bandit-cli 1.0.1 → 1.0.3

package/README.md

@@ -1,4 +1,5 @@
-# Bandit CLI 🤠
+# Bandit CLI
+
 > **The Swiss Army Knife for Backend Developers**
 
 `bandit` is an interactive, high-utility terminal workspace helper built for backend developers. Instead of relying on heavy GUI clients or complex shell scripts, `bandit` lets you test APIs, benchmark endpoints, terminate locked ports, validate environment setups, and audit server health directly from your command line.
@@ -7,23 +8,25 @@
 
 ## 🚀 Key Features
 
-* **Interactive API Client**: Auto-scans your codebase (Express, Fastify, Hono, NestJS) to find route definitions, maps parameters, takes JSON payloads, prompts for Bearer Auth tokens, and displays pretty-printed HTTP responses.
-* **High-Speed Load Benchmarker**: Benchmark any local or remote HTTP endpoint with configurable concurrency, calculating throughput (RPS), p50-p99 percentiles, and rendering a beautiful ASCII distribution chart.
-* **Port Inspector & Process Killer**: Scans active ports, identifies the PID and process names (e.g. `node.exe`, `postgres.exe`, `ollama.exe`), and lets you terminate locked processes in one click.
-* **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
-* **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
-* **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
+- **Interactive API Client**: Auto-scans your codebase (Express, Fastify, Hono, NestJS) to find route definitions, maps parameters, takes JSON payloads, prompts for Bearer Auth tokens, and displays pretty-printed HTTP responses.
+- **High-Speed Load Benchmarker**: Benchmark any local or remote HTTP endpoint with configurable concurrency, calculating throughput (RPS), p50-p99 percentiles, and rendering a beautiful ASCII distribution chart.
+- **Port Inspector & Process Killer**: Scans active ports, identifies the PID and process names (e.g. `node.exe`, `postgres.exe`, `ollama.exe`), and lets you terminate locked processes in one click.
+- **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
+- **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
+- **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
 
 ---
 
 ## 📦 Installation
 
 Install globally via npm:
+
 ```bash
 npm install -g bandit-cli
 ```
 
 Or run instantly using `npx`:
+
 ```bash
 npx bandit-cli <command>
 ```
@@ -33,37 +36,54 @@ npx bandit-cli <command>
 ## 🛠️ Usage & Commands
 
 ### 1. Interactive API Playfield
-Find and test routes in your codebase:
+
+Find and test routes in your codebase interactively:
 ```bash
 bandit api
 ```
 
+Or execute a direct API request immediately (acts like a local curl/HTTPie):
+```bash
+bandit api GET /api/v1/products --url http://localhost:8080 --token "jwt-token"
+bandit api POST /api/v1/users --body '{"name":"Raj"}'
+```
+
 ### 2. Endpoint Benchmarking
+
 Run a concurrent load test on an endpoint:
+
 ```bash
 bandit bench http://localhost:3000/api/users --connections 10 --requests 200
 ```
 
 ### 3. Ports Inspector
+
 List processes listening on local ports and terminate them:
+
 ```bash
 bandit ports
 ```
 
 ### 4. Active Server Diagnostics
+
 Audit a running server's security headers and vulnerabilities:
+
 ```bash
 bandit doctor http://localhost:3000
 ```
 
 ### 5. Environment variable check
+
 Validate local environment configurations:
+
 ```bash
 bandit env
 ```
 
 ### 6. Static Project Audit
+
 Audit files, directory structure, and dependencies:
+
 ```bash
 bandit audit
 ```
@@ -71,4 +91,5 @@ bandit audit
 ---
 
 ## 🎨 Under the Hood
+
 Built with TypeScript, [Commander](https://github.com/tj/commander.js), and [@clack/prompts](https://github.com/natemoo-re/clack) for a modern, fluid interactive terminal interface.

package/dist/cli/api.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import fg from "fast-glob";
 import * as clack from "@clack/prompts";
 import chalk from "chalk";
-// Scans files for common route definitions
+// Scans files for common route definitions and mounts
 async function scanForRoutes(projectPath) {
     const routes = [];
     const files = await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
@@ -11,18 +11,39 @@ async function scanForRoutes(projectPath) {
         absolute: true,
         ignore: ["**/node_modules/**", "**/dist/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"],
     });
+    const prefixMap = new Map();
+    // Regex to detect router mounts, e.g. app.use('/api/v1/auth', authRouter) or router.use('/auth', authRouter)
+    // Group 3 matches the path prefix, Group 4 matches the router variable name
+    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*([a-zA-Z0-9_]+)/gi;
+    // Read files first to construct prefixMap
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            let match;
+            mountPattern.lastIndex = 0;
+            while ((match = mountPattern.exec(content)) !== null) {
+                const prefix = match[3];
+                const routerName = match[4];
+                if (prefix && routerName && routerName !== "express" && routerName !== "cors" && routerName !== "helmet") {
+                    prefixMap.set(routerName, prefix);
+                }
+            }
+        }
+        catch { }
+    }
     // Regex patterns
-    // 1. Express/Fastify/Hono: router.get('/path', ...) or app.post('/path', ...)
-    const expressPattern = /\b(app|router|route|fastify|hono|api)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 2. NestJS decorators: @Get('/path') or @Post('/path')
+    // 1. Generic Router paths: authRouter.post('/login', ...)
+    // Group 1 matches the router variable, Group 2 matches method, Group 3 matches endpoint path
+    const expressPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
+    // 2. NestJS decorators: @Get('/path')
     const nestPattern = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 3. NestJS controllers to prefix: @Controller('/prefix')
+    // 3. NestJS controllers: @Controller('/prefix')
     const controllerPattern = /@Controller\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
     for (const file of files) {
         try {
             const content = fs.readFileSync(file, "utf-8");
             const relativePath = path.relative(projectPath, file);
-            // Check NestJS Controller prefix if any
+            // NestJS controller prefix
             let controllerPrefix = "";
             const cMatch = [...content.matchAll(controllerPattern)];
             if (cMatch.length > 0) {
@@ -30,20 +51,30 @@ async function scanForRoutes(projectPath) {
                 if (controllerPrefix === "/")
                     controllerPrefix = "";
             }
-            // 1. Check Express-style matches
+            // 1. Express-style
             let match;
             expressPattern.lastIndex = 0;
             while ((match = expressPattern.exec(content)) !== null) {
+                const instanceName = match[1];
                 const method = match[2].toUpperCase();
-                let rPath = match[3];
-                // Sanitize path variable names if necessary
+                const subPath = match[3];
+                let rPath = subPath;
+                // If the instanceName has a registered mount prefix, prepend it!
+                if (prefixMap.has(instanceName)) {
+                    const prefix = prefixMap.get(instanceName).replace(/\/$/, "");
+                    rPath = `${prefix}/${subPath.replace(/^\//, "")}`;
+                }
+                // Clean up double slashes
+                rPath = rPath.replace(/\/+/g, "/");
+                if (!rPath.startsWith("/"))
+                    rPath = `/${rPath}`;
                 routes.push({
                     method,
                     routePath: rPath,
                     sourceFile: relativePath,
                 });
             }
-            // 2. Check NestJS matches
+            // 2. NestJS
             nestPattern.lastIndex = 0;
             while ((match = nestPattern.exec(content)) !== null) {
                 const method = match[1].toUpperCase();
@@ -51,17 +82,16 @@ async function scanForRoutes(projectPath) {
                 if (subPath === "/")
                     subPath = "";
                 const fullPath = `${controllerPrefix.replace(/\/$/, "")}/${subPath.replace(/^\//, "")}`;
-                const sanitizedFullPath = fullPath.startsWith("/") ? fullPath : `/${fullPath}`;
+                let rPath = fullPath.startsWith("/") ? fullPath : `/${fullPath}`;
+                rPath = rPath.replace(/\/+/g, "/");
                 routes.push({
                     method: method === "DELETE" ? "DELETE" : method,
-                    routePath: sanitizedFullPath,
+                    routePath: rPath,
                     sourceFile: relativePath,
                 });
             }
         }
-        catch (err) {
-            // Ignore reading errors
-        }
+        catch { }
     }
     // Deduplicate routes by method + routePath
     const seen = new Set();
@@ -90,9 +120,90 @@ function detectLocalPort(projectPath) {
     catch { }
     return 3000;
 }
-export async function runApiCommand(projectPath = ".") {
+export async function runApiCommand(methodOrPath = ".", routePath, opts = {}) {
+    const httpMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+    const isDirectMode = routePath !== undefined && httpMethods.includes(methodOrPath.toUpperCase());
+    if (isDirectMode) {
+        const finalMethod = methodOrPath.toUpperCase();
+        const finalPath = routePath;
+        // Resolve base URL
+        const absoluteProjectPath = path.resolve(".");
+        const port = detectLocalPort(absoluteProjectPath);
+        let baseUrl = opts.url || `http://localhost:${port}`;
+        baseUrl = baseUrl.replace(/\/$/, "");
+        // Resolve Headers
+        const headers = {
+            Accept: "application/json, text/plain, */*",
+        };
+        if (opts.token) {
+            headers["Authorization"] = `Bearer ${opts.token}`;
+        }
+        if (opts.body) {
+            headers["Content-Type"] = "application/json";
+        }
+        // Parse custom headers -H "Key: Val"
+        if (opts.header) {
+            const hList = Array.isArray(opts.header) ? opts.header : [opts.header];
+            for (const h of hList) {
+                const colonIdx = h.indexOf(":");
+                if (colonIdx !== -1) {
+                    const key = h.slice(0, colonIdx).trim();
+                    const val = h.slice(colonIdx + 1).trim();
+                    headers[key] = val;
+                }
+            }
+        }
+        const finalUrl = `${baseUrl}${finalPath}`;
+        clack.intro(chalk.bold.bgBlue.white(" Bandit Direct API Request "));
+        clack.log.info(`Sending ${chalk.bold.green(finalMethod)} request to ${chalk.cyan(finalUrl)}...`);
+        const s = clack.spinner();
+        s.start("Executing request...");
+        try {
+            const start = performance.now();
+            const res = await fetch(finalUrl, {
+                method: finalMethod,
+                headers,
+                ...(opts.body ? { body: opts.body } : {}),
+            });
+            const end = performance.now();
+            const duration = end - start;
+            s.stop(`Request completed in ${duration.toFixed(1)}ms.`);
+            const contentType = res.headers.get("content-type") || "";
+            const resText = await res.text();
+            console.log("\n" + chalk.bold.cyan("📬 RESPONSE"));
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(`Status:  ${res.status >= 200 && res.status < 300 ? chalk.bold.green(res.status) : chalk.bold.red(res.status)} ${res.statusText}`);
+            console.log(`Time:    ${duration.toFixed(1)} ms`);
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(chalk.bold.cyan("Headers:"));
+            res.headers.forEach((val, key) => {
+                console.log(`  ${chalk.gray(key)}: ${val}`);
+            });
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(chalk.bold.cyan("Body:"));
+            if (contentType.includes("application/json")) {
+                try {
+                    const parsed = JSON.parse(resText);
+                    console.log(chalk.green(JSON.stringify(parsed, null, 2)));
+                }
+                catch {
+                    console.log(resText);
+                }
+            }
+            else {
+                console.log(resText || chalk.italic.gray("<empty body>"));
+            }
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+        }
+        catch (err) {
+            s.stop("Request failed.");
+            clack.log.error(`Fetch execution error: ${err.message}`);
+        }
+        clack.outro(chalk.bold.green("Direct API call complete."));
+        return;
+    }
     clack.intro(chalk.bold.bgBlue.white(" Bandit Interactive API Client "));
-    const absoluteProjectPath = path.resolve(projectPath);
+    const absoluteProjectPath = path.resolve(methodOrPath);
     const s = clack.spinner();
     s.start("Scanning codebase for API endpoints...");
     const discoveredRoutes = await scanForRoutes(absoluteProjectPath);
@@ -190,10 +301,20 @@ export async function runApiCommand(projectPath = ".") {
     }
     else {
         finalMethod = selectedRoute.method;
-        finalPath = selectedRoute.routePath;
+        // Let the developer confirm and edit the path (highly convenient for prefix additions!)
+        const editPath = await clack.text({
+            message: "Confirm or edit the route path:",
+            defaultValue: selectedRoute.routePath,
+            placeholder: selectedRoute.routePath,
+            validate: (v) => (!v || !v.startsWith("/") ? "Route path must start with a slash '/'" : undefined),
+        });
+        if (clack.isCancel(editPath)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        finalPath = editPath;
     }
     // 1. Process Path Parameters if any (e.g. /users/:id or /users/{id})
-    // We look for :name or {name}
     const pathParamPattern = /:([a-zA-Z0-9_]+)|\{([a-zA-Z0-9_]+)\}/g;
     let matches;
     const pathParams = [];
@@ -213,7 +334,6 @@ export async function runApiCommand(projectPath = ".") {
             clack.outro("Execution stopped.");
             return;
         }
-        // Replace :param or {param}
         resolvedPath = resolvedPath
             .replace(`:${param}`, val)
             .replace(`{${param}}`, val);
@@ -242,7 +362,7 @@ export async function runApiCommand(projectPath = ".") {
             queryStr = trimmed.startsWith("?") ? trimmed : `?${trimmed}`;
         }
     }
-    // 3. Process Request Body if POST/PUT/PATCH
+    // 3. Process Request Body if POST/PUT/PATCH (Interactive Key-Value Editor!)
     let requestBody;
     if (["POST", "PUT", "PATCH"].includes(finalMethod)) {
         const enterBody = await clack.confirm({
@@ -254,32 +374,119 @@ export async function runApiCommand(projectPath = ".") {
             return;
         }
         if (enterBody) {
-            const bodyInput = await clack.text({
-                message: "Enter JSON payload:",
-                placeholder: '{"name": "Alice", "email": "alice@gmail.com"}',
-                validate: (v) => {
-                    if (!v || !v.trim())
-                        return undefined;
-                    try {
-                        JSON.parse(v);
-                        return undefined;
-                    }
-                    catch {
-                        return "Invalid JSON syntax. Please enter valid JSON.";
-                    }
-                },
+            const bodyInputType = await clack.select({
+                message: "How would you like to enter the JSON body?",
+                options: [
+                    { value: "kv", label: "Interactive Key-Value builder (Easy/Convenient)" },
+                    { value: "raw", label: "Paste raw JSON string" },
+                ],
             });
-            if (clack.isCancel(bodyInput)) {
+            if (clack.isCancel(bodyInputType)) {
                 clack.outro("Execution stopped.");
                 return;
             }
-            const val = bodyInput.trim();
-            if (val) {
-                requestBody = val;
+            if (bodyInputType === "kv") {
+                const bodyObj = {};
+                let addingFields = true;
+                while (addingFields) {
+                    const fieldKey = await clack.text({
+                        message: "Enter field key:",
+                        placeholder: "e.g. email",
+                    });
+                    if (clack.isCancel(fieldKey) || !fieldKey || !fieldKey.trim())
+                        break;
+                    const fieldVal = await clack.text({
+                        message: `Enter value for '${fieldKey.trim()}':`,
+                        placeholder: "e.g. raj@example.com",
+                    });
+                    if (clack.isCancel(fieldVal))
+                        break;
+                    const trimmedVal = fieldVal.trim();
+                    let parsedVal = trimmedVal;
+                    // Smart casting
+                    if (trimmedVal.toLowerCase() === "true")
+                        parsedVal = true;
+                    else if (trimmedVal.toLowerCase() === "false")
+                        parsedVal = false;
+                    else if (trimmedVal.toLowerCase() === "null")
+                        parsedVal = null;
+                    else if (!isNaN(Number(trimmedVal)) && trimmedVal !== "")
+                        parsedVal = Number(trimmedVal);
+                    bodyObj[fieldKey.trim()] = parsedVal;
+                    const addMore = await clack.confirm({
+                        message: "Add another field to the request body?",
+                        initialValue: false,
+                    });
+                    if (clack.isCancel(addMore) || !addMore) {
+                        addingFields = false;
+                    }
+                }
+                requestBody = JSON.stringify(bodyObj);
+            }
+            else {
+                // Raw JSON input
+                const bodyInput = await clack.text({
+                    message: "Enter JSON payload:",
+                    placeholder: '{"name": "Alice", "email": "alice@gmail.com"}',
+                    validate: (v) => {
+                        if (!v || !v.trim())
+                            return undefined;
+                        try {
+                            JSON.parse(v);
+                            return undefined;
+                        }
+                        catch {
+                            return "Invalid JSON syntax. Please enter valid JSON.";
+                        }
+                    },
+                });
+                if (clack.isCancel(bodyInput)) {
+                    clack.outro("Execution stopped.");
+                    return;
+                }
+                const val = bodyInput.trim();
+                if (val) {
+                    requestBody = val;
+                }
+            }
+        }
+    }
+    // 4. Custom Headers Editor
+    const customHeaders = {};
+    const addHeaders = await clack.confirm({
+        message: "Do you want to add custom request headers?",
+        initialValue: false,
+    });
+    if (clack.isCancel(addHeaders)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    if (addHeaders) {
+        let addingHeaders = true;
+        while (addingHeaders) {
+            const headerKey = await clack.text({
+                message: "Enter Header Name:",
+                placeholder: "e.g. X-Custom-Key",
+            });
+            if (clack.isCancel(headerKey) || !headerKey || !headerKey.trim())
+                break;
+            const headerVal = await clack.text({
+                message: `Enter value for '${headerKey.trim()}':`,
+                placeholder: "e.g. test-value",
+            });
+            if (clack.isCancel(headerVal))
+                break;
+            customHeaders[headerKey.trim()] = headerVal.trim();
+            const addMoreHeaders = await clack.confirm({
+                message: "Add another custom header?",
+                initialValue: false,
+            });
+            if (clack.isCancel(addMoreHeaders) || !addMoreHeaders) {
+                addingHeaders = false;
             }
         }
     }
-    // 4. Prompt for Authorization Header (Bearer token)
+    // 5. Prompt for Authorization Header (Bearer token)
     const addAuth = await clack.confirm({
         message: "Do you want to add an Authorization Bearer token?",
         initialValue: false,
@@ -304,6 +511,9 @@ export async function runApiCommand(projectPath = ".") {
     // Confirm and Execute Request
     const finalUrl = `${baseUrl}${resolvedPath}${queryStr}`;
     clack.log.info(`Ready to request: ${chalk.bold.green(finalMethod)} ${chalk.cyan(finalUrl)}`);
+    if (Object.keys(customHeaders).length > 0) {
+        clack.log.info(`Headers:\n${chalk.gray(JSON.stringify(customHeaders, null, 2))}`);
+    }
     if (bearerToken) {
         const preview = bearerToken.length > 12 ? `${bearerToken.slice(0, 8)}...` : bearerToken;
         clack.log.info(`Auth: Bearer ${preview} (masked)`);
@@ -325,6 +535,7 @@ export async function runApiCommand(projectPath = ".") {
         const headers = {
             Accept: "application/json, text/plain, */*",
             ...(requestBody ? { "Content-Type": "application/json" } : {}),
+            ...customHeaders,
         };
         if (bearerToken) {
             headers["Authorization"] = `Bearer ${bearerToken}`;

package/dist/index.js

@@ -57,11 +57,16 @@ program
 // Subcommand: api
 program
     .command("api")
-    .description("Interactive API playfield: scan codebase routes and send test requests")
-    .argument("[path]", "Path to the project", ".")
-    .action(async (projectPath) => {
+    .description("API playfield: scan codebase routes (interactive) or send direct requests")
+    .argument("[method_or_path]", "HTTP Method or project path", ".")
+    .argument("[route_path]", "Route path (only when method is provided)")
+    .option("-u, --url <url>", "Server base URL")
+    .option("-b, --body <body>", "JSON request body")
+    .option("-t, --token <token>", "Bearer Auth token")
+    .option("-H, --header <headers...>", "Custom headers in Key:Value format")
+    .action(async (methodOrPath, routePath, opts) => {
     const { runApiCommand } = await import("./cli/api.js");
-    await runApiCommand(projectPath);
+    await runApiCommand(methodOrPath, routePath, opts);
 });
 // Subcommand: bench
 program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bandit-cli",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "",
   "main": "index.js",
   "scripts": {