@topy-ai/maggie 0.7.60 → 0.8.0

package/bundled-tools/clis/maggie_security.py

@@ -31,7 +31,7 @@ import maggie_security_core as core  # noqa: E402
 AREA_MODULES = [
     "maggie_security_intel", "maggie_security_deps", "maggie_security_code", "maggie_security_web",
     "maggie_security_protect", "maggie_security_logs", "maggie_security_host", "maggie_security_health",
-    "maggie_security_standards", "maggie_security_agent", "maggie_security_report", "maggie_security_mcp", "maggie_security_hosted",
+    "maggie_security_standards", "maggie_security_agent", "maggie_security_report", "maggie_security_scan", "maggie_security_mcp", "maggie_security_hosted",
 ]
 
 # Commands from the PRDs that are not built yet, with their milestone, so the

package/bundled-tools/clis/maggie_security_code.py

@@ -535,6 +535,53 @@ def semgrep_to_findings(ctx: core.Context, data: dict, project: Path) -> list[di
     return findings
 
 
+# Bearer-inspired privacy lens (Bearer itself is Elastic-licensed and cannot be run
+# or bundled, so its detection *patterns* are reimplemented as native rules): flag a
+# log/print call that puts personal data in the output — a GDPR hazard (CWE-532).
+PII_LOG_CALL = re.compile(
+    r"(?i)(console\.(log|info|warn|error|debug)|[^\w.](print|println|printf)\s*\(|fmt\.(Print|Printf|Println|Sprintf)|"
+    r"System\.out\.print|var_dump|print_r|error_log|\b(logger|log|logging|logr|slog|console)\s*\.\s*"
+    r"(info|debug|warn|warning|error|trace|notice|log)\b)")
+PII_TOKEN = re.compile(
+    r"(?i)\b(e[-_]?mail(?:address|_address)?|ssn|social[_\s-]?security|passport(?:[_\s-]?(?:no|number))?|"
+    r"credit[_\s-]?card|card[_\s-]?number|cardnum|cvv|cvc|iban|phone[_\s-]?number|date[_\s-]?of[_\s-]?birth|"
+    r"\bdob\b|national[_\s-]?id|tax[_\s-]?id|driver'?s?[_\s-]?licen[cs]e)\b")
+PII_SOURCE_EXT = re.compile(r"(?i)\.(js|jsx|ts|tsx|mjs|cjs|py|php|rb|go|java|kt|cs|scala|swift|rs|vue|svelte|ex|exs)$")
+
+
+def native_pii_checks(ctx: core.Context, files: list[Path], project: Path) -> list[dict]:
+    """Logging of personal data (GDPR / CWE-532) — one finding per file, lines as evidence."""
+    findings = []
+    for path in files:
+        if not PII_SOURCE_EXT.search(path.name):
+            continue
+        text = read_text(path)
+        if not text:
+            continue
+        hits = []
+        for number, line in enumerate(text.splitlines(), 1):
+            if len(line) > 400:
+                continue
+            if PII_LOG_CALL.search(line) and PII_TOKEN.search(line):
+                hits.append((number, line.strip()[:200]))
+            if len(hits) >= 10:
+                break
+        if not hits:
+            continue
+        rel = path.relative_to(project).as_posix()
+        findings.append(core.make_finding(
+            kind="code", command="code-scan", primary_id="maggie.privacy.pii-in-logs", site=ctx.site,
+            title=f"Personal data may be written to logs ({rel})", severity="low", severity_source="maggie",
+            confidence="possible", cwe_ids=["CWE-532"], asvs_ids=["V7.1.1"], target={"path": rel}, tool="maggie-native",
+            rule_id="maggie.privacy.pii-in-logs",
+            evidence=[{"path": rel, "line": n, "excerpt": core.clean_excerpt(ln, 200)} for n, ln in hits[:5]],
+            remediation={"summary": "Avoid logging personal data (email, SSN, card, phone, DOB…). Redact or omit it, or log an opaque id instead. "
+                         "Logs are often shipped to third parties and retained — this is a GDPR exposure.",
+                         "steps": [], "snippets": [], "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html"],
+                         "cheat_sheet": "Logging"}))
+    return findings
+
+
 def native_config_checks(ctx: core.Context, files: list[Path], project: Path) -> list[dict]:
     """Two checks semgrep expresses poorly: Dockerfile final stage without USER, nginx serving dotfiles."""
     findings = []
@@ -598,7 +645,8 @@ def code_scan(ctx: core.Context):
     else:
         targets = [str(project / p) for p in (args.paths or ["."])]
     files = [Path(t) for t in targets if Path(t).is_file()] + [f for t in targets if Path(t).is_dir() for f in text_files(Path(t), project)]
-    findings = native_config_checks(ctx, [f for f in files if not any(part in SKIP_DIRS for part in f.relative_to(project).parts)], project)
+    in_scope = [f for f in files if not any(part in SKIP_DIRS for part in f.relative_to(project).parts)]
+    findings = native_config_checks(ctx, in_scope, project) + native_pii_checks(ctx, in_scope, project)
     with tempfile.TemporaryDirectory() as tmp:
         out = Path(tmp) / "semgrep.json"
         argv = ["scan", "--json", "--json-output", str(out), "--timeout", "30", "--max-target-bytes", "1000000", "--quiet"]

package/bundled-tools/clis/maggie_security_deps.py

@@ -361,6 +361,99 @@ def image(ctx: core.Context):
     return ctx.finish(findings, covered=[f"image:{ref}"])
 
 
+# --------------------------------------------------------------------------- image-patch (copa remediation plan)
+
+# image-patch completes the safe-patching story for containers: `image` detects the
+# CVEs, image-patch turns a Trivy report into a reviewed copa command that rebuilds
+# the image with the OS-package fixes applied — into a NEW tag, so the original is
+# untouched. Plan only (like fix-plan/protect-plan): Maggie never runs copa; the
+# operator reviews it and runs it where Docker/buildkit is available.
+
+
+def _patched_tag(ref: str, override: str | None) -> str:
+    if override:
+        return override
+    name, _, _tag = ref.rpartition(":")
+    return f"{name}:patched" if name and "/" not in _tag else f"{ref}-patched"
+
+
+def image_patch(ctx: core.Context) -> dict:
+    import shlex
+
+    args = ctx.args
+    ref = args.ref
+    tag = _patched_tag(ref, args.tag)
+    pkg_types = args.pkg_types
+    report = args.report or "scan.json"
+
+    fixable = total = None
+    if args.report:
+        data = core.read_json(Path(args.report))
+        fixed_ids, all_ids = set(), set()
+        for result in data.get("Results") or []:
+            for vuln in result.get("Vulnerabilities") or []:
+                vid = vuln.get("VulnerabilityID")
+                all_ids.add(vid)
+                if vuln.get("FixedVersion"):
+                    fixed_ids.add(vid)
+        fixable, total = len(fixed_ids), len(all_ids)
+
+    scan_cmd = f"trivy image --quiet --scanners vuln --pkg-types os --format json -o {shlex.quote(report)} {shlex.quote(ref)}"
+    patch_cmd = f"copa patch -i {shlex.quote(ref)} -r {shlex.quote(report)} --pkg-types {pkg_types} -t {shlex.quote(tag)}"
+    verify_cmd = f"trivy image --quiet {shlex.quote(tag)}"
+
+    sh = [
+        "#!/usr/bin/env bash",
+        f"# Container patch plan for {ref} — generated {core.iso()[:10]} by maggie security image-patch.",
+        "# REVIEW BEFORE RUNNING. Maggie did not and will not run any of this.",
+        "# copa rebuilds the image with OS-package fixes into a NEW tag; the original image is untouched.",
+        "# Prerequisites: copa (maggie security tools install --tool copa) and a running Docker/buildkit.",
+        "set -euo pipefail",
+        "",
+        "# 1. Scan the image to a report copa can read:" if not args.report else f"# 1. Using the provided report {report}.",
+    ]
+    if not args.report:
+        sh.append(scan_cmd)
+    sh += [
+        "# 2. Patch OS packages into a new tag (original image untouched):",
+        patch_cmd,
+        "# 3. Re-scan the patched image to confirm the fixes, then test it before you deploy:",
+        verify_cmd,
+        "",
+    ]
+    script = "\n".join(sh).rstrip() + "\n"
+    if args.script:
+        path = Path(args.script)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(script, encoding="utf-8")
+        path.chmod(0o755)
+
+    md = [f"# Container patch plan — {ref}", "",
+          "**Review before running — Maggie never runs copa.** copa rebuilds the image with OS-package "
+          "fixes into a **new tag** (`" + tag + "`); the original image is untouched. Needs Docker/buildkit.", ""]
+    if fixable is not None:
+        md.append(f"The report lists **{fixable} fixable** OS-package CVE(s)" + (f" of {total} total." if total else ".") + "")
+        md.append("")
+    md += ["```bash", (scan_cmd + "\n" if not args.report else "") + patch_cmd + "\n" + verify_cmd, "```", "",
+           "After patching: re-scan with `maggie security image --ref " + tag + "` and test the image before deploying."]
+    runbook = "\n".join(md)
+
+    return {"schema": "maggie-security-image-patch.v1", "ref": ref, "patched_tag": tag, "pkg_types": pkg_types,
+            "fixable": fixable, "total": total, "commands": {"scan": scan_cmd, "patch": patch_cmd, "verify": verify_cmd},
+            "script_path": str(args.script) if args.script else None,
+            "note": "Plan only. Maggie never runs copa; it rebuilds into a new tag, leaving the original image untouched.",
+            "markdown": runbook}
+
+
+def _image_patch(p: argparse.ArgumentParser) -> None:
+    p.add_argument("ref", help="the image to patch, e.g. myapp:1.0")
+    p.add_argument("--report", help="a Trivy JSON report for the image (else the plan generates one with trivy)")
+    p.add_argument("--tag", help="output tag for the patched image (default <ref>-patched)")
+    p.add_argument("--pkg-types", choices=["os", "os,library"], default="os", dest="pkg_types",
+                   help="os (default) or os,library to also patch application dependencies")
+    p.add_argument("--script", help="write the runnable plan to this path (chmod 755)")
+
+
 # --------------------------------------------------------------------------- preinstall (vet a package before installing it)
 
 
@@ -554,6 +647,8 @@ COMMANDS = [core.Command("deps", "known vulnerabilities in dependencies (every l
                          ["osv-api", "retire-jsrepo", "kev", "epss"], configure, deps),
             core.Command("sbom", "CycloneDX SBOM of the project (or an image with syft)", [], _sbom, sbom, findings=False),
             core.Command("image", "container image vulnerabilities, secrets and best practices (trivy + dockle)", ["kev", "github-releases"], _image, image),
+            core.Command("image-patch", "a reviewed copa plan to rebuild a container image with OS-package fixes into a new tag; never applied by Maggie",
+                         [], _image_patch, image_patch, findings=False, routine_safe=False),
             core.Command("preinstall", "vet an npm package before installing it (age, install scripts, typosquats, malware, vulnerabilities, Scorecard)",
                          ["npm-registry", "osv-api", "scorecard", "kev", "epss"], _preinstall, preinstall, findings=False),
             core.Command("exposure-check", "known malicious packages already installed (OSV MAL- records and incident catalogs)", ["osv-api", "kev"],

package/bundled-tools/clis/maggie_security_host.py

@@ -215,6 +215,125 @@ def host_quick(ctx: core.Context):
     return ctx.finish(findings, covered=[f"host:{host}", "*"])
 
 
+# --------------------------------------------------------------------------- host-impact (patch blast-radius)
+
+# The blast-radius collector answers "how big is the impact of patching X on this
+# host?" — the input the fix-risk tiers need to judge a patch against what is
+# actually running. Read-only. Techniques ported from PatchMon (apt security
+# simulate + origin parsing; /var/run/reboot-required + kernel comparison;
+# needrestart for the patched-but-not-restarted gap).
+IMPACT_COLLECTOR = r"""set +e
+s() { printf '\n### %s\n' "$1"; }
+SUDO=""; [ "$(id -u)" != 0 ] && sudo -n true 2>/dev/null && SUDO="sudo -n"
+s os-release; cat /etc/os-release 2>/dev/null
+s security-updates; LANG=C apt-get -s -o Debug::NoLocking=1 upgrade 2>/dev/null | grep '^Inst ' | head -300
+s reboot-required; [ -f /var/run/reboot-required ] && echo yes || echo no
+s reboot-pkgs; cat /var/run/reboot-required.pkgs 2>/dev/null | head -50
+s kernel; uname -r; ls -1 /boot/vmlinuz-* 2>/dev/null | sed 's#.*/vmlinuz-##' | sort -V | tail -1
+s needrestart; $SUDO needrestart -b 2>/dev/null | grep -E '^NEEDRESTART-(KCUR|KEXP|KSTA|SVC):' | head -200
+s listen; ss -H -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null
+s running-services; systemctl list-units --type=service --state=running --no-legend 2>/dev/null | awk '{print $1}' | head -200
+s timers; systemctl list-timers --all --no-legend 2>/dev/null | awk '{print $NF}' | grep -v '^$' | head -60
+s cron; ls -1 /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null | grep -v ':$' | sort -u | head -40; $SUDO ls -1 /var/spool/cron/crontabs 2>/dev/null | head -20
+"""
+
+LISTEN_PROC_RE = re.compile(r'users:\(\("([^"]+)"')
+APT_INST_RE = re.compile(r"^Inst\s+(\S+)\s+(?:\[[^\]]*\]\s+)?\(\S+\s*([^)]*)\)")  # name, then the origin tail
+
+
+def parse_impact(sections: dict[str, str]) -> dict:
+    """Turn the collector sections into a patch blast-radius snapshot."""
+    def lines(name: str) -> list[str]:
+        return [l.strip() for l in sections.get(name, "").splitlines() if l.strip()]
+
+    security, pending = [], []
+    for line in lines("security-updates"):
+        m = APT_INST_RE.match(line)
+        if not m:
+            continue
+        name, origins = m.group(1), m.group(2) or ""
+        pending.append(name)
+        if "security" in origins.lower():  # only the origin tail — package names can contain "security"
+            security.append(name)
+
+    reboot = (sections.get("reboot-required", "").strip().lower().startswith("yes"))
+    reboot_pkgs = lines("reboot-pkgs")
+    kl = lines("kernel")
+    running_k = kl[0] if kl else None
+    latest_k = kl[1] if len(kl) > 1 else None
+
+    svc_restart, kcur, kexp, ksta = [], running_k, None, None
+    for line in lines("needrestart"):
+        tag, _, val = line.partition(":")
+        val = val.strip()
+        if tag == "NEEDRESTART-SVC":
+            svc_restart.append(val)
+        elif tag == "NEEDRESTART-KCUR":
+            kcur = val
+        elif tag == "NEEDRESTART-KEXP":
+            kexp = val
+        elif tag == "NEEDRESTART-KSTA":
+            ksta = val
+    if kexp and not latest_k:
+        latest_k = kexp
+    kernel_stale = bool(ksta == "3") or bool(running_k and latest_k and running_k != latest_k)
+
+    listening = []
+    for line in lines("listen"):
+        proc = LISTEN_PROC_RE.search(line)
+        addr = line.split()[3] if len(line.split()) > 3 else ""
+        port = addr.rsplit(":", 1)[-1] if ":" in addr else addr
+        if proc and port:
+            listening.append({"port": port, "process": proc.group(1)})
+
+    return {"schema": "maggie-security-impact.v1",
+            "reboot_required": reboot or kernel_stale, "reboot_pkgs": reboot_pkgs,
+            "kernel": {"running": kcur, "latest": latest_k, "stale": kernel_stale},
+            "services_need_restart": sorted(set(svc_restart)),
+            "security_updates": sorted(set(security)), "pending_updates": sorted(set(pending)),
+            "listening": listening, "running_services": lines("running-services"),
+            "timers": lines("timers"), "cron": lines("cron"),
+            "needrestart_available": bool(sections.get("needrestart", "").strip())}
+
+
+def impact_findings(ctx: core.Context, snapshot: dict, host: str) -> list[dict]:
+    findings: list[dict] = []
+    svcs = snapshot["services_need_restart"]
+    if svcs:
+        shown = ", ".join(svcs[:8]) + (f" (+{len(svcs) - 8} more)" if len(svcs) > 8 else "")
+        findings.append(check(
+            "hq-needs-restart", f"{len(svcs)} running service(s) still use pre-update libraries — restart needed", "medium",
+            "A library was updated on disk but these services are still running the old copy in memory, so the fix is not live yet. "
+            "Restart them (or reboot if the kernel changed).", host=host, ctx=ctx,
+            evidence=shown, steps=["sudo needrestart -r a   # review, then restart the services it lists"] +
+            [f"sudo systemctl restart {shlex.quote(s)}" for s in svcs[:8]]))
+    if snapshot["reboot_required"]:
+        why_pkgs = (": " + ", ".join(snapshot["reboot_pkgs"][:6])) if snapshot["reboot_pkgs"] else ""
+        kern = snapshot["kernel"]
+        detail = f"running {kern['running']}, installed {kern['latest']}" if kern.get("stale") and kern.get("latest") else why_pkgs
+        findings.append(check(
+            "hq-reboot-required", "The server needs a reboot to finish applying updates", "medium",
+            "A kernel or core library update is only fully applied after a reboot. Schedule one in a maintenance window.",
+            host=host, ctx=ctx, evidence=detail.strip(" :"),
+            steps=["# schedule a reboot in a maintenance window, then:", "sudo shutdown -r +1 'Maggie: applying security updates'"]))
+    return findings
+
+
+def host_impact(ctx: core.Context):
+    if ctx.args.print_collector:
+        return {"_raw": IMPACT_COLLECTOR}
+    text, host = evidence_text(ctx, IMPACT_COLLECTOR)
+    sections = parse_sections(text)
+    if not sections:
+        raise core.UsageError("the evidence has no '### section' blocks; run the collector from --print-collector")
+    snapshot = parse_impact(sections)
+    snapshot.update({"host": host, "collected_at": core.iso()})
+    core.write_json(ctx.state.path("inventory", "impact.json"), snapshot)
+    findings = impact_findings(ctx, snapshot, host)
+    ctx.run["inputs"].update({"host": host, "impact": "inventory/impact.json"})
+    return ctx.finish(findings, covered=[f"host:{host}", "*"])
+
+
 # --------------------------------------------------------------------------- host-audit (lynis report.dat)
 
 
@@ -540,4 +659,6 @@ COMMANDS = [
                  routine_safe=False),
     core.Command("host-nginx-config", "nginx and PHP configuration rules (hidden files, PHP in uploads, TLS, headers, rate limits)", [], _quick,
                  host_nginx_config),
+    core.Command("host-impact", "patch blast-radius: which pending updates are security-only, what needs restart/reboot, and what is running "
+                 "(read-only; feeds fix-plan's risk tiers)", [], _quick, host_impact),
 ]

package/bundled-tools/clis/maggie_security_mcp.py

@@ -73,7 +73,7 @@ SCHEMAS: dict[str, dict] = {
         "mode": {"enum": ["traffic", "attacks", "ioc"]}, "file": LOGFILE, "since": SINCE,
         "rules": {"type": "string", "pattern": r"^(web|proxy|emerging)(,(web|proxy|emerging))*$"}}},
     "security_host_check": {"type": "object", "required": ["host"], "additionalProperties": False, "properties": {
-        "host": ALIAS, "depth": {"enum": ["quick", "nginx"]}}},
+        "host": ALIAS, "depth": {"enum": ["quick", "nginx", "impact"]}}},
     "security_protect_plan": {"type": "object", "required": ["host"], "additionalProperties": False, "properties": {
         "host": ALIAS, "engine": {"enum": ["auto", "crowdsec", "fail2ban", "cloudflare"]}, "site_type": {"enum": ["wordpress", "php-app", "node-app", "static", "workers"]}}},
     "security_uptime_status": {"type": "object", "additionalProperties": False, "properties": {"window": {"enum": ["1h", "24h", "7d", "30d"]}}},
@@ -95,11 +95,29 @@ SCHEMAS: dict[str, dict] = {
         "id": {"type": "string", "pattern": r"^msf_[0-9a-f]{24}$"}, "action": {"enum": ["accept", "false-positive", "reopen"]},
         "reason": {"type": "string", "maxLength": 300}, "until": {"type": "string", "pattern": r"^\d{4}-\d{2}-\d{2}$"},
         "confirm": {"type": "boolean"}, "confirmation": {"type": "string", "maxLength": 80}}},
+    "security_image_patch": {"type": "object", "required": ["ref"], "additionalProperties": False, "properties": {
+        "ref": {"type": "string", "pattern": r"^[a-z0-9][a-z0-9._/:-]*$", "description": "the image to patch, e.g. myapp:1.0"},
+        "report": {"type": "string", "maxLength": 300, "description": "a Trivy JSON report inside the project"},
+        "tag": {"type": "string", "maxLength": 200}, "pkg_types": {"enum": ["os", "os,library"]}}},
+    "security_scan": {"type": "object", "additionalProperties": False, "properties": {
+        "profile": {"type": "string", "maxLength": 20, "description": "override the detected site profile, e.g. wordpress, node-app"},
+        "domain": {"type": "string", "pattern": DOMAIN, "description": "verified domain for the web checks (headers, tls)"},
+        "kind": {"enum": ["weekly", "daily_ops"]}, "fix_plan": {"type": "boolean"}}},
+    "security_node_check": {"type": "object", "additionalProperties": False, "properties": {
+        "node_version": {"type": "string", "pattern": r"^\d+(\.\d+){0,2}$", "description": "Node.js version (default: the versions in the inventory)"}}},
+    "security_fix_plan": {"type": "object", "additionalProperties": False, "properties": {
+        "priority": {"enum": ["p0", "p1", "p2", "p3", "p4"], "description": "only include findings at or above this priority"},
+        "since": SINCE}},
+    "security_incident": {"type": "object", "required": ["action"], "additionalProperties": False, "properties": {
+        "action": {"enum": ["start", "log", "close"]}, "id": {"type": "string", "maxLength": 80},
+        "title": {"type": "string", "maxLength": 200}, "cve": {"type": "string", "maxLength": 40},
+        "finding": {"type": "string", "pattern": r"^msf_[0-9a-f]{24}$"}, "event": {"type": "string", "maxLength": 40},
+        "note": {"type": "string", "maxLength": 300}, "confirm": {"type": "boolean"}, "confirmation": {"type": "string", "maxLength": 80}}},
 }
 NETWORK_TOOLS = {"security_vuln_watch", "security_osv_query", "security_wp_check", "security_eol_check", "security_deps_scan",
                  "security_domain_verify_check", "security_headers_check", "security_tls_check", "security_web_scan", "security_public_check",
                  "security_uptime_status",
-                 "security_checklist_get", "security_package_vet", "security_exposure_check", "security_image_scan"}
+                 "security_checklist_get", "security_package_vet", "security_exposure_check", "security_image_scan", "security_node_check", "security_scan"}
 
 
 def registry_path() -> Path:
@@ -229,7 +247,7 @@ class Server:
                 argv += ["--rules", args["rules"]]
             return argv
         if name == "security_host_check":
-            command = "host-nginx-config" if args.get("depth") == "nginx" else "host-quick"
+            command = {"nginx": "host-nginx-config", "impact": "host-impact"}.get(args.get("depth"), "host-quick")
             return [command] if dry else [command, "--ssh", f"{args['host']}={self.host_target(args['host'])}"]
         if name == "security_protect_plan":
             argv = ["protect-plan", "--host", args.get("host", "web1"), "--engine", args.get("engine", "auto")]
@@ -269,6 +287,54 @@ class Server:
             return ["image", args.get("ref", "x")]
         if name == "security_sbom_build":
             return ["sbom"]
+        if name == "security_image_patch":
+            argv = ["image-patch"]
+            if dry:
+                return argv
+            argv.append(args["ref"])
+            if args.get("report"):
+                argv += ["--report", self.safe_log_path(args["report"])]
+            if args.get("tag"):
+                argv += ["--tag", args["tag"]]
+            if args.get("pkg_types"):
+                argv += ["--pkg-types", args["pkg_types"]]
+            return argv
+        if name == "security_scan":
+            argv = ["scan"]
+            if dry:
+                return argv
+            if args.get("profile"):
+                argv += ["--profile", args["profile"]]
+            if args.get("domain"):
+                argv += ["--domain", args["domain"]]
+            if args.get("kind"):
+                argv += ["--kind", args["kind"]]
+            if args.get("fix_plan"):
+                argv += ["--fix-plan"]
+            return argv
+        if name == "security_node_check":
+            argv = ["node-check"]
+            if not dry and args.get("node_version"):
+                argv += ["--node-version", args["node_version"]]
+            return argv
+        if name == "security_fix_plan":
+            argv = ["fix-plan"]
+            if dry:
+                return argv
+            if args.get("priority"):
+                argv += ["--priority", args["priority"]]
+            if args.get("since"):
+                argv += ["--since", args["since"]]
+            return argv
+        if name == "security_incident":
+            if dry:
+                return ["incident"]
+            argv = ["incident", args["action"]]
+            for key, flag in (("id", "--id"), ("title", "--title"), ("cve", "--cve"), ("finding", "--finding"),
+                              ("event", "--event"), ("note", "--note")):
+                if args.get(key):
+                    argv += [flag, args[key]]
+            return argv
         if name == "security_report_build":
             return ["report", "--kind", args.get("kind", "weekly"), "--audience", args.get("audience", "owner")]
         if name == "security_ledger_mark":