codeant-cli 0.5.3 → 0.5.5

package/src/commands/getDashboardUrl.js

@@ -0,0 +1,49 @@
+import React, { useState, useEffect } from 'react';
+import { Text, Box, useApp } from 'ink';
+import { getConfigValue } from '../utils/config.js';
+import { getBaseUrl, getDashboardUrl as resolveDashboardUrl } from '../utils/baseUrl.js';
+
+export default function GetDashboardUrl() {
+  const { exit } = useApp();
+  const [state, setState] = useState({ status: 'loading' });
+
+  const envValue = process.env.CODEANT_DASHBOARD_URL;
+  const configValue = getConfigValue('dashboardUrl');
+  const source = envValue ? 'env' : configValue ? 'config' : 'upstream (queried from API base URL)';
+
+  useEffect(() => {
+    (async () => {
+      try {
+        const url = await resolveDashboardUrl();
+        setState({ status: 'resolved', url });
+      } catch (err) {
+        setState({ status: 'error', message: err.message });
+      }
+      exit();
+    })();
+  }, []);
+
+  if (state.status === 'loading') {
+    return React.createElement(
+      Box,
+      { flexDirection: 'column', padding: 1 },
+      React.createElement(Text, null, 'Querying dashboard URL...')
+    );
+  }
+
+  if (state.status === 'error') {
+    return React.createElement(
+      Box,
+      { flexDirection: 'column', padding: 1 },
+      React.createElement(Text, { color: 'red' }, '✗ ', state.message),
+      React.createElement(Text, { color: 'gray' }, 'Base URL: ', getBaseUrl())
+    );
+  }
+
+  return React.createElement(
+    Box,
+    { flexDirection: 'column', padding: 1 },
+    React.createElement(Text, { bold: true }, 'Dashboard URL: ', state.url),
+    React.createElement(Text, { color: 'gray' }, 'Source: ', source)
+  );
+}

package/src/commands/hotlist/index.js

@@ -0,0 +1,58 @@
+import { runHotlistGet, runHotlistList } from '../../hotlist/client.js';
+
+function addTenantOptions(command) {
+  return command
+    .option('--org <org>', 'Organization name (auto-picked when unambiguous)')
+    .option('--service <service>', 'github, gitlab, bitbucket, or azuredevops')
+    .option('--provider-base-url <url>', 'Override the authenticated provider base URL')
+    .option('--max-wait <seconds>', 'Wait for an initial Hotlist build', Number, 60);
+}
+
+export default function registerHotlistCommands(program, { runCmd }) {
+  const hotlist = program
+    .command('hotlist')
+    .description('Query organization-wide prioritized Hotlist findings');
+
+  addTenantOptions(
+    hotlist
+      .command('list')
+      .description('List Hotlist findings using the same filters and ranking as the app')
+      .option('--search <text>', 'Search title, repository, path, package, CVE, or check ID')
+      .option('--type <values>', 'Comma-separated finding types')
+      .option('--location <values>', 'Comma-separated repositories or cloud accounts')
+      .option('--severity <values>', 'Comma-separated severities')
+      .option('--ticket-status <values>', 'created,not_created')
+      .option('--compliance <values>', 'Comma-separated compliance frameworks')
+      .option('--validation <values>', 'Comma-separated validation flags (for example exploit_confirmed)')
+      .option('--limit <n>', 'Page size from 1 to 100', Number, 30)
+      .option('--cursor <cursor>', 'Continue from a previous next_cursor')
+      .option('--all', 'Fetch every matching page', false),
+  ).action((options) => runCmd(() => runHotlistList({
+    org: options.org,
+    service: options.service,
+    providerBaseUrl: options.providerBaseUrl,
+    maxWaitSeconds: options.maxWait,
+    search: options.search,
+    types: options.type,
+    locations: options.location,
+    severities: options.severity,
+    ticketStatuses: options.ticketStatus,
+    compliance: options.compliance,
+    validation: options.validation,
+    limit: options.limit,
+    cursor: options.cursor,
+    all: options.all,
+  })));
+
+  addTenantOptions(
+    hotlist
+      .command('get <finding-id>')
+      .description('Get one finding by the stable ID shown in the Hotlist detail panel'),
+  ).action((findingId, options) => runCmd(() => runHotlistGet({
+    findingId,
+    org: options.org,
+    service: options.service,
+    providerBaseUrl: options.providerBaseUrl,
+    maxWaitSeconds: options.maxWait,
+  })));
+}

package/src/commands/login.js

@@ -30,7 +30,15 @@ export default function Login() {
     let timeoutId;
 
     (async () => {
-      const dashboardUrl = await getDashboardUrl();
+      let dashboardUrl;
+      try {
+        dashboardUrl = await getDashboardUrl();
+      } catch (err) {
+        setError(err.message);
+        setStatus('error');
+        setTimeout(() => exit(err), 100);
+        return;
+      }
       const loginUrl = `${dashboardUrl}?ideLoginToken=${token}`;
       setLoginUrl(loginUrl);
 

package/src/commands/logout.js

@@ -1,17 +1,25 @@
 import React, { useEffect } from 'react';
 import { Text, Box, useApp } from 'ink';
-import { getConfigValue, setConfigValue } from '../utils/config.js';
+import { getConfigValue } from '../utils/config.js';
+import { logoutCodeAnt } from '../utils/logout.js';
 
 export default function Logout() {
   const { exit } = useApp();
 
   const wasLoggedIn = !!getConfigValue('apiKeyV2');
+  const [warning, setWarning] = React.useState(null);
+  const [done, setDone] = React.useState(!wasLoggedIn);
 
   useEffect(() => {
-    if (wasLoggedIn) {
-      setConfigValue('apiKeyV2', null);
+    if (!wasLoggedIn) {
+      exit();
+      return;
     }
-    exit();
+    logoutCodeAnt().then((result) => {
+      setWarning(result.warning || null);
+      setDone(true);
+      setTimeout(() => exit(), 100);
+    });
   }, []);
 
   if (!wasLoggedIn) {
@@ -25,6 +33,7 @@ export default function Logout() {
   return React.createElement(
     Box,
     { flexDirection: 'column', padding: 1 },
-    React.createElement(Text, { color: 'green' }, '✓ Logged out successfully.')
+    React.createElement(Text, { color: done ? 'green' : 'gray' }, done ? '✓ Logged out successfully.' : 'Revoking session...'),
+    warning ? React.createElement(Text, { color: 'yellow' }, warning) : null
   );
 }

package/src/commands/removeDashboardUrl.js

@@ -0,0 +1,31 @@
+import React, { useEffect } from 'react';
+import { Text, Box, useApp } from 'ink';
+import { getConfigValue, setConfigValue } from '../utils/config.js';
+
+export default function RemoveDashboardUrl() {
+  const { exit } = useApp();
+
+  const hadValue = !!getConfigValue('dashboardUrl');
+
+  useEffect(() => {
+    if (hadValue) {
+      setConfigValue('dashboardUrl', null);
+    }
+    exit();
+  }, []);
+
+  if (!hadValue) {
+    return React.createElement(
+      Box,
+      { flexDirection: 'column', padding: 1 },
+      React.createElement(Text, { color: 'yellow' }, 'No dashboard URL override was set.')
+    );
+  }
+
+  return React.createElement(
+    Box,
+    { flexDirection: 'column', padding: 1 },
+    React.createElement(Text, { color: 'green' }, '✓ Dashboard URL override removed.'),
+    React.createElement(Text, { color: 'gray' }, 'It will be auto-detected from the API base URL on next login.')
+  );
+}

package/src/commands/setDashboardUrl.js

@@ -0,0 +1,37 @@
+import React, { useEffect } from 'react';
+import { Text, Box, useApp } from 'ink';
+import { setConfigValue, CONFIG_FILE } from '../utils/config.js';
+
+export default function SetDashboardUrl({ url }) {
+  const { exit } = useApp();
+
+  useEffect(() => {
+    if (!url) {
+      exit(new Error('URL is required'));
+      return;
+    }
+
+    try {
+      setConfigValue('dashboardUrl', url);
+      exit();
+    } catch (err) {
+      exit(err);
+    }
+  }, []);
+
+  if (!url) {
+    return React.createElement(
+      Box,
+      { flexDirection: 'column', padding: 1 },
+      React.createElement(Text, { color: 'red' }, '✗ Error: URL is required'),
+      React.createElement(Text, { color: 'gray' }, 'Usage: codeant set-dashboard-url <url>')
+    );
+  }
+
+  return React.createElement(
+    Box,
+    { flexDirection: 'column', padding: 1 },
+    React.createElement(Text, { color: 'green' }, '✓ Dashboard URL set to: ', url),
+    React.createElement(Text, { color: 'gray' }, 'Saved to: ', CONFIG_FILE)
+  );
+}

package/src/findings/antipatterns.js

@@ -0,0 +1,31 @@
+import { resolveCliTenant } from '../api/tenant.js';
+import { runRepos } from '../commands/scans/repos.js';
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+function splitRepos(value) {
+  const values = Array.isArray(value) ? value : value ? [value] : [];
+  return values
+    .flatMap((entry) => String(entry).split(','))
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+export async function runOrganizationAntipatterns(options = {}) {
+  const tenant = await resolveCliTenant(options);
+  let repos = splitRepos(options.repos);
+  if (repos.length === 0) {
+    const result = await runRepos({ org: tenant.organization });
+    repos = (result.repos || []).map((repo) => repo.full_name || repo.name).filter(Boolean);
+  }
+  if (repos.length === 0) throw new Error('No repositories are available for this organization.');
+
+  const result = await fetchAppApi(
+    '/explorer/quality/antipatterns',
+    'POST',
+    { ...tenant.requestBody, org: tenant.organization, repos },
+    tenant,
+  );
+  return { tenant: tenant.requestBody, ...result };
+}
+
+export { splitRepos };

package/src/findings/cloud.js

@@ -0,0 +1,119 @@
+import { resolveCliTenant } from '../api/tenant.js';
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+const PROVIDERS = new Set(['aws', 'azure', 'gcp']);
+const KINDS = new Set(['cspm', 'vm', 'container']);
+
+function normalizeProvider(value, { allowAll = false } = {}) {
+  const provider = String(value || '').trim().toLowerCase();
+  if (allowAll && (!provider || provider === 'all')) return 'all';
+  if (!PROVIDERS.has(provider)) {
+    throw new Error(`--provider must be one of: ${[...PROVIDERS].join(', ')}.`);
+  }
+  return provider;
+}
+
+function requireValue(value, option) {
+  if (!String(value || '').trim()) throw new Error(`${option} is required.`);
+  return String(value).trim();
+}
+
+function normalizeKind(value) {
+  const kind = String(value || 'cspm').trim().toLowerCase();
+  if (!KINDS.has(kind)) throw new Error(`--kind must be one of: ${[...KINDS].join(', ')}.`);
+  return kind;
+}
+
+function endpoint(provider, kind, action) {
+  if (kind === 'vm') return `/cloud/${provider}/vm-scanning/${action}`;
+  if (kind === 'container') return `/cloud/${provider}/container-scanning/${action}`;
+  return `/cloud/${provider}/scan/${action}`;
+}
+
+function providerScope(provider, options = {}) {
+  if (provider === 'azure') {
+    return { tenant_id: requireValue(options.tenantId, '--tenant-id for Azure findings') };
+  }
+  if (provider === 'gcp') {
+    return { project_id: requireValue(options.projectId, '--project-id for GCP findings') };
+  }
+  return options.accountId ? { account_id: options.accountId } : {};
+}
+
+function optionalFilters(provider, options = {}) {
+  const filters = {};
+  const service = options.cloudService;
+  if (service) filters[`${provider}_service`] = service;
+  if (options.severity) filters.severity = options.severity;
+  if (options.status) filters.status = options.status;
+  if (options.framework) filters.framework = options.framework;
+  if (options.minDaysUnused !== undefined) filters.min_days_unused = options.minDaysUnused;
+  if (provider === 'aws' && options.exploitAttemptedOnly) filters.exploit_attempted_only = true;
+  if (provider === 'azure' && options.subscriptionId) filters.subscription_id = options.subscriptionId;
+  return filters;
+}
+
+async function request(provider, kind, action, options = {}, extra = {}, resolvedTenant = null) {
+  const tenant = resolvedTenant || await resolveCliTenant(options);
+  const data = await fetchAppApi(
+    endpoint(provider, kind, action),
+    'POST',
+    {
+      ...tenant.requestBody,
+      username: tenant.organization,
+      ...extra,
+    },
+    tenant,
+  );
+  return { tenant: tenant.requestBody, provider, kind, ...data };
+}
+
+export async function runCloudHistory(options = {}) {
+  const provider = normalizeProvider(options.provider, { allowAll: true });
+  const kind = normalizeKind(options.kind);
+  if (options.latest && kind !== 'cspm') {
+    throw new Error('--latest is supported only for --kind cspm; VM and container history already returns scan records.');
+  }
+  const action = options.latest ? 'latest' : 'history';
+  const providers = provider === 'all' ? [...PROVIDERS] : [provider];
+  const tenant = await resolveCliTenant(options);
+  if (provider !== 'all') return request(provider, kind, action, options, {}, tenant);
+  const settled = await Promise.allSettled(
+    providers.map((item) => request(item, kind, action, options, {}, tenant)),
+  );
+  const results = settled.map((result, index) => (
+    result.status === 'fulfilled'
+      ? result.value
+      : { provider: providers[index], kind, error: result.reason?.message || String(result.reason) }
+  ));
+  return {
+    tenant: tenant.requestBody,
+    providers: Object.fromEntries(results.map((result) => [result.provider, result])),
+  };
+}
+
+export async function runCloudFindings(options = {}) {
+  const provider = normalizeProvider(options.provider);
+  const kind = normalizeKind(options.kind);
+  const scanId = requireValue(options.scanId, '--scan-id');
+  return request(provider, kind, kind === 'cspm' ? 'findings' : 'results', options, {
+    scan_id: scanId,
+    ...(kind === 'cspm' ? providerScope(provider, options) : {}),
+    ...(kind === 'cspm' ? optionalFilters(provider, options) : {}),
+  });
+}
+
+export async function runCloudFindingGet(options = {}) {
+  const provider = normalizeProvider(options.provider);
+  const kind = normalizeKind(options.kind);
+  const scanId = requireValue(options.scanId, '--scan-id');
+  const uid = requireValue(options.uid, '--uid');
+  return request(provider, kind, 'finding_detail', options, {
+    scan_id: scanId,
+    uid,
+    ...(kind === 'cspm' ? providerScope(provider, options) : {}),
+    ...(kind === 'cspm' && options.cloudService ? { [`${provider}_service`]: options.cloudService } : {}),
+  });
+}
+
+export { normalizeKind, normalizeProvider };

package/src/findings/pentest.js

@@ -0,0 +1,42 @@
+import { resolveCliTenant } from '../api/tenant.js';
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+function variantBody(variant) {
+  if (!variant || variant === 'prod') return {};
+  if (variant !== 'test') throw new Error('--variant must be prod or test.');
+  return { variant: 'test' };
+}
+
+async function request(endpoint, options = {}, body = {}) {
+  const tenant = await resolveCliTenant(options);
+  const data = await fetchAppApi(
+    endpoint,
+    'POST',
+    { ...tenant.requestBody, ...body, org: tenant.organization },
+    tenant,
+  );
+  return { tenant: tenant.requestBody, ...data };
+}
+
+function reportId(options) {
+  if (!String(options.reportId || '').trim()) throw new Error('--report-id is required.');
+  return String(options.reportId).trim();
+}
+
+export async function runPentestHistory(options = {}) {
+  return request('/pentesting/history', options);
+}
+
+export async function runPentestIssues(options = {}) {
+  return request('/pentesting/issues', options, {
+    report_id: reportId(options),
+    ...variantBody(options.variant),
+  });
+}
+
+export async function runPentestReport(options = {}) {
+  return request('/pentesting/report', options, {
+    report_id: reportId(options),
+    ...variantBody(options.variant),
+  });
+}

package/src/hotlist/client.js

@@ -0,0 +1,89 @@
+import { resolveCliTenant } from '../api/tenant.js';
+import { fetchAppApi } from '../utils/fetchApi.js';
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function splitValues(value) {
+  const values = Array.isArray(value) ? value : value ? [value] : [];
+  return values.flatMap((entry) => String(entry).split(',')).map((entry) => entry.trim()).filter(Boolean);
+}
+
+export function hotlistFilters(options = {}) {
+  return {
+    types: splitValues(options.types),
+    locations: splitValues(options.locations),
+    severities: splitValues(options.severities).map((value) => value.toLowerCase()),
+    ticket_statuses: splitValues(options.ticketStatuses),
+    compliance: splitValues(options.compliance).map((value) => value.toLowerCase()),
+    validation: splitValues(options.validation),
+  };
+}
+
+export const resolveHotlistTenant = resolveCliTenant;
+
+async function requestReady(endpoint, body, tenant, maxWaitSeconds = 60) {
+  const deadline = Date.now() + Math.max(0, Number(maxWaitSeconds) || 0) * 1000;
+  while (true) {
+    const response = await fetchAppApi(endpoint, 'POST', body, tenant);
+    if (response?.state !== 'building') return response;
+    if (Date.now() >= deadline) {
+      throw new Error('Hotlist is still building. Retry the command in a few seconds or increase --max-wait.');
+    }
+    const retrySeconds = Math.min(Math.max(Number(response.retry_after_seconds) || 3, 1), 10);
+    await sleep(retrySeconds * 1000);
+  }
+}
+
+function pageLimit(value) {
+  const limit = value === undefined ? 30 : Number(value);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    throw new Error('--limit must be an integer between 1 and 100.');
+  }
+  return limit;
+}
+
+export async function runHotlistList(options = {}) {
+  const tenant = await resolveHotlistTenant(options);
+  const request = {
+    ...tenant.requestBody,
+    search: options.search || '',
+    filters: hotlistFilters(options),
+    limit: pageLimit(options.limit),
+    cursor: options.cursor || null,
+  };
+  let result = await requestReady('/explorer/security/hotlist/query', request, tenant, options.maxWaitSeconds);
+  if (!options.all) return { tenant: tenant.requestBody, ...result };
+
+  const items = [...(result.items || [])];
+  while (result.has_more && result.next_cursor) {
+    result = await requestReady(
+      '/explorer/security/hotlist/query',
+      { ...request, cursor: result.next_cursor },
+      tenant,
+      options.maxWaitSeconds,
+    );
+    items.push(...(result.items || []));
+  }
+  return {
+    tenant: tenant.requestBody,
+    ...result,
+    items,
+    returned_count: items.length,
+    next_cursor: null,
+    has_more: false,
+  };
+}
+
+export async function runHotlistGet({ findingId, ...options } = {}) {
+  if (!/^[0-9a-f]{32}$/i.test(String(findingId || ''))) {
+    throw new Error('Finding ID must be the 32-character stable ID shown in Hotlist.');
+  }
+  const tenant = await resolveHotlistTenant(options);
+  const result = await requestReady(
+    '/explorer/security/hotlist/finding',
+    { ...tenant.requestBody, finding_id: String(findingId).toLowerCase() },
+    tenant,
+    options.maxWaitSeconds,
+  );
+  return { tenant: tenant.requestBody, ...result };
+}

package/src/index.js

@@ -7,6 +7,9 @@ import { createRequire } from 'module';
 import Secrets from './commands/secrets.js';
 import SetBaseUrl from './commands/setBaseUrl.js';
 import GetBaseUrl from './commands/getBaseUrl.js';
+import SetDashboardUrl from './commands/setDashboardUrl.js';
+import GetDashboardUrl from './commands/getDashboardUrl.js';
+import RemoveDashboardUrl from './commands/removeDashboardUrl.js';
 import SetApiKey from './commands/setApiKey.js';
 import GetApiKey from './commands/getApiKey.js';
 import Login from './commands/login.js';
@@ -20,6 +23,9 @@ import { setConfigValue } from './utils/config.js';
 import { track, shutdown as analyticsShutdown, isTelemetryDisabled } from './utils/analytics.js';
 import registerScansCommands from './commands/scans/index.js';
 import registerSettingsCommands from './commands/settings/index.js';
+import registerApiCommands from './commands/api/index.js';
+import registerHotlistCommands from './commands/hotlist/index.js';
+import registerFindingsCommands from './commands/findings/index.js';
 
 // Read version from package.json
 const require = createRequire(import.meta.url);
@@ -188,6 +194,27 @@ program
       render(React.createElement(GetBaseUrl));
     });
 
+  program
+    .command('set-dashboard-url <url>')
+    .description('Set the web app dashboard URL used for login')
+    .action((url) => {
+      render(React.createElement(SetDashboardUrl, { url }));
+    });
+
+  program
+    .command('get-dashboard-url')
+    .description('Show the current dashboard URL override')
+    .action(() => {
+      render(React.createElement(GetDashboardUrl));
+    });
+
+  program
+    .command('remove-dashboard-url')
+    .description('Remove the dashboard URL override')
+    .action(() => {
+      render(React.createElement(RemoveDashboardUrl));
+    });
+
   program
     .command('set-codeant-api-key <key>')
     .description('Set the CodeAnt API key')
@@ -397,6 +424,15 @@ program
   // ─── Settings commands ───
   registerSettingsCommands(program, { runCmd });
 
+  // ─── Authenticated application API passthrough ───
+  registerApiCommands(program, { runCmd });
+
+  // ─── Organization Hotlist findings ───
+  registerHotlistCommands(program, { runCmd });
+
+  // ─── Unified findings commands ───
+  registerFindingsCommands(program, { runCmd });
+
   // ─── MCP server (for Claude Code plugin and other MCP clients) ───
   program
     .command('mcp')