securewithtrace 0.10.0 → 0.12.0

package/README.md

@@ -10,7 +10,7 @@
 
 `tracecli` is the official CLI for Trace.
 
-Use it to authenticate, browse connected repositories, clone repositories, and inspect vulnerabilities directly from the command line.
+Use it to authenticate, browse and filter connected repositories, clone repositories, and inspect vulnerabilities directly from the command line.
 
 ## Install
 
@@ -42,6 +42,9 @@ tracecli auth status
 # 3) List connected repositories
 tracecli repo list
 
+# 3b) Filter repositories
+tracecli repo list --platform GITHUB --status CONNECTED --query trace
+
 # 4) View vulnerabilities
 tracecli vulnerabilities list --severity HIGH
 ```
@@ -49,7 +52,8 @@ tracecli vulnerabilities list --severity HIGH
 ## What You Can Do
 
 - **Authenticate securely** with device authorization flow (`auth login/logout/status`)
-- **List repositories** connected to your Trace organization (`repo list`)
+- **List and filter repositories** connected to your Trace organization (`repo list`, `repo filter`)
+- **Find repositories by dependency** with optional version filtering (`repo list --dependency`)
 - **Clone repositories** with secure token handling (`repo clone`)
 - **Filter vulnerabilities** by repo, severity, and status (`vulnerabilities list`)
 - **Export results as JSON or TSV** for automation (`vulnerabilities list --output json`)
@@ -70,6 +74,27 @@ tracecli auth logout
 # List org repositories known to Trace
 tracecli repo list
 
+# List only connected GitHub repositories that match "trace"
+tracecli repo list --platform GITHUB --status CONNECTED --query trace
+
+# Advanced filtering syntax (repeatable)
+tracecli repo list --filter "platform=GITHUB" --filter "repo:trace" --filter "status!=DISCONNECTED"
+
+# Alias command for filtering
+tracecli repo filter --filter "language:typescript" --filter "branch=main"
+
+# Find repositories that use a specific dependency
+tracecli repo list --dependency lodash
+
+# Filter by dependency at a specific version
+tracecli repo list --dependency lodash@4.17.21
+
+# Filter by scoped package with partial version match
+tracecli repo list --dependency @types/node@20
+
+# Dependency results as JSON
+tracecli repo list --dependency react --json | jq '.[].fullName'
+
 # Clone by owner/repo shorthand
 tracecli repo clone securewithtrace/trace
 
@@ -114,6 +139,18 @@ Supported filter values:
 - `--severity`: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`
 - `--status`: `OPEN`, `IN_PROGRESS`, `FIXED`, `IGNORED`, `FALSE_POSITIVE`
 
+Repository filter options:
+
+- `--platform`: `GITHUB`, `GITLAB`, `BITBUCKET`
+- `--status`: `CONNECTED`, `DISCONNECTED`
+- `--query`: case-insensitive contains match across URL, repo name, default branch, and language
+- `--default-branch`: case-insensitive contains match for default branch
+- `--language`: case-insensitive contains match for primary language
+- `--filter`: repeatable advanced expression in the form `<field><operator><value>`
+  - Supported fields: `platform`, `status`, `url`, `repo`, `branch`, `language`
+  - Supported operators: `=` (exact), `!=` (not exact), `:` (contains), `!:` (not contains)
+- `--dependency`: filter by dependency name with optional `@version` (e.g. `lodash`, `lodash@4.17`, `@types/node@20`)
+
 ### Pentests
 
 ```bash

package/dist/index.js

@@ -25736,6 +25736,9 @@ function extractRepoName(input) {
   return input;
 }
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
+var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
+var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
+var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
 function validateBranchName(branch) {
   if (branch.startsWith("-")) {
     throw new Error(`Invalid branch name: '${branch}' \u2014 branch names cannot start with a dash`);
@@ -25745,29 +25748,341 @@ function validateBranchName(branch) {
   }
   return branch;
 }
-function createListCommand2() {
-  return new Command("list").description("List repositories in your organization").action(async () => {
-    const organizationId = await resolveOrganizationId();
-    const result = await authenticatedRequest(
-      (client) => client.repository.listRepositories({
-        params: { organizationId }
-      })
+function parseDependencyFilter(filter) {
+  const isScoped = filter.startsWith("@");
+  const separatorIndex = isScoped ? filter.indexOf("@", 1) : filter.indexOf("@");
+  if (separatorIndex === -1) {
+    return { name: filter };
+  }
+  const name = filter.slice(0, separatorIndex);
+  const version2 = filter.slice(separatorIndex + 1);
+  if (!name || !version2) {
+    return { name: filter };
+  }
+  return { name, version: version2 };
+}
+function parseCloneDepth(value) {
+  const depth = Number.parseInt(value, 10);
+  if (!Number.isInteger(depth) || depth < 1) {
+    throw new Error("--depth must be a positive integer");
+  }
+  return depth;
+}
+function normalizeForMatching(value) {
+  return value.trim().toLowerCase();
+}
+function normalizePlatform(value, source) {
+  const normalized = value.trim().toUpperCase();
+  if (REPOSITORY_PLATFORMS.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${REPOSITORY_PLATFORMS.join(", ")}. Received '${value}'.`
+  );
+}
+function normalizeStatus(value, source) {
+  const normalized = value.trim().toUpperCase();
+  if (REPOSITORY_STATUSES.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${REPOSITORY_STATUSES.join(", ")}. Received '${value}'.`
+  );
+}
+function normalizeFilterField(rawField) {
+  const field = rawField.trim().toLowerCase();
+  switch (field) {
+    case "platform":
+      return "platform";
+    case "status":
+      return "status";
+    case "url":
+    case "repository":
+    case "repositoryurl":
+    case "repository_url":
+      return "repository_url";
+    case "repo":
+    case "name":
+    case "repository_name":
+      return "repo_name";
+    case "branch":
+    case "defaultbranch":
+    case "default_branch":
+      return "default_branch";
+    case "language":
+    case "primarylanguage":
+    case "primary_language":
+      return "language";
+    default:
+      throw new Error(
+        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language.`
+      );
+  }
+}
+function parseFilterOperator(rawOperator) {
+  switch (rawOperator) {
+    case "=":
+      return "exact";
+    case "!=":
+      return "not_exact";
+    case ":":
+      return "contains";
+    case "!:":
+      return "not_contains";
+    default:
+      throw new Error(`Unsupported filter operator '${rawOperator}'. Use one of: =, !=, :, !:.`);
+  }
+}
+function parseRepositoryFilterExpression(expression) {
+  const trimmed = expression.trim();
+  const match = /^([a-zA-Z][a-zA-Z0-9_-]*)(!=|!:|=|:)(.+)$/.exec(trimmed);
+  if (!match) {
+    throw new Error(
+      `Invalid filter '${expression}'. Expected format: <field><operator><value> (e.g., platform=GITHUB, repo:trace, status!=DISCONNECTED).`
     );
-    if (result.status !== 200) {
-      console.error(`Failed to list repositories (status ${result.status}).`);
-      process.exit(1);
+  }
+  const rawField = match[1];
+  const rawOperator = match[2];
+  const rawValue = match[3];
+  if (!rawField || !rawOperator || !rawValue) {
+    throw new Error(`Invalid filter '${expression}'.`);
+  }
+  const value = rawValue.trim();
+  if (!value) {
+    throw new Error(`Invalid filter '${expression}': value cannot be empty.`);
+  }
+  const field = normalizeFilterField(rawField);
+  const operator = parseFilterOperator(rawOperator);
+  if (field === "platform") {
+    normalizePlatform(value, "--filter");
+  }
+  if (field === "status") {
+    normalizeStatus(value, "--filter");
+  }
+  return { field, operator, value };
+}
+function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly) {
+  const normalizedCandidate = normalizeForMatching(candidate);
+  const normalizedFilter = normalizeForMatching(filterValue);
+  if (exactMatchOnly || operator === "exact" || operator === "not_exact") {
+    const matches2 = normalizedCandidate === normalizedFilter;
+    return operator === "not_exact" ? !matches2 : matches2;
+  }
+  const matches = normalizedCandidate.includes(normalizedFilter);
+  return operator === "not_contains" ? !matches : matches;
+}
+function matchParsedFilter(repo, parsedFilter) {
+  switch (parsedFilter.field) {
+    case "platform":
+      return doesValueMatchFilter(repo.platform, parsedFilter.value, parsedFilter.operator, true);
+    case "status":
+      return doesValueMatchFilter(repo.status, parsedFilter.value, parsedFilter.operator, true);
+    case "repository_url":
+      return doesValueMatchFilter(
+        repo.repositoryUrl,
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "repo_name":
+      return doesValueMatchFilter(
+        extractRepoName(repo.repositoryUrl),
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "default_branch":
+      return doesValueMatchFilter(
+        repo.defaultBranch,
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "language": {
+      const language = repo.primaryLanguage ?? "";
+      return doesValueMatchFilter(language, parsedFilter.value, parsedFilter.operator, false);
+    }
+  }
+}
+function filterRepositories(repositories, options) {
+  const parsedFilters = (options.filters ?? []).map(
+    (expression) => parseRepositoryFilterExpression(expression)
+  );
+  const normalizedPlatform = options.platform ? normalizePlatform(options.platform, "--platform") : void 0;
+  const normalizedStatus = options.status ? normalizeStatus(options.status, "--status") : void 0;
+  const normalizedQuery = options.query ? normalizeForMatching(options.query) : void 0;
+  const normalizedDefaultBranch = options.defaultBranch ? normalizeForMatching(options.defaultBranch) : void 0;
+  const normalizedLanguage = options.language ? normalizeForMatching(options.language) : void 0;
+  return repositories.filter((repo) => {
+    if (normalizedPlatform && repo.platform.toUpperCase() !== normalizedPlatform) {
+      return false;
+    }
+    if (normalizedStatus && repo.status.toUpperCase() !== normalizedStatus) {
+      return false;
+    }
+    if (normalizedDefaultBranch && !normalizeForMatching(repo.defaultBranch).includes(normalizedDefaultBranch)) {
+      return false;
+    }
+    const repoLanguage = normalizeForMatching(repo.primaryLanguage ?? "");
+    if (normalizedLanguage && !repoLanguage.includes(normalizedLanguage)) {
+      return false;
+    }
+    if (normalizedQuery) {
+      const normalizedUrl = normalizeForMatching(repo.repositoryUrl);
+      const normalizedBranch = normalizeForMatching(repo.defaultBranch);
+      const normalizedName = normalizeForMatching(extractRepoName(repo.repositoryUrl));
+      if (!normalizedUrl.includes(normalizedQuery) && !normalizedBranch.includes(normalizedQuery) && !repoLanguage.includes(normalizedQuery) && !normalizedName.includes(normalizedQuery)) {
+        return false;
+      }
+    }
+    for (const parsedFilter of parsedFilters) {
+      if (!matchParsedFilter(repo, parsedFilter)) {
+        return false;
+      }
     }
-    const repos = result.body;
-    if (repos.length === 0) {
-      console.log("No repositories found.");
+    return true;
+  });
+}
+function collectFilterExpression(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function toRepositoryListFilterOptions(options) {
+  return {
+    ...options.platform ? { platform: options.platform } : {},
+    ...options.status ? { status: options.status } : {},
+    ...options.query ? { query: options.query } : {},
+    ...options.defaultBranch ? { defaultBranch: options.defaultBranch } : {},
+    ...options.language ? { language: options.language } : {},
+    ...options.filter.length > 0 ? { filters: options.filter } : {}
+  };
+}
+function addRepositoryFilterOptions(command) {
+  return command.option(
+    "--platform <platform>",
+    "Filter by platform (GITHUB, GITLAB, BITBUCKET)",
+    (value) => value.toUpperCase()
+  ).option(
+    "--status <status>",
+    "Filter by status (CONNECTED, DISCONNECTED)",
+    (value) => value.toUpperCase()
+  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option(
+    "--filter <expression>",
+    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, language!:typescript",
+    collectFilterExpression,
+    []
+  ).option("--json", "Output as JSON").option(
+    "--dependency <pkg>",
+    "Filter repositories that use a dependency (e.g. lodash, lodash@4.17.21, @types/node@20)"
+  );
+}
+async function runRepositoryListCommand(options) {
+  const organizationId = await resolveOrganizationId();
+  if (options.dependency) {
+    await runDependencyFilter(organizationId, options);
+    return;
+  }
+  let filteredRepositories;
+  const result = await authenticatedRequest(
+    (client) => client.repository.listRepositories({
+      params: { organizationId }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to list repositories (status ${result.status}).`);
+    process.exit(1);
+  }
+  try {
+    filteredRepositories = filterRepositories(result.body, toRepositoryListFilterOptions(options));
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
+    console.error(`Invalid repository filter: ${message}`);
+    process.exit(1);
+  }
+  if (filteredRepositories.length === 0) {
+    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.filter.length > 0) {
+      console.log("No repositories found matching the provided filters.");
       return;
     }
-    for (const repo of repos) {
-      const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
-      const url2 = stripAnsi(String(repo.repositoryUrl));
-      const platform = stripAnsi(String(repo.platform)).toLowerCase();
-      console.log(`${url2}  (${platform}, ${status})`);
+    console.log("No repositories found.");
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(filteredRepositories, null, 2));
+    return;
+  }
+  for (const repo of filteredRepositories) {
+    const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
+    const url2 = stripAnsi(String(repo.repositoryUrl));
+    const platform = stripAnsi(String(repo.platform)).toLowerCase();
+    console.log(`${url2}  (${platform}, ${status})`);
+  }
+}
+async function runDependencyFilter(organizationId, options) {
+  const { name, version: version2 } = parseDependencyFilter(options.dependency);
+  const result = await authenticatedRequest(
+    (client) => client.dependency.searchDependencies({
+      params: { organizationId },
+      body: {
+        query: name,
+        ...version2 ? { versionPrefix: version2 } : {},
+        pageSize: 100
+      }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to search dependencies (status ${result.status}).`);
+    process.exit(1);
+  }
+  const repoMap = /* @__PURE__ */ new Map();
+  for (const pkg of result.body.packages) {
+    if (pkg.name.toLowerCase() !== name.toLowerCase()) {
+      continue;
+    }
+    for (const repo of pkg.repositories) {
+      const existing = repoMap.get(repo.repositoryId);
+      const versionStrings = repo.versions.map((v) => v.version);
+      if (existing) {
+        for (const v of versionStrings) {
+          if (!existing.versions.includes(v)) {
+            existing.versions.push(v);
+          }
+        }
+      } else {
+        repoMap.set(repo.repositoryId, {
+          fullName: repo.fullName,
+          versions: versionStrings
+        });
+      }
     }
+  }
+  const repos = Array.from(repoMap.values());
+  if (repos.length === 0) {
+    const label = version2 ? `${name}@${version2}` : name;
+    console.log(`No repositories found using dependency '${label}'.`);
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(repos, null, 2));
+    return;
+  }
+  for (const repo of repos) {
+    const versions = repo.versions.join(", ");
+    console.log(`${repo.fullName}  (${versions})`);
+  }
+}
+function createListCommand2() {
+  return addRepositoryFilterOptions(
+    new Command("list").description("List repositories in your organization")
+  ).action(async (options) => {
+    await runRepositoryListCommand(options);
+  });
+}
+function createFilterCommand() {
+  return addRepositoryFilterOptions(
+    new Command("filter").description("Filter repositories in your organization")
+  ).action(async (options) => {
+    await runRepositoryListCommand(options);
   });
 }
 function urlWithUsername(httpsUrl) {
@@ -25776,14 +26091,21 @@ function urlWithUsername(httpsUrl) {
   url2.password = "";
   return url2.toString();
 }
-function createAskPassScript(token) {
+function createAskPassScript() {
   const dir = mkdtempSync(join3(tmpdir(), "trace-askpass-"));
   const scriptPath = join3(dir, "askpass.sh");
-  writeFileSync3(scriptPath, `#!/bin/sh
-echo '${token.replace(/'/g, "'\\''")}'
-`, {
-    mode: 448
-  });
+  writeFileSync3(
+    scriptPath,
+    `#!/bin/sh
+if [ -z "\${${TRACE_GIT_ASKPASS_TOKEN_ENV}:-}" ]; then
+  exit 1
+fi
+printf '%s\\n' "$${TRACE_GIT_ASKPASS_TOKEN_ENV}"
+`,
+    {
+      mode: 448
+    }
+  );
   chmodSync(scriptPath, 448);
   return scriptPath;
 }
@@ -25803,7 +26125,8 @@ async function fetchCloneToken(repoUrl) {
       return null;
     }
     if (result.status === 200) {
-      return result.body.token;
+      const token = result.body.token.trim();
+      return token.length > 0 ? token : null;
     }
     return null;
   } catch {
@@ -25811,7 +26134,7 @@ async function fetchCloneToken(repoUrl) {
   }
 }
 function createCloneCommand() {
-  return new Command("clone").description("Clone a repository").argument("<repository>", "Repository URL or owner/repo shorthand").argument("[directory]", "Directory to clone into").option("--branch <branch>", "Branch to clone").option("--depth <depth>", "Shallow clone depth", Number.parseInt).action(
+  return new Command("clone").description("Clone a repository").argument("<repository>", "Repository URL or owner/repo shorthand").argument("[directory]", "Directory to clone into").option("--branch <branch>", "Branch to clone").option("--depth <depth>", "Shallow clone depth", parseCloneDepth).action(
     async (repository, directory, options) => {
       const cloneUrl = resolveRepoUrl(repository);
       const targetDir = directory ?? extractRepoName(repository);
@@ -25833,8 +26156,9 @@ function createCloneCommand() {
       console.log(`Cloning ${cloneUrl} into ${targetDir}...`);
       const extraEnv = {};
       if (installationToken) {
-        askPassScript = createAskPassScript(installationToken);
+        askPassScript = createAskPassScript();
         extraEnv["GIT_ASKPASS"] = askPassScript;
+        extraEnv[TRACE_GIT_ASKPASS_TOKEN_ENV] = installationToken;
         extraEnv["GIT_TERMINAL_PROMPT"] = "0";
       }
       try {
@@ -25845,7 +26169,7 @@ function createCloneCommand() {
         });
         const exitCode = await proc.exited;
         if (exitCode !== 0) {
-          process.exit(exitCode);
+          process.exit(1);
         }
         if (installationToken) {
           const resetProc = Bun.spawn(["git", "remote", "set-url", "origin", cloneUrl], {
@@ -25872,6 +26196,7 @@ function createCloneCommand() {
 function createRepoCommand() {
   const repo = new Command("repo").description("Manage repositories");
   repo.addCommand(createListCommand2());
+  repo.addCommand(createFilterCommand());
   repo.addCommand(createCloneCommand());
   return repo;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {