securewithtrace 0.15.0 → 0.16.1

package/README.md

@@ -66,12 +66,17 @@ tracecli vulnerabilities list --severity HIGH
 tracecli auth login
 tracecli auth status
 tracecli auth logout
-tracecli auth org list
-tracecli auth org current
-tracecli auth org switch <organization-id-or-slug>
 ```
 
-When your account belongs to multiple organizations, use `tracecli auth org switch` to set the active organization context used by repository, vulnerability, and pentest commands.
+### Organization context
+
+```bash
+tracecli org list
+tracecli org current
+tracecli org switch <organization-id-or-slug>
+```
+
+When your account belongs to multiple organizations, use `tracecli org switch` to set the active organization context used by repository, vulnerability, and pentest commands.
 
 ### Repositories
 

package/dist/index.js

@@ -22645,6 +22645,7 @@ var PatchCapabilitiesResponseSchema = external_exports.object({
 });
 var OrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
+  workosOrganizationId: external_exports.string().optional(),
   name: external_exports.string(),
   slug: external_exports.string(),
   logoUrl: external_exports.string().nullable(),
@@ -23942,7 +23943,9 @@ var VulnerabilityAggregatedCountsRequestSchema = external_exports.object({
   excludeStatuses: external_exports.array(VulnerabilityStatus).optional(),
   defaultBranchOnly: external_exports.boolean().default(true).optional(),
   /** Lower bound for time-series data. Only vulnerabilities created on or after this date are included in the timeSeries field. Does not affect byRepoAndSeverity or byStatusAndSeverity. */
-  timeSeriesSince: external_exports.coerce.date().optional()
+  timeSeriesSince: external_exports.coerce.date().optional(),
+  /** When provided, only include vulnerabilities belonging to this repository. */
+  repositoryId: external_exports.uuid().optional()
 });
 var VulnerabilityAggregatedCountsResponseSchema = external_exports.object({
   byRepoAndSeverity: external_exports.array(RepoSeverityCountSchema),
@@ -24701,17 +24704,21 @@ async function pollForToken(clientId, deviceCode, options = {}) {
   }
   throw new Error("Authorization timed out. Please try again.");
 }
-async function refreshAccessToken(clientId, refreshToken) {
+async function refreshAccessToken(clientId, refreshToken, organizationId) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: clientId,
+    refresh_token: refreshToken
+  });
+  if (organizationId && organizationId.trim().length > 0) {
+    body.set("organization_id", organizationId);
+  }
   const response = await fetch(WORKOS_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: clientId,
-      refresh_token: refreshToken
-    })
+    body
   });
   if (!response.ok) {
     const text = await response.text();
@@ -24899,6 +24906,24 @@ async function refreshStoredAccessToken() {
     return null;
   }
 }
+async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return false;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return true;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return false;
+  }
+}
 async function authenticatedRequest(request) {
   const token = readToken();
   if (!token) {
@@ -25027,6 +25052,21 @@ async function resolveOrganizationIdSafe(client) {
   }
 }
 
+// src/format.ts
+var SEVERITY_ORDER = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3,
+  INFORMATIONAL: 4
+};
+function formatStatus(status) {
+  return status.toLowerCase().replace("_", " ");
+}
+function tsvSafe(value) {
+  return (value ?? "").replace(/[\t\r\n]/g, " ");
+}
+
 // src/auth/commands.ts
 function getClientId() {
   const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
@@ -25172,9 +25212,15 @@ Use an organization ID or exact slug.`
     };
   }
   return {
-    error: `Organization '${input}' not found. Run \`tracecli auth org list\` to see available organizations.`
+    error: `Organization '${input}' not found. Run \`tracecli org list\` to see available organizations.`
   };
 }
+async function refreshAfterOrganizationSwitch(workosOrganizationId, refreshForOrganization = (organizationId) => refreshStoredAccessTokenForOrganization(organizationId)) {
+  if (!workosOrganizationId || workosOrganizationId.trim().length === 0) {
+    return false;
+  }
+  return refreshForOrganization(workosOrganizationId);
+}
 function createLoginCommand() {
   return new Command("login").description("Authenticate with Trace").action(async () => {
     const existingToken = readToken();
@@ -25283,7 +25329,14 @@ function createStatusCommand() {
   });
 }
 function createOrgListCommand() {
-  return new Command("list").description("List organizations available to your account").option("--json", "Output as JSON").action(async (options) => {
+  return new Command("list").description("List organizations available to your account").option("-o, --output <format>", "Output format: table (default), json, tsv").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli org list
+  tracecli org list --output json
+  tracecli org list --output tsv | cut -f1`
+  ).action(async (options) => {
     const organizationContext = await fetchOrganizationContext();
     const items = organizationContext.organizations.map(
       (organization) => ({
@@ -25292,10 +25345,23 @@ function createOrgListCommand() {
         selected: organization.organizationId === organizationContext.selectedOrganizationId
       })
     );
-    if (options.json) {
+    if (options.output === "json") {
       console.log(JSON.stringify(items, null, 2));
       return;
     }
+    if (options.output === "tsv") {
+      for (const item of items) {
+        console.log(
+          [
+            tsvSafe(item.name),
+            tsvSafe(item.slug),
+            tsvSafe(item.organizationId),
+            item.active ? "true" : "false"
+          ].join("	")
+        );
+      }
+      return;
+    }
     for (const item of items) {
       const marker = item.active ? "*" : " ";
       const labels = [item.active ? "active" : null, item.selected ? "selected" : null].filter(
@@ -25312,11 +25378,18 @@ function createOrgListCommand() {
   });
 }
 function createOrgCurrentCommand() {
-  return new Command("current").description("Show the active organization used by CLI commands").option("--json", "Output as JSON").action(async (options) => {
+  return new Command("current").description("Show the active organization used by CLI commands").option("-o, --output <format>", "Output format: table (default), json, tsv").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli org current
+  tracecli org current --output json
+  tracecli org current --output tsv`
+  ).action(async (options) => {
     const organizationContext = await fetchOrganizationContext();
     const active = organizationContext.activeOrganization;
     const source = organizationContext.selectedOrganizationId === active.organizationId ? "selected" : "default";
-    if (options.json) {
+    if (options.output === "json") {
       console.log(
         JSON.stringify(
           {
@@ -25329,6 +25402,17 @@ function createOrgCurrentCommand() {
       );
       return;
     }
+    if (options.output === "tsv") {
+      console.log(
+        [
+          tsvSafe(active.name),
+          tsvSafe(active.slug),
+          tsvSafe(active.organizationId),
+          tsvSafe(source)
+        ].join("	")
+      );
+      return;
+    }
     console.log(
       `Active organization: ${sanitizeForOutput(active.name)} (${sanitizeForOutput(active.slug)})`
     );
@@ -25351,10 +25435,18 @@ function createOrgSwitchCommand() {
       process.exit(1);
     }
     writeSelectedOrganizationId(match.organization.organizationId);
+    const refreshed = await refreshAfterOrganizationSwitch(
+      match.organization.workosOrganizationId
+    );
     console.log(
       `Active organization set to ${sanitizeForOutput(match.organization.name)} (${sanitizeForOutput(match.organization.slug)})`
     );
     console.log(`  Org ID: ${match.organization.organizationId}`);
+    if (!refreshed) {
+      console.warn(
+        "Token refresh for the selected organization was not completed. If repository commands fail, run `tracecli auth login` again."
+      );
+    }
   });
 }
 function createOrgCommand() {
@@ -25369,7 +25461,7 @@ function createAuthCommand() {
   auth.addCommand(createLoginCommand());
   auth.addCommand(createLogoutCommand());
   auth.addCommand(createStatusCommand());
-  auth.addCommand(createOrgCommand());
+  auth.addCommand(createOrgCommand(), { hidden: true });
   return auth;
 }
 
@@ -25755,22 +25847,10 @@ function createCompletionCommand(program3) {
   });
 }
 
-// src/format.ts
-var SEVERITY_ORDER = {
-  CRITICAL: 0,
-  HIGH: 1,
-  MEDIUM: 2,
-  LOW: 3,
-  INFORMATIONAL: 4
-};
-function formatStatus(status) {
-  return status.toLowerCase().replace("_", " ");
-}
-
 // src/pentest/commands.ts
 var DEFAULT_LIMIT = 30;
 var MAX_LIMIT = 100;
-function tsvSafe(value) {
+function tsvSafe2(value) {
   return value.replace(/[\t\n\r]/g, " ");
 }
 function formatDate(date5) {
@@ -25889,7 +25969,7 @@ Examples:
       for (const pt of pentests) {
         const cols = [
           `PT-${pt.displayId}`,
-          tsvSafe(pt.title),
+          tsvSafe2(pt.title),
           pt.status,
           pt.startedAt ? String(pt.startedAt) : "",
           pt.endedAt ? String(pt.endedAt) : "",
@@ -25972,8 +26052,8 @@ Examples:
         const cols = [
           finding.severity,
           finding.status,
-          tsvSafe(finding.category),
-          tsvSafe(finding.title),
+          tsvSafe2(finding.category),
+          tsvSafe2(finding.title),
           finding.cweIds.join(";"),
           finding.cvssScore != null ? String(finding.cvssScore) : ""
         ];
@@ -26061,6 +26141,8 @@ function extractRepoName(input) {
 }
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
 var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
+var DEFAULT_LIMIT2 = 30;
+var MAX_LIMIT2 = 100;
 var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
 var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
 function validateBranchName(branch) {
@@ -26267,6 +26349,29 @@ function filterRepositories(repositories, options) {
     return true;
   });
 }
+function parseListLimit(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1) {
+    throw new Error("--limit must be a positive integer");
+  }
+  if (n > MAX_LIMIT2) {
+    throw new Error(`--limit cannot exceed ${MAX_LIMIT2}`);
+  }
+  return n;
+}
+function printRepositoriesTsv(repositories) {
+  for (const repo of repositories) {
+    console.log(
+      [
+        tsvSafe(repo.repositoryUrl),
+        tsvSafe(repo.platform),
+        tsvSafe(repo.status),
+        tsvSafe(repo.defaultBranch),
+        tsvSafe(repo.primaryLanguage)
+      ].join("	")
+    );
+  }
+}
 function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
@@ -26291,11 +26396,16 @@ function addRepositoryFilterOptions(command) {
     "Filter by status (CONNECTED, DISCONNECTED)",
     (value) => value.toUpperCase()
   ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option(
-    "--filter <expression>",
-    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, language!:typescript",
+    "-f, --filter <expression>",
+    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED",
     collectFilterExpression,
     []
-  ).option("--json", "Output as JSON").option(
+  ).option("-o, --output <format>", "Output format: table (default), json, tsv").option(
+    "-L, --limit <n>",
+    `Maximum repositories to display (default ${DEFAULT_LIMIT2}, max ${MAX_LIMIT2})`,
+    parseListLimit,
+    DEFAULT_LIMIT2
+  ).option(
     "--dependency <pkg>",
     "Filter repositories that use a dependency (e.g. lodash, lodash@4.17.21, @types/node@20)"
   );
@@ -26334,11 +26444,17 @@ async function runRepositoryListCommand(options) {
     console.log("No repositories found.");
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(filteredRepositories, null, 2));
+  const limit = options.limit ?? DEFAULT_LIMIT2;
+  const displayedRepositories = filteredRepositories.slice(0, limit);
+  if (options.output === "json") {
+    console.log(JSON.stringify(displayedRepositories, null, 2));
+    return;
+  }
+  if (options.output === "tsv") {
+    printRepositoriesTsv(displayedRepositories);
     return;
   }
-  for (const repo of filteredRepositories) {
+  for (const repo of displayedRepositories) {
     const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
     const url2 = stripAnsi(String(repo.repositoryUrl));
     const platform = stripAnsi(String(repo.platform)).toLowerCase();
@@ -26393,11 +26509,19 @@ async function runDependencyFilter(organizationId, options) {
     console.log(`No repositories found using dependency '${label}'.`);
     return;
   }
-  if (options.json) {
-    console.log(JSON.stringify(repos, null, 2));
+  const limit = options.limit ?? DEFAULT_LIMIT2;
+  const displayedRepos = repos.slice(0, limit);
+  if (options.output === "json") {
+    console.log(JSON.stringify(displayedRepos, null, 2));
     return;
   }
-  for (const repo of repos) {
+  if (options.output === "tsv") {
+    for (const repo of displayedRepos) {
+      console.log(`${tsvSafe(repo.fullName)}	${tsvSafe(repo.versions.join(","))}`);
+    }
+    return;
+  }
+  for (const repo of displayedRepos) {
     const versions = repo.versions.join(", ");
     console.log(`${repo.fullName}  (${versions})`);
   }
@@ -26405,6 +26529,16 @@ async function runDependencyFilter(organizationId, options) {
 function createListCommand2() {
   return addRepositoryFilterOptions(
     new Command("list").description("List repositories in your organization")
+  ).addHelpText(
+    "after",
+    `
+Examples:
+  tracecli repo list
+  tracecli repo list --platform GITHUB --status CONNECTED
+  tracecli repo list --output json | jq '.[].repositoryUrl'
+  tracecli repo list --output tsv | cut -f1
+  tracecli repo list --filter "language:typescript" --limit 10
+  tracecli repo list --dependency lodash@4.17.21`
   ).action(async (options) => {
     await runRepositoryListCommand(options);
   });
@@ -26412,6 +26546,12 @@ function createListCommand2() {
 function createFilterCommand() {
   return addRepositoryFilterOptions(
     new Command("filter").description("Filter repositories in your organization")
+  ).addHelpText(
+    "after",
+    `
+Examples:
+  tracecli repo filter --filter "platform=GITHUB" --filter "status=CONNECTED"
+  tracecli repo filter --language typescript --output json`
   ).action(async (options) => {
     await runRepositoryListCommand(options);
   });
@@ -26533,8 +26673,8 @@ function createRepoCommand() {
 }
 
 // src/vulnerabilities/commands.ts
-var DEFAULT_LIMIT2 = 30;
-var MAX_LIMIT2 = 100;
+var DEFAULT_LIMIT3 = 30;
+var MAX_LIMIT3 = 100;
 async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
   const result = await authenticatedRequest(
     (client) => client.repository.listRepositories({
@@ -26643,13 +26783,13 @@ function createListCommand3() {
     (value) => value.toUpperCase()
   ).option(
     "-L, --limit <n>",
-    `Max results to return (default: ${DEFAULT_LIMIT2}, max: ${MAX_LIMIT2})`,
+    `Max results to return (default: ${DEFAULT_LIMIT3}, max: ${MAX_LIMIT3})`,
     (v) => {
       const n = Number.parseInt(v, 10);
       if (Number.isNaN(n) || n < 1) {
         throw new Error("--limit must be a positive integer");
       }
-      return Math.min(n, MAX_LIMIT2);
+      return Math.min(n, MAX_LIMIT3);
     }
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
@@ -26680,7 +26820,7 @@ Examples:
         sortBy: "severity",
         sortOrder: "desc"
       };
-      const limit = options.limit ?? DEFAULT_LIMIT2;
+      const limit = options.limit ?? DEFAULT_LIMIT3;
       const isJson = options.output === "json";
       const isTsv = options.output === "tsv";
       const collected = [];
@@ -26746,6 +26886,7 @@ program2.action(() => {
   program2.outputHelp();
 });
 program2.addCommand(createAuthCommand());
+program2.addCommand(createOrgCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createPentestCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {