penthera 1.4.0 → 1.5.0

package/src/cli/deps.js

@@ -2,14 +2,32 @@
  * `penthera deps [path]`: CLI runner for the dependency capability scan.
  */
 import { resolve } from "node:path";
-import { existsSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { mergeResults } from "./merge-results.js";
 import { buildActionPlan } from "../../lib/remediation/index.js";
 import { printReport, printFindings, writeJsonReport, writeSarifReport, createProgress, printError } from "../reporter.js";
 import { writeMarkdownReport, markdownPathFromJson } from "../report/markdown.js";
 
-export const DEPS_FLAGS = ["diff", "base", "online", "pr-comment", "prod"];
+export const DEPS_FLAGS = ["diff", "base", "online", "pr-comment", "prod", "license-policy"];
+
+/**
+ * The license policy for this run: `--license-policy <preset|file>`, else the
+ * `licenses` section of penthera.policy.json, else none.
+ */
+async function resolveLicensePolicy(root, flag) {
+  const { normalizeLicensePolicy, LICENSE_PRESETS } = await import("../../lib/deps/license.js");
+  if (flag) {
+    if (LICENSE_PRESETS[flag]) return normalizeLicensePolicy({ preset: flag }, "--license-policy");
+    const path = resolve(flag);
+    if (!existsSync(path)) throw new Error(`--license-policy: "${flag}" is neither a preset (${Object.keys(LICENSE_PRESETS).join(", ")}) nor a file`);
+    let raw;
+    try { raw = JSON.parse(readFileSync(path, "utf-8")); } catch (e) { throw new Error(`${flag}: ${e.message}`); }
+    return normalizeLicensePolicy(raw && typeof raw === "object" && "licenses" in raw ? raw.licenses : raw, `${flag}: licenses`);
+  }
+  const { loadPolicy } = await import("../../lib/install/policy.js");
+  return loadPolicy(root).policy.licenses;
+}
 
 export async function runDeps(args, opts, { version }) {
   if (args.length > 1) {
@@ -34,7 +52,9 @@ export async function runDeps(args, opts, { version }) {
   const { scanDeps } = await import("../../lib/deps/index.js");
   let result;
   try {
+    const licensePolicy = await resolveLicensePolicy(root, opts["license-policy"]);
     result = await scanDeps(root, {
+      licensePolicy,
       diff: opts.diff || null,
       base: opts.base || null,
       online: !!opts.online,

package/src/cli/hook.js

@@ -0,0 +1,131 @@
+/**
+ * `penthera hook install|uninstall|run`: the pre-commit hook (lib/hook/).
+ * Exit codes for `run`: 0 commit may go ahead, 1 blocked, 2 error (also blocks).
+ */
+import { parseArgs } from "node:util";
+import { relative, resolve } from "node:path";
+import { runHook, installHook, uninstallHook, fixHint } from "../../lib/hook/index.js";
+import { printError } from "../reporter.js";
+import { bold, dim, green, red, yellow, cyan } from "./ansi.js";
+
+const HELP = `
+  ${bold("penthera hook")} — block secrets, malicious agent config and risky lockfile changes before they are committed
+
+  ${dim("Usage")}
+    $ penthera hook install      Write .git/hooks/pre-commit (an existing hook is kept and runs first)
+    $ penthera hook uninstall    Remove it and restore the hook it replaced
+    $ penthera hook run          Check what is staged now (what the hook runs)
+
+  ${dim("Options")}
+        --policy <file>    Policy file (default: ./penthera.policy.json)
+        --force            install: write into core.hooksPath even when another tool manages it
+        --json             run: print the result as JSON
+    -v, --verbose          run: also list findings below the blocking severity
+    -h, --help             Show this help
+
+  ${dim("What it checks (staged content only, offline)")}
+    Secrets and AI provider keys in staged files; \`penthera agents\` rules on staged
+    .mcp.json, CLAUDE.md, AGENTS.md, .claude/, .cursor/ and skills/; and, when
+    package-lock.json is staged, the capability diff against HEAD plus the license
+    policy. Blocks on high and critical by default.
+
+  ${dim("Policy")}  ${dim("(penthera.policy.json)")}
+    { "hook": { "blockOn": "high", "ignore": ["tests/fixtures/**"],
+                "checks": { "secrets": true, "agents": true, "deps": true, "licenses": true } } }
+
+  ${dim("Other hook managers")}
+    pre-commit:  repo: https://github.com/danoszz/penthera, hooks: [{ id: penthera }]
+    husky:       echo "npx --no-install penthera hook run" >> .husky/pre-commit
+    lefthook:    pre-commit: { commands: { penthera: { run: npx --no-install penthera hook run } } }
+`;
+
+const SEV = { critical: red, high: red, medium: yellow, low: dim, info: dim };
+const where = (f) => `${f.url}${f.line ? `:${f.line}` : ""}`;
+
+function findingLine(f, mark) {
+  const sev = (SEV[f.severity] || dim)(f.severity.toUpperCase().padEnd(8));
+  const ev = f.evidence ? `  ${dim(f.evidence)}` : "";
+  return `  ${mark} ${sev} ${cyan(where(f))}  ${f.title}${ev}  ${dim(`id ${f.id}`)}\n      ${dim("→")} ${fixHint(f)}`;
+}
+
+function printRun(r, { verbose }) {
+  const L = [];
+  const secs = (r.duration / 1000).toFixed(1);
+  const what = [`${r.staged} staged file${r.staged === 1 ? "" : "s"}`, r.checked.agents && `${r.checked.agents} agent config`, r.checked.lockfiles && `${r.checked.lockfiles} lockfile`].filter(Boolean).join(", ");
+  for (const w of r.warnings) L.push(`  ${yellow("!")} ${w}`);
+  if (!r.blocking.length) {
+    const below = r.below.length ? dim(` · ${r.below.length} below ${r.blockOn}${verbose ? "" : " (-v to list)"}`) : "";
+    const sup = r.suppressed.length ? dim(` · ${r.suppressed.length} suppressed`) : "";
+    L.push(`  ${green("✓")} ${bold("penthera")} ${what} checked in ${secs}s${below}${sup}`);
+    if (verbose) for (const f of r.below) L.push(findingLine(f, yellow("!")));
+    process.stderr.write(L.join("\n") + "\n");
+    return;
+  }
+  L.push("");
+  L.push(`  ${red("✗")} ${bold("penthera")} blocked this commit: ${r.blocking.length} finding${r.blocking.length === 1 ? "" : "s"} at ${r.blockOn} or above ${dim(`(${what}, ${secs}s)`)}`);
+  L.push("");
+  for (const f of r.blocking) L.push(findingLine(f, red("✗")));
+  if (verbose) for (const f of r.below) L.push(findingLine(f, yellow("!")));
+  else if (r.below.length) L.push(dim(`  + ${r.below.length} below ${r.blockOn}, not blocking (-v to list)`));
+  L.push("");
+  L.push(`  Fix and \`git add\` again. A false positive? Add it to penthera.suppress.json:`);
+  L.push(dim(`    { "version": 1, "suppress": [{ "id": "${r.blocking[0].id}", "reason": "why this is safe" }] }`));
+  L.push(`  To skip the check for one commit: ${bold("git commit --no-verify")} ${dim("(the finding still ships)")}`);
+  L.push("");
+  process.stderr.write(L.join("\n") + "\n");
+}
+
+export async function runHookCommand(argv) {
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: argv,
+      allowPositionals: true,
+      options: {
+        policy: { type: "string" },
+        force: { type: "boolean", default: false },
+        json: { type: "boolean", default: false },
+        verbose: { type: "boolean", short: "v", default: false },
+        help: { type: "boolean", short: "h", default: false },
+      },
+    });
+  } catch (e) {
+    printError(e.message);
+    return 2;
+  }
+  const { values: opts, positionals } = parsed;
+  const sub = positionals[0];
+  if (opts.help || !sub) {
+    console.log(HELP);
+    return sub || opts.help ? 0 : 2;
+  }
+  const cwd = process.cwd();
+  const rel = (p) => relative(cwd, p) || p;
+  try {
+    if (sub === "install") {
+      const r = installHook(cwd, { force: opts.force });
+      console.log(`  ${green("✓")} ${r.updated ? "Updated" : "Installed"} ${rel(r.path)}`);
+      if (r.chained) console.log(`  ${dim("▸")} Your existing hook moved to ${rel(r.chained)} and runs first; \`penthera hook uninstall\` puts it back.`);
+      console.log(`  ${dim("▸")} Every commit now checks staged secrets, agent config and lockfile changes. Skip once with git commit --no-verify.`);
+      return 0;
+    }
+    if (sub === "uninstall") {
+      const r = uninstallHook(cwd);
+      if (!r.removed) console.log(`  ${dim("No penthera pre-commit hook installed.")}`);
+      else console.log(`  ${green("✓")} Removed ${rel(r.path)}${r.restored ? `; your previous hook is back in place` : ""}`);
+      return 0;
+    }
+    if (sub === "run") {
+      const r = await runHook(cwd, { policyPath: opts.policy ? resolve(opts.policy) : null });
+      if (opts.json) console.log(JSON.stringify(r, null, 2));
+      else printRun(r, { verbose: opts.verbose });
+      return r.blocking.length ? 1 : 0;
+    }
+  } catch (e) {
+    printError(e.message);
+    if (sub === "run") process.stderr.write(`  ${dim("The commit is blocked because the check could not run. Skip it once with git commit --no-verify.")}\n`);
+    return 2;
+  }
+  printError(`Unknown hook command "${sub}". Use install, uninstall or run.`);
+  return 2;
+}

package/src/cli.js

@@ -24,7 +24,9 @@ import { blankAssessment } from "../lib/compliance/self-assessment.js";
 import { buildPolicyPack, policyPackIndex } from "../lib/compliance/policy-pack.js";
 import { parseQuestionnaire, answerQuestionnaire, formatQuestionnaireMarkdown } from "../lib/compliance/questionnaire.js";
 import { buildIncidentReports, formatIncidentMarkdown, incidentTemplate } from "../lib/compliance/incident.js";
-import { buildSbom } from "../lib/whitebox/sbom.js";
+import { buildSbom, buildAiBom } from "../lib/whitebox/sbom.js";
+import { aiBomSummary } from "../lib/whitebox/aibom.js";
+import { buildCraReports, craTemplate, formatCraMarkdown, readCraInput } from "../lib/compliance/cra.js";
 import { emptyHistory, updateHistory, buildAuditLoop } from "../lib/audit-loop.js";
 import { rateSuppliers, parseSupplierList, formatSuppliersMarkdown } from "../lib/supply-chain.js";
 
@@ -89,10 +91,14 @@ const HELP = `
         --online                Also check npm registry metadata (the only network use)
         --prod                  Skip devDependencies
         --pr-comment <file>     Write a short Markdown capability diff for a PR comment
+        --license-policy <p>    permissive | weak-copyleft-ok | no-agpl, or a policy file
 
   ${dim("Install mode")}  ${dim("(penthera install [pkg...]; penthera install --help for all options)")}
         --yes / --dry-run       Install only if nothing breaches the policy / report only
 
+  ${dim("Hook mode")}  ${dim("(penthera hook install|uninstall|run; penthera hook --help)")}
+                                Pre-commit: staged secrets, agent config, lockfile diff
+
   ${dim("Options")}
     -r, --repo <path>       Path to repo for source analysis
         --api-root <path>   API routes directory (default: auto-detect)
@@ -114,6 +120,9 @@ const HELP = `
         --incident <file>   Generate NIS2 incident-report drafts + timeline
         --incident-init <file>  Write a blank incident template and exit
         --sbom <file>       Write a CycloneDX software bill of materials (from --repo)
+        --aibom <file>      Write a CycloneDX 1.6 AI-BOM: AI SDKs, models, MCP servers, skills, prompts
+        --cra <file>        Generate CRA Article 14 report drafts + timeline (writes cra-reports.md)
+        --cra-init <file>   Write a blank CRA reporting template and exit
         --history <file>    Track findings over time (time-to-fix, ageing, drift)
         --memory            Learn from this scan locally; apply suppressions + ranking
         --suppliers <file>  Passively rate suppliers' public domains (RAG, measure d)
@@ -166,6 +175,12 @@ export async function run() {
     return;
   }
 
+  if (process.argv[2] === "hook") {
+    const { runHookCommand } = await import("./cli/hook.js");
+    process.exitCode = await runHookCommand(process.argv.slice(3));
+    return;
+  }
+
   if (process.argv[2] === "evidence") {
     const { runEvidence } = await import("./cli/evidence.js");
     process.exit(runEvidence(process.argv.slice(3)));
@@ -206,6 +221,9 @@ export async function run() {
         incident:    { type: "string" },
         "incident-init": { type: "string" },
         sbom:        { type: "string" },
+        aibom:       { type: "string" },
+        cra:         { type: "string" },
+        "cra-init":  { type: "string" },
         history:     { type: "string" },
         memory:      { type: "boolean", default: false },
         suppliers:   { type: "string" },
@@ -214,6 +232,7 @@ export async function run() {
         online:      { type: "boolean", default: false },
         "pr-comment": { type: "string" },
         prod:        { type: "boolean", default: false },
+        "license-policy": { type: "string" },
         profile:     { type: "string" },
         "auth-cookie": { type: "string" },
         "auth-bearer": { type: "string" },
@@ -292,6 +311,32 @@ export async function run() {
     process.exit(0);
   }
 
+  if (opts["cra-init"]) {
+    const path = resolve(opts["cra-init"]);
+    writeFileSync(path, JSON.stringify(craTemplate(), null, 2) + "\n");
+    console.log(`Wrote a blank CRA reporting template to ${path}`);
+    console.log(`Set type and aware_at (ISO 8601), then run:  penthera --cra ${opts["cra-init"]}`);
+    process.exit(0);
+  }
+
+  if (opts.cra) {
+    let input;
+    try {
+      input = readCraInput(resolve(opts.cra));
+    } catch (e) {
+      printError(`Could not read --cra file: ${e.message}`);
+      process.exit(2);
+    }
+    for (const err of input.errors) printError(err);
+    const result = buildCraReports(input.cra, loadJurisdiction(), { now: new Date().toISOString(), prefilled: input.prefilled });
+    const outPath = resolve("cra-reports.md");
+    writeFileSync(outPath, formatCraMarkdown(result));
+    console.log(`CRA Article 14 report drafts written to ${outPath}`);
+    for (const t of result.timeline) console.log(`  ${t.title} (${t.within}): ${t.dueBy ? `due ${t.dueBy}` : t.basis || "n/a"}, ${t.status}`);
+    for (const w of result.warnings) console.log(`  ⚠️ ${w}`);
+    process.exit(0);
+  }
+
   if (opts.suppliers && opts.offline) {
     printError("--suppliers rates third-party domains, which --offline forbids.");
     process.exit(2);
@@ -326,8 +371,8 @@ export async function run() {
     await runDeps(positionals.slice(1), opts, { version: pkg.version });
     return;
   }
-  if (opts.diff || opts.base || opts.online || opts["pr-comment"] || opts.prod) {
-    printError("--diff, --base, --online, --prod and --pr-comment only apply to `penthera deps`.");
+  if (opts.diff || opts.base || opts.online || opts["pr-comment"] || opts.prod || opts["license-policy"]) {
+    printError("--diff, --base, --online, --prod, --pr-comment and --license-policy only apply to `penthera deps`.");
     process.exit(2);
   }
 
@@ -352,8 +397,8 @@ export async function run() {
   const url = positionals[0] && !agentsMode ? normalizeBaseUrl(positionals[0]) : null;
   const repo = opts.repo || null;
 
-  if (!agentsMode && !url && !repo && !opts.machine && !opts.readiness && !opts["policy-pack"] && !opts.sbom && !opts.questionnaire) {
-    printError("No target specified. Provide a URL, --repo, --machine, --readiness, --policy-pack, --sbom, --questionnaire, or combine them.");
+  if (!agentsMode && !url && !repo && !opts.machine && !opts.readiness && !opts["policy-pack"] && !opts.sbom && !opts.aibom && !opts.questionnaire) {
+    printError("No target specified. Provide a URL, --repo, --machine, --readiness, --policy-pack, --sbom, --aibom, --questionnaire, or combine them.");
     console.log(HELP);
     process.exit(2);
   }
@@ -609,6 +654,19 @@ export async function run() {
     }
   }
 
+  if (opts.aibom) {
+    const aibom = buildAiBom(resolve(opts.repo || "."), {
+      serialNumber: `urn:uuid:${randomUUID()}`,
+      timestamp: new Date().toISOString(),
+      toolVersion: pkg.version,
+    });
+    writeFileSync(resolve(opts.aibom), JSON.stringify(aibom, null, 2) + "\n");
+    if (!opts.quiet && !opts.json) {
+      const n = aiBomSummary(aibom);
+      process.stderr.write(`  AI-BOM (CycloneDX 1.6) ${n.sdks} SDKs, ${n.models} models, ${n.mcpServers} MCP servers, ${n.skills} skills, ${n.prompts} prompts → ${opts.aibom}\n`);
+    }
+  }
+
   if (opts["policy-pack"]) {
     const dir = resolve(opts["policy-pack"]);
     mkdirSync(dir, { recursive: true });
@@ -668,7 +726,7 @@ export async function run() {
     );
   }
 
-  if ((opts.output || opts.markdown || opts.sarif || opts.evidence || opts.readiness || opts["policy-pack"] || opts.sbom || opts.history || opts.questionnaire) && !opts.quiet && !opts.json) {
+  if ((opts.output || opts.markdown || opts.sarif || opts.evidence || opts.readiness || opts["policy-pack"] || opts.sbom || opts.aibom || opts.history || opts.questionnaire) && !opts.quiet && !opts.json) {
     process.stderr.write("\n");
   }