_DEFINITIONS.find((t) => t.kebab === "mark-plan-items-implementation-done").description)
@@ -634,39 +681,69 @@ export function buildCliProgram() {
         console.log(out);
     });
     program
-        .command("run-sast-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-sast-scan").description)
+        .command("report-sast-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-sast-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Semgrep CLI JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-sast-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-sast-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program
-        .command("run-deps-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-deps-scan").description)
+        .command("report-secrets-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-secrets-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Gitleaks JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-deps-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-secrets-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program
-        .command("run-secrets-scan")
-        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "run-secrets-scan").description)
+        .command("report-deps-findings")
+        .description(TOOL_DEFINITIONS.find((t) => t.kebab === "report-deps-findings").description)
         .addOption(jsonInputOption())
-        .option("--id <scanId>")
+        .option("--id <scanId>", "Security scan id")
+        .option("--report-file <path>", "Path to full Trivy JSON report")
         .action(async (opts) => {
         const body = {};
         if (opts.id)
             body.id = String(opts.id);
-        const out = await runTool("run-secrets-scan", mergeBodies(body, opts.jsonInput), { postMcp });
+        if (opts.reportFile)
+            body.reportFile = String(opts.reportFile);
+        const merged = mergeBodies(body, opts.jsonInput);
+        if (!merged.id || String(merged.id).trim() === "") {
+            throw new Error("id is required");
+        }
+        if (!merged.reportFile || String(merged.reportFile).trim() === "") {
+            throw new Error("reportFile is required (--report-file)");
+        }
+        const out = await runTool("report-deps-findings", { id: String(merged.id).trim(), reportFile: String(merged.reportFile).trim() }, { postMcp });
         console.log(out);
     });
     program

package/dist/core/schemas.d.ts

@@ -79,6 +79,26 @@ export declare const getTestScenariosInput: z.ZodObject<{
 export declare const getManualSessionDetailsInput: z.ZodObject<{
     manualSessionId: z.ZodString;
 }, z.core.$strip>;
+export declare const getIssueDetailsInput: z.ZodObject<{
+    issueId: z.ZodString;
+}, z.core.$strip>;
+export declare const updateIssueStatusInput: z.ZodObject<{
+    issueId: z.ZodString;
+    status: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        IGNORED: "IGNORED";
+        FIXED: "FIXED";
+        DUPLICATE: "DUPLICATE";
+        IN_PROGRESS_BUG: "IN_PROGRESS_BUG";
+        ARCHIVED_BUG: "ARCHIVED_BUG";
+        BLOCKED: "BLOCKED";
+    }>;
+    ignoreReason: z.ZodOptional<z.ZodEnum<{
+        INTENDED_BEHAVIOUR: "INTENDED_BEHAVIOUR";
+        INACCURATE_ASSESSMENT: "INACCURATE_ASSESSMENT";
+        NOT_IMPORTANT: "NOT_IMPORTANT";
+    }>>;
+}, z.core.$strip>;
 export declare const emptyInput: z.ZodObject<{}, z.core.$strip>;
 export declare const getBranchSpecificEndpointConfigInput: z.ZodObject<{
     branchName: z.ZodOptional<z.ZodString>;
@@ -577,8 +597,17 @@ export declare const reportDastFindingsInput: z.ZodObject<{
     id: z.ZodString;
     reportFile: z.ZodString;
 }, z.core.$strip>;
-export declare const stubSecurityScanInput: z.ZodObject<{
-    id: z.ZodOptional<z.ZodString>;
+export declare const reportSastFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportSecretsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
+}, z.core.$strip>;
+export declare const reportDepsFindingsInput: z.ZodObject<{
+    id: z.ZodString;
+    reportFile: z.ZodString;
 }, z.core.$strip>;
 /** UpsertScreenStatesRequest JSON (proto camelCase). */
 export declare const upsertScreenStatesInput: z.ZodObject<{

package/dist/core/schemas.js

@@ -80,6 +80,25 @@ export const getTestScenariosInput = z
 export const getManualSessionDetailsInput = z.object({
     manualSessionId: z.string().min(1),
 });
+export const getIssueDetailsInput = z.object({
+    /** Accepts #B-123, B-123, #B123, B123, or plain 123 */
+    issueId: z.string().min(1),
+});
+export const updateIssueStatusInput = z.object({
+    issueId: z.string().min(1),
+    status: z.enum([
+        "ACTIVE",
+        "IGNORED",
+        "FIXED",
+        "DUPLICATE",
+        "IN_PROGRESS_BUG",
+        "ARCHIVED_BUG",
+        "BLOCKED",
+    ]),
+    ignoreReason: z
+        .enum(["INTENDED_BEHAVIOUR", "INACCURATE_ASSESSMENT", "NOT_IMPORTANT"])
+        .optional(),
+});
 export const emptyInput = z.object({});
 export const getBranchSpecificEndpointConfigInput = z.object({
     branchName: z.string().optional(),
@@ -252,8 +271,20 @@ export const reportDastFindingsInput = z.object({
     /** Path to ZAP Traditional JSON report file */
     reportFile: z.string().min(1),
 });
-export const stubSecurityScanInput = z.object({
-    id: z.string().min(1).optional(),
+export const reportSastFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Semgrep CLI JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportSecretsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Gitleaks JSON report file */
+    reportFile: z.string().min(1),
+});
+export const reportDepsFindingsInput = z.object({
+    id: z.string().min(1),
+    /** Path to full Trivy JSON report file */
+    reportFile: z.string().min(1),
 });
 const screenStatesEntrySchema = z.object({
     screen: z.string().optional(),

package/dist/core/tools.js

@@ -219,6 +219,37 @@ export const TOOL_DEFINITIONS = [
             });
         },
     },
+    {
+        kebab: "get-issue-details",
+        description: "Fetch a TestChimp issue (bug) by ordinal id. Accepts flexible issueId formats: " +
+            "#B-123, B-123, #B123, B123, or plain 123. Returns title, description, status, linked entities, " +
+            "artifact references, and short-lived signed URLs for GCS attachments/screenshots.",
+        inputSchema: S.getIssueDetailsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/get_issue_details", {
+                issueId: a.issueId.trim(),
+            });
+        },
+    },
+    {
+        kebab: "update-issue-status",
+        description: "Update a TestChimp issue status by ordinal id (same flexible issueId formats as get-issue-details). " +
+            "status must be one of: ACTIVE, IGNORED, FIXED, DUPLICATE, IN_PROGRESS_BUG, ARCHIVED_BUG, BLOCKED. " +
+            "For /testchimp fix issue: set IN_PROGRESS_BUG after applying a code fix; set FIXED only after user confirmation / commits pushed. " +
+            "Optional ignoreReason when status is IGNORED: INTENDED_BEHAVIOUR | INACCURATE_ASSESSMENT | NOT_IMPORTANT.",
+        inputSchema: S.updateIssueStatusInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const body = {
+                issueId: a.issueId.trim(),
+                status: a.status,
+            };
+            if (a.ignoreReason)
+                body.ignoreReason = a.ignoreReason;
+            return postMcp("/api/mcp/update_issue_status", body);
+        },
+    },
     {
         kebab: "mark-plan-items-implementation-done",
         description: "Mark user stories and/or test scenarios implementation-complete in platform lifecycle (DB only; does not rewrite plan markdown). " +
@@ -481,8 +512,10 @@ export const TOOL_DEFINITIONS = [
     },
     {
         kebab: "get-security-scan-config",
-        description: "Fetch security scan config by scan id (categories, environment, release label, status). " +
-            "Pass id (CLI: --id). Used by /testchimp run security scan.",
+        description: "Fetch security scan config by scan id (detail.dastCheckConfig / detail.sastCheckConfig / " +
+            "detail.depsCheckConfig / detail.leaksCheckConfig, release label, status). Pass id (CLI: --id). " +
+            "Used by /testchimp run security scan. For DAST honour allowActiveScan / useEphemeralSandbox / scope " +
+            "on dastCheckConfig.",
         inputSchema: S.getSecurityScanConfigInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -492,7 +525,8 @@ export const TOOL_DEFINITIONS = [
     {
         kebab: "update-scan-progress",
         description: "Update a scan's status. status must be one of: QUEUED, IN_PROGRESS, COMPLETED, EXCEPTION. " +
-            "Call IN_PROGRESS when starting; COMPLETED when all selected categories finish; EXCEPTION on hard failure.",
+            "Call IN_PROGRESS when starting. Each scan is a single checker type: the category playbook " +
+            "sets COMPLETED after a successful report-*-findings (or EXCEPTION on hard failure).",
         inputSchema: S.updateScanProgressInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -506,7 +540,7 @@ export const TOOL_DEFINITIONS = [
         kebab: "report-dast-findings",
         description: "Upload a ZAP Traditional JSON report for a security scan. Pass --id and --report-file <path>. " +
             "Backend parses alerts, dedupes by bug hash, and inserts new SECURITY bugs linked to the scan. " +
-            "Does not mark the scan COMPLETED.",
+            "Does not mark the scan COMPLETED — the DAST playbook calls update-scan-progress COMPLETED after this.",
         inputSchema: S.reportDastFindingsInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -519,22 +553,52 @@ export const TOOL_DEFINITIONS = [
         },
     },
     {
-        kebab: "run-sast-scan",
-        description: "Stub: Semgrep SAST scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-sast-scan" }),
+        kebab: "report-sast-findings",
+        description: "Upload a full Semgrep CLI JSON report for a SAST security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the raw report, parses results, dedupes by bug hash, and inserts new SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the SAST playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSastFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_sast_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
-        kebab: "run-deps-scan",
-        description: "Stub: Trivy dependency scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-deps-scan" }),
+        kebab: "report-secrets-findings",
+        description: "Upload a full Gitleaks JSON report for a secrets security scan. Pass --id and --report-file <path>. " +
+            "Backend redacts secret payloads, stores the report, dedupes by bug hash, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the secrets playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportSecretsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_secrets_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
-        kebab: "run-secrets-scan",
-        description: "Stub: Gitleaks secrets scan is not implemented yet.",
-        inputSchema: S.stubSecurityScanInput,
-        execute: async () => JSON.stringify({ status: "not_implemented", tool: "run-secrets-scan" }),
+        kebab: "report-deps-findings",
+        description: "Upload a full Trivy JSON report for a dependency security scan. Pass --id and --report-file <path>. " +
+            "Backend stores the report, filters by security profile / ignore-unfixed, dedupes, and inserts SECURITY bugs. " +
+            "Does not mark the scan COMPLETED — the deps playbook calls update-scan-progress COMPLETED after this.",
+        inputSchema: S.reportDepsFindingsInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const { readFile } = await import("node:fs/promises");
+            const reportJson = await readFile(a.reportFile, "utf8");
+            return postMcp("/api/mcp/report_deps_findings", {
+                scanId: a.id.trim(),
+                reportJson,
+            });
+        },
     },
     {
         kebab: "upsert-screen-states",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",