codeant-cli 0.5.4 → 0.5.6

package/src/mcp/server.js

@@ -13,7 +13,13 @@ import { runStartScan } from '../commands/scans/start-scan.js';
 import { runReviewHeadless } from '../reviewHeadless.js';
 import * as scm from '../scm/index.js';
 import { isAlreadyLoggedIn, runLoginFlow } from '../utils/loginFlow.js';
-import { getConfigValue, setConfigValue } from '../utils/config.js';
+import { getConfigValue } from '../utils/config.js';
+import { runHotlistGet, runHotlistList } from '../hotlist/client.js';
+import { logoutCodeAnt } from '../utils/logout.js';
+import { runApiRequest } from '../commands/api/request.js';
+import { runOrganizationAntipatterns } from '../findings/antipatterns.js';
+import { runCloudFindingGet, runCloudFindings, runCloudHistory } from '../findings/cloud.js';
+import { runPentestHistory, runPentestIssues, runPentestReport } from '../findings/pentest.js';
 
 const require = createRequire(import.meta.url);
 const pkg = require('../../package.json');
@@ -215,6 +221,224 @@ export async function startMcpServer() {
     }
   );
 
+  // ─── Organization Hotlist findings (read-only) ──────────────────────────
+  server.registerTool(
+    'codeant_hotlist_list',
+    {
+      title: 'List prioritized Hotlist findings',
+      description: 'Query the organization-wide Hotlist using the same stable IDs, ranking, filters, and pagination as the CodeAnt app. Use this for cross-repository security prioritization and agent triage.',
+      inputSchema: {
+        org: z.string().optional().describe('Organization name. Auto-picked when exactly one connection matches.'),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional().describe('Override only for a self-hosted provider.'),
+        search: z.string().optional(),
+        types: z.array(z.string()).optional(),
+        locations: z.array(z.string()).optional(),
+        severities: z.array(z.enum(['critical', 'high', 'medium', 'low', 'unknown'])).optional(),
+        ticketStatuses: z.array(z.enum(['created', 'not_created'])).optional(),
+        compliance: z.array(z.string()).optional(),
+        validation: z.array(z.enum(['exploit_confirmed'])).optional(),
+        limit: z.number().int().positive().max(100).optional(),
+        cursor: z.string().optional(),
+        all: z.boolean().optional().describe('Fetch every matching page. Default false.'),
+        maxWaitSeconds: z.number().int().nonnegative().max(600).optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runHotlistList(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_hotlist_get',
+    {
+      title: 'Get a Hotlist finding',
+      description: 'Fetch one complete Hotlist finding by its 32-character stable ID. Use the ID displayed in the app or returned by codeant_hotlist_list.',
+      inputSchema: {
+        findingId: z.string().regex(/^[0-9a-f]{32}$/i),
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        maxWaitSeconds: z.number().int().nonnegative().max(600).optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runHotlistGet(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_findings_antipatterns',
+    {
+      title: 'List organization anti-pattern findings',
+      description: 'Fetch anti-pattern findings across selected repositories, or every repository in the organization when repos is omitted.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        repos: z.array(z.string()).optional().describe('Repositories in owner/repo form. Omit to query every repository.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runOrganizationAntipatterns(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_cloud_scan_history',
+    {
+      title: 'List cloud security scan history',
+      description: 'List AWS, Azure, or GCP CSPM, VM, or container scans visible in the CodeAnt Cloud Security UI. Cloud findings are organization/account scoped, not repository scoped.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        provider: z.enum(['aws', 'azure', 'gcp', 'all']).optional().describe('Default all.'),
+        kind: z.enum(['cspm', 'vm', 'container']).optional().describe('Default cspm.'),
+        latest: z.boolean().optional().describe('Return latest scans instead of complete history. CSPM only.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runCloudHistory(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_cloud_findings_list',
+    {
+      title: 'List cloud security findings',
+      description: 'Fetch findings for one AWS, Azure, or GCP CSPM, VM, or container scan using the same endpoint as the app.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        provider: z.enum(['aws', 'azure', 'gcp']),
+        kind: z.enum(['cspm', 'vm', 'container']).optional().describe('Default cspm.'),
+        scanId: z.string(),
+        accountId: z.string().optional().describe('Optional AWS account ID.'),
+        tenantId: z.string().optional().describe('Required for Azure.'),
+        projectId: z.string().optional().describe('Required for GCP.'),
+        cloudService: z.string().optional(),
+        severity: z.string().optional(),
+        status: z.string().optional(),
+        framework: z.string().optional(),
+        subscriptionId: z.string().optional(),
+        exploitAttemptedOnly: z.boolean().optional(),
+        minDaysUnused: z.number().int().nonnegative().optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runCloudFindings(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_cloud_finding_get',
+    {
+      title: 'Get cloud security finding detail',
+      description: 'Fetch complete detail for one CSPM, VM, or container finding UID.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        provider: z.enum(['aws', 'azure', 'gcp']),
+        kind: z.enum(['cspm', 'vm', 'container']).optional().describe('Default cspm.'),
+        scanId: z.string(),
+        uid: z.string(),
+        accountId: z.string().optional(),
+        tenantId: z.string().optional().describe('Required for Azure.'),
+        projectId: z.string().optional().describe('Required for GCP.'),
+        cloudService: z.string().optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runCloudFindingGet(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_pentest_history',
+    {
+      title: 'List pentest engagements',
+      description: 'List every pentest engagement visible in the CodeAnt Pentesting UI, including status and finding counts.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runPentestHistory(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_pentest_issues',
+    {
+      title: 'List pentest issues',
+      description: 'Fetch all available open issues for one pentest engagement. The backend applies the same entitlement redaction as the UI.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        reportId: z.string(),
+        variant: z.enum(['prod', 'test']).optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runPentestIssues(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  server.registerTool(
+    'codeant_pentest_report',
+    {
+      title: 'Get pentest report',
+      description: 'Fetch the full customer report for one pentest engagement. The backend applies the same entitlement redaction as the UI.',
+      inputSchema: {
+        org: z.string().optional(),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional(),
+        reportId: z.string(),
+        variant: z.enum(['prod', 'test']).optional(),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runPentestReport(input)); } catch (err) { return fail(err); }
+    }
+  );
+
+  // Generic GET keeps newly-added read APIs available without a CLI release.
+  // Non-GET requests are registered below only when write mode is enabled.
+  server.registerTool(
+    'codeant_api_get',
+    {
+      title: 'Call a CodeAnt GET API',
+      description: 'Call any authenticated GET endpoint on the configured CodeAnt API host. The path must be relative (for example /extension/scans2/validate); absolute URLs are rejected.',
+      inputSchema: {
+        path: z.string().startsWith('/'),
+        org: z.string().optional().describe('Organization name. Required when the login has multiple matching connections.'),
+        service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+        providerBaseUrl: z.string().url().optional().describe('Override only for a self-hosted provider.'),
+        query: z.record(z.union([z.string(), z.number(), z.boolean(), z.array(z.string())])).optional(),
+        headers: z.array(z.string()).optional().describe('Optional repeatable "Name: value" headers. Authorization cannot be overridden.'),
+      },
+      annotations: READ,
+    },
+    async (input) => {
+      try { return ok(await runApiRequest({ method: 'GET', ...input })); } catch (err) { return fail(err); }
+    }
+  );
+
   // ─── Pull requests (SCM, read-only) ──────────────────────────────────────
   server.registerTool(
     'codeant_pr_list',
@@ -419,16 +643,39 @@ export async function startMcpServer() {
     },
     async () => {
       try {
-        const wasLoggedIn = !!(process.env.CODEANT_API_TOKEN?.trim() || getConfigValue('apiKeyV2'));
-        setConfigValue('apiKeyV2', null);
-        delete process.env.CODEANT_API_TOKEN;
-        return ok({ wasLoggedIn, status: wasLoggedIn ? 'logged_out' : 'not_logged_in' });
+        const result = await logoutCodeAnt();
+        return ok({
+          ...result,
+          status: result.wasLoggedIn ? 'logged_out' : 'not_logged_in',
+        });
       } catch (err) { return fail(err); }
     }
   );
 
   // ─── Write-side tools (gated behind CODEANT_READ_ONLY=0) ─────────────────
   if (!readOnly) {
+    server.registerTool(
+      'codeant_api_request',
+      {
+        title: 'Call a CodeAnt write API',
+        description: 'Call an authenticated POST, PUT, PATCH, or DELETE endpoint on the configured CodeAnt API host. WRITE OPERATION — only enabled when CODEANT_READ_ONLY=0. Absolute URLs are rejected.',
+        inputSchema: {
+          method: z.enum(['POST', 'PUT', 'PATCH', 'DELETE']),
+          path: z.string().startsWith('/'),
+          org: z.string().optional().describe('Organization name. Required when the login has multiple matching connections.'),
+          service: z.enum(['github', 'gitlab', 'bitbucket', 'azuredevops']).optional(),
+          providerBaseUrl: z.string().url().optional().describe('Override only for a self-hosted provider.'),
+          query: z.record(z.union([z.string(), z.number(), z.boolean(), z.array(z.string())])).optional(),
+          body: z.unknown().optional(),
+          headers: z.array(z.string()).optional(),
+        },
+        annotations: WRITE_NON_DESTRUCTIVE,
+      },
+      async (input) => {
+        try { return ok(await runApiRequest(input)); } catch (err) { return fail(err); }
+      }
+    );
+
     server.registerTool(
       'codeant_scans_start',
       {

package/src/utils/fetchApi.js

@@ -23,13 +23,61 @@ const RETRYABLE_CAUSES = new Set([
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-const fetchApi = async (endpoint, method = 'GET', body = null) => {
-  const url = endpoint.startsWith('http') ? endpoint : `${getBaseUrl()}${endpoint}`;
+function responseMessage(data, status) {
+  if (typeof data?.error?.message === 'string') return data.error.message;
+  if (typeof data?.message === 'string') return data.message;
+  if (typeof data?.error === 'string') return data.error;
+  return `HTTP error ${status}`;
+}
+
+function appendQuery(url, query) {
+  if (!query || typeof query !== 'object') return url;
+  const parsed = new URL(url);
+  for (const [key, value] of Object.entries(query)) {
+    if (value === undefined || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) parsed.searchParams.append(key, String(item));
+    } else {
+      parsed.searchParams.set(key, String(value));
+    }
+  }
+  return parsed.toString();
+}
+
+async function parseResponse(response) {
+  if (response.status === 204 || response.status === 205) return null;
+  const text = await response.text();
+  if (!text) return null;
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('json') || /^[\s]*[\[{]/.test(text)) {
+    try {
+      return JSON.parse(text);
+    } catch {
+      // A mislabeled response should still be inspectable by the caller.
+    }
+  }
+  return text;
+}
+
+const fetchApiResponse = async (endpoint, {
+  method = 'GET',
+  body = null,
+  headers = {},
+  query = null,
+  allowHttpError = false,
+  tenant = null,
+  signal = undefined,
+} = {}) => {
+  const baseUrl = getBaseUrl();
+  const resolvedUrl = endpoint.startsWith('http') ? endpoint : `${baseUrl}${endpoint}`;
+  const url = appendQuery(resolvedUrl, query);
+  const normalizedMethod = String(method || 'GET').toUpperCase();
 
   const options = {
-    method,
+    method: normalizedMethod,
     headers: {
       'Content-Type': 'application/json',
+      ...headers,
     },
   };
 
@@ -38,10 +86,18 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
   if (token) {
     options.headers['Authorization'] = `Bearer ${token}`;
   }
+  if (tenant) {
+    options.headers['X-CodeAnt-CLI-Org'] = tenant.organization;
+    options.headers['X-CodeAnt-CLI-Service'] = tenant.service;
+    options.headers['X-CodeAnt-CLI-Base-URL'] = tenant.providerBaseUrl;
+  }
 
-  if (body && method !== 'GET') {
+  if (body !== null && body !== undefined && !['GET', 'HEAD'].includes(normalizedMethod)) {
     options.body = JSON.stringify(body);
   }
+  if (signal) {
+    options.signal = signal;
+  }
 
   // Retry transient network/cold-start failures up to 2 times.
   const MAX_ATTEMPTS = 3;
@@ -55,13 +111,21 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
         throw new Error('Access denied (403). Please run `codeant logout` and then `codeant login` to re-authenticate.');
       }
 
-      const data = await response.json();
+      const data = await parseResponse(response);
 
-      if (!response.ok) {
-        throw new Error(data.message || `HTTP error ${response.status}`);
+      if (!response.ok && !allowHttpError) {
+        const error = new Error(responseMessage(data, response.status));
+        error.status = response.status;
+        error.data = data;
+        throw error;
       }
 
-      return data;
+      return {
+        ok: response.ok,
+        status: response.status,
+        headers: Object.fromEntries(response.headers.entries()),
+        data,
+      };
     } catch (err) {
       lastErr = err;
       const cause = err?.cause?.code || err?.cause?.message || err?.cause || '';
@@ -78,4 +142,14 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
   throw lastErr;
 };
 
-export { fetchApi };
+const fetchApi = async (endpoint, method = 'GET', body = null) => {
+  const response = await fetchApiResponse(endpoint, { method, body });
+  return response.data;
+};
+
+const fetchAppApi = async (endpoint, method = 'GET', body = null, tenant) => {
+  const response = await fetchApiResponse(endpoint, { method, body, tenant });
+  return response.data;
+};
+
+export { fetchApi, fetchApiResponse, fetchAppApi };

package/src/utils/installPushProtectionHook.js

@@ -6,7 +6,7 @@ const HOOK_MARKER = '# codeant-push-protection';
 const HOOK_MARKER_END = '# end-codeant-push-protection';
 
 /**
- * Build the full pre-push hook script (with shebang).
+ * Build the full pre-commit hook script (with shebang).
  */
 function buildHookScript(cliPath) {
   return `#!/bin/sh
@@ -21,27 +21,28 @@ ${buildHookBlock(cliPath)}
  */
 function buildHookBlock(cliPath) {
   if (cliPath) {
+    const quotedCliPath = `'${cliPath.replace(/'/g, "'\\''")}'`;
     return `${HOOK_MARKER}
-# Auto-installed by CodeAnt AI — blocks pushes containing secrets.
+# Auto-installed by CodeAnt AI — blocks commits containing secrets.
 # To disable: delete this hook or run "codeant push-protection disable"
 # Uses the CLI bundled with the VS Code extension.
 # Reopen stdin from terminal so the CLI can show an interactive bypass prompt.
-# In non-interactive environments (CI), this silently fails and the push is blocked.
+# In non-interactive environments (CI), this silently fails and the commit is blocked.
 exec < /dev/tty 2>/dev/null || true
-if [ -f "${cliPath}" ] && command -v node >/dev/null 2>&1; then
-  node "${cliPath}" secrets --committed --hook
+if [ -f ${quotedCliPath} ] && command -v node >/dev/null 2>&1; then
+  node ${quotedCliPath} secrets --staged --hook
 else
   command -v codeant >/dev/null 2>&1 || exit 0
-  codeant secrets --committed --hook
+  codeant secrets --staged --hook
 fi
 ${HOOK_MARKER_END}`;
   }
   return `${HOOK_MARKER}
-# Auto-installed by CodeAnt AI — blocks pushes containing secrets.
+# Auto-installed by CodeAnt AI — blocks commits containing secrets.
 # To disable: delete this hook or run "codeant push-protection disable"
 exec < /dev/tty 2>/dev/null || true
 command -v codeant >/dev/null 2>&1 || exit 0
-codeant secrets --committed --hook
+codeant secrets --staged --hook
 ${HOOK_MARKER_END}`;
 }
 
@@ -97,7 +98,7 @@ function getHooksDir(gitRoot) {
 }
 
 /**
- * Install a pre-push hook that runs secret scanning before push.
+ * Install a pre-commit hook that runs secret scanning before commit.
  *
  * @param {string} workspacePath - Path to the git repository
  * @param {string} [cliPath] - Absolute path to the codeant CLI entry point (from extension node_modules)
@@ -113,7 +114,7 @@ export function installPushProtectionHook(workspacePath, cliPath) {
   if (!existsSync(hooksDir)) {
     mkdirSync(hooksDir, { recursive: true });
   }
-  const hookPath = path.join(hooksDir, 'pre-push');
+  const hookPath = path.join(hooksDir, 'pre-commit');
 
   // If hook already exists, check if it's ours
   if (existsSync(hookPath)) {
@@ -127,14 +128,14 @@ export function installPushProtectionHook(workspacePath, cliPath) {
     }
     // There's a user-managed hook — append only for shell hooks to avoid breaking non-shell scripts
     const firstLine = existing.split('\n', 1)[0] || '';
-    const isShellHook = firstLine.startsWith('#!') ? /\/(ba|z|k)?sh(\s|$)/.test(firstLine) : true;
+    const isShellHook = firstLine.startsWith('#!') ? /^#!\s*(?:\/\S*\/|\/usr\/bin\/env\s+(?:-S\s+)?)(ba|z|k)?sh(\s|$)/.test(firstLine) : true;
     if (!isShellHook) {
-      return { installed: false, hookPath, message: 'Existing pre-push hook is non-shell; cannot append CodeAnt block safely' };
+      return { installed: false, hookPath, message: 'Existing pre-commit hook is non-shell; cannot append CodeAnt block safely' };
     }
     const appended = existing.trimEnd() + '\n\n' + buildHookBlock(cliPath) + '\n';
     writeFileSync(hookPath, appended, 'utf-8');
     chmodSync(hookPath, 0o755);
-    return { installed: true, hookPath, message: 'Hook appended to existing pre-push' };
+    return { installed: true, hookPath, message: 'Hook appended to existing pre-commit' };
   }
 
   writeFileSync(hookPath, buildHookScript(cliPath), 'utf-8');
@@ -143,7 +144,7 @@ export function installPushProtectionHook(workspacePath, cliPath) {
 }
 
 /**
- * Remove the CodeAnt pre-push hook (or just our section if appended).
+ * Remove the CodeAnt pre-commit hook (or just our section if appended).
  *
  * @param {string} workspacePath
  * @returns {{ removed: boolean, message: string }}
@@ -155,10 +156,10 @@ export function removePushProtectionHook(workspacePath) {
   }
 
   const hooksDir = getHooksDir(gitRoot);
-  const hookPath = path.join(hooksDir, 'pre-push');
+  const hookPath = path.join(hooksDir, 'pre-commit');
 
   if (!existsSync(hookPath)) {
-    return { removed: false, message: 'No pre-push hook found' };
+    return { removed: false, message: 'No pre-commit hook found' };
   }
 
   const content = readFileSync(hookPath, 'utf-8');

package/src/utils/logout.js

@@ -0,0 +1,31 @@
+import { getConfigValue, setConfigValue } from './config.js';
+import { fetchApiResponse } from './fetchApi.js';
+
+const DEFAULT_LOGOUT_REVOCATION_TIMEOUT_MS = 3_000;
+
+export async function logoutCodeAnt({
+  revocationTimeoutMs = DEFAULT_LOGOUT_REVOCATION_TIMEOUT_MS,
+} = {}) {
+  const token = process.env.CODEANT_API_TOKEN?.trim() || getConfigValue('apiKeyV2');
+  if (!token) return { wasLoggedIn: false, serverRevoked: false };
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), revocationTimeoutMs);
+  let serverRevoked = false;
+  let warning;
+  try {
+    await fetchApiResponse('/extension/logout', {
+      method: 'POST',
+      body: {},
+      signal: controller.signal,
+    });
+    serverRevoked = true;
+  } catch (error) {
+    warning = `The local token was cleared, but server revocation could not be confirmed: ${error.message}`;
+  } finally {
+    clearTimeout(timeout);
+    setConfigValue('apiKeyV2', null);
+    delete process.env.CODEANT_API_TOKEN;
+  }
+  return { wasLoggedIn: true, serverRevoked, warning };
+}