@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/internal/ide-setup.js

@@ -1,16 +1,349 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-const SERVER_NAME = "zivis";
-function buildServerConfig(session, extra) {
-    const config = {
+function getServerName(pkg) {
+    return pkg === "builder" ? "zivis-builder" : "zivis";
+}
+function appendBlock(filePath, blockKey, content) {
+    const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
+    const end = `<!-- END ZIVIS:${blockKey} -->`;
+    let existing = fs.existsSync(filePath)
+        ? fs.readFileSync(filePath, "utf-8")
+        : "";
+    const blockRegex = new RegExp(`${escapeRegex(begin)}[\\s\\S]*?${escapeRegex(end)}`, "g");
+    const newBlock = `${begin}\n${content}\n${end}`;
+    if (blockRegex.test(existing)) {
+        existing = existing.replace(blockRegex, newBlock);
+    }
+    else {
+        if (existing && !existing.endsWith("\n"))
+            existing += "\n";
+        existing += `\n${newBlock}\n`;
+    }
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(filePath, existing);
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function removeBlockFrom(filePath, blockKey) {
+    if (!fs.existsSync(filePath))
+        return false;
+    const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
+    const end = `<!-- END ZIVIS:${blockKey} -->`;
+    const blockRegex = new RegExp(`\\n?${escapeRegex(begin)}[\\s\\S]*?${escapeRegex(end)}\\n?`, "g");
+    const existing = fs.readFileSync(filePath, "utf-8");
+    if (!blockRegex.test(existing))
+        return false;
+    const stripped = existing.replace(blockRegex, "\n").replace(/\n{3,}/g, "\n\n");
+    fs.writeFileSync(filePath, stripped);
+    return true;
+}
+function cursorRuleContent() {
+    return `---
+description: ZIVIS security guidance — quietly suggest security checks at the right moments
+globs:
+  - "**/*.{ts,tsx,js,jsx,py,go,rb,java}"
+  - "**/package.json"
+  - "**/requirements.txt"
+  - "**/pyproject.toml"
+  - "**/go.mod"
+  - "**/Dockerfile"
+alwaysApply: false
+---
+
+<!-- BEGIN ZIVIS:guidance -->
+
+# ZIVIS Security Guidance
+
+ZIVIS is a security platform connected to this project as an MCP server.
+Use it sparingly and only when relevant — never nag.
+
+## When to suggest ZIVIS
+
+**On first security question in this project (per session):**
+If the user asks anything about security, safety, vulnerabilities, or "is this
+secure", call \`zivis_get_started\` first (no arguments). Present the
+\`recommended_next_steps\` as a numbered list. Do NOT invent your own security
+checklist — let ZIVIS produce one based on actual project state.
+
+**When dependencies change** (\`package.json\`, \`requirements.txt\`, \`go.mod\`,
+\`pyproject.toml\` is being edited and a new package is added):
+Mention once per session: "Want me to check this dependency with ZIVIS?
+It scans for prompt-injection risks and known vulnerabilities."
+If yes, call \`zivis_check_repo_trust\` with the package's source repo.
+This tool requires NO auth — works for any public GitHub repo.
+
+**When AI/LLM SDKs are imported** (\`openai\`, \`anthropic\`, \`langchain\`,
+\`@anthropic-ai/sdk\`, \`llamaindex\`, \`cohere\`, \`together\`, etc.):
+Mention once per session: "You're integrating an AI SDK. Want to set up a
+red-team target with ZIVIS? It tests for prompt injection, jailbreaks, and
+PII leakage." If yes, call \`zivis_setup_red_team_target\` with
+target_type=ai_chat.
+
+**When user mentions:** "audit", "compliance", "SOC 2", "pen test",
+"customer security questionnaire", "going to production", "launch":
+Call \`zivis_get_started\` with their phrase as the \`concern\` parameter.
+
+**When user has unread findings:**
+At the start of a session you may call \`zivis_get_findings\` (status=open) once.
+If any critical findings exist, surface them before the user starts new work.
+
+## When NOT to suggest ZIVIS
+
+- Never for non-security questions (refactors, performance, styling, tests, business logic).
+- Never call \`zivis_get_started\` more than once per session unless re-asked.
+- Never run scans that cost credits without explicit user confirmation.
+- Do not lecture about security best practices — let ZIVIS findings speak.
+
+## Vocabulary
+
+The user is a developer, not a security engineer. Avoid these words unless
+the user uses them first: "actor", "attack vector", "threat model", "STRIDE",
+"kill chain", "TTPs". Prefer plain alternatives: "tester", "how an attacker
+might break in", "security plan", "categories of attacks".
+
+## Available slash commands
+
+- \`/zivis-getting-started\` — entry-point tour for new users
+- \`/zivis-secure-my-app\` — register and test an app
+- \`/zivis-audit-dependencies\` — check open source libraries (no auth needed)
+- \`/zivis-prep-for-launch\` — pre-launch security checklist
+- \`/zivis-weekly-check\` — weekly security status update
+
+## Top tools (for quick reference)
+
+- \`zivis_get_started\` — entry point when user is unsure
+- \`zivis_check_repo_trust\` — scan a GitHub repo for risks (no auth needed)
+- \`zivis_setup_red_team_target\` — register an app for testing
+- \`zivis_run_test_scenario\` — run a security test against a target
+- \`zivis_get_findings\` — list current security issues
+- \`zivis_triage_finding\` — resolve / dismiss / accept-risk a finding
+- \`zivis_security_review\` — pre-PR composite security intelligence
+
+<!-- END ZIVIS:guidance -->`;
+}
+function claudeBlockContent() {
+    return `## ZIVIS
+
+ZIVIS is connected to this project via the \`zivis\` CLI — one agent-neutral command surface, not IDE-specific tooling. Each command grounds you with the methodology + your app's live security context; you do the work, then submit the result. The submit step is what records the work — skip it and nothing is saved.
+
+- Security-test / review → \`zivis test\` (or \`zivis test <scope>\`; \`zivis test --list\` lists scopes). Do the review it grounds, then submit with the \`zivis run complete …\` command it prints — records findings and risks.
+- Threat model → \`zivis threatmodel\`, author/update the model, then submit with \`zivis threatmodel sync --input <file.md>\`.
+- Inventory → derive the repo's endpoints, tech stack, and top features, write \`{ endpoints?, technologyStack?, features? }\` to JSON, then \`zivis sync --file <inventory.json>\`.
+- Full review or onboarding → run all three in one pass: \`zivis test\` (+submit), then \`zivis sync\`, then \`zivis threatmodel\` (+sync). Together they fill findings, risks, endpoints, tech stack, features, and a living threat model.
+- Use your own repo understanding, reasoning, and shell/tools as needed — these commands ground you; they don't replace judgment.
+- Don't treat their output alone as a confirmed finding; verify before reporting.`;
+}
+function ruleFileContent() {
+    return `# ZIVIS Security Guidance
+
+ZIVIS is connected to this project via MCP. Use it only for security-related requests.
+
+## When to suggest ZIVIS
+
+- User asks about security, vulnerabilities, or safety → call zivis_get_started (no args)
+- New dependency added → offer zivis_check_repo_trust (no auth, works for any public repo)
+- AI SDK import added (openai, anthropic, langchain, etc.) → offer zivis_setup_red_team_target with target_type=ai_chat
+- User mentions "audit", "launch", "pen test", "SOC 2" → call zivis_get_started with concern=<their phrase>
+
+## When NOT to use
+
+Non-security work: refactors, performance, styling, tests, business logic.
+Never run paid scans without user confirmation.
+Never call zivis_get_started more than once per session unless re-asked.
+
+## Vocabulary rule
+
+Avoid security jargon unless the user uses it first.
+Say "how someone might break in" not "attack vector".
+Say "security plan" not "threat model".
+
+## Slash commands
+
+/zivis-getting-started — start here if user is new
+/zivis-secure-my-app — set up an app for testing
+/zivis-audit-dependencies — check libraries (free, no login)
+/zivis-prep-for-launch — pre-launch checklist
+/zivis-weekly-check — weekly status update`;
+}
+function copilotBlockContent() {
+    return `## ZIVIS Security Integration
+
+This project has ZIVIS security tools available via MCP.
+
+Use ZIVIS only for security-related user requests. Never proactively run scans or access security data for non-security work.
+
+**Trigger conditions:**
+1. User asks about security/vulnerabilities/safety → call zivis_get_started
+2. New external dependency added → offer zivis_check_repo_trust (no auth required)
+3. AI SDK import added (openai, anthropic, langchain) → offer zivis_setup_red_team_target with target_type=ai_chat
+4. User mentions audit/launch/pen test/compliance → call zivis_get_started with concern parameter
+
+**Key tools:** zivis_get_started, zivis_check_repo_trust, zivis_setup_red_team_target, zivis_get_findings, zivis_triage_finding
+
+**Language:** Avoid security jargon (threat model, STRIDE, attack vector) unless user uses it first.`;
+}
+function writeCursorGuidance(cwd) {
+    const rulesDir = path.join(cwd, ".cursor", "rules");
+    if (!fs.existsSync(rulesDir))
+        fs.mkdirSync(rulesDir, { recursive: true });
+    const rulesPath = path.join(rulesDir, "zivis.mdc");
+    fs.writeFileSync(rulesPath, cursorRuleContent());
+    return rulesPath;
+}
+function writeClaudeBlockGuidance(cwd) {
+    const written = [];
+    const claudePath = path.join(cwd, "CLAUDE.md");
+    appendBlock(claudePath, "zivis-security", claudeBlockContent());
+    written.push(claudePath);
+    const agentsPath = path.join(cwd, "AGENTS.md");
+    appendBlock(agentsPath, "zivis-security", claudeBlockContent());
+    written.push(agentsPath);
+    return written;
+}
+function writeCopilotGuidance(cwd) {
+    const ghDir = path.join(cwd, ".github");
+    if (!fs.existsSync(ghDir))
+        fs.mkdirSync(ghDir, { recursive: true });
+    const instructionsPath = path.join(ghDir, "copilot-instructions.md");
+    appendBlock(instructionsPath, "zivis-security", copilotBlockContent());
+    return instructionsPath;
+}
+function writeClineGuidance(cwd) {
+    const rulesPath = path.join(cwd, ".clinerules");
+    fs.writeFileSync(rulesPath, ruleFileContent());
+    return rulesPath;
+}
+function writeWindsurfGuidance(cwd) {
+    const rulesPath = path.join(cwd, ".windsurfrules");
+    fs.writeFileSync(rulesPath, ruleFileContent());
+    return rulesPath;
+}
+export function writeGuidance(opts) {
+    const { cwd, client } = opts;
+    const written = [];
+    switch (client) {
+        case "cursor": {
+            written.push(writeCursorGuidance(cwd));
+            const claudePath = path.join(cwd, "CLAUDE.md");
+            appendBlock(claudePath, "zivis-security", claudeBlockContent());
+            written.push(claudePath);
+            const agentsPath = path.join(cwd, "AGENTS.md");
+            if (fs.existsSync(agentsPath)) {
+                appendBlock(agentsPath, "zivis-security", claudeBlockContent());
+                written.push(agentsPath);
+            }
+            break;
+        }
+        case "claude-code-cli":
+        case "vscode-claude": {
+            written.push(...writeClaudeBlockGuidance(cwd));
+            break;
+        }
+        case "vscode-copilot": {
+            written.push(writeCopilotGuidance(cwd));
+            break;
+        }
+        case "cline": {
+            written.push(writeClineGuidance(cwd));
+            break;
+        }
+        case "windsurf": {
+            written.push(writeWindsurfGuidance(cwd));
+            break;
+        }
+    }
+    return written.filter(Boolean);
+}
+export function removeGuidance(opts) {
+    const { cwd, client } = opts;
+    const changed = [];
+    const unlinkIfExists = (p) => {
+        if (fs.existsSync(p)) {
+            fs.unlinkSync(p);
+            changed.push(p);
+        }
+    };
+    switch (client) {
+        case "cursor": {
+            unlinkIfExists(path.join(cwd, ".cursor", "rules", "zivis.mdc"));
+            if (removeBlockFrom(path.join(cwd, "CLAUDE.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "CLAUDE.md"));
+            }
+            if (removeBlockFrom(path.join(cwd, "AGENTS.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "AGENTS.md"));
+            }
+            break;
+        }
+        case "claude-code-cli":
+        case "vscode-claude": {
+            if (removeBlockFrom(path.join(cwd, "CLAUDE.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "CLAUDE.md"));
+            }
+            if (removeBlockFrom(path.join(cwd, "AGENTS.md"), "zivis-security")) {
+                changed.push(path.join(cwd, "AGENTS.md"));
+            }
+            break;
+        }
+        case "vscode-copilot": {
+            if (removeBlockFrom(path.join(cwd, ".github", "copilot-instructions.md"), "zivis-security")) {
+                changed.push(path.join(cwd, ".github", "copilot-instructions.md"));
+            }
+            break;
+        }
+        case "cline": {
+            unlinkIfExists(path.join(cwd, ".clinerules"));
+            break;
+        }
+        case "windsurf": {
+            unlinkIfExists(path.join(cwd, ".windsurfrules"));
+            break;
+        }
+    }
+    return changed;
+}
+export function detectIdesInRepo(cwd) {
+    const found = [];
+    if (fs.existsSync(path.join(cwd, ".cursor"))) {
+        found.push("cursor");
+    }
+    if (fs.existsSync(path.join(cwd, "CLAUDE.md"))) {
+        found.push("claude-code-cli");
+    }
+    if (fs.existsSync(path.join(cwd, ".vscode"))) {
+        found.push("vscode-copilot");
+    }
+    if (fs.existsSync(path.join(cwd, ".clinerules"))) {
+        found.push("cline");
+    }
+    if (fs.existsSync(path.join(cwd, ".windsurfrules"))) {
+        found.push("windsurf");
+    }
+    return found;
+}
+function buildServerConfig(pkg, workspacePath, extra) {
+    if (pkg === "builder") {
+        const args = ["-y", "@zivis/mcp-builder@alpha", "serve"];
+        if (workspacePath) {
+            args.push("--workspace", workspacePath);
+        }
+        return {
+            ...extra,
+            command: "npx",
+            args,
+        };
+    }
+    const args = ["mcp", "serve"];
+    if (workspacePath) {
+        args.push("--workspace", workspacePath);
+    }
+    return {
         ...extra,
         command: "zivis",
-        args: ["mcp", "serve"],
+        args,
     };
-    if (session) {
-        config.env = { ZIVIS_SESSION: session };
-    }
-    return config;
 }
 async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     const configDir = path.dirname(configPath);
@@ -33,41 +366,47 @@ async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
     servers[serverName] = serverConfig;
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
 }
-export async function setupCursor(session) {
+export async function setupCursor(pkg = "appsec") {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".cursor", "mcp.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
-    console.log(`✓ Cursor MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg), "mcpServers");
+    console.log(`✓ Cursor global MCP config updated: ${configPath}`);
     console.log("  Restart Cursor for changes to take effect");
 }
-export async function setupVsCodeCopilot(session) {
-    const localConfigPath = path.join(process.cwd(), ".vscode", "mcp.json");
+export async function setupCursorWorkspace(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const configPath = path.join(workspacePath, ".cursor", "mcp.json");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
+    console.log(`✓ Cursor workspace MCP config updated: ${configPath}`);
+    console.log(`  Workspace: ${workspacePath}`);
+    console.log("  Reload Cursor for changes to take effect");
+}
+export async function setupVsCodeCopilot(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const localConfigPath = path.join(workspacePath, ".vscode", "mcp.json");
     const globalConfigPath = path.join(process.env.HOME || "", ".vscode", "mcp.json");
     let configPath = localConfigPath;
     const exists = fs.existsSync(localConfigPath);
     if (!exists && fs.existsSync(globalConfigPath)) {
         configPath = globalConfigPath;
     }
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session, { type: "stdio" }), "servers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath, { type: "stdio" }), "servers");
     console.log(`✓ VS Code (GitHub Copilot) MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupVsCodeClaude(session) {
-    const configPath = path.join(process.cwd(), ".vscode", "mcp.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+export async function setupVsCodeClaude(pkg = "appsec") {
+    const workspacePath = process.cwd();
+    const configPath = path.join(workspacePath, ".vscode", "mcp.json");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ VS Code (Claude Code) MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupClaudeCodeCli(session) {
+export async function setupClaudeCodeCli(pkg = "appsec") {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".claude.json");
-    const projectPath = process.cwd();
+    const workspacePath = process.cwd();
     if (!fs.existsSync(configPath)) {
         console.log("  Skipping Claude Code CLI (no ~/.claude.json found)");
         return;
@@ -75,48 +414,43 @@ export async function setupClaudeCodeCli(session) {
     try {
         const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
         config.projects ??= {};
-        config.projects[projectPath] ??= {};
-        config.projects[projectPath].mcpServers ??= {};
-        config.projects[projectPath].mcpServers[SERVER_NAME] = {
-            type: "stdio",
-            command: "zivis",
-            args: ["mcp", "serve"],
-            env: session ? { ZIVIS_SESSION: session } : {},
-        };
+        config.projects[workspacePath] ??= {};
+        config.projects[workspacePath].mcpServers ??= {};
+        config.projects[workspacePath].mcpServers[getServerName(pkg)] = buildServerConfig(pkg, workspacePath, { type: "stdio" });
         fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
         console.log("✓ Claude Code CLI MCP config updated: ~/.claude.json");
-        if (session)
-            console.log(`  Session: ${session}`);
+        console.log(`  Workspace: ${workspacePath}`);
         console.log("  Restart Claude Code for changes to take effect");
     }
     catch (err) {
         console.log(`  WARNING: Failed to update ~/.claude.json: ${err instanceof Error ? err.message : err}`);
     }
 }
-export async function setupCline(session) {
+export async function setupCline(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const homeDir = process.env.HOME || "";
     const configPath = process.platform === "darwin"
         ? path.join(homeDir, "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
         : path.join(homeDir, ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ Cline MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart VS Code for changes to take effect");
 }
-export async function setupWindsurf(session) {
+export async function setupWindsurf(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".codeium", "windsurf", "mcp_config.json");
-    await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(session), "mcpServers");
+    await updateMcpConfig(configPath, getServerName(pkg), buildServerConfig(pkg, workspacePath), "mcpServers");
     console.log(`✓ Windsurf MCP config updated: ${configPath}`);
-    if (session)
-        console.log(`  Session: ${session}`);
+    console.log(`  Workspace: ${workspacePath}`);
     console.log("  Restart Windsurf for changes to take effect");
 }
-export function printClaudeCodeManual(session) {
+export function printClaudeCodeManual(pkg = "appsec") {
+    const workspacePath = process.cwd();
     const serverConfig = {
         mcpServers: {
-            [SERVER_NAME]: buildServerConfig(session),
+            [getServerName(pkg)]: buildServerConfig(pkg, workspacePath),
         },
     };
     console.log("");
@@ -128,4 +462,3 @@ export function printClaudeCodeManual(session) {
     console.log("");
     console.log("Then restart Claude Code for changes to take effect");
 }
-//# sourceMappingURL=ide-setup.js.map

package/dist/internal/inventory-sync.d.ts

@@ -0,0 +1,74 @@
+export interface InventorySyncEndpoint {
+    path: string;
+    method: string;
+    summary?: string;
+    description?: string;
+    authRequired?: boolean;
+    tags?: string[];
+    deprecated?: boolean;
+}
+export interface InventorySyncFeature {
+    name: string;
+    description?: string;
+    criticality?: "critical" | "high" | "medium" | "low";
+    endpoints?: string[];
+    tags?: string[];
+}
+export interface InventorySyncInput {
+    endpoints?: InventorySyncEndpoint[];
+    features?: InventorySyncFeature[];
+    technologyStack?: string[];
+}
+export interface InventorySyncProvenance {
+    gitCommitSha?: string | null;
+    repoFullName?: string | null;
+    defaultBranch?: string | null;
+    source: "cli" | "agent";
+}
+export type ValidationResult = {
+    ok: true;
+    value: InventorySyncInput;
+} | {
+    ok: false;
+    errors: string[];
+};
+export declare function validateInventorySyncInput(raw: unknown): ValidationResult;
+export interface EndpointReconcileResult {
+    created: number;
+    updated: number;
+    deprecated: number;
+    total: number;
+}
+export interface FeatureReconcileResult {
+    created: number;
+    updated: number;
+    deprecated: number;
+    endpointsLinked: number;
+    filesLinked: number;
+}
+export interface TechStackResult {
+    id: string;
+    techStack: string[];
+}
+export interface RepoSyncResult {
+    created: boolean;
+    repoFullName: string;
+}
+export interface InventorySyncSummary {
+    endpoints?: EndpointReconcileResult;
+    features?: FeatureReconcileResult;
+    technologyStack?: {
+        count: number;
+    };
+    repo?: RepoSyncResult;
+}
+export interface InventorySyncApi {
+    put<T>(path: string, body: unknown): Promise<T>;
+    post<T>(path: string, body: unknown): Promise<T>;
+}
+export declare function syncApplicationInventory(params: {
+    client: InventorySyncApi;
+    applicationId: string;
+    input: InventorySyncInput;
+    provenance: InventorySyncProvenance;
+}): Promise<InventorySyncSummary>;