@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.41

package/dist/internal/packs/signing.js

@@ -0,0 +1,49 @@
+import * as crypto from "node:crypto";
+import { canonicalize } from "./jcs.js";
+export const DEV_PACK_SIGNING_KEY_ID = "zivis-pack-dev-2026-08";
+const DEV_PACK_PUBLIC_KEY_SPKI_B64 = "MCowBQYDK2VwAyEA1xfF9X57KKlqMA8vbHg7DEuU6K5aTURJaFINYk6wRvA=";
+const KNOWN_PUBLIC_KEYS = {
+    [DEV_PACK_SIGNING_KEY_ID]: DEV_PACK_PUBLIC_KEY_SPKI_B64,
+};
+function loadPublicKey(keyId) {
+    const spkiB64 = KNOWN_PUBLIC_KEYS[keyId];
+    if (!spkiB64)
+        return null;
+    return crypto.createPublicKey({
+        key: Buffer.from(spkiB64, "base64"),
+        format: "der",
+        type: "spki",
+    });
+}
+export function manifestSigningPayload(manifest) {
+    return canonicalize(manifest);
+}
+export function verifyManifestSignature(manifest) {
+    const { signature, ...unsigned } = manifest;
+    if (!signature || signature.algorithm !== "ed25519")
+        return false;
+    const publicKey = loadPublicKey(signature.key_id);
+    if (!publicKey)
+        return false;
+    try {
+        const payload = manifestSigningPayload(unsigned);
+        return crypto.verify(null, new Uint8Array(Buffer.from(payload, "utf8")), publicKey, new Uint8Array(Buffer.from(signature.signature, "base64")));
+    }
+    catch {
+        return false;
+    }
+}
+export function signManifestDev(manifest, privateKeySpkiB64) {
+    const privateKey = crypto.createPrivateKey({
+        key: Buffer.from(privateKeySpkiB64, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const payload = manifestSigningPayload(manifest);
+    const sig = crypto.sign(null, new Uint8Array(Buffer.from(payload, "utf8")), privateKey);
+    return {
+        algorithm: "ed25519",
+        key_id: DEV_PACK_SIGNING_KEY_ID,
+        signature: sig.toString("base64"),
+    };
+}

package/dist/internal/packs/types.d.ts

@@ -0,0 +1,70 @@
+export type PackType = "appsec" | "threatmodel";
+export interface PackContentEntry {
+    path: string;
+    sha256: string;
+}
+export interface PackScopeEntry extends PackContentEntry {
+    id: string;
+    label: string;
+    description: string;
+}
+export interface PackSignature {
+    algorithm: "ed25519";
+    key_id: string;
+    signature: string;
+}
+export interface PackManifestV1 {
+    schema_version: "1.0.0";
+    pack_id: string;
+    pack_type: PackType;
+    version: string;
+    min_cli_version: string;
+    description?: string;
+    built_at: string;
+    base: PackContentEntry;
+    scopes?: PackScopeEntry[];
+    signature: PackSignature;
+}
+export interface PackVersionSummary {
+    version: string;
+    min_cli_version: string;
+    manifest_sha256: string;
+    published_at: string;
+}
+export interface PackVersionListing {
+    pack_type: PackType;
+    versions: PackVersionSummary[];
+}
+export type PackSource = "network" | "cache-verified" | "cache-offline";
+export interface ResolvedScope {
+    id: string;
+    label: string;
+    description: string;
+    content: string;
+}
+export interface ResolvedPack {
+    packId: string;
+    packType: PackType;
+    version: string;
+    minCliVersion: string;
+    source: PackSource;
+    basePath: string;
+    baseContent: string;
+    scopes: PackScopeEntry[];
+    cacheDir: string;
+}
+export declare class PackIntegrityError extends Error {
+    constructor(message: string);
+}
+export declare class PackUnavailableError extends Error {
+    constructor(message: string);
+}
+export declare class UnknownScopeError extends Error {
+    readonly availableScopes: PackScopeEntry[];
+    constructor(scopeId: string, availableScopes: PackScopeEntry[]);
+}
+export interface PackRegistryClient {
+    listVersions(packType: PackType): Promise<PackVersionListing>;
+    getManifest(packType: PackType, version: string): Promise<PackManifestV1>;
+    getContent(packType: PackType, version: string, relativePath: string): Promise<string>;
+}

package/dist/internal/packs/types.js

@@ -0,0 +1,20 @@
+export class PackIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackIntegrityError";
+    }
+}
+export class PackUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PackUnavailableError";
+    }
+}
+export class UnknownScopeError extends Error {
+    availableScopes;
+    constructor(scopeId, availableScopes) {
+        super(`Unknown scope "${scopeId}". Available scopes: ${availableScopes.map((s) => s.id).join(", ") || "(none)"}`);
+        this.name = "UnknownScopeError";
+        this.availableScopes = availableScopes;
+    }
+}

package/dist/internal/run-workdir.d.ts

@@ -0,0 +1 @@
+export declare function writeRunWorkFile(cwd: string, runId: string, filename: string, data: unknown): string;

package/dist/internal/run-workdir.js

@@ -0,0 +1,11 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+export function writeRunWorkFile(cwd, runId, filename, data) {
+    ensureZivisGitignore(cwd);
+    const dir = path.join(cwd, ".zivis", "work", runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, filename);
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+    return filePath;
+}

package/dist/internal/security-context.d.ts

@@ -0,0 +1,62 @@
+export interface SecurityContextFinding {
+    id: string;
+    title: string;
+    severity: string;
+    status: string;
+    owaspId: string | null;
+    sourceSubtype: string;
+    resourceId: string | null;
+    firstDetectedAt: string;
+    dispositionAt?: string | null;
+    dispositionRef?: string | null;
+}
+export interface SecurityContext {
+    application: {
+        id: string;
+        name: string;
+    };
+    repo: {
+        repoFullName: string;
+        defaultBranch: string | null;
+        latestKnownCommitSha: string | null;
+        revisionSyncedAt: string | null;
+    } | null;
+    lastTestedGitSha: string | null;
+    lastThreatModeledGitSha: string | null;
+    openFindings: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    findingsAwaitingRetest: {
+        total: number;
+        truncated: boolean;
+        items: SecurityContextFinding[];
+    };
+    inconclusiveAreas: unknown[];
+    weakOrUncoveredAreas: unknown[];
+    latestThreatModel: {
+        version: number;
+        gitCommitSha: string | null;
+        updatedAt: string;
+        methodology: string | null;
+    } | null;
+    trustRoomUrl: string | null;
+    generatedAt: string;
+    gaps: {
+        field: string;
+        reason: string;
+    }[];
+}
+export interface SecurityContextApi {
+    get<T>(path: string): Promise<T>;
+}
+export type SecurityContextOutcome = {
+    available: true;
+    context: SecurityContext;
+} | {
+    available: false;
+    reason: string;
+};
+export declare function fetchSecurityContext(client: SecurityContextApi, applicationId: string): Promise<SecurityContextOutcome>;
+export declare function renderSecurityContext(outcome: SecurityContextOutcome, format?: "human" | "json"): string;

package/dist/internal/security-context.js

@@ -0,0 +1,50 @@
+export async function fetchSecurityContext(client, applicationId) {
+    try {
+        const context = await client.get(`/api/rt/applications/${encodeURIComponent(applicationId)}/security-context`);
+        return { available: true, context };
+    }
+    catch (err) {
+        return { available: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+function summarizeFinding(f) {
+    return `  - [${f.severity}] ${f.title} (${f.id})${f.owaspId ? ` — ${f.owaspId}` : ""}`;
+}
+export function renderSecurityContext(outcome, format = "human") {
+    if (format === "json") {
+        return JSON.stringify(outcome, null, 2);
+    }
+    if (!outcome.available) {
+        return `[zivis] No connected security context available (${outcome.reason}). Continuing with local-only context.`;
+    }
+    const c = outcome.context;
+    const lines = [];
+    lines.push(`ZIVIS connected security context — ${c.application.name}`);
+    if (c.repo) {
+        lines.push(`Last known repo commit: ${c.repo.latestKnownCommitSha ?? "unknown"} (${c.repo.repoFullName})`);
+    }
+    lines.push(c.lastThreatModeledGitSha
+        ? `Last threat-modeled commit: ${c.lastThreatModeledGitSha}; compare local HEAD using git.`
+        : `No prior threat model on record for this Application.`);
+    if (c.lastTestedGitSha) {
+        lines.push(`Last tested commit: ${c.lastTestedGitSha}; compare local HEAD using git.`);
+    }
+    if (c.openFindings.total > 0) {
+        lines.push(`Prior open findings: ${c.openFindings.total}${c.openFindings.truncated ? ` (showing ${c.openFindings.items.length})` : ""}`);
+        c.openFindings.items.forEach((f) => lines.push(summarizeFinding(f)));
+    }
+    else {
+        lines.push(`No prior open findings on record.`);
+    }
+    if (c.findingsAwaitingRetest.total > 0) {
+        lines.push(`Findings claimed fixed but not yet retested: ${c.findingsAwaitingRetest.total}${c.findingsAwaitingRetest.truncated ? ` (showing ${c.findingsAwaitingRetest.items.length})` : ""}`);
+        c.findingsAwaitingRetest.items.forEach((f) => lines.push(`  - Finding ${f.id} was remediated but has not been retested.${f.dispositionRef ? ` (ref: ${f.dispositionRef})` : ""}`));
+    }
+    if (c.latestThreatModel) {
+        lines.push(`Latest threat model: v${c.latestThreatModel.version}${c.latestThreatModel.methodology ? `, methodology: ${c.latestThreatModel.methodology}` : ""}`);
+    }
+    if (c.trustRoomUrl) {
+        lines.push(`Trust Room: ${c.trustRoomUrl}`);
+    }
+    return lines.join("\n");
+}

package/dist/internal/sync-outbox.d.ts

@@ -0,0 +1,40 @@
+import type { InventorySyncInput, InventorySyncProvenance } from "./inventory-sync.js";
+interface OutboxEntryBase {
+    id: string;
+    queuedAt: string;
+    attempts: number;
+    lastError: string;
+}
+export interface InventorySyncOutboxEntry extends OutboxEntryBase {
+    kind: "inventory-sync";
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+}
+export interface DevXRunCompleteOutboxEntry extends OutboxEntryBase {
+    kind: "devx-run-complete";
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+}
+export type OutboxEntry = InventorySyncOutboxEntry | DevXRunCompleteOutboxEntry;
+export declare function writeOutboxEntry(cwd: string, params: {
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+    error: string;
+}): string;
+export declare function writeDevXRunCompleteOutboxEntry(cwd: string, params: {
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+    error: string;
+}): string;
+export interface OutboxListing {
+    filePath: string;
+    entry: OutboxEntry;
+}
+export declare function listOutboxEntries(cwd: string): OutboxListing[];
+export declare function removeOutboxEntry(filePath: string): void;
+export declare function recordOutboxRetryFailure(filePath: string, entry: OutboxEntry, error: string): void;
+export {};

package/dist/internal/sync-outbox.js

@@ -0,0 +1,66 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { ensureZivisGitignore } from "./zivis-local-state.js";
+function outboxDir(cwd) {
+    return path.join(cwd, ".zivis", "outbox");
+}
+function writeEntryFile(cwd, entry) {
+    ensureZivisGitignore(cwd);
+    const dir = outboxDir(cwd);
+    fs.mkdirSync(dir, { recursive: true });
+    const filePath = path.join(dir, `${entry.queuedAt.replace(/[:.]/g, "-")}-${entry.id.slice(0, 8)}.json`);
+    fs.writeFileSync(filePath, JSON.stringify(entry, null, 2) + "\n");
+    return filePath;
+}
+export function writeOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "inventory-sync",
+        id: crypto.randomUUID(),
+        applicationId: params.applicationId,
+        input: params.input,
+        provenance: params.provenance,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function writeDevXRunCompleteOutboxEntry(cwd, params) {
+    const entry = {
+        kind: "devx-run-complete",
+        id: crypto.randomUUID(),
+        runId: params.runId,
+        contractVersion: params.contractVersion,
+        result: params.result,
+        queuedAt: new Date().toISOString(),
+        attempts: 1,
+        lastError: params.error,
+    };
+    return writeEntryFile(cwd, entry);
+}
+export function listOutboxEntries(cwd) {
+    const dir = outboxDir(cwd);
+    if (!fs.existsSync(dir))
+        return [];
+    const files = fs.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
+    const listings = [];
+    for (const file of files) {
+        const filePath = path.join(dir, file);
+        try {
+            const raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+            const entry = (raw.kind ? raw : { ...raw, kind: "inventory-sync" });
+            listings.push({ filePath, entry });
+        }
+        catch {
+        }
+    }
+    return listings;
+}
+export function removeOutboxEntry(filePath) {
+    fs.rmSync(filePath, { force: true });
+}
+export function recordOutboxRetryFailure(filePath, entry, error) {
+    const updated = { ...entry, attempts: entry.attempts + 1, lastError: error };
+    fs.writeFileSync(filePath, JSON.stringify(updated, null, 2) + "\n");
+}

package/dist/internal/test-scope.d.ts

@@ -0,0 +1,68 @@
+import { type DevXRunApi } from "./devx-run.js";
+import { type SecurityContextApi, type SecurityContextOutcome } from "./security-context.js";
+import type { PackRegistryClient } from "./packs/types.js";
+export interface TestRunDeps {
+    apiClient: DevXRunApi & SecurityContextApi;
+    registryClient: PackRegistryClient;
+}
+export interface StartTestRunParams {
+    applicationId: string;
+    scopeId?: string;
+    cwd: string;
+    cliVersion: string;
+}
+export interface ResolvedScopeSummary {
+    id: string;
+    label: string;
+}
+export interface TestRunEnvelope {
+    run_id: string;
+    application: {
+        id: string;
+    };
+    connection: {
+        mode: "connected";
+    };
+    git: {
+        sha: string | null;
+        dirty: boolean | null;
+    };
+    methodology: {
+        pack: string;
+        version: string;
+        path: string;
+        scope?: {
+            id: string;
+            label: string;
+            path: string;
+        };
+    };
+    context: {
+        path: string;
+    };
+    scope: ResolvedScopeSummary | null;
+    requested_intent: {
+        scope: string;
+    } | null;
+    result_contract: {
+        schema_version: string;
+        complete_command: string;
+    };
+    agent_instructions: string[];
+}
+export interface StartTestRunResult {
+    envelope: TestRunEnvelope;
+    resolvedScope: ResolvedScopeSummary | null;
+    contextOutcome: SecurityContextOutcome;
+}
+export declare function startTestRun(deps: TestRunDeps, params: StartTestRunParams): Promise<StartTestRunResult>;
+export interface TestScopeListing {
+    pack: string;
+    version: string;
+    scopes: {
+        id: string;
+        label: string;
+        description: string;
+    }[];
+}
+export declare function listTestScopes(registryClient: PackRegistryClient, cliVersion: string): Promise<TestScopeListing>;

package/dist/internal/test-scope.js

@@ -0,0 +1,69 @@
+import { readGitMetadata } from "./git.js";
+import { startDevXRun, DEVX_RUN_CONTRACT_VERSION } from "./devx-run.js";
+import { fetchSecurityContext } from "./security-context.js";
+import { resolveCompatiblePack, resolveScope, listAvailableScopes } from "./packs/resolve.js";
+import { writeRunWorkFile } from "./run-workdir.js";
+function scopeContentPath(resolved, scopeId) {
+    const entry = resolved.scopes.find((s) => s.id === scopeId);
+    return entry ? `${resolved.cacheDir}/${entry.path}` : resolved.cacheDir;
+}
+function buildAgentInstructions(resolvedScope) {
+    if (resolvedScope) {
+        return [
+            `Read the base methodology and the "${resolvedScope.label}" scope guidance at methodology.scope.path.`,
+            `Focus this review on the "${resolvedScope.label}" scope. Requested intent is scope=${resolvedScope.id} — this does not mean other areas were evaluated.`,
+            `You may report incidental findings outside this scope if you actually find them, but keep result provenance honest: do not claim coverage you did not perform.`,
+            `Use your own repository understanding, shell, and tools to perform the review. When finished, complete the run using result_contract.complete_command.`,
+        ];
+    }
+    return [
+        `Read the methodology at methodology.path and perform a full, adaptive AppSec review — decide applicability yourself rather than mechanically executing every category.`,
+        `Use your own repository understanding, shell, and tools to perform the review. When finished, complete the run using result_contract.complete_command.`,
+    ];
+}
+export async function startTestRun(deps, params) {
+    const [git, contextOutcome, resolvedPack] = await Promise.all([
+        readGitMetadata(params.cwd),
+        fetchSecurityContext(deps.apiClient, params.applicationId),
+        resolveCompatiblePack("appsec", { registryClient: deps.registryClient, cliVersion: params.cliVersion }),
+    ]);
+    const scope = params.scopeId ? await resolveScope(resolvedPack, params.scopeId) : null;
+    const resolvedScope = scope ? { id: scope.id, label: scope.label } : null;
+    const started = await startDevXRun(deps.apiClient, {
+        applicationId: params.applicationId,
+        runType: "test",
+        requestedIntent: resolvedScope ? { scope: resolvedScope.id } : undefined,
+        pack: { packId: resolvedPack.packId, packType: resolvedPack.packType, version: resolvedPack.version },
+        cwd: params.cwd,
+    });
+    const contextPath = writeRunWorkFile(params.cwd, started.runId, "context.json", contextOutcome);
+    const envelope = {
+        run_id: started.runId,
+        application: { id: params.applicationId },
+        connection: { mode: "connected" },
+        git: { sha: git.commitSha ?? null, dirty: git.dirty ?? null },
+        methodology: {
+            pack: resolvedPack.packType,
+            version: resolvedPack.version,
+            path: resolvedPack.basePath,
+            ...(resolvedScope ? { scope: { id: resolvedScope.id, label: resolvedScope.label, path: scopeContentPath(resolvedPack, resolvedScope.id) } } : {}),
+        },
+        context: { path: contextPath },
+        scope: resolvedScope,
+        requested_intent: resolvedScope ? { scope: resolvedScope.id } : null,
+        result_contract: {
+            schema_version: DEVX_RUN_CONTRACT_VERSION,
+            complete_command: `zivis run complete ${started.runId} --input <result.json> --json`,
+        },
+        agent_instructions: buildAgentInstructions(resolvedScope),
+    };
+    return { envelope, resolvedScope, contextOutcome };
+}
+export async function listTestScopes(registryClient, cliVersion) {
+    const resolvedPack = await resolveCompatiblePack("appsec", { registryClient, cliVersion });
+    return {
+        pack: resolvedPack.packType,
+        version: resolvedPack.version,
+        scopes: listAvailableScopes(resolvedPack),
+    };
+}

package/dist/internal/zivis-local-state.d.ts

@@ -0,0 +1 @@
+export declare function ensureZivisGitignore(cwd: string): void;

package/dist/internal/zivis-local-state.js

@@ -0,0 +1,22 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+const MANAGED_GITIGNORE_CONTENT = `# Managed by ZIVIS — local scratch/queue state, never committed.
+# .zivis/project.json (this directory's parent) is the one exception —
+# it is intentionally tracked so the whole team shares the same
+# org/Application binding.
+extracted/
+outbox/
+cache/
+work/
+`;
+export function ensureZivisGitignore(cwd) {
+    const zivisDir = path.join(cwd, ".zivis");
+    if (!fs.existsSync(zivisDir)) {
+        fs.mkdirSync(zivisDir, { recursive: true });
+    }
+    const gitignorePath = path.join(zivisDir, ".gitignore");
+    const current = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf-8") : null;
+    if (current !== MANAGED_GITIGNORE_CONTENT) {
+        fs.writeFileSync(gitignorePath, MANAGED_GITIGNORE_CONTENT);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.40",
+  "version": "0.1.0-alpha.41",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",
@@ -30,6 +30,7 @@
     "@vscode/tree-sitter-wasm": "^0.3.1",
     "commander": "^12.1.0",
     "ignore": "^7.0.5",
+    "js-yaml": "^4.1.0",
     "open": "^10.1.0",
     "web-tree-sitter": "^0.26.8",
     "@zivis/mcp": "0.1.5"
@@ -39,7 +40,6 @@
     "@types/node": "^22.0.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "js-yaml": "^4.1.0",
     "tsx": "^4.19.2",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
@@ -47,6 +47,7 @@
   "scripts": {
     "build:workspace-deps": "pnpm --filter @zivis/mcp run build",
     "build": "pnpm run build:workspace-deps && tsc -p tsconfig.build.json && node scripts/ensure-symlink.cjs",
+    "build:methodology-pack": "tsx ../scripts/build-methodology-pack.ts",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "lint": "pnpm run build:workspace-deps && tsc --noEmit",