@zivis/cli 0.1.0-alpha.43 → 0.1.0-alpha.44

package/dist/commands/auth/init.js

@@ -9,7 +9,7 @@ import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../.
 import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
 import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
 import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
-import { resolveExistingSessionTokens } from "../../internal/resolve-init-session.js";
+import { resolveExistingSessionAuth } from "../../internal/resolve-init-session.js";
 async function maybePromptGitHubLinkage(config) {
     try {
         const msg = await buildLinkagePrompt({ config });
@@ -74,11 +74,15 @@ export async function initCommand(opts) {
     console.log(`Environment: ${envLabel} (${config.apiBaseUrl})`);
     console.log("");
     let tokens;
-    const existing = await resolveExistingSessionTokens(config, session);
+    let existingOrgId;
+    let existingEmail;
+    const existing = await resolveExistingSessionAuth(config, session, process.cwd());
     if (existing) {
         console.log("Existing session found — reusing stored credentials.");
         console.log("(Run `zivis auth logout` first to switch accounts.)\n");
-        tokens = existing;
+        tokens = { access_token: existing.accessToken, id_token: existing.idToken };
+        existingOrgId = existing.organizationId;
+        existingEmail = existing.email;
     }
     else {
         console.log("Opening browser for authentication...");
@@ -91,9 +95,9 @@ export async function initCommand(opts) {
             process.exit(1);
         }
     }
-    const email = extractEmail(tokens.id_token);
+    const email = existingEmail ?? extractEmail(tokens.id_token);
     const claims = decodeJwtPayload(tokens.access_token);
-    const jwtOrgId = claims?.org_id;
+    const jwtOrgId = existingOrgId ?? claims?.org_id;
     if (jwtOrgId) {
         let orgName;
         try {

package/dist/commands/run/index.js

@@ -45,17 +45,39 @@ export function registerRunCommands(program) {
                 contractVersion: DEVX_RUN_CONTRACT_VERSION,
                 result,
             });
+            const reconciliation = response.reconciliation;
             const output = jsonEnvelope("run complete", {
                 run_id: runId,
                 outcome: response.outcome,
                 status: response.run.status,
                 completed_at: response.run.completedAt,
+                ...(reconciliation
+                    ? {
+                        finding_ids: reconciliation.findings.map((f) => ({ id: f.id, action: f.action })),
+                        retest_results: reconciliation.retests,
+                        evidence_ids: reconciliation.evidence.map((e) => ({ id: e.id, action: e.action })),
+                        coverage: reconciliation.coverage,
+                    }
+                    : {}),
             });
             if (json) {
                 printJson(output);
             }
             else {
                 console.log(`zivis run complete: ${response.outcome} (run ${runId} is now ${response.run.status})`);
+                if (reconciliation) {
+                    const created = reconciliation.findings.filter((f) => f.action === "created").length;
+                    const updated = reconciliation.findings.filter((f) => f.action === "updated").length;
+                    const retested = reconciliation.retests.filter((r) => r.action === "disposition_updated").length;
+                    if (created)
+                        console.log(`  + ${created} new finding${created === 1 ? "" : "s"}`);
+                    if (updated)
+                        console.log(`  ~ ${updated} finding${updated === 1 ? "" : "s"} updated`);
+                    if (retested)
+                        console.log(`  ✓ ${retested} retest${retested === 1 ? "" : "s"} recorded`);
+                    if (reconciliation.evidence.length)
+                        console.log(`  ${reconciliation.evidence.length} artifact(s) persisted`);
+                }
             }
             process.exit(EXIT.OK);
         }

package/dist/internal/devx-run.d.ts

@@ -31,9 +31,30 @@ export interface DevXRunWire {
     cancelledAt: string | null;
     cancelReason: string | null;
 }
+export interface DevXRunReconciliationSummary {
+    findings: Array<{
+        id: string;
+        action: "created" | "updated" | "unchanged";
+        fingerprint: string;
+    }>;
+    retests: Array<{
+        findingId: string;
+        outcome: "resolved" | "still_present";
+        action: "disposition_updated" | "no_change";
+    }>;
+    evidence: Array<{
+        id: string;
+        action: "created" | "existing";
+    }>;
+    coverage: Array<{
+        scopeId: string;
+        applicability: string;
+    }>;
+}
 export interface DevXRunOutcome {
     outcome: "completed" | "cancelled" | "idempotent-replay";
     run: DevXRunWire;
+    reconciliation?: DevXRunReconciliationSummary;
 }
 export declare function isRetryableDevXRunError(err: unknown): boolean;
 export declare function completeDevXRunRemote(client: DevXRunApi, params: {

package/dist/internal/project-binding.js

@@ -7,10 +7,10 @@ import { fetchUserOrgs } from "./orgs.js";
 export async function ensureProjectBinding(opts) {
     const { config, session, accessToken, cwd, autoBind, skipBind } = opts;
     const claims = decodeJwtPayload(accessToken);
-    const jwtOrgId = claims?.org_id;
+    const jwtOrgId = claims?.org_id ?? opts.organizationId;
     if (!jwtOrgId) {
         console.log("");
-        console.log("  Note: JWT has no org_id — skipping project binding.");
+        console.log("  Note: no org_id available (JWT has none, and no organizationId was supplied) — skipping project binding.");
         return;
     }
     let detected = detectProjectBinding(cwd);

package/dist/internal/resolve-init-session.d.ts

@@ -1,6 +1,8 @@
 import { type ZivisConfig } from "@zivis/mcp/types";
-export interface ExistingSessionTokens {
-    access_token: string;
-    id_token?: string;
+export interface ExistingSessionAuth {
+    accessToken: string;
+    idToken?: string;
+    organizationId?: string;
+    email?: string;
 }
-export declare function resolveExistingSessionTokens(config: ZivisConfig, session: string): Promise<ExistingSessionTokens | null>;
+export declare function resolveExistingSessionAuth(config: ZivisConfig, session: string, cwd: string): Promise<ExistingSessionAuth | null>;

package/dist/internal/resolve-init-session.js

@@ -1,10 +1,36 @@
-import { loadTokens } from "@zivis/mcp/auth";
+import { loadTokens, loadSessionIndex, resolveAuth } from "@zivis/mcp/auth";
 import { getValidAccessToken } from "@zivis/mcp/auth/token-refresh";
 import { credentialStorageFromConfig } from "@zivis/mcp/types";
-export async function resolveExistingSessionTokens(config, session) {
-    const accessToken = await getValidAccessToken({ ...config, session });
-    if (!accessToken)
+import { detectProjectBinding } from "@zivis/mcp/project-binding";
+import { fetchUserOrgs } from "./orgs.js";
+export async function resolveExistingSessionAuth(config, session, cwd) {
+    const sessionConfig = { ...config, session };
+    const oauthAccessToken = await getValidAccessToken(sessionConfig);
+    if (oauthAccessToken) {
+        const stored = await loadTokens(session, credentialStorageFromConfig(config));
+        return { accessToken: oauthAccessToken, idToken: stored?.id_token };
+    }
+    const creds = await resolveAuth(sessionConfig, "apikey");
+    if (creds.method !== "apikey" || !creds.apiKey)
         return null;
-    const stored = await loadTokens(session, credentialStorageFromConfig(config));
-    return { access_token: accessToken, id_token: stored?.id_token };
+    const binding = detectProjectBinding(cwd);
+    const workosOrgId = binding?.binding.workosOrgId;
+    if (!workosOrgId)
+        return null;
+    let orgs;
+    try {
+        orgs = await fetchUserOrgs(config, creds.apiKey);
+    }
+    catch {
+        return null;
+    }
+    if (!orgs.some((o) => o.workosOrgId === workosOrgId)) {
+        return null;
+    }
+    const index = await loadSessionIndex(credentialStorageFromConfig(config));
+    return {
+        accessToken: creds.apiKey,
+        organizationId: workosOrgId,
+        email: index[session]?.email,
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.43",
+  "version": "0.1.0-alpha.44",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",