depwire-cli 0.9.25 → 0.9.26

package/dist/{chunk-ORGAO3HT.js → chunk-B2KGFBZL.js}

@@ -14,8 +14,9 @@ import {
   loadMetadata,
   parseProject,
   parseTypeScriptFile,
+  scanSecurity,
   searchSymbols
-} from "./chunk-QHVWDUSX.js";
+} from "./chunk-YYY5TNG7.js";
 
 // src/viz/data.ts
 import { basename } from "path";
@@ -1127,6 +1128,50 @@ Always run this before any refactor that touches file structure.`,
         },
         required: ["operation", "target"]
       }
+    },
+    {
+      name: "security_scan",
+      description: `Scan the codebase for security vulnerabilities using deterministic checks + graph-aware severity scoring. No API key required.
+
+Checks: dependency CVEs, shell injection, hardcoded secrets, path traversal, auth bypass, input validation, information disclosure, cryptography weaknesses, frontend XSS, architecture-level risks.
+
+Graph-aware severity: vulnerabilities reachable from MCP tools or HTTP routes are automatically elevated. A medium shell injection reachable from connect_repo becomes Critical.
+
+Returns ranked findings (Critical \u2192 Low) with attack scenarios and suggested fixes. Use --target for single-file scan.`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          target: {
+            type: "string",
+            description: "Relative file path to scan. Omit to scan entire repo."
+          },
+          classes: {
+            type: "array",
+            items: {
+              type: "string",
+              enum: [
+                "dependency-cve",
+                "shell-injection",
+                "code-injection",
+                "secrets",
+                "path-traversal",
+                "auth",
+                "input-validation",
+                "information-disclosure",
+                "architecture",
+                "cryptography",
+                "supply-chain",
+                "frontend-xss"
+              ]
+            },
+            description: "Vulnerability classes to check. Omit for all."
+          },
+          graphAware: {
+            type: "boolean",
+            description: "Enable graph-aware severity elevation (recommended). Default: true."
+          }
+        }
+      }
     }
   ];
 }
@@ -1209,6 +1254,19 @@ async function handleToolCall(name, args, state) {
       } else {
         result = handleSimulateChange(args, state);
       }
+    } else if (name === "security_scan") {
+      if (!isProjectLoaded(state)) {
+        result = {
+          error: "No project loaded",
+          message: "Use connect_repo to connect to a codebase first"
+        };
+      } else {
+        result = await scanSecurity(state.projectRoot, state.graph, {
+          target: args.target,
+          classes: args.classes,
+          graphAware: args.graphAware !== false
+        });
+      }
     } else {
       if (!isProjectLoaded(state)) {
         result = {