@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/commands/run/index.js

@@ -0,0 +1,206 @@
+import * as fs from "node:fs/promises";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEVX_RUN_CONTRACT_VERSION, completeDevXRunRemote, cancelDevXRunRemote, reportDevXRunItems, isRetryableDevXRunError, } from "../../internal/devx-run.js";
+import { writeDevXRunCompleteOutboxEntry } from "../../internal/sync-outbox.js";
+import { jsonEnvelope, printJson, EXIT, errorMessage, failCommand } from "../../internal/cli-output.js";
+import { trustRoomJsonFields, trustRoomHumanLines } from "../../internal/trust-room-link.js";
+async function readInput(inputArg) {
+    const raw = inputArg === "-" ? await readStdin() : await fs.readFile(inputArg, "utf-8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`--input is not valid JSON: ${errorMessage(err)}`);
+    }
+}
+async function readStdin() {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    for await (const chunk of process.stdin) {
+        data += chunk;
+    }
+    return data;
+}
+export function registerRunCommands(program) {
+    const run = program.command("run").description("resolve a DevX run started by a run producer (e.g. `zivis test`)");
+    run
+        .command("complete <runId>")
+        .description("complete a pending run with its result envelope")
+        .requiredOption("--input <path>", "path to a JSON result file, or '-' for stdin")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (runId, opts) => {
+        const json = !!opts.json;
+        let result;
+        try {
+            result = await readInput(opts.input);
+        }
+        catch (err) {
+            failCommand("run complete", err, json);
+        }
+        const config = resolveConfigFromBinding(process.cwd());
+        const client = new ApiClient(config);
+        try {
+            const response = await completeDevXRunRemote(client, {
+                runId,
+                contractVersion: DEVX_RUN_CONTRACT_VERSION,
+                result,
+            });
+            const reconciliation = response.reconciliation;
+            const output = jsonEnvelope("run complete", {
+                run_id: runId,
+                outcome: response.outcome,
+                status: response.run.status,
+                completed_at: response.run.completedAt,
+                ...(reconciliation
+                    ? {
+                        finding_ids: reconciliation.findings.map((f) => ({ id: f.id, action: f.action })),
+                        retest_results: reconciliation.retests,
+                        evidence_ids: reconciliation.evidence.map((e) => ({ id: e.id, action: e.action })),
+                        coverage: reconciliation.coverage,
+                    }
+                    : {}),
+                ...trustRoomJsonFields(response),
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(`zivis run complete: ${response.outcome} (run ${runId} is now ${response.run.status})`);
+                if (reconciliation) {
+                    const created = reconciliation.findings.filter((f) => f.action === "created").length;
+                    const updated = reconciliation.findings.filter((f) => f.action === "updated").length;
+                    const retested = reconciliation.retests.filter((r) => r.action === "disposition_updated").length;
+                    if (created)
+                        console.log(`  + ${created} new finding${created === 1 ? "" : "s"}`);
+                    if (updated)
+                        console.log(`  ~ ${updated} finding${updated === 1 ? "" : "s"} updated`);
+                    if (retested)
+                        console.log(`  ✓ ${retested} retest${retested === 1 ? "" : "s"} recorded`);
+                    if (reconciliation.evidence.length)
+                        console.log(`  ${reconciliation.evidence.length} artifact(s) persisted`);
+                }
+                const trustRoomLines = trustRoomHumanLines(response);
+                if (trustRoomLines.length) {
+                    console.log("");
+                    for (const line of trustRoomLines)
+                        console.log(line);
+                }
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            if (isRetryableDevXRunError(err)) {
+                const message = errorMessage(err);
+                const outboxPath = writeDevXRunCompleteOutboxEntry(process.cwd(), {
+                    runId,
+                    contractVersion: DEVX_RUN_CONTRACT_VERSION,
+                    result,
+                    error: message,
+                });
+                if (json) {
+                    printJson(jsonEnvelope("run complete", { run_id: runId, outcome: "queued", queued_at: outboxPath, error: message }));
+                }
+                else {
+                    console.error(`zivis run complete: Cloud unreachable (${message})\nQueued for retry: ${outboxPath}\nRun \`zivis sync --flush\` once the issue is resolved.`);
+                }
+                process.exit(EXIT.CLOUD_UNAVAILABLE);
+            }
+            failCommand("run complete", err, json);
+        }
+    });
+    run
+        .command("report <runId>")
+        .description("post confirmed findings/evidence/observations against a pending run as you go, without completing it (ZIV-332)")
+        .requiredOption("--input <path>", "path to a JSON item-batch file ({ findings?, evidence?, observations? }), or '-' for stdin")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (runId, opts) => {
+        const json = !!opts.json;
+        let items;
+        try {
+            items = await readInput(opts.input);
+        }
+        catch (err) {
+            failCommand("run report", err, json);
+        }
+        if (!items || typeof items !== "object" || Array.isArray(items)) {
+            failCommand("run report", new Error("--input must be a JSON object with findings[], evidence[], and/or observations[]"), json);
+        }
+        const config = resolveConfigFromBinding(process.cwd());
+        const client = new ApiClient(config);
+        try {
+            const response = await reportDevXRunItems(client, { runId, items: items });
+            const output = jsonEnvelope("run report", {
+                run_id: runId,
+                outcome: response.outcome,
+                findings: response.items.findings,
+                evidence: response.items.evidence,
+                observations: response.items.observations,
+                ...(response.rejectedObservations?.length ? { rejected_observations: response.rejectedObservations } : {}),
+                run_totals: response.runTotals,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                const findings = response.items.findings;
+                const evidence = response.items.evidence;
+                const observations = response.items.observations;
+                const created = findings.filter((f) => f.action === "created").length;
+                const matched = findings.length - created;
+                const retest = findings.filter((f) => f.retestRecommendation !== null).length;
+                const withHistory = findings.filter((f) => f.dispositionHistory.length > 0).length;
+                const total = findings.length + evidence.length + observations.length;
+                console.log(`zivis run report: applied ${total} item${total === 1 ? "" : "s"} (run ${runId} stays pending)`);
+                if (created)
+                    console.log(`  + ${created} new finding${created === 1 ? "" : "s"}`);
+                if (matched)
+                    console.log(`  = ${matched} matched existing finding${matched === 1 ? "" : "s"}`);
+                if (retest)
+                    console.log(`  ↻ ${retest} retest recommendation${retest === 1 ? "" : "s"} — cite in retests[] on run complete`);
+                if (withHistory)
+                    console.log(`  ⚑ ${withHistory} finding${withHistory === 1 ? "" : "s"} with prior disposition history — surface to the human; never auto-apply`);
+                if (evidence.length)
+                    console.log(`  ${evidence.length} evidence item${evidence.length === 1 ? "" : "s"} persisted`);
+                if (observations.length)
+                    console.log(`  ${observations.length} observation${observations.length === 1 ? "" : "s"} recorded`);
+                if (response.rejectedObservations?.length)
+                    console.log(`  ! ${response.rejectedObservations.length} observation(s) rejected — see --json for reasons`);
+                console.log(`  run totals so far: ${response.runTotals.findings} findings / ${response.runTotals.evidence} evidence / ${response.runTotals.observations} observations`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            failCommand("run report", err, json);
+        }
+    });
+    run
+        .command("cancel <runId>")
+        .description("cancel a pending run")
+        .option("--reason <text>", "optional human-readable cancellation reason")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (runId, opts) => {
+        const json = !!opts.json;
+        const config = resolveConfigFromBinding(process.cwd());
+        const client = new ApiClient(config);
+        try {
+            const response = await cancelDevXRunRemote(client, { runId, reason: opts.reason ?? null });
+            const output = jsonEnvelope("run cancel", {
+                run_id: runId,
+                outcome: response.outcome,
+                status: response.run.status,
+                cancelled_at: response.run.cancelledAt,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(`zivis run cancel: ${response.outcome} (run ${runId} is now ${response.run.status})`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            failCommand("run cancel", err, json);
+        }
+    });
+}

package/dist/commands/scan/index.js

@@ -1,8 +1,8 @@
 import { ApiClient } from "@zivis/mcp/api-client";
-import { DEFAULT_CONFIG } from "@zivis/mcp/types";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 const VALID_TARGET_TYPES = ["ai_chat", "web_app", "api"];
 function buildClient(opts) {
-    const config = opts.session ? { ...DEFAULT_CONFIG, session: opts.session } : DEFAULT_CONFIG;
+    const config = opts.session ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session } : resolveConfigFromBinding(process.cwd());
     return new ApiClient(config);
 }
 export function registerScanCommands(program) {
@@ -118,11 +118,6 @@ export function registerScanCommands(program) {
         }
     });
 }
-/**
- * Map customer-facing ApplicationType to the RT scan's targetType enum.
- * The two enums differ historically: ApplicationType is product-shape,
- * targetType is what the RT runner needs to know about the wire format.
- */
 function appTypeToTargetType(appType) {
     switch (appType) {
         case "agent":
@@ -131,10 +126,10 @@ function appTypeToTargetType(appType) {
             return "ai_chat";
         case "rest_api":
             return "api";
+        case "application":
         case "ad_hoc_url":
             return "web_app";
         default:
             return undefined;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/share/index.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from "commander";
+export interface ShareResponse {
+    trustRoomId: string;
+    trustRoomName: string;
+    trustRoomUrl: string;
+    accessUrl: string;
+    email: string;
+    permission: string;
+    status: "shared" | "already_shared";
+    isNewUser: boolean;
+    emailSent: boolean;
+}
+export declare function registerShareCommands(program: Command): void;
+export default registerShareCommands;

package/dist/commands/share/index.js

@@ -0,0 +1,100 @@
+import readline from "node:readline/promises";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { jsonEnvelope, printJson, failCommand, EXIT } from "../../internal/cli-output.js";
+const COMMAND = "share";
+const PERMISSIONS = ["view", "comment", "edit", "admin"];
+async function prompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+function isValidEmail(value) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+export function registerShareCommands(program) {
+    program
+        .command("share")
+        .description("share this Application's current Assurance Room with someone by email")
+        .argument("[email]", "who to share with (prompted for when omitted)")
+        .option("-s, --session <name>", "named session for multi-tenant")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--permission <level>", `access level: ${PERMISSIONS.join(" | ")}`, "view")
+        .option("--json", "emit machine-readable JSON")
+        .action(async (emailArg, opts) => {
+        const json = Boolean(opts.json);
+        try {
+            const permission = (opts.permission ?? "view").toLowerCase();
+            if (!PERMISSIONS.includes(permission)) {
+                throw new Error(`--permission must be one of: ${PERMISSIONS.join(", ")}`);
+            }
+            const resolvedApp = requireApplicationId(opts.app, process.cwd());
+            if (!resolvedApp.ok) {
+                if (json) {
+                    printJson(jsonEnvelope(COMMAND, { result: "error", error: resolvedApp.message }));
+                }
+                else {
+                    console.error(`zivis ${COMMAND}: ${resolvedApp.message}`);
+                }
+                process.exit(EXIT.INVALID_OR_INDETERMINATE);
+            }
+            let email = (emailArg ?? "").trim();
+            if (!email) {
+                if (json) {
+                    throw new Error("An email argument is required with --json (no prompting).");
+                }
+                email = await prompt("Share this Assurance Room with (email): ");
+            }
+            if (!isValidEmail(email)) {
+                throw new Error(`'${email}' does not look like an email address.`);
+            }
+            const config = opts.session
+                ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session }
+                : resolveConfigFromBinding(process.cwd());
+            const client = new ApiClient(config);
+            const res = await client.post("/api/assurance/share", {
+                applicationId: resolvedApp.id,
+                email,
+                permission,
+            });
+            if (json) {
+                printJson(jsonEnvelope(COMMAND, {
+                    result: "ok",
+                    status: res.status,
+                    email: res.email,
+                    permission: res.permission,
+                    is_new_user: res.isNewUser,
+                    email_sent: res.emailSent,
+                    trust_room_id: res.trustRoomId,
+                    trust_room_url: res.trustRoomUrl,
+                    access_url: res.accessUrl,
+                }));
+                return;
+            }
+            if (res.status === "already_shared") {
+                console.log(`${res.email} already has access to ${res.trustRoomName}.`);
+            }
+            else {
+                console.log(`Shared ${res.trustRoomName} with ${res.email} (${res.permission}).`);
+            }
+            if (res.isNewUser) {
+                console.log(`${res.email} has no ZIVIS account yet — they'll create one when they open the link.`);
+            }
+            if (!res.emailSent) {
+                console.log("Access was granted, but the invitation email could not be sent.");
+                console.log("Pass this link on directly:");
+            }
+            console.log("");
+            console.log(`Assurance Room: ${res.accessUrl}`);
+        }
+        catch (err) {
+            failCommand(COMMAND, err, json);
+        }
+    });
+}
+export default registerShareCommands;

package/dist/commands/sync/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerSyncCommands(program: Command): void;

package/dist/commands/sync/index.js

@@ -0,0 +1,193 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { readGitMetadata, deriveRepoFullNameFromRemote } from "../../internal/git-metadata.js";
+import { validateInventorySyncInput, syncApplicationInventory, } from "../../internal/inventory-sync.js";
+import { ensureZivisGitignore } from "../../internal/zivis-local-state.js";
+import { writeOutboxEntry, listOutboxEntries, removeOutboxEntry, recordOutboxRetryFailure, } from "../../internal/sync-outbox.js";
+import { completeDevXRunRemote } from "../../internal/devx-run.js";
+export function registerSyncCommands(program) {
+    program
+        .command("sync")
+        .description("push a locally-derived endpoint/feature/technology-stack inventory to your bound ZIVIS Application " +
+        "(the coding agent derives the inventory; this command reconciles it — see --file)")
+        .option("--file <path>", "JSON file with { endpoints?, features?, technologyStack? } (use - for stdin)")
+        .option("--flush", "retry pending outbox entries from a previous failed sync, instead of reading --file")
+        .option("--cwd <path>", "repo root (default: cwd)")
+        .option("--source <source>", "provenance source: cli or agent", "agent")
+        .option("--format <fmt>", "output format: human or json", "human")
+        .option("--dry-run", "validate/list and print what would be sent — no network calls")
+        .action(async (opts) => {
+        const exitCode = opts.flush ? await runFlush(opts) : await runSync(opts);
+        process.exit(exitCode);
+    });
+}
+async function runSync(opts) {
+    const rootDir = opts.cwd ? path.resolve(opts.cwd) : process.cwd();
+    const format = opts.format === "json" ? "json" : "human";
+    const source = opts.source === "cli" ? "cli" : "agent";
+    if (!opts.file) {
+        return fail(format, "--file is required (or pass --flush to retry queued entries)");
+    }
+    if (opts.source && opts.source !== "cli" && opts.source !== "agent") {
+        return fail(format, `--source must be "cli" or "agent" (got: ${opts.source})`);
+    }
+    let raw;
+    try {
+        raw = opts.file === "-" ? await readStdin() : await fs.readFile(path.resolve(rootDir, opts.file), "utf-8");
+    }
+    catch (err) {
+        return fail(format, `Could not read ${opts.file}: ${err instanceof Error ? err.message : err}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        return fail(format, `Invalid JSON: ${err instanceof Error ? err.message : err}`);
+    }
+    const validated = validateInventorySyncInput(parsed);
+    if (!validated.ok) {
+        return fail(format, `Invalid inventory input:\n  - ${validated.errors.join("\n  - ")}`);
+    }
+    const binding = detectProjectBinding(rootDir);
+    const applicationId = binding?.binding.applicationId;
+    if (!applicationId) {
+        return fail(format, "No Application bound for this repo. Run `zivis init` first (see .zivis/project.json).");
+    }
+    const gitMeta = await readGitMetadata(rootDir);
+    const repoFullName = deriveRepoFullNameFromRemote(gitMeta.remoteUrl);
+    const provenance = {
+        gitCommitSha: gitMeta.commitSha ?? null,
+        repoFullName: repoFullName ?? null,
+        defaultBranch: gitMeta.branch ?? null,
+        source,
+    };
+    if (opts.dryRun) {
+        process.stdout.write(JSON.stringify({ applicationId, provenance, input: validated.value }, null, 2) + "\n");
+        if (format === "human") {
+            process.stderr.write("\n[zivis sync] --dry-run: nothing was sent.\n");
+        }
+        return 0;
+    }
+    ensureZivisGitignore(rootDir);
+    const config = resolveConfigFromBinding(rootDir);
+    const client = new ApiClient(config);
+    let summary;
+    try {
+        summary = await syncApplicationInventory({ client, applicationId, input: validated.value, provenance });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const outboxPath = writeOutboxEntry(rootDir, { applicationId, input: validated.value, provenance, error: message });
+        return fail(format, `Sync failed: ${message}\nQueued for retry: ${outboxPath}\nRun \`zivis sync --flush\` once the issue is resolved.`);
+    }
+    if (format === "json") {
+        process.stdout.write(JSON.stringify({ applicationId, summary }, null, 2) + "\n");
+        return 0;
+    }
+    renderHumanSummary(summary);
+    return 0;
+}
+async function runFlush(opts) {
+    const rootDir = opts.cwd ? path.resolve(opts.cwd) : process.cwd();
+    const format = opts.format === "json" ? "json" : "human";
+    const pending = listOutboxEntries(rootDir);
+    if (pending.length === 0) {
+        if (format === "json")
+            process.stdout.write(JSON.stringify({ pending: 0 }, null, 2) + "\n");
+        else
+            process.stdout.write("\nNo pending outbox entries.\n");
+        return 0;
+    }
+    if (opts.dryRun) {
+        const preview = pending.map((p) => ({
+            file: p.filePath,
+            kind: p.entry.kind,
+            queuedAt: p.entry.queuedAt,
+            attempts: p.entry.attempts,
+            lastError: p.entry.lastError,
+            ...(p.entry.kind === "devx-run-complete"
+                ? { runId: p.entry.runId, result: p.entry.result }
+                : { applicationId: p.entry.applicationId, input: p.entry.input }),
+        }));
+        process.stdout.write(JSON.stringify(preview, null, 2) + "\n");
+        if (format === "human")
+            process.stderr.write(`\n[zivis sync --flush] --dry-run: ${pending.length} pending, nothing sent.\n`);
+        return 0;
+    }
+    const config = resolveConfigFromBinding(rootDir);
+    const client = new ApiClient(config);
+    let succeeded = 0;
+    let failed = 0;
+    const trustRoomUrls = [];
+    for (const { filePath, entry } of pending) {
+        try {
+            if (entry.kind === "devx-run-complete") {
+                const completed = await completeDevXRunRemote(client, { runId: entry.runId, contractVersion: entry.contractVersion, result: entry.result });
+                if (completed.trustRoomUrl && !trustRoomUrls.includes(completed.trustRoomUrl)) {
+                    trustRoomUrls.push(completed.trustRoomUrl);
+                }
+            }
+            else {
+                await syncApplicationInventory({
+                    client,
+                    applicationId: entry.applicationId,
+                    input: entry.input,
+                    provenance: entry.provenance,
+                });
+            }
+            removeOutboxEntry(filePath);
+            succeeded++;
+        }
+        catch (err) {
+            recordOutboxRetryFailure(filePath, entry, err instanceof Error ? err.message : String(err));
+            failed++;
+        }
+    }
+    if (format === "json") {
+        process.stdout.write(JSON.stringify({ succeeded, failed, remaining: failed, ...(trustRoomUrls.length ? { trust_room_urls: trustRoomUrls } : {}) }, null, 2) + "\n");
+    }
+    else {
+        process.stdout.write(`\nFlushed outbox: ${succeeded} succeeded, ${failed} still failing (left queued).\n`);
+        for (const url of trustRoomUrls)
+            process.stdout.write(`Trust Room: ${url}\n`);
+    }
+    return failed > 0 ? 1 : 0;
+}
+function renderHumanSummary(summary) {
+    let out = "\nZIVIS inventory sync:\n\n";
+    if (summary.technologyStack) {
+        out += `  Technology stack: ${summary.technologyStack.count} entries\n`;
+    }
+    if (summary.endpoints) {
+        const e = summary.endpoints;
+        out += `  Endpoints:  +${e.created} new, ${e.updated} updated, ${e.deprecated} deprecated (${e.total} total reported)\n`;
+    }
+    if (summary.features) {
+        const f = summary.features;
+        out += `  Features:   +${f.created} new, ${f.updated} updated, ${f.deprecated} deprecated\n`;
+    }
+    if (summary.repo) {
+        out += `  Repository: ${summary.repo.repoFullName} (${summary.repo.created ? "linked" : "revision updated"})\n`;
+    }
+    process.stdout.write(out + "\n");
+}
+function fail(format, message) {
+    if (format === "json") {
+        process.stdout.write(JSON.stringify({ error: message }, null, 2) + "\n");
+    }
+    else {
+        process.stderr.write(`\n${message}\n`);
+    }
+    return 1;
+}
+async function readStdin() {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    for await (const chunk of process.stdin) {
+        data += chunk;
+    }
+    return data;
+}

package/dist/commands/target/index.js

@@ -4,8 +4,6 @@ import { getStorageName } from "../../internal/target-auth/keychain.js";
 import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
 const DEFAULT_PERSONA = "default";
 function warnDeprecated() {
-    // stderr so it doesn't pollute stdout (CLI scripts pipe `zivis target token`
-    // straight into curl). One line, no color codes — keeps grep-friendly.
     console.error("[zivis] WARNING: 'zivis target' is deprecated; use 'zivis app' instead.");
 }
 export function registerTargetCommands(program) {
@@ -143,4 +141,3 @@ export function registerTargetCommands(program) {
         console.log(`✓ Cleared tokens for target ${targetId} (persona: ${opts.persona})`);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/test/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerTestCommand(program: Command): void;