@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/commands/auth/status.js

@@ -1,12 +1,13 @@
-import { resolveAuth, loadTokens, getStorageName, keychainRead } from "@zivis/mcp/auth";
-import { detectProjectBinding } from "@zivis/mcp/project-binding";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveAuth, loadTokens, keychainRead } from "@zivis/mcp/auth";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "@zivis/mcp/types";
 import { extractEmail } from "../../internal/orgs.js";
 export async function statusCommand(opts) {
-    const config = DEFAULT_CONFIG;
+    const config = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(process.cwd()) };
     const detected = detectProjectBinding(process.cwd());
     const session = opts.session || config.session || detected?.binding.session;
     const resolveConfig = session ? { ...config, session } : config;
+    const st = credentialStorageFromConfig(resolveConfig);
     if (session) {
         const source = opts.session
             ? "flag"
@@ -18,7 +19,7 @@ export async function statusCommand(opts) {
     const creds = await resolveAuth(resolveConfig);
     switch (creds.method) {
         case "oauth": {
-            const tokens = await loadTokens(session);
+            const tokens = await loadTokens(session, st);
             const email = extractEmail(tokens?.id_token);
             console.log(`Auth:   OAuth (${email})`);
             if (tokens) {
@@ -28,11 +29,30 @@ export async function statusCommand(opts) {
             break;
         }
         case "apikey": {
-            const masked = creds.apiKey?.startsWith("sk_")
-                ? `sk_...${creds.apiKey.slice(-4)}`
+            const key = creds.apiKey ?? "";
+            const masked = key.startsWith("sk_")
+                ? `${key.slice(0, 10)}...${key.slice(-4)}`
                 : "***";
-            const source = (await keychainRead("apikey")) ? getStorageName() : "environment variable";
-            console.log(`Auth:   API Key (${masked}) from ${source}`);
+            const sessionApiKeyAccount = session ? `apikey.${session}` : null;
+            const isSessionKey = sessionApiKeyAccount
+                ? !!(await keychainRead(sessionApiKeyAccount, st))
+                : false;
+            const isEnvKey = key === process.env.ZIVIS_API_KEY;
+            const isGlobalKey = !isSessionKey && !isEnvKey && !!(await keychainRead("apikey", st));
+            if (isSessionKey && key.startsWith("sk_")) {
+                console.log(`Auth:   Local Project Binding Token (${masked})`);
+                console.log(`        Minted by \`zivis auth bind\` — org-scoped, no refresh needed`);
+            }
+            else if (isEnvKey) {
+                console.log(`Auth:   API Key from ZIVIS_API_KEY env var (${masked})`);
+            }
+            else if (isGlobalKey) {
+                console.log(`Auth:   API Key from keychain (${masked})`);
+                console.log(`        Run \`zivis auth bind\` in this repo for project-scoped credentials`);
+            }
+            else {
+                console.log(`Auth:   API Key (${masked})`);
+            }
             break;
         }
         case "none":
@@ -40,14 +60,15 @@ export async function statusCommand(opts) {
             console.log("");
             if (session) {
                 console.log(`Session "${session}" has no credentials.`);
-                console.log(`Run: zivis auth login --session ${session}`);
+                console.log(`  Run in this repo:  zivis auth bind`);
+                console.log(`  Or manually:       zivis auth login --session ${session}`);
             }
             else {
                 console.log("To authenticate:");
-                console.log("  zivis auth login");
+                console.log("  zivis auth bind    (recommended — mints a project-scoped token)");
+                console.log("  zivis auth login   (interactive OAuth for web access)");
             }
             break;
     }
     console.log(`API:    ${resolveConfig.apiBaseUrl}`);
 }
-//# sourceMappingURL=status.js.map

package/dist/commands/auth/token.d.ts

@@ -0,0 +1,4 @@
+export interface TokenCmdOpts {
+    session?: string;
+}
+export declare function tokenCommand(apiKey: string, opts: TokenCmdOpts): Promise<void>;

package/dist/commands/auth/token.js

@@ -0,0 +1,73 @@
+import { keychainStore, getStorageName } from "@zivis/mcp/auth";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "@zivis/mcp/types";
+const API_KEY_PREFIX = "sk_";
+const API_KEY_REGEX = /^sk_[a-z0-9_]{10,}$/i;
+function getApiKeyAccount(session) {
+    return session ? `apikey.${session}` : "apikey";
+}
+function validateKeyFormat(key) {
+    return API_KEY_REGEX.test(key);
+}
+export async function tokenCommand(apiKey, opts) {
+    if (!validateKeyFormat(apiKey)) {
+        console.error(`Invalid API token format. Expected: ${API_KEY_PREFIX}<token value>`);
+        console.error(`Got: ${apiKey.substring(0, 20)}...`);
+        console.error(`\nGenerate a token at: Settings → API Tokens in the ZIVIS platform.`);
+        process.exit(1);
+    }
+    const cwd = process.cwd();
+    const detected = detectProjectBinding(cwd);
+    const session = opts.session ?? detected?.binding.session;
+    const config = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(cwd) };
+    const account = getApiKeyAccount(session);
+    const sessionLabel = session ? `session "${session}"` : "default session";
+    const storageName = getStorageName();
+    try {
+        await keychainStore(account, apiKey, credentialStorageFromConfig(config));
+    }
+    catch (err) {
+        console.error(`Failed to store token: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+    }
+    const maskedKey = `${apiKey.substring(0, 12)}...${apiKey.slice(-4)}`;
+    console.log(`✓ API token stored for ${sessionLabel}`);
+    console.log(`  Key: ${maskedKey}`);
+    console.log(`  Storage: ${storageName} (account: ${account})`);
+    if (session) {
+        console.log(`\nThe MCP server will use this token automatically for projects bound to session "${session}".`);
+    }
+    else {
+        console.log(`\nThe MCP server will use this token for the default session.`);
+        console.log(`Tip: Use --session <name> to scope this token to a specific org.`);
+    }
+    if (detected) {
+        const orgLabel = detected.binding.orgName
+            ? ` (${detected.binding.orgName})`
+            : "";
+        console.log(`\nProject binding detected: this repo is bound to session "${detected.binding.session}"${orgLabel}.`);
+        if (!session) {
+            console.log(`  Tip: Run with --session ${detected.binding.session} to scope this token to that org.`);
+        }
+    }
+    try {
+        const response = await fetch(`${config.apiBaseUrl}/api/mcp/session`, {
+            headers: { "X-API-Key": apiKey, "User-Agent": "@zivis/cli" },
+        });
+        if (response.ok) {
+            const data = (await response.json());
+            const orgName = data.org?.name ?? "unknown org";
+            const email = data.user?.email ?? "unknown user";
+            console.log(`\n✓ Token verified — authenticated as ${email} in ${orgName}`);
+        }
+        else {
+            const body = await response.json().catch(() => ({}));
+            console.log(`\n  Warning: Could not verify token against API (HTTP ${response.status}): ${body.message ?? body.error ?? "unknown error"}`);
+            console.log(`  Token was stored but may be invalid or lack the 'mcp' scope.`);
+        }
+    }
+    catch {
+        console.log(`\n  Note: Could not reach the ZIVIS API to verify the token (stored anyway).`);
+    }
+    process.exit(0);
+}

package/dist/commands/check/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerCheckCommands(program: Command): void;

package/dist/commands/check/index.js

@@ -0,0 +1,463 @@
+import * as crypto from "node:crypto";
+import * as readline from "node:readline";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { resolveAuth } from "@zivis/mcp/auth";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { runMatcher } from "@zivis/mcp/matcher";
+import { runExtractor } from "../../internal/extractor/index.js";
+import { buildRepoGraphArtifact } from "../../internal/extractor/graph-builder.js";
+import { loginCommand } from "../auth/login.js";
+import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+const execAsync = promisify(exec);
+const LLM_PACKAGE_NAMES = new Set([
+    "openai",
+    "@anthropic-ai/sdk",
+    "anthropic",
+    "@anthropic-ai/bedrock-sdk",
+    "@anthropic-ai/vertex-sdk",
+    "@google/generative-ai",
+    "@google-cloud/aiplatform",
+    "@google-cloud/vertexai",
+    "@aws-sdk/client-bedrock-runtime",
+    "@azure/openai",
+    "langchain",
+    "@langchain/core",
+    "@langchain/openai",
+    "@langchain/anthropic",
+    "llamaindex",
+    "ai",
+    "ollama",
+    "cohere-ai",
+    "@cohere-ai/sdk",
+    "replicate",
+    "mistralai",
+    "@mistralai/mistralai",
+    "groq-sdk",
+    "@groq/groq-sdk",
+]);
+export function registerCheckCommands(program) {
+    program
+        .command("check")
+        .description("inspect this repo's architecture and post findings to your ZIVIS threat model")
+        .option("--cwd <path>", "repo root to inspect (default: cwd)")
+        .option("--format <fmt>", "output format: human or json", "human")
+        .option("--no-network", "skip server-side promotion; build the graph + run matcher locally only")
+        .action(async (opts) => {
+        const result = await runCheck(opts);
+        process.exit(result.exitCode);
+    });
+}
+async function runCheck(opts) {
+    const rootDir = opts.cwd ?? process.cwd();
+    const format = opts.format === "json" ? "json" : "human";
+    const network = opts.network !== false;
+    const config = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(rootDir) };
+    const authStatus = await resolveAuth(config);
+    if (authStatus.method === "none") {
+        const handled = await handleUnauthenticated({ format, config });
+        if (handled !== "continue") {
+            return { exitCode: handled };
+        }
+        const recheck = await resolveAuth(config);
+        if (recheck.method === "none") {
+            printIfHuman(format, "\nAuth did not complete. Run `zivis auth login` and try again.");
+            return { exitCode: 1 };
+        }
+    }
+    const creds = await resolveAuth(config);
+    const startedAt = Date.now();
+    const extractorOutput = await runExtractor({
+        rootDir,
+        extractorVersion: "check",
+    });
+    const gitMeta = await readGitMetadata(rootDir);
+    const binding = detectProjectBinding(rootDir);
+    const applicationId = binding?.binding.applicationId;
+    const repoId = deriveRepoId(gitMeta.remoteUrl, rootDir);
+    const artifact = buildRepoGraphArtifact(extractorOutput, {
+        applicationId,
+        repoId,
+        commitSha: gitMeta.commitSha,
+        branch: gitMeta.branch,
+        analysisMode: "local",
+    });
+    const artifactPath = await writeArtifactToCache(artifact);
+    let matcherFindings = [];
+    try {
+        const matcherResult = await runMatcher({ artifactPath, cwd: rootDir });
+        matcherFindings = matcherResult.findings;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`\n[zivis check] matcher failed (continuing without pattern matches): ${msg}\n`);
+    }
+    const durationMs = Date.now() - startedAt;
+    const summary = summarizeArtifact(artifact, matcherFindings);
+    let promotion;
+    let promotionError;
+    if (network) {
+        try {
+            promotion = await postCheckArtifact({
+                config,
+                creds,
+                artifact,
+                findings: matcherFindings,
+                repoName: deriveRepoNameFromGit(gitMeta.remoteUrl, rootDir),
+            });
+        }
+        catch (err) {
+            promotionError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    let linkagePrompt = null;
+    if (network) {
+        try {
+            linkagePrompt = await buildLinkagePrompt({
+                config,
+                applicationId: promotion?.applicationId ?? applicationId,
+            });
+        }
+        catch {
+        }
+    }
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(buildJsonOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt), null, 2) + "\n");
+    }
+    else {
+        renderHumanOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt);
+    }
+    return { exitCode: 0 };
+}
+async function handleUnauthenticated(args) {
+    const isInteractive = process.stdout.isTTY && process.stdin.isTTY && process.env.CI !== "true";
+    if (!isInteractive) {
+        printNonTtyAuthInstructions(args.format);
+        return 1;
+    }
+    if (args.format === "json") {
+        process.stdout.write(JSON.stringify({
+            schema_version: "1",
+            error: "not_authenticated",
+            message: "zivis check requires authentication; run `zivis auth login` interactively.",
+        }, null, 2) + "\n");
+        return 1;
+    }
+    const choice = await promptAuthChoice();
+    if (choice === "quit") {
+        process.stdout.write("\nCancelled — run `zivis check` again when ready.\n");
+        return 1;
+    }
+    process.stdout.write(`\nOpening your browser to ${choice === "create" ? "sign up" : "sign in"}...\n`);
+    try {
+        await loginCommand({});
+    }
+    catch (err) {
+        process.stdout.write(`\nAuthentication failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    process.stdout.write("\nRunning zivis check ...\n\n");
+    return "continue";
+}
+function printNonTtyAuthInstructions(format) {
+    if (format === "json") {
+        process.stdout.write(JSON.stringify({
+            schema_version: "1",
+            error: "not_authenticated",
+            message: "zivis check requires authentication; set ZIVIS_API_KEY for CI or run interactively.",
+            help: {
+                sign_up: "https://app.zivis.ai/sign-up?source=cli",
+                sign_in: "https://app.zivis.ai/sign-in?source=cli",
+                api_keys: "https://app.zivis.ai/settings/api-keys",
+            },
+        }, null, 2) + "\n");
+        return;
+    }
+    process.stdout.write(`\nZIVIS requires an account to inspect repos.\n\n` +
+        `  → Sign up:                  https://app.zivis.ai/sign-up?source=cli\n` +
+        `  → Sign in:                  https://app.zivis.ai/sign-in?source=cli\n` +
+        `  → For CI / headless use:    set ZIVIS_API_KEY (issue a service key from\n` +
+        `                              https://app.zivis.ai/settings/api-keys)\n\n`);
+}
+async function promptAuthChoice() {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        process.stdout.write(`\nZIVIS requires an account to inspect repos.\n\n` +
+            `  1) Create account   (recommended — first time using ZIVIS)\n` +
+            `  2) Sign in          (already have an account)\n` +
+            `  q) Quit\n\n`);
+        for (;;) {
+            const raw = await new Promise((resolve) => rl.question("> ", resolve));
+            const choice = raw.trim().toLowerCase();
+            if (choice === "" || choice === "1")
+                return "create";
+            if (choice === "2")
+                return "signin";
+            if (choice === "q" || choice === "quit")
+                return "quit";
+            process.stdout.write("Please choose 1, 2, or q.\n");
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+async function postCheckArtifact(args) {
+    const { config, creds, artifact, findings, repoName } = args;
+    const url = `${config.apiBaseUrl}/api/cli/check`;
+    const headers = {
+        "Content-Type": "application/json",
+        "User-Agent": "@zivis/cli",
+    };
+    if (creds.method === "oauth" && creds.accessToken) {
+        headers.Authorization = `Bearer ${creds.accessToken}`;
+    }
+    else if (creds.method === "apikey" && creds.apiKey) {
+        headers["X-API-Key"] = creds.apiKey;
+    }
+    const body = {
+        artifact,
+        matches: findings.map((f) => ({
+            pattern_id: f.pattern_id,
+            lane: f.lane,
+            confidence: f.confidence,
+            evidence_spans: (f.evidence ?? []).map((e) => ({
+                file: e.file,
+                line_span: e.end_line ? [e.start_line, e.end_line] : undefined,
+            })),
+            capsule: {
+                safe_summary: f.safe_summary,
+                threats: Array.isArray(f.threats) ? f.threats : undefined,
+            },
+        })),
+        repoName,
+    };
+    const response = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`HTTP ${response.status} from /api/cli/check: ${text.slice(0, 400)}`);
+    }
+    return (await response.json());
+}
+function summarizeArtifact(artifact, findings) {
+    const services = artifact.nodes.filter((n) => n.type === "service").length;
+    const endpoints = artifact.nodes.filter((n) => n.type === "endpoint").length;
+    const deps = artifact.nodes.filter((n) => n.type === "external_dependency");
+    const llmIntegrations = new Set();
+    for (const dep of deps) {
+        if (dep.type !== "external_dependency")
+            continue;
+        const pkg = dep.attributes.package;
+        if (!pkg)
+            continue;
+        if (LLM_PACKAGE_NAMES.has(pkg)) {
+            llmIntegrations.add(friendlyLlmName(pkg));
+        }
+    }
+    const trustedMatches = findings.filter((f) => f.lane === "trusted").length;
+    const inferredMatches = findings.filter((f) => f.lane === "inferred").length;
+    const topPatterns = findings
+        .slice()
+        .sort((a, b) => b.confidence - a.confidence)
+        .slice(0, 3)
+        .map((f) => f.pattern_id);
+    return {
+        serviceCount: services,
+        endpointCount: endpoints,
+        externalDependencyCount: deps.length,
+        llmIntegrations: Array.from(llmIntegrations).sort(),
+        languages: artifact.scope.languages ?? [],
+        filesScanned: artifact.scope.files_scanned ?? 0,
+        trustedMatches,
+        inferredMatches,
+        topPatterns,
+    };
+}
+function friendlyLlmName(pkg) {
+    if (pkg === "openai" || pkg === "@azure/openai")
+        return "openai";
+    if (pkg.startsWith("@anthropic-ai") || pkg === "anthropic")
+        return "anthropic";
+    if (pkg.startsWith("@google") || pkg.includes("vertexai") || pkg.includes("generative-ai")) {
+        return "google";
+    }
+    if (pkg.includes("bedrock"))
+        return "aws-bedrock";
+    if (pkg.startsWith("@langchain") || pkg === "langchain")
+        return "langchain";
+    if (pkg === "llamaindex")
+        return "llamaindex";
+    if (pkg === "ollama")
+        return "ollama";
+    if (pkg.includes("cohere"))
+        return "cohere";
+    if (pkg.includes("mistral"))
+        return "mistral";
+    if (pkg.includes("groq"))
+        return "groq";
+    if (pkg === "ai")
+        return "vercel-ai";
+    return pkg;
+}
+function renderHumanOutput(_artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt) {
+    const seconds = (durationMs / 1000).toFixed(1);
+    let out = `\nZIVIS read your repo (${seconds}s):\n\n`;
+    out += `  Architecture (current snapshot)\n`;
+    out += `    ${summary.serviceCount} service${plural(summary.serviceCount)} · ${summary.endpointCount} endpoint${plural(summary.endpointCount)}\n`;
+    if (summary.llmIntegrations.length > 0) {
+        out += `    ${summary.llmIntegrations.length} LLM integration${plural(summary.llmIntegrations.length)} (${summary.llmIntegrations.join(", ")})\n`;
+    }
+    if (summary.languages.length > 0) {
+        out += `    Languages: ${summary.languages.join(", ")}\n`;
+    }
+    const totalMatches = summary.trustedMatches + summary.inferredMatches;
+    if (totalMatches > 0) {
+        out += `\n  Patterns matched\n`;
+        out += `    ${summary.trustedMatches} trusted · ${summary.inferredMatches} inferred (need IDE review)\n`;
+        for (const p of summary.topPatterns) {
+            out += `      • ${p}\n`;
+        }
+    }
+    if (promotion) {
+        out += `\n  ${promotion.isNewApplication ? "Created" : "Updated"} threat model — "${promotion.applicationName}"\n`;
+        out += `    Components:   +${promotion.componentsAdded}`;
+        if (promotion.componentsUnchanged > 0)
+            out += ` (${promotion.componentsUnchanged} already present)`;
+        out += `\n`;
+        out += `    Data flows:   +${promotion.dataFlowsAdded}`;
+        if (promotion.dataFlowsUnchanged > 0)
+            out += ` (${promotion.dataFlowsUnchanged} already present)`;
+        out += `\n`;
+        out += `    Actors:       +${promotion.actorsAttached}\n`;
+        out += `    Observations: +${promotion.findingsCreated}\n`;
+        out += `    Scenarios:    +${promotion.scenariosGenerated}\n`;
+        out += `\n  View it:    ${promotion.webAppUrl}\n`;
+    }
+    else if (network && promotionError) {
+        out += `\n  Could not post to your threat model: ${promotionError}\n`;
+        out += `  (graph + matches still produced locally; rerun once the API is reachable)\n`;
+    }
+    else if (!network) {
+        out += `\n  (--no-network: nothing posted to your threat model)\n`;
+    }
+    out += `\nContinue:\n`;
+    out += `  → In your IDE:                         zivis mcp install --for claude-code\n`;
+    out += `  → Human-reviewed Mini-Threat-Model:    zivis teardown   ($500)\n`;
+    out += `  → Full Deal-Readiness Threat Model:    zivis sales      ($7.5K–$15K)\n`;
+    if (linkagePrompt) {
+        out += linkagePrompt + "\n";
+    }
+    out += "\n";
+    process.stdout.write(out);
+}
+function plural(n) {
+    return n === 1 ? "" : "s";
+}
+function buildJsonOutput(artifact, summary, durationMs, promotion, promotionError, network, linkagePrompt) {
+    let promotionField;
+    if (promotion)
+        promotionField = { status: "ok", ...promotion };
+    else if (!network)
+        promotionField = { status: "skipped", reason: "no-network" };
+    else if (promotionError)
+        promotionField = { status: "error", error: promotionError };
+    return {
+        schema_version: "1",
+        repo_id: artifact.provenance.repo_id ?? "unknown",
+        ran_at: artifact.extracted_at,
+        duration_ms: durationMs,
+        architecture: {
+            services: summary.serviceCount,
+            endpoints: summary.endpointCount,
+            external_dependencies: summary.externalDependencyCount,
+            llm_integrations: summary.llmIntegrations,
+            languages: summary.languages,
+        },
+        matches: {
+            trusted: summary.trustedMatches,
+            inferred: summary.inferredMatches,
+            top_patterns: summary.topPatterns,
+        },
+        promotion: promotionField,
+        conversion_links: {
+            mcp_install: "zivis mcp install --for <ide>",
+            teardown: "zivis teardown",
+            sales: "zivis sales",
+        },
+        linkage_prompt: linkagePrompt,
+    };
+}
+function printIfHuman(format, msg) {
+    if (format === "human")
+        process.stdout.write(msg + "\n");
+}
+async function readGitMetadata(rootDir) {
+    return {
+        remoteUrl: await tryGit(rootDir, "remote get-url origin"),
+        commitSha: await tryGit(rootDir, "rev-parse HEAD"),
+        branch: await tryGit(rootDir, "rev-parse --abbrev-ref HEAD"),
+    };
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function deriveRepoId(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        return "remote-" + sha256Short(remoteUrl);
+    }
+    return "path-" + sha256Short(rootDir);
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+function deriveRepoNameFromGit(remoteUrl, rootDir) {
+    if (remoteUrl) {
+        const m = /[/:]([^/:]+?)\/([^/]+?)(?:\.git)?$/.exec(remoteUrl);
+        if (m)
+            return m[2];
+    }
+    const base = path.basename(rootDir);
+    return base && base !== "." ? base : undefined;
+}
+function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+async function writeArtifactToCache(artifact) {
+    const repoId = artifact.provenance.repo_id ?? "unknown";
+    const commitSha = artifact.provenance.commit_sha;
+    const runId = formatRunId(commitSha, artifact.extracted_at);
+    const outPath = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs", `${runId}.json`);
+    await fs.mkdir(path.dirname(outPath), { recursive: true });
+    await fs.writeFile(outPath, JSON.stringify(artifact, null, 2) + "\n");
+    return outPath;
+}
+function formatRunId(commitSha, extractedAt) {
+    const compactTs = extractedAt.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+    if (!commitSha)
+        return `nogit-${compactTs}`;
+    return `${commitSha.slice(0, 7)}-${compactTs}`;
+}

package/dist/commands/credits/index.js

@@ -1,7 +1,7 @@
 import { ApiClient } from "@zivis/mcp/api-client";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 function buildClient(opts) {
-    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
+    const config = opts.session ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session } : resolveConfigFromBinding(process.cwd());
     return new ApiClient(config);
 }
 export function registerCreditsCommands(program) {
@@ -48,4 +48,3 @@ export function registerCreditsCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/gate/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerGateCommand(program: Command): void;