@zivis/cli 0.1.0-alpha.39 → 0.1.0-alpha.4

package/dist/internal/extractor/walker.js

@@ -1,3 +1,17 @@
+/**
+ * Filesystem walker — yields source files relative to the scan root,
+ * filtered by .gitignore + .zivisignore + per-extractor extension filters.
+ *
+ * Uses the `ignore` npm package (the same engine git ships with) so the
+ * matching semantics mirror what developers expect from .gitignore.
+ *
+ * Hard limits:
+ *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
+ *    if not in .gitignore. These exist by convention and contain
+ *    third-party code that pollutes the inventory.
+ *  - Caps total files at 50_000 to refuse to scan a generated monorepo
+ *    by accident (extractor would take forever; user should narrow scope).
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -50,6 +64,7 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
+                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -84,9 +99,12 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
+        // No ignore file — fine.
     }
 }
+/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
+//# sourceMappingURL=walker.js.map

package/dist/internal/extractor/walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.js","sourceRoot":"","sources":["../../../src/internal/extractor/walker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,MAAkB,MAAM,QAAQ,CAAC;AAExC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC;AAmBzB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,MAAc;QACjD,IAAI,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO;QAEnE,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,yDAAyD;gBACzD,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC/B,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACzD,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE9B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,QAAgB;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/ide-setup.d.ts

@@ -1,16 +1,7 @@
-export type Package = "appsec" | "builder";
-export type GuidanceClient = "cursor" | "claude-code-cli" | "vscode-copilot" | "vscode-claude" | "cline" | "windsurf";
-export interface GuidanceOptions {
-    cwd: string;
-    client: GuidanceClient;
-}
-export declare function writeGuidance(opts: GuidanceOptions): string[];
-export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
-export declare function setupCursor(pkg?: Package): Promise<void>;
-export declare function setupCursorWorkspace(pkg?: Package): Promise<void>;
-export declare function setupVsCodeCopilot(pkg?: Package): Promise<void>;
-export declare function setupVsCodeClaude(pkg?: Package): Promise<void>;
-export declare function setupClaudeCodeCli(pkg?: Package): Promise<void>;
-export declare function setupCline(pkg?: Package): Promise<void>;
-export declare function setupWindsurf(pkg?: Package): Promise<void>;
-export declare function printClaudeCodeManual(pkg?: Package): void;
+export declare function setupCursor(session?: string): Promise<void>;
+export declare function setupVsCodeCopilot(session?: string): Promise<void>;
+export declare function setupVsCodeClaude(session?: string): Promise<void>;
+export declare function setupClaudeCodeCli(session?: string): Promise<void>;
+export declare function setupCline(session?: string): Promise<void>;
+export declare function setupWindsurf(session?: string): Promise<void>;
+export declare function printClaudeCodeManual(session?: string): void;

package/dist/internal/ide-setup.js

@@ -1,290 +1,16 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-function getServerName(pkg) {
-    return pkg === "builder" ? "zivis-builder" : "zivis";
-}
-function appendBlock(filePath, blockKey, content) {
-    const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
-    const end = `<!-- END ZIVIS:${blockKey} -->`;
-    let existing = fs.existsSync(filePath)
-        ? fs.readFileSync(filePath, "utf-8")
-        : "";
-    const blockRegex = new RegExp(`${escapeRegex(begin)}[\\s\\S]*?${escapeRegex(end)}`, "g");
-    const newBlock = `${begin}\n${content}\n${end}`;
-    if (blockRegex.test(existing)) {
-        existing = existing.replace(blockRegex, newBlock);
-    }
-    else {
-        if (existing && !existing.endsWith("\n"))
-            existing += "\n";
-        existing += `\n${newBlock}\n`;
-    }
-    const dir = path.dirname(filePath);
-    if (!fs.existsSync(dir))
-        fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(filePath, existing);
-}
-function escapeRegex(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function cursorRuleContent() {
-    return `---
-description: ZIVIS security guidance — quietly suggest security checks at the right moments
-globs:
-  - "**/*.{ts,tsx,js,jsx,py,go,rb,java}"
-  - "**/package.json"
-  - "**/requirements.txt"
-  - "**/pyproject.toml"
-  - "**/go.mod"
-  - "**/Dockerfile"
-alwaysApply: false
----
-
-<!-- BEGIN ZIVIS:guidance -->
-
-# ZIVIS Security Guidance
-
-ZIVIS is a security platform connected to this project as an MCP server.
-Use it sparingly and only when relevant — never nag.
-
-## When to suggest ZIVIS
-
-**On first security question in this project (per session):**
-If the user asks anything about security, safety, vulnerabilities, or "is this
-secure", call \`zivis_get_started\` first (no arguments). Present the
-\`recommended_next_steps\` as a numbered list. Do NOT invent your own security
-checklist — let ZIVIS produce one based on actual project state.
-
-**When dependencies change** (\`package.json\`, \`requirements.txt\`, \`go.mod\`,
-\`pyproject.toml\` is being edited and a new package is added):
-Mention once per session: "Want me to check this dependency with ZIVIS?
-It scans for prompt-injection risks and known vulnerabilities."
-If yes, call \`zivis_check_repo_trust\` with the package's source repo.
-This tool requires NO auth — works for any public GitHub repo.
-
-**When AI/LLM SDKs are imported** (\`openai\`, \`anthropic\`, \`langchain\`,
-\`@anthropic-ai/sdk\`, \`llamaindex\`, \`cohere\`, \`together\`, etc.):
-Mention once per session: "You're integrating an AI SDK. Want to set up a
-red-team target with ZIVIS? It tests for prompt injection, jailbreaks, and
-PII leakage." If yes, call \`zivis_setup_red_team_target\` with
-target_type=ai_chat.
-
-**When user mentions:** "audit", "compliance", "SOC 2", "pen test",
-"customer security questionnaire", "going to production", "launch":
-Call \`zivis_get_started\` with their phrase as the \`concern\` parameter.
-
-**When user has unread findings:**
-At the start of a session you may call \`zivis_get_findings\` (status=open) once.
-If any critical findings exist, surface them before the user starts new work.
-
-## When NOT to suggest ZIVIS
-
-- Never for non-security questions (refactors, performance, styling, tests, business logic).
-- Never call \`zivis_get_started\` more than once per session unless re-asked.
-- Never run scans that cost credits without explicit user confirmation.
-- Do not lecture about security best practices — let ZIVIS findings speak.
-
-## Vocabulary
-
-The user is a developer, not a security engineer. Avoid these words unless
-the user uses them first: "actor", "attack vector", "threat model", "STRIDE",
-"kill chain", "TTPs". Prefer plain alternatives: "tester", "how an attacker
-might break in", "security plan", "categories of attacks".
-
-## Available slash commands
-
-- \`/zivis-getting-started\` — entry-point tour for new users
-- \`/zivis-secure-my-app\` — register and test an app
-- \`/zivis-audit-dependencies\` — check open source libraries (no auth needed)
-- \`/zivis-prep-for-launch\` — pre-launch security checklist
-- \`/zivis-weekly-check\` — weekly security status update
-
-## Top tools (for quick reference)
-
-- \`zivis_get_started\` — entry point when user is unsure
-- \`zivis_check_repo_trust\` — scan a GitHub repo for risks (no auth needed)
-- \`zivis_setup_red_team_target\` — register an app for testing
-- \`zivis_run_test_scenario\` — run a security test against a target
-- \`zivis_get_findings\` — list current security issues
-- \`zivis_triage_finding\` — resolve / dismiss / accept-risk a finding
-- \`zivis_security_review\` — pre-PR composite security intelligence
-
-<!-- END ZIVIS:guidance -->`;
-}
-function claudeBlockContent() {
-    return `## ZIVIS Security (MCP)
-
-ZIVIS is connected to this project. Use its tools sparingly — only for security-related topics.
-
-**When to use ZIVIS:**
-- User asks "is this secure" / "check for vulnerabilities" / "audit my deps" → call \`zivis_get_started\` first
-- User adds a new npm/pip/go package → offer to call \`zivis_check_repo_trust\` (no auth needed)
-- User adds openai/anthropic/langchain import → offer to call \`zivis_setup_red_team_target\` (target_type=ai_chat)
-- User mentions "launch", "audit", "compliance", "pen test" → call \`zivis_get_started\` with concern=<their phrase>
-
-**When NOT to use:** refactors, performance, styling, tests, business logic, anything non-security.
-
-**Vocabulary:** Don't use "threat model", "STRIDE", "attack vector", "kill chain" unless user does.
-
-**Slash commands:** /zivis-getting-started  /zivis-secure-my-app  /zivis-audit-dependencies  /zivis-prep-for-launch`;
-}
-function ruleFileContent() {
-    return `# ZIVIS Security Guidance
-
-ZIVIS is connected to this project via MCP. Use it only for security-related requests.
-
-## When to suggest ZIVIS
-
-- User asks about security, vulnerabilities, or safety → call zivis_get_started (no args)
-- New dependency added → offer zivis_check_repo_trust (no auth, works for any public repo)
-- AI SDK import added (openai, anthropic, langchain, etc.) → offer zivis_setup_red_team_target with target_type=ai_chat
-- User mentions "audit", "launch", "pen test", "SOC 2" → call zivis_get_started with concern=<their phrase>
-
-## When NOT to use
-
-Non-security work: refactors, performance, styling, tests, business logic.
-Never run paid scans without user confirmation.
-Never call zivis_get_started more than once per session unless re-asked.
-
-## Vocabulary rule
-
-Avoid security jargon unless the user uses it first.
-Say "how someone might break in" not "attack vector".
-Say "security plan" not "threat model".
-
-## Slash commands
-
-/zivis-getting-started — start here if user is new
-/zivis-secure-my-app — set up an app for testing
-/zivis-audit-dependencies — check libraries (free, no login)
-/zivis-prep-for-launch — pre-launch checklist
-/zivis-weekly-check — weekly status update`;
-}
-function copilotBlockContent() {
-    return `## ZIVIS Security Integration
-
-This project has ZIVIS security tools available via MCP.
-
-Use ZIVIS only for security-related user requests. Never proactively run scans or access security data for non-security work.
-
-**Trigger conditions:**
-1. User asks about security/vulnerabilities/safety → call zivis_get_started
-2. New external dependency added → offer zivis_check_repo_trust (no auth required)
-3. AI SDK import added (openai, anthropic, langchain) → offer zivis_setup_red_team_target with target_type=ai_chat
-4. User mentions audit/launch/pen test/compliance → call zivis_get_started with concern parameter
-
-**Key tools:** zivis_get_started, zivis_check_repo_trust, zivis_setup_red_team_target, zivis_get_findings, zivis_triage_finding
-
-**Language:** Avoid security jargon (threat model, STRIDE, attack vector) unless user uses it first.`;
-}
-function writeCursorGuidance(cwd) {
-    const rulesDir = path.join(cwd, ".cursor", "rules");
-    if (!fs.existsSync(rulesDir))
-        fs.mkdirSync(rulesDir, { recursive: true });
-    const rulesPath = path.join(rulesDir, "zivis.mdc");
-    fs.writeFileSync(rulesPath, cursorRuleContent());
-    return rulesPath;
-}
-function writeClaudeBlockGuidance(cwd) {
-    const written = [];
-    const claudePath = path.join(cwd, "CLAUDE.md");
-    appendBlock(claudePath, "zivis-security", claudeBlockContent());
-    written.push(claudePath);
-    const agentsPath = path.join(cwd, "AGENTS.md");
-    if (fs.existsSync(agentsPath)) {
-        appendBlock(agentsPath, "zivis-security", claudeBlockContent());
-        written.push(agentsPath);
-    }
-    return written;
-}
-function writeCopilotGuidance(cwd) {
-    const ghDir = path.join(cwd, ".github");
-    if (!fs.existsSync(ghDir))
-        fs.mkdirSync(ghDir, { recursive: true });
-    const instructionsPath = path.join(ghDir, "copilot-instructions.md");
-    appendBlock(instructionsPath, "zivis-security", copilotBlockContent());
-    return instructionsPath;
-}
-function writeClineGuidance(cwd) {
-    const rulesPath = path.join(cwd, ".clinerules");
-    fs.writeFileSync(rulesPath, ruleFileContent());
-    return rulesPath;
-}
-function writeWindsurfGuidance(cwd) {
-    const rulesPath = path.join(cwd, ".windsurfrules");
-    fs.writeFileSync(rulesPath, ruleFileContent());
-    return rulesPath;
-}
-export function writeGuidance(opts) {
-    const { cwd, client } = opts;
-    const written = [];
-    switch (client) {
-        case "cursor": {
-            written.push(writeCursorGuidance(cwd));
-            const extraPaths = writeClaudeBlockGuidance(cwd).filter((p) => fs.existsSync(p));
-            written.push(...extraPaths);
-            break;
-        }
-        case "claude-code-cli":
-        case "vscode-claude": {
-            written.push(...writeClaudeBlockGuidance(cwd));
-            break;
-        }
-        case "vscode-copilot": {
-            written.push(writeCopilotGuidance(cwd));
-            break;
-        }
-        case "cline": {
-            written.push(writeClineGuidance(cwd));
-            break;
-        }
-        case "windsurf": {
-            written.push(writeWindsurfGuidance(cwd));
-            break;
-        }
-    }
-    return written.filter(Boolean);
-}
-export function detectIdesInRepo(cwd) {
-    const found = [];
-    if (fs.existsSync(path.join(cwd, ".cursor"))) {
-        found.push("cursor");
-    }
-    if (fs.existsSync(path.join(cwd, "CLAUDE.md"))) {
-        found.push("claude-code-cli");
-    }
-    if (fs.existsSync(path.join(cwd, ".vscode"))) {
-        found.push("vscode-copilot");
-    }
-    if (fs.existsSync(path.join(cwd, ".clinerules"))) {
-        found.push("cline");
-    }
-    if (fs.existsSync(path.join(cwd, ".windsurfrules"))) {
-        found.push("windsurf");
-    }
-    return found;
-}
-function buildServerConfig(pkg, workspacePath, extra) {
-    if (pkg === "builder") {
-        const args = ["-y", "@zivis/mcp-builder@alpha", "serve"];
-        if (workspacePath) {
-            args.push("--workspace", workspacePath);
-        }
-        return {
-            ...extra,
-            command: "npx",
-            args,
-        };
-    }
-    const args = ["mcp", "serve"];
-    if (workspacePath) {
-        args.push("--workspace", workspacePath);
-    }
-    return {
+const SERVER_NAME = "zivis";
+function buildServerConfig(session, extra) {
+    const config = {
         ...extra,
         command: "zivis",
-        args,
+        args: ["mcp", "serve"],
     };
+    if (session) {
+        config.env = { ZIVIS_SESSION: session };
+    }
+    return config;
 }
 async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     const configDir = path.dirname(configPath);
@@ -307,47 +33,41 @@ async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     servers[serverName] = serverConfig;
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
 }
-export async function setupCursor(pkg = "appsec") {
+export async function setupCursor(session) {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".cursor", "mcp.json");
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg), "mcpServers");
-    console.log(`✓ Cursor global MCP config updated: ${configPath}`);
+    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+    console.log(`✓ Cursor MCP config updated: ${configPath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
     console.log("  Restart Cursor for changes to take effect");
 }
-export async function setupCursorWorkspace(pkg = "appsec") {
-    const workspacePath = process.cwd();
-    const configPath = path.join(workspacePath, ".cursor", "mcp.json");
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
-    console.log(`✓ Cursor workspace MCP config updated: ${configPath}`);
-    console.log(`  Workspace: ${workspacePath}`);
-    console.log("  Reload Cursor for changes to take effect");
-}
-export async function setupVsCodeCopilot(pkg = "appsec") {
-    const workspacePath = process.cwd();
-    const localConfigPath = path.join(workspacePath, ".vscode", "mcp.json");
+export async function setupVsCodeCopilot(session) {
+    const localConfigPath = path.join(process.cwd(), ".vscode", "mcp.json");
     const globalConfigPath = path.join(process.env.HOME || "", ".vscode", "mcp.json");
     let configPath = localConfigPath;
     const exists = fs.existsSync(localConfigPath);
     if (!exists && fs.existsSync(globalConfigPath)) {
         configPath = globalConfigPath;
     }
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath, { type: "stdio" }), "servers");
+    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session, { type: "stdio" }), "servers");
     console.log(`✓ VS Code (GitHub Copilot) MCP config updated: ${configPath}`);
-    console.log(`  Workspace: ${workspacePath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupVsCodeClaude(pkg = "appsec") {
-    const workspacePath = process.cwd();
-    const configPath = path.join(workspacePath, ".vscode", "mcp.json");
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
+export async function setupVsCodeClaude(session) {
+    const configPath = path.join(process.cwd(), ".vscode", "mcp.json");
+    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
     console.log(`✓ VS Code (Claude Code) MCP config updated: ${configPath}`);
-    console.log(`  Workspace: ${workspacePath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupClaudeCodeCli(pkg = "appsec") {
+export async function setupClaudeCodeCli(session) {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".claude.json");
-    const workspacePath = process.cwd();
+    const projectPath = process.cwd();
     if (!fs.existsSync(configPath)) {
         console.log("  Skipping Claude Code CLI (no ~/.claude.json found)");
         return;
@@ -355,43 +75,48 @@ export async function setupClaudeCodeCli(pkg = "appsec") {
     try {
         const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
         config.projects ??= {};
-        config.projects[workspacePath] ??= {};
-        config.projects[workspacePath].mcpServers ??= {};
-        config.projects[workspacePath].mcpServers[getServerName(pkg)] = buildServerConfig(pkg, workspacePath, { type: "stdio" });
+        config.projects[projectPath] ??= {};
+        config.projects[projectPath].mcpServers ??= {};
+        config.projects[projectPath].mcpServers[SERVER_NAME] = {
+            type: "stdio",
+            command: "zivis",
+            args: ["mcp", "serve"],
+            env: session ? { ZIVIS_SESSION: session } : {},
+        };
         fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
         console.log("✓ Claude Code CLI MCP config updated: ~/.claude.json");
-        console.log(`  Workspace: ${workspacePath}`);
+        if (session)
+            console.log(`  Session: ${session}`);
         console.log("  Restart Claude Code for changes to take effect");
     }
     catch (err) {
         console.log(`  WARNING: Failed to update ~/.claude.json: ${err instanceof Error ? err.message : err}`);
     }
 }
-export async function setupCline(pkg = "appsec") {
-    const workspacePath = process.cwd();
+export async function setupCline(session) {
     const homeDir = process.env.HOME || "";
     const configPath = process.platform === "darwin"
         ? path.join(homeDir, "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
         : path.join(homeDir, ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json");
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
+    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
     console.log(`✓ Cline MCP config updated: ${configPath}`);
-    console.log(`  Workspace: ${workspacePath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupWindsurf(pkg = "appsec") {
-    const workspacePath = process.cwd();
+export async function setupWindsurf(session) {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".codeium", "windsurf", "mcp_config.json");
-    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
+    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
     console.log(`✓ Windsurf MCP config updated: ${configPath}`);
-    console.log(`  Workspace: ${workspacePath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
     console.log("  Restart Windsurf for changes to take effect");
 }
-export function printClaudeCodeManual(pkg = "appsec") {
-    const workspacePath = process.cwd();
+export function printClaudeCodeManual(session) {
     const serverConfig = {
         mcpServers: {
-            [getServerName(pkg)]: buildServerConfig(pkg, workspacePath),
+            [SERVER_NAME]: buildServerConfig(session),
         },
     };
     console.log("");
@@ -403,3 +128,4 @@ export function printClaudeCodeManual(pkg = "appsec") {
     console.log("");
     console.log("Then restart Claude Code for changes to take effect");
 }
+//# sourceMappingURL=ide-setup.js.map

package/dist/internal/ide-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-setup.js","sourceRoot":"","sources":["../../src/internal/ide-setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,SAAS,iBAAiB,CACxB,OAAgB,EAChB,KAA+B;IAE/B,MAAM,MAAM,GAA4B;QACtC,GAAG,KAAK;QACR,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,UAAkB,EAClB,YAAqC,EACrC,OAAe;IAEf,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,kBAAkB,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAA4B,CAAC;IAC3D,OAAO,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC;IAEnC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7D,MAAM,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAElF,IAAI,UAAU,GAAG,eAAe,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,UAAU,GAAG,gBAAgB,CAAC;IAChC,CAAC;IAED,MAAM,eAAe,CACnB,UAAU,EACV,WAAW,EACX,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAC7C,SAAS,CACV,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kDAAkD,UAAU,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,+CAA+C,UAAU,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAElC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC;QAC/C,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG;YACrD,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;YACtB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;SAC/C,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GACd,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,OAAO,EACP,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,MAAM,EACN,eAAe,EACf,wBAAwB,EACxB,UAAU,EACV,yBAAyB,CAC1B;QACH,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,OAAO,EACP,SAAS,EACT,MAAM,EACN,MAAM,EACN,eAAe,EACf,wBAAwB,EACxB,UAAU,EACV,yBAAyB,CAC1B,CAAC;IACR,MAAM,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjF,MAAM,eAAe,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE;YACV,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC;SAC1C;KACF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC"}

package/dist/internal/orgs.js

@@ -28,3 +28,4 @@ export function extractEmail(idToken) {
         return "unknown";
     }
 }
+//# sourceMappingURL=orgs.js.map

package/dist/internal/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/internal/orgs.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAmB,EACnB,WAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,yBAAyB,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,YAAY;SAC3B;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CACZ,IAA+B,CAAC,OAAO;YACrC,IAA+B,CAAC,KAAK;YACtC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;IACrE,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAC3D,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/internal/project-binding.d.ts

@@ -7,6 +7,5 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
-    force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;

package/dist/internal/project-binding.js

@@ -13,25 +13,19 @@ export async function ensureProjectBinding(opts) {
         console.log("  Note: JWT has no org_id — skipping project binding.");
         return;
     }
-    let detected = detectProjectBinding(cwd);
+    const detected = detectProjectBinding(cwd);
     if (detected?.binding.workosOrgId === jwtOrgId) {
         console.log(`✓ Project binding verified: ${detected.filePath}`);
         return;
     }
     if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
-        if (!opts.force) {
-            console.error("");
-            console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
-            console.error(`[zivis]   Binding file: ${detected.filePath}`);
-            console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
-            console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
-            console.error("[zivis] This should not happen — investigate before proceeding.");
-            process.exit(1);
-        }
-        const oldLabel = detected.binding.orgName ?? detected.binding.workosOrgId;
-        console.log(`  Replacing existing binding (was: ${oldLabel})`);
-        fs.unlinkSync(detected.filePath);
-        detected = null;
+        console.error("");
+        console.error("[zivis] ERROR: Project binding org mismatches JWT org.");
+        console.error(`[zivis]   Binding file: ${detected.filePath}`);
+        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+        console.error("[zivis] This should not happen — investigate before proceeding.");
+        process.exit(1);
     }
     let orgInfo;
     try {
@@ -99,3 +93,4 @@ export async function ensureProjectBinding(opts) {
     console.log(`  File: ${bindingPath}`);
     console.log("  Commit this file so future sessions in this repo are org-locked.");
 }
+//# sourceMappingURL=project-binding.js.map

package/dist/internal/project-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-binding.js","sourceRoot":"","sources":["../../src/internal/project-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAuB;IAChE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE3C,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,2BAA2B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,2BAA2B,QAAQ,CAAC,OAAO,CAAC,WAAW,GACrD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAChE,EAAE,CACH,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,EAAE,EAAE,IAAI,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAmB;YAC/B,GAAG,QAAQ,CAAC,OAAO;YACnB,WAAW,EAAE,QAAQ;SACtB,CAAC;QACF,IAAI,OAAO;YAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;QACxC,IAAI,UAAU;YAAE,QAAQ,CAAC,KAAK,GAAG,UAAU,CAAC;QAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IAChE,IAAI,UAAU,GAAG,QAAQ,CAAC;IAE1B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtF,UAAU,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAmB;QAC9B,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC;IACF,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACvC,IAAI,UAAU;QAAE,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACpF,CAAC"}

package/dist/internal/target-auth/api-config.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Fetches an Application's auth config from the ZIVIS platform.
+ *
+ * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
+ * file the user previously had to write by hand. The Application's IdP
+ * discovery (clientId, domain, mode, scopes) lives on the Application
+ * record on the platform; the CLI calls this endpoint to learn how to
+ * PKCE-auth, then runs the flow locally and stores tokens in the user's
+ * keychain. Tokens never leave the user's machine unless the user
+ * explicitly ships them with a scenario-run trigger.
+ */
 import type { TargetAuthConfig, WorkosMode } from "./types.js";
 interface AuthConfigResponse {
     applicationId: string;
@@ -16,5 +27,11 @@ interface AuthConfigResponse {
     error?: string;
 }
 export declare function fetchAuthConfig(applicationId: string, sessionName?: string): Promise<AuthConfigResponse>;
+/**
+ * Adapt the platform's auth-config response into the local TargetAuthConfig
+ * shape that the existing PKCE flow consumes. Throws when the application
+ * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
+ * caller should give a useful error and direct the user elsewhere.
+ */
 export declare function adaptToWorkosConfig(resp: AuthConfigResponse): TargetAuthConfig;
 export {};

package/dist/internal/target-auth/api-config.js

@@ -1,3 +1,14 @@
+/**
+ * Fetches an Application's auth config from the ZIVIS platform.
+ *
+ * Phase J.4: replaces the local `~/.config/zivis/target-configs/*.json`
+ * file the user previously had to write by hand. The Application's IdP
+ * discovery (clientId, domain, mode, scopes) lives on the Application
+ * record on the platform; the CLI calls this endpoint to learn how to
+ * PKCE-auth, then runs the flow locally and stores tokens in the user's
+ * keychain. Tokens never leave the user's machine unless the user
+ * explicitly ships them with a scenario-run trigger.
+ */
 import { ApiClient } from "@zivis/mcp/api-client";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
 export async function fetchAuthConfig(applicationId, sessionName) {
@@ -7,6 +18,12 @@ export async function fetchAuthConfig(applicationId, sessionName) {
     const client = new ApiClient(config);
     return client.request("GET", `/api/applications/${encodeURIComponent(applicationId)}/auth-config`);
 }
+/**
+ * Adapt the platform's auth-config response into the local TargetAuthConfig
+ * shape that the existing PKCE flow consumes. Throws when the application
+ * isn't OAuth-PKCE-shaped (e.g., static_token, client_credentials) — the
+ * caller should give a useful error and direct the user elsewhere.
+ */
 export function adaptToWorkosConfig(resp) {
     if (!resp.oauth) {
         throw new Error(resp.hint || resp.error ||
@@ -20,3 +37,4 @@ export function adaptToWorkosConfig(resp) {
         extraScopes: resp.oauth.scopes,
     };
 }
+//# sourceMappingURL=api-config.js.map

package/dist/internal/target-auth/api-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-config.js","sourceRoot":"","sources":["../../../src/internal/target-auth/api-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoBlD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,WAAoB;IAEpB,MAAM,MAAM,GAAG,WAAW;QACxB,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE;QAC7C,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,OAAO,CACnB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,aAAa,CAAC,cAAc,CACrE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;YACrB,eAAe,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ,mCAAmC,CACzF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;QAC7B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;QACzB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACrB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;KAC/B,CAAC;AACJ,CAAC"}