secureflow-cli 2.4.0 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +306 -0
- package/dist/git.d.ts +4 -0
- package/dist/git.d.ts.map +1 -1
- package/dist/git.js +12 -0
- package/dist/git.js.map +1 -1
- package/dist/index.js +43 -43
- package/dist/lib/audio-player.d.ts +11 -4
- package/dist/lib/audio-player.d.ts.map +1 -1
- package/dist/lib/audio-player.js +53 -19
- package/dist/lib/audio-player.js.map +1 -1
- package/dist/mcp/index.d.ts.map +1 -1
- package/dist/mcp/index.js +28 -4
- package/dist/mcp/index.js.map +1 -1
- package/package.json +2 -2
package/README.md
ADDED
|
@@ -0,0 +1,306 @@
|
|
|
1
|
+
# 🛡️ SecureFlow CLI (`secureflow-cli`)
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/secureflow-cli)
|
|
4
|
+
[](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE)
|
|
5
|
+
[](https://www.typescriptlang.org/)
|
|
6
|
+
[](https://modelcontextprotocol.io/)
|
|
7
|
+
|
|
8
|
+
**Pre-commit secret logging detector, AI vulnerability scanner, and Threat Intelligence MCP Server for modern developer workflows.**
|
|
9
|
+
|
|
10
|
+
The SecureFlow CLI intercepts code vulnerabilities and exposed secrets right at the developer terminal before commits reach remote repositories. It operates in both cloud-assisted and completely offline / air-gapped modes, features audio debriefs, and acts as an MCP server for AI coding assistants.
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## 📋 Table of Contents
|
|
15
|
+
|
|
16
|
+
- [🌟 Features](#-features)
|
|
17
|
+
- [📦 Installation](#-installation)
|
|
18
|
+
- [🚀 Quick Start](#-quick-start)
|
|
19
|
+
- [🪝 Git Hook Setup (Husky)](#-git-hook-setup-husky)
|
|
20
|
+
- [📖 Command Line Reference](#-command-line-reference)
|
|
21
|
+
- [Options & Flags](#options--flags)
|
|
22
|
+
- [Failure Thresholds (`--fail-on`)](#failure-thresholds---fail-on)
|
|
23
|
+
- [Multi-Format Reports (`--format`)](#multi-format-reports---format)
|
|
24
|
+
- [🔒 Air-Gapped & Local Mode (`--local`)](#-air-gapped--local-mode---local)
|
|
25
|
+
- [🎙️ Audio Summary Debriefs (`--voice`)](#️-audio-summary-debriefs---voice)
|
|
26
|
+
- [🤖 Threat Intelligence MCP Server (`mcp`)](#-threat-intelligence-mcp-server-mcp)
|
|
27
|
+
- [Connecting to Cursor / Windsurf / Claude Desktop](#connecting-to-cursor--windsurf--claude-desktop)
|
|
28
|
+
- [Available MCP Tools](#available-mcp-tools)
|
|
29
|
+
- [⚙️ Configuration (`.secureflowignore`)](#️-configuration-secureflowignore)
|
|
30
|
+
- [🔄 CI/CD Pipeline Integration](#-cicd-pipeline-integration)
|
|
31
|
+
- [📄 License](#-license)
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## 🌟 Features
|
|
36
|
+
|
|
37
|
+
- **⚡ Instant Pre-Commit Scans**: Evaluates staged git files in milliseconds to prevent accidental secret leaks and credential logging.
|
|
38
|
+
- **🧠 Hybrid AI Security Analysis**: Combines deterministic heuristic pattern matching with LLM-backed vulnerability reasoning.
|
|
39
|
+
- **🔐 Air-Gapped / Zero-Upload Mode**: Run with `--local` to guarantee that code snippets never leave your workstation.
|
|
40
|
+
- **🎙️ Voice Debriefs (`--voice` / `-v`)**: Audio debriefs of scan findings directly in your terminal upon scan completion, with automatic headless CI bypass.
|
|
41
|
+
- **🤖 Built-in MCP Server**: `secureflow mcp` exposes live threat intelligence, CVE lookups, and ArmorIQ cryptographic intent verification over JSON-RPC stdio.
|
|
42
|
+
- **📊 Comprehensive Exporters**: Export audit-grade reports in **SARIF** (GitHub Code Scanning), **HTML**, **CSV** (formula injection hardened), **JSON**, and **Markdown**.
|
|
43
|
+
- **🚦 Configurable Quality Gates**: Strict build-failing control using `--fail-on <low|medium|high|critical>`.
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## 📦 Installation
|
|
48
|
+
|
|
49
|
+
### Global Installation (Recommended)
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npm install -g secureflow-cli
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
### Project Dev Dependency
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
npm install --save-dev secureflow-cli
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
### Run Instantly via `npx`
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
npx secureflow --help
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## 🚀 Quick Start
|
|
70
|
+
|
|
71
|
+
1. **Stage your changes in git:**
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
git add src/
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
2. **Run the security scanner:**
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
secureflow
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
3. **Run with an audio summary debrief:**
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
secureflow --voice
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
4. **Export a SARIF report for GitHub Code Scanning:**
|
|
90
|
+
```bash
|
|
91
|
+
secureflow --format sarif -o results.sarif
|
|
92
|
+
```
|
|
93
|
+
|
|
94
|
+
---
|
|
95
|
+
|
|
96
|
+
## 🪝 Git Hook Setup (Husky)
|
|
97
|
+
|
|
98
|
+
Prevent sensitive data from ever entering your git history by configuring SecureFlow in your pre-commit hook:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
# Initialize husky in your project
|
|
102
|
+
npx husky init
|
|
103
|
+
|
|
104
|
+
# Add secureflow to your pre-commit hook
|
|
105
|
+
echo "npx secureflow --fail-on high" > .husky/pre-commit
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
Now, every `git commit` automatically triggers a security check on staged files. If a high or critical finding is detected, the commit is safely blocked.
|
|
109
|
+
|
|
110
|
+
---
|
|
111
|
+
|
|
112
|
+
## 📖 Command Line Reference
|
|
113
|
+
|
|
114
|
+
```text
|
|
115
|
+
Usage:
|
|
116
|
+
secureflow [options]
|
|
117
|
+
secureflow mcp [options]
|
|
118
|
+
|
|
119
|
+
Commands:
|
|
120
|
+
mcp Start the Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
### Options & Flags
|
|
124
|
+
|
|
125
|
+
| Flag | Shorthand | Default | Description |
|
|
126
|
+
| :--------------------- | :-------- | :------------------ | :------------------------------------------------------------------------------------------------- |
|
|
127
|
+
| `--fail-on <level>` | | `medium` | Exit with error code `1` if findings meet or exceed severity (`low`, `medium`, `high`, `critical`) |
|
|
128
|
+
| `--format <format>` | | `text` | Output report format: `text`, `json`, `sarif`, `csv`, `html`, `markdown` |
|
|
129
|
+
| `--output <path>` | `-o` | `stdout` | Write report to the specified file path |
|
|
130
|
+
| `--voice` | `-v` | `false` | Play an audio debrief of findings in your terminal upon completion |
|
|
131
|
+
| `--local` | | `false` | Skip cloud AI upload and run fully local pattern analysis |
|
|
132
|
+
| `--local-model <tag>` | | `llama3` | Specify local model tag when using local AI providers |
|
|
133
|
+
| `--ignore-file <path>` | | `.secureflowignore` | Custom path to ignore configuration file |
|
|
134
|
+
| `--dry-run` | | `false` | Simulate scan execution without writing output files |
|
|
135
|
+
| `--verbose` | | `false` | Enable verbose diagnostic logging |
|
|
136
|
+
| `--help` | `-h` | | Display CLI usage instructions and exit |
|
|
137
|
+
|
|
138
|
+
---
|
|
139
|
+
|
|
140
|
+
### Failure Thresholds (`--fail-on`)
|
|
141
|
+
|
|
142
|
+
Control the sensitivity of the pre-commit gate:
|
|
143
|
+
|
|
144
|
+
```bash
|
|
145
|
+
# Block only on high and critical findings (standard CI recommendation)
|
|
146
|
+
secureflow --fail-on high
|
|
147
|
+
|
|
148
|
+
# Strict zero-tolerance gate (blocks on any finding, including low)
|
|
149
|
+
secureflow --fail-on low
|
|
150
|
+
|
|
151
|
+
# Allow commits while logging warnings
|
|
152
|
+
secureflow --fail-on none
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
### Multi-Format Reports (`--format`)
|
|
158
|
+
|
|
159
|
+
- **Text (`text`)**: Clean, ANSI-colored terminal overview with source code context snippets.
|
|
160
|
+
- **SARIF (`sarif`)**: Industry-standard OASIS SARIF 2.1.0 format, ready for direct upload to GitHub Security tab.
|
|
161
|
+
- **HTML (`html`)**: Self-contained, responsive HTML report suitable for sharing and compliance reviews.
|
|
162
|
+
- **CSV (`csv`)**: Formatted tabular output hardened against spreadsheet formula injection (CWE-1236).
|
|
163
|
+
- **JSON (`json`)**: Machine-readable JSON object representing findings and metadata.
|
|
164
|
+
- **Markdown (`markdown` / `md`)**: GitHub-Flavored Markdown table with sanitized code fences.
|
|
165
|
+
|
|
166
|
+
```bash
|
|
167
|
+
secureflow --format html -o security-report.html
|
|
168
|
+
secureflow --format sarif -o results.sarif
|
|
169
|
+
secureflow --format markdown -o findings.md
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
---
|
|
173
|
+
|
|
174
|
+
## 🔒 Air-Gapped & Local Mode (`--local`)
|
|
175
|
+
|
|
176
|
+
When handling proprietary or classified source code, use the `--local` flag:
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
secureflow --local
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
### Guarantees under `--local`:
|
|
183
|
+
|
|
184
|
+
- **Zero Cloud Uploads**: The hosted AI API pass (`/api/cli/scan`) is completely bypassed.
|
|
185
|
+
- **Staged Code Stays Local**: File contents are parsed and scanned strictly in-memory on your local machine.
|
|
186
|
+
- **Compatible with Local Models**: Seamlessly pairs with local Ollama or vLLM deployments (`--local-model <tag>`).
|
|
187
|
+
|
|
188
|
+
For hardware requirements, VRAM sizing, and fallback configuration, see the [Local Model & VRAM Guide](../docs/local-inference.md).
|
|
189
|
+
|
|
190
|
+
---
|
|
191
|
+
|
|
192
|
+
## 🎙️ Audio Summary Debriefs (`--voice`)
|
|
193
|
+
|
|
194
|
+
Listen to hands-free voice briefings of scan findings right in your terminal:
|
|
195
|
+
|
|
196
|
+
```bash
|
|
197
|
+
secureflow --voice
|
|
198
|
+
# or shorthand
|
|
199
|
+
secureflow -v
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
### Capabilities:
|
|
203
|
+
|
|
204
|
+
- **Native OS Playback**:
|
|
205
|
+
- macOS: `afplay`
|
|
206
|
+
- Windows: PowerShell `System.Media.SoundPlayer` / `Windows.Media.Playback`
|
|
207
|
+
- Linux: `mpg123` or `aplay`
|
|
208
|
+
- **Fallback**: Automatically saves findings to `secureflow-summary.mp3` if no audio player is present.
|
|
209
|
+
- **CI Safe**: Detects non-interactive environments (`CI=true`, `GITHUB_ACTIONS=true`) and silently skips playback without stalling build runners.
|
|
210
|
+
- **ElevenLabs Integration**: Synthesizes natural voice summaries if `ELEVENLABS_API_KEY` is present.
|
|
211
|
+
|
|
212
|
+
---
|
|
213
|
+
|
|
214
|
+
## 🤖 Threat Intelligence MCP Server (`mcp`)
|
|
215
|
+
|
|
216
|
+
SecureFlow CLI doubles as a **Model Context Protocol (MCP)** server, allowing AI agents in **Cursor**, **Windsurf**, **Claude Desktop**, or **Antigravity** to query threat intelligence and verify tool actions against ArmorIQ policy boundaries.
|
|
217
|
+
|
|
218
|
+
```bash
|
|
219
|
+
secureflow mcp
|
|
220
|
+
```
|
|
221
|
+
|
|
222
|
+
### Connecting to Cursor / Windsurf / Claude Desktop
|
|
223
|
+
|
|
224
|
+
Add this configuration to your `claude_desktop_config.json` or Cursor MCP settings:
|
|
225
|
+
|
|
226
|
+
```json
|
|
227
|
+
{
|
|
228
|
+
"mcpServers": {
|
|
229
|
+
"secureflow": {
|
|
230
|
+
"command": "npx",
|
|
231
|
+
"args": ["-y", "secureflow-cli", "mcp"]
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
}
|
|
235
|
+
```
|
|
236
|
+
|
|
237
|
+
### Available MCP Tools
|
|
238
|
+
|
|
239
|
+
| Tool | Parameters | Description |
|
|
240
|
+
| :-------------------------- | :-------------------------------------- | :------------------------------------------------------------------------------------------ |
|
|
241
|
+
| `query_threat_intelligence` | `query: string`, `intentToken?: string` | Search CVE and threat intelligence databases for vulnerabilities and remediation guidance. |
|
|
242
|
+
| `lookup_cve` | `cveId: string`, `intentToken?: string` | Look up detailed advisories, severity scores, and fix patterns for a CVE or CWE identifier. |
|
|
243
|
+
|
|
244
|
+
_All MCP tool calls are gated behind ArmorIQ cryptographic intent verification to enforce zero-trust boundary compliance and mitigate Prompt Injection (CWE-94)._
|
|
245
|
+
|
|
246
|
+
For comprehensive IDE configuration steps, intent signing keys, and manual testing instructions, see the dedicated [Threat Intelligence MCP Server Guide](../docs/mcp-server.md).
|
|
247
|
+
|
|
248
|
+
---
|
|
249
|
+
|
|
250
|
+
## ⚙️ Configuration (`.secureflowignore`)
|
|
251
|
+
|
|
252
|
+
Define exclusion patterns and placeholder allowances in `.secureflowignore` at the root of your project:
|
|
253
|
+
|
|
254
|
+
```gitignore
|
|
255
|
+
# Ignore specific directories and generated bundles
|
|
256
|
+
dist/
|
|
257
|
+
coverage/
|
|
258
|
+
node_modules/
|
|
259
|
+
*.min.js
|
|
260
|
+
|
|
261
|
+
# Ignore documentation examples
|
|
262
|
+
docs/samples/**
|
|
263
|
+
|
|
264
|
+
# Allow safe mock/test tokens
|
|
265
|
+
[placeholders]
|
|
266
|
+
mock-token-*
|
|
267
|
+
test_api_key_dummy
|
|
268
|
+
EXAMPLE_SECRET
|
|
269
|
+
```
|
|
270
|
+
|
|
271
|
+
---
|
|
272
|
+
|
|
273
|
+
## 🔄 CI/CD Pipeline Integration
|
|
274
|
+
|
|
275
|
+
### GitHub Actions Workflow
|
|
276
|
+
|
|
277
|
+
```yaml
|
|
278
|
+
name: Security Scan
|
|
279
|
+
on: [push, pull_request]
|
|
280
|
+
|
|
281
|
+
jobs:
|
|
282
|
+
secureflow-scan:
|
|
283
|
+
runs-on: ubuntu-latest
|
|
284
|
+
steps:
|
|
285
|
+
- uses: actions/checkout@v4
|
|
286
|
+
|
|
287
|
+
- name: Setup Node.js
|
|
288
|
+
uses: actions/setup-node@v4
|
|
289
|
+
with:
|
|
290
|
+
node-version: 20
|
|
291
|
+
|
|
292
|
+
- name: Run SecureFlow Scanner
|
|
293
|
+
run: npx secureflow-cli --format sarif -o results.sarif --fail-on high
|
|
294
|
+
|
|
295
|
+
- name: Upload SARIF to GitHub Security tab
|
|
296
|
+
if: always()
|
|
297
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
298
|
+
with:
|
|
299
|
+
sarif_file: results.sarif
|
|
300
|
+
```
|
|
301
|
+
|
|
302
|
+
---
|
|
303
|
+
|
|
304
|
+
## 📄 License
|
|
305
|
+
|
|
306
|
+
This package is licensed under the [ISC License](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE). Built with ❤️ by the SecureFlow Team.
|
package/dist/git.d.ts
CHANGED
|
@@ -48,4 +48,8 @@ export declare function getStagedFiles(): string[];
|
|
|
48
48
|
* a symlink), so the caller can report it rather than treat it as clean.
|
|
49
49
|
*/
|
|
50
50
|
export declare function readStagedContent(path: string): string | null;
|
|
51
|
+
/**
|
|
52
|
+
* Detects the currently checked out branch name, or null if detached or outside git repository.
|
|
53
|
+
*/
|
|
54
|
+
export declare function getCurrentBranch(): string | null;
|
|
51
55
|
//# sourceMappingURL=git.d.ts.map
|
package/dist/git.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IAG/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBADxB,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,OAAO,YAAA;CAK3B;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D"}
|
|
1
|
+
{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IAG/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBADxB,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,OAAO,YAAA;CAK3B;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAOhD"}
|
package/dist/git.js
CHANGED
|
@@ -93,4 +93,16 @@ export function readStagedContent(path) {
|
|
|
93
93
|
return null;
|
|
94
94
|
}
|
|
95
95
|
}
|
|
96
|
+
/**
|
|
97
|
+
* Detects the currently checked out branch name, or null if detached or outside git repository.
|
|
98
|
+
*/
|
|
99
|
+
export function getCurrentBranch() {
|
|
100
|
+
try {
|
|
101
|
+
const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]).trim();
|
|
102
|
+
return branch === "HEAD" || branch.length === 0 ? null : branch;
|
|
103
|
+
}
|
|
104
|
+
catch {
|
|
105
|
+
return null;
|
|
106
|
+
}
|
|
107
|
+
}
|
|
96
108
|
//# sourceMappingURL=git.js.map
|
package/dist/git.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGtB;IAFX,YACE,OAAe,EACN,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGtB;IAFX,YACE,OAAe,EACN,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -20,50 +20,50 @@ const AI_SKIP_REASON = hostedAiScanSkipReason(process.argv);
|
|
|
20
20
|
*/
|
|
21
21
|
Object.assign(process.env, localModeEnv(process.argv, process.env));
|
|
22
22
|
function printMcpHelp() {
|
|
23
|
-
console.log(`
|
|
24
|
-
SecureFlow CLI - Threat Intelligence MCP Server
|
|
25
|
-
|
|
26
|
-
Usage:
|
|
27
|
-
secureflow mcp [options]
|
|
28
|
-
|
|
29
|
-
Description:
|
|
30
|
-
Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio.
|
|
31
|
-
Communicates using JSON-RPC protocol over standard input/output.
|
|
32
|
-
|
|
33
|
-
Options:
|
|
34
|
-
-h, --help Show this help message
|
|
23
|
+
console.log(`
|
|
24
|
+
SecureFlow CLI - Threat Intelligence MCP Server
|
|
25
|
+
|
|
26
|
+
Usage:
|
|
27
|
+
secureflow mcp [options]
|
|
28
|
+
|
|
29
|
+
Description:
|
|
30
|
+
Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio.
|
|
31
|
+
Communicates using JSON-RPC protocol over standard input/output.
|
|
32
|
+
|
|
33
|
+
Options:
|
|
34
|
+
-h, --help Show this help message
|
|
35
35
|
`);
|
|
36
36
|
}
|
|
37
37
|
function printHelp() {
|
|
38
|
-
console.log(`
|
|
39
|
-
SecureFlow CLI - Security analysis tool for staged git files
|
|
40
|
-
|
|
41
|
-
Usage:
|
|
42
|
-
secureflow [options]
|
|
43
|
-
secureflow mcp [options]
|
|
44
|
-
|
|
45
|
-
Commands:
|
|
46
|
-
mcp Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
47
|
-
|
|
48
|
-
Options:
|
|
49
|
-
--verbose Enable verbose logging
|
|
50
|
-
--format <format> Output format: text, json, sarif, csv, html, markdown (default: text)
|
|
51
|
-
-o, --output <path> Write output to specified file path
|
|
52
|
-
--ignore-file <path> Path to custom ignore configuration file
|
|
53
|
-
--fail-on <level> Fail scan threshold (low, medium, high, critical)
|
|
54
|
-
--local Run scan locally without uploading files externally
|
|
55
|
-
--local-model <tag> Specify local AI model tag (default: llama3)
|
|
56
|
-
--dry-run Simulate scan execution without writing files
|
|
57
|
-
-v, --voice Play an audio summary debrief of scan findings upon completion
|
|
58
|
-
-h, --help Show this help message
|
|
59
|
-
|
|
60
|
-
Examples:
|
|
61
|
-
$ secureflow # Run standard security scan on staged files
|
|
62
|
-
$ secureflow -v # Run scan and play audio summary debrief
|
|
63
|
-
$ secureflow mcp # Start the Threat Intelligence MCP server over stdio
|
|
64
|
-
$ secureflow --format json -o res.json # Scan and export results to JSON file
|
|
65
|
-
$ secureflow --fail-on high # Fail commit only on high/critical findings
|
|
66
|
-
$ secureflow --local --local-model llama3 # Run completely local scan
|
|
38
|
+
console.log(`
|
|
39
|
+
SecureFlow CLI - Security analysis tool for staged git files
|
|
40
|
+
|
|
41
|
+
Usage:
|
|
42
|
+
secureflow [options]
|
|
43
|
+
secureflow mcp [options]
|
|
44
|
+
|
|
45
|
+
Commands:
|
|
46
|
+
mcp Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
47
|
+
|
|
48
|
+
Options:
|
|
49
|
+
--verbose Enable verbose logging
|
|
50
|
+
--format <format> Output format: text, json, sarif, csv, html, markdown (default: text)
|
|
51
|
+
-o, --output <path> Write output to specified file path
|
|
52
|
+
--ignore-file <path> Path to custom ignore configuration file
|
|
53
|
+
--fail-on <level> Fail scan threshold (low, medium, high, critical)
|
|
54
|
+
--local Run scan locally without uploading files externally
|
|
55
|
+
--local-model <tag> Specify local AI model tag (default: llama3)
|
|
56
|
+
--dry-run Simulate scan execution without writing files
|
|
57
|
+
-v, --voice Play an audio summary debrief of scan findings upon completion
|
|
58
|
+
-h, --help Show this help message
|
|
59
|
+
|
|
60
|
+
Examples:
|
|
61
|
+
$ secureflow # Run standard security scan on staged files
|
|
62
|
+
$ secureflow -v # Run scan and play audio summary debrief
|
|
63
|
+
$ secureflow mcp # Start the Threat Intelligence MCP server over stdio
|
|
64
|
+
$ secureflow --format json -o res.json # Scan and export results to JSON file
|
|
65
|
+
$ secureflow --fail-on high # Fail commit only on high/critical findings
|
|
66
|
+
$ secureflow --local --local-model llama3 # Run completely local scan
|
|
67
67
|
`);
|
|
68
68
|
}
|
|
69
69
|
function parseFormatArg() {
|
|
@@ -246,7 +246,7 @@ async function main() {
|
|
|
246
246
|
const outputString = formatScanResults(filteredResults, format);
|
|
247
247
|
if (outputPath) {
|
|
248
248
|
if (DRY_RUN) {
|
|
249
|
-
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
249
|
+
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
250
250
|
${outputString}`);
|
|
251
251
|
}
|
|
252
252
|
else {
|
|
@@ -261,7 +261,7 @@ ${outputString}`);
|
|
|
261
261
|
else if (outputPath) {
|
|
262
262
|
const textOutput = formatScanResults(filteredResults, "text");
|
|
263
263
|
if (DRY_RUN) {
|
|
264
|
-
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
264
|
+
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
265
265
|
${textOutput}`);
|
|
266
266
|
}
|
|
267
267
|
else {
|
|
@@ -5,10 +5,11 @@ export interface AudioPlaybackResult {
|
|
|
5
5
|
savedPath?: string;
|
|
6
6
|
error?: string;
|
|
7
7
|
}
|
|
8
|
+
export type AudioPlayerEnv = NodeJS.ProcessEnv | Record<string, string | undefined>;
|
|
8
9
|
/**
|
|
9
10
|
* Checks if the current process is running in a non-interactive CI/CD environment.
|
|
10
11
|
*/
|
|
11
|
-
export declare function isNonInteractiveCiEnvironment(env?:
|
|
12
|
+
export declare function isNonInteractiveCiEnvironment(env?: AudioPlayerEnv): boolean;
|
|
12
13
|
/**
|
|
13
14
|
* Determines the command and arguments for native OS audio playback.
|
|
14
15
|
*/
|
|
@@ -21,7 +22,7 @@ export declare function getOsAudioCommand(filePath: string, platform?: NodeJS.Pl
|
|
|
21
22
|
*/
|
|
22
23
|
export declare function playAudioFile(filePath: string, options?: {
|
|
23
24
|
platform?: NodeJS.Platform;
|
|
24
|
-
env?:
|
|
25
|
+
env?: AudioPlayerEnv;
|
|
25
26
|
verbose?: boolean;
|
|
26
27
|
fallbackDir?: string;
|
|
27
28
|
}): AudioPlaybackResult;
|
|
@@ -31,16 +32,22 @@ export declare function playAudioFile(filePath: string, options?: {
|
|
|
31
32
|
export declare function fetchAudioSummary(summaryText: string, options?: {
|
|
32
33
|
baseUrl?: string;
|
|
33
34
|
files?: StagedFileForAiScan[];
|
|
34
|
-
env?:
|
|
35
|
+
env?: AudioPlayerEnv;
|
|
35
36
|
}): Promise<Buffer | null>;
|
|
37
|
+
/**
|
|
38
|
+
* Safely removes a temporary file, suppressing any filesystem errors.
|
|
39
|
+
*/
|
|
40
|
+
export declare function cleanupTempFile(filePath: string): boolean;
|
|
36
41
|
/**
|
|
37
42
|
* Coordinates fetching and playing the voice summary debrief.
|
|
38
43
|
*/
|
|
39
44
|
export declare function playVoiceDebrief(summaryText: string, options?: {
|
|
40
45
|
baseUrl?: string;
|
|
41
46
|
files?: StagedFileForAiScan[];
|
|
42
|
-
env?:
|
|
47
|
+
env?: AudioPlayerEnv;
|
|
43
48
|
verbose?: boolean;
|
|
44
49
|
fallbackDir?: string;
|
|
50
|
+
keepTempFile?: boolean;
|
|
51
|
+
platform?: NodeJS.Platform;
|
|
45
52
|
}): Promise<AudioPlaybackResult>;
|
|
46
53
|
//# sourceMappingURL=audio-player.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,
|
|
1
|
+
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEpF;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,cAA4B,GAAG,OAAO,CAcxF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA8B5C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,mBAAmB,CAwCrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuExB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUzD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,GACA,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}
|
package/dist/lib/audio-player.js
CHANGED
|
@@ -14,7 +14,10 @@ export function isNonInteractiveCiEnvironment(env = process.env) {
|
|
|
14
14
|
env.CIRCLECI ||
|
|
15
15
|
env.TRAVIS ||
|
|
16
16
|
env.CONTINUOUS_INTEGRATION ||
|
|
17
|
-
env.BUILDKITE
|
|
17
|
+
env.BUILDKITE ||
|
|
18
|
+
env.DOCKER === "true" ||
|
|
19
|
+
env.DOCKER_CONTAINER === "true" ||
|
|
20
|
+
env.container === "docker");
|
|
18
21
|
}
|
|
19
22
|
/**
|
|
20
23
|
* Determines the command and arguments for native OS audio playback.
|
|
@@ -25,18 +28,23 @@ export function getOsAudioCommand(filePath, platform = process.platform) {
|
|
|
25
28
|
return { command: "afplay", args: [filePath] };
|
|
26
29
|
case "win32": {
|
|
27
30
|
// PowerShell sound player: uses SoundPlayer for .wav or MediaPlayer / wmplayer fallback
|
|
28
|
-
const psScript = `
|
|
29
|
-
try {
|
|
30
|
-
Add-Type -AssemblyName presentationCore;
|
|
31
|
-
$player = New-Object System.Windows.Media.MediaPlayer;
|
|
32
|
-
$player.Open([System.Uri]'${filePath.replace(/'/g, "''")}');
|
|
33
|
-
$player.Play();
|
|
34
|
-
Start-Sleep -Seconds 1;
|
|
35
|
-
} catch {
|
|
36
|
-
[System.Media.SystemSounds]::Beep.Play();
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
|
|
31
|
+
const psScript = `
|
|
32
|
+
try {
|
|
33
|
+
Add-Type -AssemblyName presentationCore;
|
|
34
|
+
$player = New-Object System.Windows.Media.MediaPlayer;
|
|
35
|
+
$player.Open([System.Uri]'${filePath.replace(/'/g, "''")}');
|
|
36
|
+
$player.Play();
|
|
37
|
+
Start-Sleep -Seconds 1;
|
|
38
|
+
} catch {
|
|
39
|
+
[System.Media.SystemSounds]::Beep.Play();
|
|
40
|
+
}
|
|
41
|
+
`
|
|
42
|
+
.replace(/\s+/g, " ")
|
|
43
|
+
.trim();
|
|
44
|
+
return {
|
|
45
|
+
command: "powershell",
|
|
46
|
+
args: ["-NoProfile", "-NonInteractive", "-Command", psScript],
|
|
47
|
+
};
|
|
40
48
|
}
|
|
41
49
|
case "linux":
|
|
42
50
|
// Supports mpg123, aplay, paplay
|
|
@@ -115,6 +123,12 @@ export async function fetchAudioSummary(summaryText, options) {
|
|
|
115
123
|
const arrayBuf = await response.arrayBuffer();
|
|
116
124
|
return Buffer.from(arrayBuf);
|
|
117
125
|
}
|
|
126
|
+
if (response.status === 429) {
|
|
127
|
+
console.warn("⚠️ [SecureFlow] ElevenLabs rate limit reached (429 Too Many Requests).");
|
|
128
|
+
}
|
|
129
|
+
else if (response.status === 401) {
|
|
130
|
+
console.warn("⚠️ [SecureFlow] ElevenLabs authentication failed (401 Unauthorized). Check API key.");
|
|
131
|
+
}
|
|
118
132
|
}
|
|
119
133
|
catch {
|
|
120
134
|
// Fallback to /api/cli/scan
|
|
@@ -149,6 +163,21 @@ export async function fetchAudioSummary(summaryText, options) {
|
|
|
149
163
|
}
|
|
150
164
|
return null;
|
|
151
165
|
}
|
|
166
|
+
/**
|
|
167
|
+
* Safely removes a temporary file, suppressing any filesystem errors.
|
|
168
|
+
*/
|
|
169
|
+
export function cleanupTempFile(filePath) {
|
|
170
|
+
try {
|
|
171
|
+
if (fs.existsSync(filePath)) {
|
|
172
|
+
fs.unlinkSync(filePath);
|
|
173
|
+
return true;
|
|
174
|
+
}
|
|
175
|
+
}
|
|
176
|
+
catch {
|
|
177
|
+
// Gracefully ignore cleanup errors
|
|
178
|
+
}
|
|
179
|
+
return false;
|
|
180
|
+
}
|
|
152
181
|
/**
|
|
153
182
|
* Coordinates fetching and playing the voice summary debrief.
|
|
154
183
|
*/
|
|
@@ -161,13 +190,18 @@ export async function playVoiceDebrief(summaryText, options) {
|
|
|
161
190
|
return { played: false, bypassed: true };
|
|
162
191
|
}
|
|
163
192
|
const audioBuffer = await fetchAudioSummary(summaryText, options);
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
193
|
+
const tempPath = path.join(os.tmpdir(), `secureflow-summary-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.mp3`);
|
|
194
|
+
const bufferToWrite = !audioBuffer || audioBuffer.length === 0
|
|
195
|
+
? Buffer.from("ID3\x04\x00\x00\x00\x00\x00#TSSE\x00\x00\x00\x0f\x00\x00\x03Lavf58.29.100\x00")
|
|
196
|
+
: audioBuffer;
|
|
197
|
+
try {
|
|
198
|
+
fs.writeFileSync(tempPath, bufferToWrite);
|
|
167
199
|
return playAudioFile(tempPath, options);
|
|
168
200
|
}
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
201
|
+
finally {
|
|
202
|
+
if (!options?.keepTempFile) {
|
|
203
|
+
cleanupTempFile(tempPath);
|
|
204
|
+
}
|
|
205
|
+
}
|
|
172
206
|
}
|
|
173
207
|
//# sourceMappingURL=audio-player.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;
|
|
1
|
+
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAW9D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE,KAAK,MAAM;QACjB,GAAG,CAAC,EAAE,KAAK,GAAG;QACd,GAAG,CAAC,cAAc,KAAK,MAAM;QAC7B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,GAAG,CAAC,gBAAgB,KAAK,MAAM;QAC/B,GAAG,CAAC,SAAS,KAAK,QAAQ,CAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wFAAwF;YACxF,MAAM,QAAQ,GAAG;;;;sCAIe,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;;;;;;OAM3D;iBACE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,KAAK,OAAO;YACV,iCAAiC;YACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,OAKC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAElD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9C,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEtE,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,8DAA8D,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,OAIC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAEhD,2DAA2D;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,CAAC,CAAC,gBAAgB;YACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+CAA+C,OAAO,EAAE,EAAE;gBACrF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,gBAAgB;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,uBAAuB;oBACjC,cAAc,EAAE;wBACd,SAAS,EAAE,GAAG;wBACd,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACV,sFAAsF,CACvF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC3B,KAAK,EAAE,IAAI;gBACX,WAAW;aACZ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6C,CAAC;YACjF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAQC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,EAAE,CAAC,MAAM,EAAE,EACX,sBAAsB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACjF,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC;IAElB,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/mcp/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,uBAAuB,EA8CnD,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,uBAAuB,EA8CnD,CAAC;AAqBF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB,wBAAwB,CA4D1B;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CA8InD;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBhF;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAKpD"}
|
package/dist/mcp/index.js
CHANGED
|
@@ -44,7 +44,19 @@ export const KNOWLEDGE_BASE = [
|
|
|
44
44
|
/**
|
|
45
45
|
* Creates and configures the SecureFlow Threat Intelligence MCP Server.
|
|
46
46
|
*/
|
|
47
|
-
|
|
47
|
+
/**
|
|
48
|
+
* Resolve the HMAC key used for MCP tool proofs.
|
|
49
|
+
*
|
|
50
|
+
* There is deliberately no built-in key. A committed default would let any
|
|
51
|
+
* reader of the repository forge proofs against a misconfigured deployment.
|
|
52
|
+
*/
|
|
53
|
+
function resolveSigningKey() {
|
|
54
|
+
const key = process.env.ARMORIQ_PROOF_SIGNING_KEY?.trim();
|
|
55
|
+
if (!key) {
|
|
56
|
+
throw new Error("ARMORIQ_PROOF_SIGNING_KEY is not configured; refusing to sign ArmorIQ proofs with a public fallback key.");
|
|
57
|
+
}
|
|
58
|
+
return key;
|
|
59
|
+
}
|
|
48
60
|
/**
|
|
49
61
|
* Validates declared cryptographic intent against ArmorIQ policy rules
|
|
50
62
|
* to prevent prompt injection (CWE-94) and arbitrary execution drift.
|
|
@@ -75,7 +87,19 @@ export function verifyDeclaredIntent(toolName, args, intentToken) {
|
|
|
75
87
|
const proofHash = createHash("sha256")
|
|
76
88
|
.update(JSON.stringify({ toolName, args, timestamp }))
|
|
77
89
|
.digest("hex");
|
|
78
|
-
|
|
90
|
+
let signature;
|
|
91
|
+
try {
|
|
92
|
+
signature = createHmac("sha256", resolveSigningKey()).update(proofHash).digest("hex");
|
|
93
|
+
}
|
|
94
|
+
catch (error) {
|
|
95
|
+
return {
|
|
96
|
+
verified: false,
|
|
97
|
+
allowed: false,
|
|
98
|
+
reason: error instanceof Error
|
|
99
|
+
? `Action blocked by ArmorIQ: ${error.message}`
|
|
100
|
+
: "Action blocked by ArmorIQ: signing key is not configured",
|
|
101
|
+
};
|
|
102
|
+
}
|
|
79
103
|
return {
|
|
80
104
|
verified: true,
|
|
81
105
|
allowed: true,
|
|
@@ -206,8 +230,8 @@ export async function queryLiveThreatIntelligence(query) {
|
|
|
206
230
|
item.category.toLowerCase().includes(q) ||
|
|
207
231
|
(item.cve && item.cve.toLowerCase().includes(q)));
|
|
208
232
|
if (match) {
|
|
209
|
-
return `[Threat Intelligence Advisory - ${match.id} (${match.severity.toUpperCase()})]
|
|
210
|
-
Category: ${match.category}
|
|
233
|
+
return `[Threat Intelligence Advisory - ${match.id} (${match.severity.toUpperCase()})]
|
|
234
|
+
Category: ${match.category}
|
|
211
235
|
Guidance: ${match.remediationGuidance}`;
|
|
212
236
|
}
|
|
213
237
|
return "";
|
package/dist/mcp/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAWnG,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,eAAe;QACzB,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,eAAe;QACpB,mBAAmB,EACjB,mHAAmH;KACtH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EACT,6IAA6I;QAC/I,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,mBAAmB,EACjB,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,oGAAoG;KACvG;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,kHAAkH;KACrH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EACT,wGAAwG;QAC1G,QAAQ,EAAE,UAAU;QACpB,mBAAmB,EACjB,oHAAoH;KACvH;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAWnG,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,eAAe;QACzB,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,eAAe;QACpB,mBAAmB,EACjB,mHAAmH;KACtH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EACT,6IAA6I;QAC/I,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,mBAAmB,EACjB,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,oGAAoG;KACvG;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,kHAAkH;KACrH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EACT,wGAAwG;QAC1G,QAAQ,EAAE,UAAU;QACpB,mBAAmB,EACjB,oHAAoH;KACvH;CACF,CAAC;AAEF;;GAEG;AACH;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,IAA6B,EAC7B,WAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEtD,kEAAkE;IAClE,IACE,iHAAiH,CAAC,IAAI,CACpH,UAAU,CACX;QACD,iGAAiG,CAAC,IAAI,CACpG,UAAU,CACX;QACD,2DAA2D,CAAC,IAAI,CAAC,UAAU,CAAC,EAC5E,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,wFAAwF;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EACJ,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE;gBAC/C,CAAC,CAAC,0DAA0D;SACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL,SAAS;YACT,SAAS;YACT,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,OAAO;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,2BAA2B;oBACjC,WAAW,EACT,yGAAyG;oBAC3G,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,WAAW,EACT,gGAAgG;6BACnG;4BACD,WAAW,EAAE;gCACX,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,qEAAqE;6BACnF;yBACF;wBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;qBACpB;iBACF;gBACD;oBACE,IAAI,EAAE,YAAY;oBAClB,WAAW,EACT,oGAAoG;oBACtG,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,mDAAmD;6BACjE;4BACD,WAAW,EAAE;gCACX,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,qEAAqE;6BACnF;yBACF;wBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;qBACpB;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,MAAM,WAAW,GAAI,IAAY,EAAE,WAAW,CAAC;QAE/C,4FAA4F;QAC5F,MAAM,kBAAkB,GAAG,oBAAoB,CAC7C,IAAI,EACH,IAAgC,IAAI,EAAE,EACvC,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,kBAAkB,CAAC,MAAM;4BAChC,IAAI,EAAE,oCAAoC;4BAC1C,WAAW,EAAE,aAAa;yBAC3B,CAAC;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,CAAE,IAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACvD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EACzD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAE,IAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAC5F,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;yBACrC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,6BAA6B,KAAK,EAAE;4BAC3C,cAAc,EAAE,+DAA+D;yBAChF,CAAC;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa;IAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACnD,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,mCAAmC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC3E,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,mBAAmB,EAAE,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;AAC/E,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "secureflow-cli",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.5.0",
|
|
4
4
|
"description": "Pre-commit secret logging detector for secure development workflows",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"bin": {
|
|
@@ -38,6 +38,6 @@
|
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@types/node": "^26.6.5",
|
|
40
40
|
"typescript": "^6",
|
|
41
|
-
"vitest": "^5.0.
|
|
41
|
+
"vitest": "^5.0.5"
|
|
42
42
|
}
|
|
43
43
|
}
|