@zksecurity/zkao-cli 0.27.0-next.18 → 0.31.0-next.20

package/README.md

@@ -16,6 +16,9 @@ zkao repos
 zkao scans launch --repo <repoId> --budget 500 --preset <ref>
 zkao scans launch --repo <repoId> --preset "builtin:Diff Scan" --base main --commit <sha>
 zkao scans wait <scanId>                    # block until the scan finishes
+zkao scans get <scanId>                     # check triage completeness
+zkao scans resume-triage <scanId> --budget <credits> --idempotency-key <key>
+zkao scans triage-wait <scanId> <runId>       # wait for the returned triage run
 zkao scans cancel <scanId>                  # cancel a running or queued scan
 zkao findings list --scan <scanId>
 ```
@@ -24,6 +27,12 @@ All output is JSON. `zkao --help` lists every command. Credentials come from
 `zkao login`, `zkao config set`, or the `ZKAO_API_TOKEN` / `ZKAO_PROJECT_ID`
 environment variables. Point at another environment with `ZKAO_URL`.
 
+Check `triage` before treating a completed scan as fully reviewed.
+Resume only within its offered budget range and your authorized spending limit.
+Reuse the same key and budget when retrying a resumption.
+After resumed triage finishes, check the scan's `triage` again.
+Use `--json-errors` for API error status, code, and message as JSON on stderr.
+
 Full docs and the SDK (`@zksecurity/zkao-sdk`): **https://github.com/zksecurity/zkao-sdk**
 
 ## License

package/dist/index.js

@@ -570,7 +570,7 @@ async function refreshUpdateCache(currentVersion) {
 // src/index.ts
 var { version } = createRequire(import.meta.url)("../package.json");
 var program = new Command();
-program.name("zkao").description("Control a zkao project from the command line.").version(version).option("--token <token>", "project API token (or env ZKAO_API_TOKEN)").option("--project <id>", "project id (or env ZKAO_PROJECT_ID)").option("--base-url <url>", "API base URL, used verbatim (env: ZKAO_URL sets the environment)");
+program.name("zkao").description("Control a zkao project from the command line.").version(version).option("--token <token>", "project API token (or env ZKAO_API_TOKEN)").option("--project <id>", "project id (or env ZKAO_PROJECT_ID)").option("--json-errors", "print API error status, code, and message as JSON on stderr").option("--base-url <url>", "API base URL, used verbatim (env: ZKAO_URL sets the environment)");
 function out(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -578,6 +578,20 @@ function fail(message) {
   console.error(message);
   process.exit(1);
 }
+function failApi(error) {
+  if (program.opts().jsonErrors) {
+    console.error(JSON.stringify({
+      error: {
+        status: error.status,
+        code: error.code,
+        message: error.message,
+        ...error.minimumCredits === void 0 ? {} : { minimumCredits: error.minimumCredits }
+      }
+    }));
+    process.exit(1);
+  }
+  fail(`Error ${error.status} (${error.code}): ${error.message}`);
+}
 function globalConfig() {
   const g = program.opts();
   return resolveConfig({ token: g.token, projectId: g.project, baseUrl: g.baseUrl });
@@ -599,7 +613,7 @@ async function run(fn) {
     out(await fn(client()));
   } catch (err) {
     if (err instanceof ZkaoApiError) {
-      fail(`Error ${err.status} (${err.code}): ${err.message}`);
+      failApi(err);
     }
     throw err;
   }
@@ -621,6 +635,13 @@ var toInt = (value) => {
   }
   return n;
 };
+var positiveInteger = (value) => {
+  const n = Number(value);
+  if (!Number.isSafeInteger(n) || n < 1) {
+    throw new InvalidArgumentError("Expected a positive integer");
+  }
+  return n;
+};
 program.command("login").description(
   "Authorize this CLI by approving it in your browser (device flow)"
 ).option("--no-browser", "print the URL instead of opening a browser").option(
@@ -665,7 +686,7 @@ program.command("whoami").description("Show which project and organization the c
     out(info);
   } catch (err) {
     if (err instanceof ZkaoApiError) {
-      fail(`Error ${err.status} (${err.code}): ${err.message}`);
+      failApi(err);
     }
     throw err;
   }
@@ -799,7 +820,7 @@ var continuous = program.command("continuous").description(
   "Turn Continuous Testing on or off for a repository and set its monthly budget"
 );
 continuous.command("get <repoId>").description(
-  "Show the schedule, this month's spend, and the recommended, minimum and maximum monthly budgets"
+  "Show the schedule, this month's spend, and the default, minimum and maximum monthly budgets"
 ).option("--branch <branch>", "the scheduled branch (default: the repository's default branch)").action(
   (repoId, opts) => run(
     (c) => c.getContinuousTesting(repoId, {
@@ -810,7 +831,7 @@ continuous.command("get <repoId>").description(
 for (const [name, description, enabled] of [
   [
     "on",
-    "Turn it on or resume it. A new schedule starts at the recommended budget unless --budget is given",
+    "Turn it on or resume it. A new schedule starts at the default monthly budget unless --budget is given",
     true
   ],
   [
@@ -922,6 +943,22 @@ scans.command("launch").description("Launch a scan").requiredOption("--repo <id>
   }
 );
 scans.command("cancel <scanId>").description("Cancel a running or queued scan").action((scanId) => run((c) => c.cancelScan(scanId)));
+scans.command("resume-triage <scanId>").description("Resume budget-stopped triage with an explicitly authorized credit budget").requiredOption("--budget <credits>", "budget from the scan's triage.resume offer", positiveInteger).requiredOption("--idempotency-key <key>", "stable key to reuse with the same budget when retrying").action(
+  (scanId, opts) => run((c) => c.resumeTriage(scanId, { creditBudget: opts.budget }, { idempotencyKey: opts.idempotencyKey }))
+);
+scans.command("triage-get <scanId> <runId>").description("Get the status of one resumed triage run").action((scanId, runId) => run((c) => c.getTriageRun(scanId, runId)));
+scans.command("triage-wait <scanId> <runId>").description("Wait for one triage run; then check the scan's triage completeness").option("--timeout <seconds>", "give up after this long", positiveInteger).action((scanId, runId, opts) => {
+  const controller = new AbortController();
+  const onSigint = () => controller.abort(new Error("Interrupted"));
+  process.once("SIGINT", onSigint);
+  return run(
+    (c) => c.waitForTriageRun(scanId, runId, {
+      timeoutMs: opts.timeout === void 0 ? void 0 : opts.timeout * 1e3,
+      signal: controller.signal,
+      onPoll: (current) => console.error(`  triage ${current.id}: ${current.status}`)
+    }).finally(() => process.removeListener("SIGINT", onSigint))
+  );
+});
 scans.command("publish <scanId>").description("Publish a completed scan as a public artifact").option("--password", "generate an access password").action(
   (scanId, opts) => run((c) => c.publishScan(scanId, { withPassword: opts.password }))
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zksecurity/zkao-cli",
-  "version": "0.27.0-next.18",
+  "version": "0.31.0-next.20",
   "description": "Command-line interface for the zkao Project API",
   "license": "MIT",
   "author": "zkSecurity",
@@ -39,7 +39,7 @@
     "prepublishOnly": "node -e \"if (!(process.env.npm_config_user_agent || '').includes('bun/')) { console.error('Publish with bun publish: npm ships the literal workspace:* dependency and breaks installs.'); process.exit(1); }\""
   },
   "dependencies": {
-    "@zksecurity/zkao-sdk": "0.27.0-next.18",
+    "@zksecurity/zkao-sdk": "0.31.0-next.20",
     "commander": "^12.1.0"
   },
   "devDependencies": {