@zivis/cli 0.1.0-alpha.45 → 0.1.0-alpha.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -127,12 +127,14 @@ might break in", "security plan", "categories of attacks".
|
|
|
127
127
|
function claudeBlockContent() {
|
|
128
128
|
return `## ZIVIS
|
|
129
129
|
|
|
130
|
-
ZIVIS is connected to this project via the \`zivis\` CLI — one agent-neutral command surface, not IDE-specific tooling.
|
|
131
|
-
|
|
132
|
-
-
|
|
133
|
-
-
|
|
134
|
-
-
|
|
135
|
-
-
|
|
130
|
+
ZIVIS is connected to this project via the \`zivis\` CLI — one agent-neutral command surface, not IDE-specific tooling. Each command grounds you with the methodology + your app's live security context; you do the work, then submit the result. The submit step is what records the work — skip it and nothing is saved.
|
|
131
|
+
|
|
132
|
+
- Security-test / review → \`zivis test\` (or \`zivis test <scope>\`; \`zivis test --list\` lists scopes). Do the review it grounds, then submit with the \`zivis run complete …\` command it prints — records findings and risks.
|
|
133
|
+
- Threat model → \`zivis threatmodel\`, author/update the model, then submit with \`zivis threatmodel sync --input <file.md>\`.
|
|
134
|
+
- Inventory → derive the repo's endpoints, tech stack, and top features, write \`{ endpoints?, technologyStack?, features? }\` to JSON, then \`zivis sync --file <inventory.json>\`.
|
|
135
|
+
- Full review or onboarding → run all three in one pass: \`zivis test\` (+submit), then \`zivis sync\`, then \`zivis threatmodel\` (+sync). Together they fill findings, risks, endpoints, tech stack, features, and a living threat model.
|
|
136
|
+
- Use your own repo understanding, reasoning, and shell/tools as needed — these commands ground you; they don't replace judgment.
|
|
137
|
+
- Don't treat their output alone as a confirmed finding; verify before reporting.`;
|
|
136
138
|
}
|
|
137
139
|
function ruleFileContent() {
|
|
138
140
|
return `# ZIVIS Security Guidance
|
package/package.json
CHANGED