@zivis/cli 0.1.0-alpha.17 → 0.1.0-alpha.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -3,6 +3,7 @@ import { initCommand } from "./init.js";
|
|
|
3
3
|
import { statusCommand } from "./status.js";
|
|
4
4
|
import { logoutCommand } from "./logout.js";
|
|
5
5
|
import { sessionsCommand } from "./sessions.js";
|
|
6
|
+
import { tokenCommand } from "./token.js";
|
|
6
7
|
export function registerAuthCommands(program) {
|
|
7
8
|
const auth = program.command("auth").description("authentication");
|
|
8
9
|
auth
|
|
@@ -45,5 +46,12 @@ export function registerAuthCommands(program) {
|
|
|
45
46
|
.action(async (opts) => {
|
|
46
47
|
await sessionsCommand(opts);
|
|
47
48
|
});
|
|
49
|
+
auth
|
|
50
|
+
.command("token <apiKey>")
|
|
51
|
+
.description("store a ZIVIS API access token for MCP/CI use (generate at Settings → API Tokens)")
|
|
52
|
+
.option("-s, --session <name>", "named session to bind this token to (defaults to project binding if present)")
|
|
53
|
+
.action(async (apiKey, opts) => {
|
|
54
|
+
await tokenCommand(apiKey, opts);
|
|
55
|
+
});
|
|
48
56
|
}
|
|
49
57
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEnE,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,yBAAyB,EAAE,oCAAoC,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,+BAA+B,CAAC;SACpD,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,OAAO,EAAE,4BAA4B,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CACV,mFAAmF,CACpF;SACA,MAAM,CACL,sBAAsB,EACtB,8EAA8E,CAC/E;SACA,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAI,EAAE,EAAE;QACrC,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* zivis auth token
|
|
3
|
+
*
|
|
4
|
+
* Store a ZIVIS API access token in the OS keychain for a named session.
|
|
5
|
+
* API tokens are the preferred auth method for the MCP server and CI pipelines
|
|
6
|
+
* — they don't expire and don't require browser interaction.
|
|
7
|
+
*
|
|
8
|
+
* Usage:
|
|
9
|
+
* zivis auth token zv_live_<...> # default session
|
|
10
|
+
* zivis auth token zv_live_<...> --session zivis # named session
|
|
11
|
+
*
|
|
12
|
+
* Tokens are generated in the ZIVIS platform: Settings → API Tokens
|
|
13
|
+
*/
|
|
14
|
+
export interface TokenCmdOpts {
|
|
15
|
+
session?: string;
|
|
16
|
+
}
|
|
17
|
+
export declare function tokenCommand(apiKey: string, opts: TokenCmdOpts): Promise<void>;
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* zivis auth token
|
|
3
|
+
*
|
|
4
|
+
* Store a ZIVIS API access token in the OS keychain for a named session.
|
|
5
|
+
* API tokens are the preferred auth method for the MCP server and CI pipelines
|
|
6
|
+
* — they don't expire and don't require browser interaction.
|
|
7
|
+
*
|
|
8
|
+
* Usage:
|
|
9
|
+
* zivis auth token zv_live_<...> # default session
|
|
10
|
+
* zivis auth token zv_live_<...> --session zivis # named session
|
|
11
|
+
*
|
|
12
|
+
* Tokens are generated in the ZIVIS platform: Settings → API Tokens
|
|
13
|
+
*/
|
|
14
|
+
import { keychainStore, getStorageName } from "@zivis/mcp/auth";
|
|
15
|
+
import { detectProjectBinding } from "@zivis/mcp/project-binding";
|
|
16
|
+
import { DEFAULT_CONFIG } from "@zivis/mcp/types";
|
|
17
|
+
const API_KEY_PREFIX = "zv_live_";
|
|
18
|
+
const API_KEY_REGEX = /^zv_live_[0-9a-f]{64}$/i;
|
|
19
|
+
function getApiKeyAccount(session) {
|
|
20
|
+
return session ? `apikey.${session}` : "apikey";
|
|
21
|
+
}
|
|
22
|
+
function validateKeyFormat(key) {
|
|
23
|
+
return API_KEY_REGEX.test(key);
|
|
24
|
+
}
|
|
25
|
+
export async function tokenCommand(apiKey, opts) {
|
|
26
|
+
// Validate format
|
|
27
|
+
if (!validateKeyFormat(apiKey)) {
|
|
28
|
+
console.error(`Invalid API token format. Expected: ${API_KEY_PREFIX}<64 hex characters>`);
|
|
29
|
+
console.error(`Got: ${apiKey.substring(0, 20)}...`);
|
|
30
|
+
console.error(`\nGenerate a token at: Settings → API Tokens in the ZIVIS platform.`);
|
|
31
|
+
process.exit(1);
|
|
32
|
+
}
|
|
33
|
+
// Determine session from opts or project binding
|
|
34
|
+
const detected = detectProjectBinding(process.cwd());
|
|
35
|
+
const session = opts.session ?? detected?.binding.session;
|
|
36
|
+
const account = getApiKeyAccount(session);
|
|
37
|
+
const sessionLabel = session ? `session "${session}"` : "default session";
|
|
38
|
+
const storageName = getStorageName();
|
|
39
|
+
try {
|
|
40
|
+
await keychainStore(account, apiKey);
|
|
41
|
+
}
|
|
42
|
+
catch (err) {
|
|
43
|
+
console.error(`Failed to store token: ${err instanceof Error ? err.message : err}`);
|
|
44
|
+
process.exit(1);
|
|
45
|
+
}
|
|
46
|
+
const maskedKey = `${apiKey.substring(0, 12)}...${apiKey.slice(-4)}`;
|
|
47
|
+
console.log(`✓ API token stored for ${sessionLabel}`);
|
|
48
|
+
console.log(` Key: ${maskedKey}`);
|
|
49
|
+
console.log(` Storage: ${storageName} (account: ${account})`);
|
|
50
|
+
if (session) {
|
|
51
|
+
console.log(`\nThe MCP server will use this token automatically for projects bound to session "${session}".`);
|
|
52
|
+
}
|
|
53
|
+
else {
|
|
54
|
+
console.log(`\nThe MCP server will use this token for the default session.`);
|
|
55
|
+
console.log(`Tip: Use --session <name> to scope this token to a specific org.`);
|
|
56
|
+
}
|
|
57
|
+
if (detected) {
|
|
58
|
+
const orgLabel = detected.binding.orgName
|
|
59
|
+
? ` (${detected.binding.orgName})`
|
|
60
|
+
: "";
|
|
61
|
+
console.log(`\nProject binding detected: this repo is bound to session "${detected.binding.session}"${orgLabel}.`);
|
|
62
|
+
if (!session) {
|
|
63
|
+
console.log(` Tip: Run with --session ${detected.binding.session} to scope this token to that org.`);
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
// Optionally verify the key works against the API
|
|
67
|
+
const config = DEFAULT_CONFIG;
|
|
68
|
+
const apiBaseUrl = config.apiBaseUrl;
|
|
69
|
+
try {
|
|
70
|
+
const response = await fetch(`${apiBaseUrl}/api/mcp/session`, {
|
|
71
|
+
headers: { "X-API-Key": apiKey, "User-Agent": "@zivis/cli" },
|
|
72
|
+
});
|
|
73
|
+
if (response.ok) {
|
|
74
|
+
const data = (await response.json());
|
|
75
|
+
const orgName = data.org?.name ?? "unknown org";
|
|
76
|
+
const email = data.user?.email ?? "unknown user";
|
|
77
|
+
console.log(`\n✓ Token verified — authenticated as ${email} in ${orgName}`);
|
|
78
|
+
}
|
|
79
|
+
else {
|
|
80
|
+
const body = await response.json().catch(() => ({}));
|
|
81
|
+
console.log(`\n Warning: Could not verify token against API (HTTP ${response.status}): ${body.message ?? body.error ?? "unknown error"}`);
|
|
82
|
+
console.log(` Token was stored but may be invalid or lack the 'mcp' scope.`);
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
catch {
|
|
86
|
+
// Network error — token is stored, just couldn't verify
|
|
87
|
+
console.log(`\n Note: Could not reach the ZIVIS API to verify the token (stored anyway).`);
|
|
88
|
+
}
|
|
89
|
+
process.exit(0);
|
|
90
|
+
}
|
|
91
|
+
//# sourceMappingURL=token.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/commands/auth/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAMhD,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAkB;IAElB,kBAAkB;IAClB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,uCAAuC,cAAc,qBAAqB,CAC3E,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,qEAAqE,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;IAE1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1E,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,OAAO,CAAC,GAAG,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,cAAc,WAAW,cAAc,OAAO,GAAG,CAAC,CAAC;IAE/D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,qFAAqF,OAAO,IAAI,CACjG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,+DAA+D,CAChE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO;YACvC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG;YAClC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CACT,8DAA8D,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,GAAG,CACtG,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CACT,6BAA6B,QAAQ,CAAC,OAAO,CAAC,OAAO,mCAAmC,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,kBAAkB,EAAE;YAC5D,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA2B,CAAC;YAC/E,OAAO,CAAC,GAAG,CACT,yDAAyD,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CAC9H,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@zivis/cli",
|
|
3
|
-
"version": "0.1.0-alpha.
|
|
3
|
+
"version": "0.1.0-alpha.18",
|
|
4
4
|
"description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"ignore": "^7.0.5",
|
|
24
24
|
"open": "^10.1.0",
|
|
25
25
|
"web-tree-sitter": "^0.26.8",
|
|
26
|
-
"@zivis/mcp": "0.1.0-alpha.
|
|
26
|
+
"@zivis/mcp": "0.1.0-alpha.7"
|
|
27
27
|
},
|
|
28
28
|
"devDependencies": {
|
|
29
29
|
"@types/node": "^22.0.0",
|