praxis-sec 1.0.0

package/cli/commands/team-report.js

@@ -0,0 +1,398 @@
+/**
+ * Team Report Command
+ * ====================
+ *
+ * Converts raw Hermes Agent team output into a professional Praxis report.
+ * Strips ANSI codes and terminal chrome, parses structured FINDING: lines,
+ * and renders everything through Praxis's HTML reporter.
+ *
+ * USAGE:
+ *   praxis team-report                     Read from stdin (pipe Hermes output)
+ *   praxis team-report output.txt          Read from file
+ *   praxis team-report output.txt --html   Save as HTML
+ *   praxis team-report output.txt --json   JSON output
+ */
+
+import fs from 'fs';
+import path from 'path';
+import chalk from 'chalk';
+import * as output from '../utils/output.js';
+import { printBanner } from '../utils/output.js';
+import {
+  SEVERITY_COLORS,
+  baseStyles,
+  countBySeverity,
+  documentShell,
+  esc,
+  severityBadge,
+} from '../core/output/html-theme.js';
+
+// =============================================================================
+// ANSI + TERMINAL NOISE STRIPPING
+// =============================================================================
+
+function stripAnsi(str) {
+  // Remove all ANSI escape sequences (colors, cursor moves, clears, etc.)
+  /* eslint-disable no-control-regex -- intentional: strips ANSI/terminal escape sequences from captured CLI output */
+  return str
+    .replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '')
+    .replace(/\x1b\][^\x07]*\x07/g, '')
+    .replace(/\x1b[()][AB012]/g, '')
+    .replace(/\x9b[0-9;]*[A-Za-z]/g, '');
+  /* eslint-enable no-control-regex */
+}
+
+function stripHermesChrome(text) {
+  const lines = text.split('\n');
+  const cleaned = [];
+  let inSplash = false;
+
+  for (const line of lines) {
+    const t = line.trim();
+
+    // Skip the Hermes splash box (╭─ ... ─╮ ... ╰─ ... ─╯)
+    if (t.startsWith('╭─') || t.startsWith('╰─')) { inSplash = !inSplash; continue; }
+    if (inSplash) continue;
+
+    // Skip raw system prompt instructions leaked into output.
+    // Template lines carry '...' placeholders; real findings parse as JSON.
+    if (t.startsWith('EXACTLY this format')) continue;
+    if (t.startsWith('FINDING: {"severity"') && t.includes('...')) continue;
+    if (t.match(/^─{10,}$/)) continue;
+
+    // Skip Hermes warning lines
+    if (t.startsWith('⚠') && t.includes('hermes')) continue;
+    if (t.startsWith('⚠') && t.includes('OPENROUTER')) continue;
+    if (t.startsWith('⚠') && (t.includes('API call failed') || t.includes('credits'))) continue;
+    if (t.startsWith('⏱') || t.startsWith('❌')) continue;
+
+    // Skip terminal screen-clear sequences
+    if (t === '[2J' || t === '[H' || t === '[2J[H') continue;
+
+    cleaned.push(line);
+  }
+
+  return cleaned.join('\n');
+}
+
+// =============================================================================
+// FINDING PARSER
+// =============================================================================
+
+function parseFindings(text) {
+  const findings = [];
+  const findingRegex = /^FINDING:\s*(\{.+\})\s*$/gm;
+  let match;
+
+  while ((match = findingRegex.exec(text)) !== null) {
+    try {
+      const f = JSON.parse(match[1]);
+      if (f.severity && f.title) findings.push(f);
+    } catch { /* skip malformed */ }
+  }
+
+  return findings;
+}
+
+// =============================================================================
+// AGENT SECTION PARSER
+// =============================================================================
+
+function parseAgentSections(text) {
+  const sections = [];
+  // Matches: ### Agent Name (Role) — N finding(s)
+  const sectionRegex = /###\s+(.+?)\s*(?:\(([^)]+)\))?\s*[—–-]+\s*(\d+)\s*finding/gi;
+  let match;
+
+  while ((match = sectionRegex.exec(text)) !== null) {
+    sections.push({
+      name: match[1].trim(),
+      role: match[2]?.trim() || '',
+      count: parseInt(match[3], 10),
+    });
+  }
+
+  // Also collect bullet findings under each section
+  const bulletRegex = /\[(CRITICAL|HIGH|MEDIUM|LOW|INFO)\]\s+(.+?)\s*[—–-]+\s*(.+)/gi;
+  const bullets = [];
+  while ((match = bulletRegex.exec(text)) !== null) {
+    bullets.push({
+      severity: match[1].toLowerCase(),
+      title: match[2].trim(),
+      location: match[3].trim(),
+    });
+  }
+
+  return { sections, bullets };
+}
+
+// =============================================================================
+// SYNTHESIS PARSER
+// =============================================================================
+
+function parseSynthesis(text) {
+  // Extract the Hermes synthesis block (inside ╭─ ⚕ Hermes ─╮ ... ╰─╯)
+  // After stripping chrome, look for the summary block
+  const lines = text.split('\n');
+  const synthesisLines = [];
+  let capturing = false;
+
+  for (const line of lines) {
+    const t = line.trim();
+
+    // The synthesis is the content after the agent section summary and before errors
+    if (t.match(/^Overall risk posture:/i)) { capturing = true; }
+    if (capturing) {
+      if (t.startsWith('⚠') || t.startsWith('❌') || t.startsWith('⏱')) break;
+      synthesisLines.push(line);
+    }
+  }
+
+  // Also look for risk posture statement
+  const riskMatch = text.match(/Overall risk posture:\s*(.+)/i);
+  const riskPosture = riskMatch ? riskMatch[1].trim() : null;
+
+  // Parse roadmap sections
+  const immediateMatch = text.match(/\*\*Immediate[^*]*\*\*:?\s*([^\n]+(?:\n(?!\*\*)[^\n]+)*)/i);
+  const shortTermMatch = text.match(/\*\*Short-term[^*]*\*\*:?\s*([^\n]+(?:\n(?!\*\*)[^\n]+)*)/i);
+  const longTermMatch  = text.match(/\*\*Long-term[^*]*\*\*:?\s*([^\n]+(?:\n(?!\*\*)[^\n]+)*)/i);
+
+  return {
+    riskPosture,
+    synthesis: synthesisLines.join('\n').trim(),
+    roadmap: {
+      immediate: immediateMatch?.[1]?.trim() || null,
+      shortTerm: shortTermMatch?.[1]?.trim() || null,
+      longTerm:  longTermMatch?.[1]?.trim()  || null,
+    },
+  };
+}
+
+// =============================================================================
+// TARGET PARSER
+// =============================================================================
+
+function parseTarget(text) {
+  const match = text.match(/assessments?\s+of\s+\*\*([^*]+)\*\*/i);
+  return match ? match[1].trim() : 'Unknown Target';
+}
+
+// =============================================================================
+// HTML RENDERER
+// =============================================================================
+
+function generateHTML(target, findings, agentSections, synthesis, bullets) {
+  const date = new Date().toLocaleDateString('en-US', {
+    year: 'numeric', month: 'long', day: 'numeric', hour: '2-digit', minute: '2-digit',
+  });
+
+  // Merge FINDING: JSON lines with bullet-parsed findings (bullets are fallback)
+  const allFindings = findings.length > 0 ? findings : bullets.map(b => ({
+    severity: b.severity,
+    title: b.title,
+    location: b.location,
+    remediation: '',
+  }));
+
+  const sevCounts = countBySeverity(allFindings);
+
+  const riskColor = (rp) => {
+    if (!rp) return '#94a3b8';
+    const lc = String(rp).toLowerCase();
+    if (lc.includes('critical')) return SEVERITY_COLORS.critical;
+    if (lc.includes('high')) return SEVERITY_COLORS.high;
+    if (lc.includes('medium')) return SEVERITY_COLORS.medium;
+    return '#22c55e';
+  };
+
+  const findingRows = allFindings.map(f => `
+    <tr>
+      <td>${severityBadge(f.severity)}</td>
+      <td><code>${esc(f.location) || '—'}</code></td>
+      <td><strong>${esc(f.title)}</strong>${f.cve ? `<br><small>CVE: ${esc(f.cve)}</small>` : ''}</td>
+      <td><small>${esc(f.remediation) || '—'}</small></td>
+    </tr>`).join('');
+
+  const agentRows = agentSections.sections.map(s => `
+    <tr>
+      <td>${esc(s.name)}</td>
+      <td><code>${esc(s.role) || '—'}</code></td>
+      <td style="color:${s.count > 0 ? SEVERITY_COLORS.high : '#22c55e'}">${esc(s.count)}</td>
+    </tr>`).join('');
+
+  const roadmap = synthesis.roadmap;
+  const roadmapRow = (label, text, color) => text
+    ? `<tr><td style="color:${color};white-space:nowrap;font-weight:600">${label}</td><td>${esc(text)}</td></tr>`
+    : '';
+  const roadmapHTML = (roadmap.immediate || roadmap.shortTerm || roadmap.longTerm) ? `
+    <h2>Remediation Roadmap</h2>
+    <table>
+      <tbody>
+        ${roadmapRow('⚡ Immediate (24–48h)', roadmap.immediate, SEVERITY_COLORS.critical)}
+        ${roadmapRow('📅 Short-term (1–2 weeks)', roadmap.shortTerm, SEVERITY_COLORS.high)}
+        ${roadmapRow('🏗 Long-term (1–3 months)', roadmap.longTerm, SEVERITY_COLORS.medium)}
+      </tbody>
+    </table>` : '';
+
+  return documentShell({
+    title: `Praxis Team Report — ${target}`,
+    styles: baseStyles() + `
+      .header{display:flex;align-items:center;gap:1rem;margin-bottom:2rem}
+      .logo{font-size:1.5rem;font-weight:800;color:#38bdf8;letter-spacing:-1px}
+      .badge{background:#1e293b;padding:3px 10px;border-radius:20px;font-size:0.75rem;color:#94a3b8;border:1px solid #334155}
+      .meta{color:#64748b;font-size:0.85rem;margin-bottom:2rem}
+      .risk-card{background:#0d1527;border:1px solid #1e293b;border-radius:12px;padding:1.5rem 2rem;margin-bottom:2rem;display:flex;align-items:center;gap:1.5rem}
+      .risk-label{font-size:0.75rem;text-transform:uppercase;color:#64748b;margin-bottom:0.25rem}
+      .risk-value{font-size:1.5rem;font-weight:700}
+      .risk-desc{color:#94a3b8;font-size:0.9rem;flex:1}
+      .stats{display:grid;grid-template-columns:repeat(5,1fr);gap:0.75rem;margin-bottom:2rem}
+      .stat{background:#0d1527;padding:1.25rem;border-radius:8px;text-align:center;border:1px solid #1e293b}
+      .stat-number{font-size:2rem;font-weight:bold}
+      .stat-label{color:#64748b;font-size:0.75rem;margin-top:0.25rem;text-transform:uppercase}
+      .powered{color:#38bdf8}
+      @media(max-width:1024px){.stats{grid-template-columns:repeat(2,1fr)}}
+    `,
+    body: `<div class="container">
+
+  <div class="header">
+    <span class="logo">Praxis</span>
+    <span class="badge">Team Security Report</span>
+    <span class="badge">Powered by Hermes Agent</span>
+  </div>
+
+  <h1>${esc(target)}</h1>
+  <p class="meta">Generated ${esc(date)} · ${allFindings.length} finding${allFindings.length !== 1 ? 's' : ''} · ${agentSections.sections.length} agent${agentSections.sections.length !== 1 ? 's' : ''}</p>
+
+  ${synthesis.riskPosture ? `
+  <div class="risk-card">
+    <div>
+      <div class="risk-label">Overall Risk Posture</div>
+      <div class="risk-value" style="color:${riskColor(synthesis.riskPosture)}">${esc(String(synthesis.riskPosture).split('—')[0].trim())}</div>
+    </div>
+    <div class="risk-desc">${esc(synthesis.riskPosture.includes('—') ? String(synthesis.riskPosture).split('—').slice(1).join('—').trim() : '')}</div>
+  </div>` : ''}
+
+  <div class="stats">
+    <div class="stat"><div class="stat-number" style="color:${SEVERITY_COLORS.critical}">${sevCounts.critical}</div><div class="stat-label">Critical</div></div>
+    <div class="stat"><div class="stat-number" style="color:${SEVERITY_COLORS.high}">${sevCounts.high}</div><div class="stat-label">High</div></div>
+    <div class="stat"><div class="stat-number" style="color:${SEVERITY_COLORS.medium}">${sevCounts.medium}</div><div class="stat-label">Medium</div></div>
+    <div class="stat"><div class="stat-number" style="color:${SEVERITY_COLORS.low}">${sevCounts.low}</div><div class="stat-label">Low</div></div>
+    <div class="stat"><div class="stat-number" style="color:${SEVERITY_COLORS.info}">${sevCounts.info}</div><div class="stat-label">Info</div></div>
+  </div>
+
+  <h2>Findings</h2>
+  <table>
+    <thead><tr><th>Severity</th><th>Location</th><th>Issue</th><th>Remediation</th></tr></thead>
+    <tbody>${findingRows || '<tr><td colspan="4" class="empty-state">No findings — clean!</td></tr>'}</tbody>
+  </table>
+
+  ${agentSections.sections.length > 0 ? `
+  <h2>Agent Team Summary</h2>
+  <table>
+    <thead><tr><th>Agent</th><th>Role</th><th>Findings</th></tr></thead>
+    <tbody>${agentRows}</tbody>
+  </table>` : ''}
+
+  ${roadmapHTML}
+
+  <div class="footer">
+    Secured by <span class="powered">Praxis</span> · <code>npx praxis-sec red-team .</code>
+  </div>
+</div>`,
+  });
+}
+
+// =============================================================================
+// MAIN COMMAND
+// =============================================================================
+
+export async function teamReportCommand(inputFile, options = {}) {
+  let raw;
+
+  if (inputFile) {
+    if (!fs.existsSync(inputFile)) {
+      output.error(`File not found: ${inputFile}`);
+      process.exit(1);
+    }
+    raw = fs.readFileSync(inputFile, 'utf-8');
+  } else {
+    // Read from stdin
+    raw = fs.readFileSync('/dev/stdin', 'utf-8');
+  }
+
+  // Clean the input
+  const stripped = stripAnsi(raw);
+  const cleaned  = stripHermesChrome(stripped);
+
+  // Parse
+  const target       = parseTarget(stripped);
+  const findings     = parseFindings(cleaned);
+  const agentSections = parseAgentSections(cleaned);
+  const synthesis    = parseSynthesis(cleaned);
+
+  const allFindings = findings.length > 0 ? findings : agentSections.bullets.map(b => ({
+    severity: b.severity,
+    title: b.title,
+    location: b.location,
+    remediation: '',
+  }));
+
+  if (options.json) {
+    console.log(JSON.stringify({ target, findings: allFindings, agentSections: agentSections.sections, synthesis }, null, 2));
+    return;
+  }
+
+  if (options.html !== undefined) {
+    const htmlPath = typeof options.html === 'string' ? options.html : 'team-report.html';
+    const html = generateHTML(target, findings, agentSections, synthesis, agentSections.bullets);
+    fs.writeFileSync(htmlPath, html, 'utf-8');
+    output.success(`Team report saved to ${htmlPath}`);
+    return;
+  }
+
+  // Terminal output
+  printBanner();
+  console.log(chalk.cyan.bold('  Team Security Report'));
+  console.log(chalk.gray(`  Target: ${target}`));
+  console.log();
+
+  if (synthesis.riskPosture) {
+    const rp = synthesis.riskPosture;
+    const color = rp.toLowerCase().includes('critical') ? chalk.red.bold
+      : rp.toLowerCase().includes('high') ? chalk.yellow.bold
+      : rp.toLowerCase().includes('medium') ? chalk.yellow
+      : chalk.green;
+    console.log(`  ${chalk.white.bold('Risk Posture:')} ${color(rp)}`);
+    console.log();
+  }
+
+  const sevColor = { critical: chalk.red.bold, high: chalk.yellow, medium: chalk.blue, low: chalk.gray, info: chalk.gray };
+  for (const f of allFindings) {
+    const col = sevColor[f.severity] || chalk.white;
+    console.log(`  ${col(`[${f.severity.toUpperCase()}]`.padEnd(11))} ${chalk.white(f.title)}`);
+    if (f.location) console.log(`  ${' '.repeat(11)} ${chalk.gray(f.location)}`);
+    if (f.remediation) console.log(`  ${' '.repeat(11)} ${chalk.green('Fix:')} ${f.remediation.slice(0, 90)}`);
+  }
+
+  if (allFindings.length === 0) {
+    console.log(chalk.green('  No findings — clean!'));
+  }
+
+  console.log();
+  if (synthesis.roadmap.immediate) {
+    console.log(chalk.red.bold('  ⚡ Immediate (24–48h):'));
+    console.log(chalk.gray(`     ${synthesis.roadmap.immediate}`));
+  }
+  if (synthesis.roadmap.shortTerm) {
+    console.log(chalk.yellow.bold('  📅 Short-term (1–2 weeks):'));
+    console.log(chalk.gray(`     ${synthesis.roadmap.shortTerm}`));
+  }
+  if (synthesis.roadmap.longTerm) {
+    console.log(chalk.white.bold('  🏗  Long-term (1–3 months):'));
+    console.log(chalk.gray(`     ${synthesis.roadmap.longTerm}`));
+  }
+
+  console.log();
+  console.log(chalk.gray('  Generate HTML report: ') + chalk.cyan(`praxis team-report ${inputFile || '<file>'} --html report.html`));
+  console.log();
+}

package/cli/commands/undo.js

@@ -0,0 +1,161 @@
+/**
+ * Undo Command
+ * ============
+ *
+ * Reverts changes applied by `praxis fix interactive`.
+ *
+ * Reads .praxis/fixes.jsonl, takes the most recent entry (or all entries
+ * with --all), and reverses each edit. Per-fix git commits made by the agent
+ * are preferred over manual reversal when available.
+ *
+ * USAGE:
+ *   praxis undo                Revert the last applied fix
+ *   praxis undo --all          Revert every fix in the log
+ *   praxis undo --dry-run      Show what would be reverted, but don't write
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { execFileSync } from 'child_process';
+import chalk from 'chalk';
+import * as output from '../utils/output.js';
+
+const FIX_LOG_PATH = '.praxis/fixes.jsonl';
+
+export async function undoCommand(targetPath = '.', options = {}) {
+  const root    = path.resolve(targetPath);
+  const logPath = path.join(root, FIX_LOG_PATH);
+
+  if (!fs.existsSync(logPath)) {
+    output.error(`No fix log found at ${FIX_LOG_PATH}`);
+    console.log(chalk.gray('  Run `praxis fix interactive` first to apply fixes.'));
+    process.exit(1);
+  }
+
+  const entries = fs.readFileSync(logPath, 'utf8')
+    .split('\n')
+    .filter(Boolean)
+    .map(line => { try { return JSON.parse(line); } catch { return null; } })
+    .filter(Boolean);
+
+  if (entries.length === 0) {
+    output.error('Fix log is empty.');
+    process.exit(1);
+  }
+
+  const toUndo = options.all ? [...entries].reverse() : [entries[entries.length - 1]];
+
+  console.log();
+  output.header('Praxis — Undo');
+  console.log();
+  console.log(chalk.gray(`  Reverting ${toUndo.length} fix(es) from ${FIX_LOG_PATH}`));
+  console.log();
+
+  let reverted = 0;
+  let failed   = 0;
+
+  for (const entry of toUndo) {
+    const file = entry.file || entry.finding?.file || '(unknown)';
+    console.log(chalk.bold(`  ${chalk.cyan(file)}`));
+
+    if (options.dryRun) {
+      console.log(chalk.gray(`    Would reverse plan: ${entry.plan?.summary || 'no summary'}`));
+      reverted++;
+      continue;
+    }
+
+    try {
+      reverseEntry(root, entry);
+      console.log(chalk.green('    Reverted.'));
+      reverted++;
+    } catch (err) {
+      console.log(chalk.red(`    Failed: ${err.message}`));
+      failed++;
+    }
+  }
+
+  // Truncate the log
+  if (!options.dryRun && reverted > 0) {
+    const remaining = options.all ? [] : entries.slice(0, -1);
+    if (remaining.length === 0) {
+      fs.unlinkSync(logPath);
+    } else {
+      fs.writeFileSync(logPath, remaining.map(e => JSON.stringify(e)).join('\n') + '\n', 'utf8');
+    }
+  }
+
+  console.log();
+  console.log(chalk.green(`  Reverted: ${reverted}`));
+  if (failed > 0) console.log(chalk.red(`  Failed:   ${failed}`));
+  console.log();
+
+  if (failed > 0) {
+    console.log(chalk.gray('  For failed entries, try `git checkout` or `git reset --hard` if you committed via --branch.'));
+    console.log();
+  }
+}
+
+function isGitRepo(dir) {
+  try {
+    execFileSync('git', ['-C', dir, 'rev-parse', '--is-inside-work-tree'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function reverseEntry(root, entry) {
+  if (entry.commitHash && isGitRepo(root)) {
+    try {
+      execFileSync('git', ['-C', root, 'revert', '--no-commit', entry.commitHash], { stdio: 'ignore' });
+      return;
+    } catch {
+      console.log(chalk.yellow(`    Git revert failed for ${entry.commitHash.slice(0, 7)}. Falling back to manual text reversal.`));
+    }
+  }
+
+  const plan = entry.plan;
+  if (!plan || !Array.isArray(plan.files) || plan.files.length === 0) {
+    throw new Error('entry has no plan to reverse');
+  }
+
+  for (const fileChange of plan.files) {
+    const abs = path.resolve(root, fileChange.path);
+
+    if (fileChange.create) {
+      // We created the file — delete it
+      if (fs.existsSync(abs)) fs.unlinkSync(abs);
+      continue;
+    }
+
+    if (fileChange.append !== undefined) {
+      if (!fs.existsSync(abs)) continue;
+      const current = fs.readFileSync(abs, 'utf8');
+      // Try to remove the appended text (it may be at the end)
+      const idx = current.lastIndexOf(fileChange.append);
+      if (idx === -1) {
+        throw new Error(`appended text not found in ${fileChange.path}`);
+      }
+      const reverted = current.slice(0, idx) + current.slice(idx + fileChange.append.length);
+      fs.writeFileSync(abs, reverted, 'utf8');
+      continue;
+    }
+
+    // Standard edits — reverse find/replace
+    if (!fs.existsSync(abs)) {
+      throw new Error(`file no longer exists: ${fileChange.path}`);
+    }
+    let content = fs.readFileSync(abs, 'utf8');
+    // Reverse in opposite order in case edits are positionally dependent
+    const reversed = [...fileChange.edits].reverse();
+    for (const e of reversed) {
+      const newStr = e.replace;
+      const oldStr = e._resolvedFind || e.find;
+      if (!content.includes(newStr)) {
+        throw new Error(`reverted text not found in ${fileChange.path} (file changed since fix)`);
+      }
+      content = content.replace(newStr, oldStr);
+    }
+    fs.writeFileSync(abs, content, 'utf8');
+  }
+}

package/cli/commands/update-intel.js

@@ -0,0 +1,126 @@
+/**
+ * Update Intel Command
+ * =====================
+ *
+ * Refreshes the local threat-intelligence database by fetching every
+ * configured source in parallel (OSV, GHSA, KEV, EPSS, NVD, Gitleaks,
+ * plus optional paid sources Snyk / Socket / GitGuardian / Sonatype /
+ * Phylum). Results are merged into ~/.praxis/threat-intel.json.
+ *
+ * USAGE:
+ *   praxis intel update                  Refresh all sources
+ *   praxis intel update --only osv,kev   Limit to listed sources
+ *   praxis intel update --force          Ignore per-source TTL caches
+ *   praxis intel update --list           Print available sources
+ */
+
+import chalk from 'chalk';
+import * as output from '../utils/output.js';
+import { ThreatIntel } from '../utils/threat-intel.js';
+import * as intel from '../utils/intel/index.js';
+
+export async function updateIntelCommand(options = {}) {
+  console.log();
+  output.header('Praxis — Threat Intelligence Update');
+  console.log();
+
+  if (options.list) {
+    printSources();
+    return;
+  }
+
+  const before = ThreatIntel.stats();
+  console.log(chalk.gray(`  Current version: ${before.version}`));
+  console.log(chalk.gray(`  Last updated:    ${before.updated || 'never'}`));
+  console.log();
+
+  const sourceFilter = options.only
+    ? String(options.only).split(',').map(s => s.trim()).filter(Boolean)
+    : null;
+
+  console.log(chalk.cyan('  Fetching sources...'));
+  console.log();
+
+  const result = await intel.runUpdate({
+    sources: sourceFilter,
+    force: !!options.force,
+    onProgress: ({ source, status, message }) => {
+      const pad = source.padEnd(12);
+      switch (status) {
+        case 'start':
+          // Skip per-source 'start' lines — the per-source result line below
+          // is enough output, and 'start' interleaving with 'ok' from parallel
+          // fetches looks messy on a non-TTY.
+          break;
+        case 'ok':
+          console.log(chalk.green(`    ${pad}  OK`));
+          break;
+        case 'cached':
+          console.log(chalk.gray(`    ${pad}  cached`));
+          break;
+        case 'skipped':
+          console.log(chalk.yellow(`    ${pad}  skipped`) + chalk.gray(` (${message || 'no key'})`));
+          break;
+        case 'error':
+          console.log(chalk.red(`    ${pad}  error`) + chalk.gray(` (${message})`));
+          break;
+      }
+    },
+  });
+
+  // Invalidate the in-memory ThreatIntel cache so the stats below reflect
+  // the freshly merged feed.
+  ThreatIntel._resetCache();
+
+  console.log();
+  console.log(chalk.green.bold(`  Merged feed v${result.merged.version} written.`));
+  console.log();
+
+  // Per-source summary
+  const rows = Object.entries(result.merged.sources || {});
+  if (rows.length) {
+    console.log(chalk.gray('  Per-source status:'));
+    for (const [name, info] of rows) {
+      const flag = info.skipped
+        ? chalk.yellow('skipped')
+        : info.ok ? chalk.green('ok') : chalk.red('failed');
+      const stats = info.stats ? Object.entries(info.stats).map(([k, v]) => `${v} ${k}`).join(', ') : '';
+      const note = info.skipped ? ` (${info.reason || 'no key'})` : info.error ? ` (${info.error})` : '';
+      console.log(`    ${name.padEnd(12)} ${flag.padEnd(18)} ${chalk.gray(stats + note)}`);
+    }
+    console.log();
+  }
+
+  // Aggregate stats
+  const after = ThreatIntel.stats();
+  console.log(chalk.gray('  Indicators loaded:'));
+  console.log(`    CVE advisories:   ${after.cveAdvisories}`);
+  console.log(`    KEV entries:      ${after.kevEntries}`);
+  console.log(`    EPSS scores:      ${after.epssScores}`);
+  console.log(`    NVD details:      ${after.nvdDetails}`);
+  console.log(`    Extra secret rules: ${after.extraSecretRules}`);
+  console.log(`    Malicious skills: ${after.hashes}`);
+  console.log(`    Compromised MCP:  ${after.servers}`);
+  console.log();
+}
+
+function printSources() {
+  const sources = intel.listSources();
+  console.log(chalk.gray('  Available sources:'));
+  console.log();
+  const core = sources.filter(s => s.tier === 'core');
+  const optional = sources.filter(s => s.tier === 'optional');
+
+  console.log(chalk.cyan('  Core (free, no auth required):'));
+  for (const s of core) {
+    console.log(`    ${chalk.bold(s.name.padEnd(12))} ${chalk.gray(s.description)}`);
+  }
+  console.log();
+  console.log(chalk.cyan('  Optional (paid; activate by setting env var):'));
+  for (const s of optional) {
+    const flag = process.env[s.envKey] ? chalk.green('[active]') : chalk.gray('[inactive]');
+    console.log(`    ${chalk.bold(s.name.padEnd(12))} ${flag} ${chalk.gray(`needs ${s.envKey}`)}`);
+    console.log(`    ${''.padEnd(12)} ${chalk.gray(s.description)}`);
+  }
+  console.log();
+}