securewithtrace 0.19.0 → 0.20.1

package/dist/index.js

@@ -24235,6 +24235,14 @@ var ScanTriggerTypeValues = [
 var ScanTriggerType = external_exports.enum(ScanTriggerTypeValues);
 
 // ../../packages/api-contracts/src/schemas/api/v1/scan.api.ts
+var ScanProviderValues = ["bedrock"];
+var ScanConfigurationSchema = external_exports.object({
+  /**
+   * Override the LLM provider used for this scan.
+   * Staff-only — must be enforced server-side.
+   */
+  provider: external_exports.enum(ScanProviderValues).optional()
+}).strict();
 var ScanIdParamsSchema = OrgIdParamsSchema.extend({
   scanId: external_exports.uuid()
 });
@@ -24244,7 +24252,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     webApplicationId: external_exports.uuid(),
     targetUrl: external_exports.url(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SAST"),
@@ -24252,7 +24260,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SCA"),
@@ -24260,7 +24268,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SECRETS"),
@@ -24268,7 +24276,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   })
 ]);
 var ScanResponseSchema = external_exports.object({
@@ -25624,267 +25632,6 @@ function removeToken() {
   return removed;
 }
 
-// src/api-client.ts
-var readTokenSafe = readToken;
-var PRODUCTION_API_URL = "https://api.securewithtrace.com";
-var UNAUTHORIZED_STATUS = 401;
-function getApiBaseUrl() {
-  const raw = process.env["TRACE_API_URL"];
-  if (!raw) {
-    return PRODUCTION_API_URL;
-  }
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    console.error(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`);
-    return PRODUCTION_API_URL;
-  }
-  if (parsed.protocol !== "https:") {
-    console.error("Invalid TRACE_API_URL: only https:// is allowed. Using default.");
-    return PRODUCTION_API_URL;
-  }
-  const hostname3 = parsed.hostname;
-  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
-    console.error(
-      "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
-    );
-    return PRODUCTION_API_URL;
-  }
-  return raw.replace(/\/+$/, "");
-}
-function createClient(token) {
-  return initClient(v1Contract, {
-    baseUrl: getApiBaseUrl(),
-    baseHeaders: {
-      Authorization: `Bearer ${token}`
-    }
-  });
-}
-function getWorkosClientId() {
-  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
-  if (!clientId || clientId.trim().length === 0) {
-    return null;
-  }
-  return clientId;
-}
-async function refreshStoredAccessToken() {
-  const clientId = getWorkosClientId();
-  const refreshToken = readRefreshToken();
-  if (!clientId || !refreshToken) {
-    return null;
-  }
-  try {
-    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
-    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
-    writeTokens(tokenResponse.access_token, nextRefreshToken);
-    return tokenResponse.access_token;
-  } catch (error48) {
-    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
-      removeToken();
-    }
-    return null;
-  }
-}
-async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
-  const clientId = getWorkosClientId();
-  const refreshToken = readRefreshToken();
-  if (!clientId || !refreshToken) {
-    return false;
-  }
-  try {
-    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
-    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
-    writeTokens(tokenResponse.access_token, nextRefreshToken);
-    return true;
-  } catch (error48) {
-    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
-      removeToken();
-    }
-    return false;
-  }
-}
-async function authenticatedRequest(request) {
-  const token = readToken();
-  if (!token) {
-    console.error("Not logged in. Run `tracecli auth login` first.");
-    process.exit(1);
-  }
-  const firstResult = await request(createClient(token));
-  if (firstResult.status !== UNAUTHORIZED_STATUS) {
-    return firstResult;
-  }
-  const refreshedToken = await refreshStoredAccessToken();
-  if (!refreshedToken) {
-    return firstResult;
-  }
-  return request(createClient(refreshedToken));
-}
-async function authenticatedRequestSafe(request) {
-  const token = readTokenSafe();
-  if (!token) {
-    return null;
-  }
-  try {
-    const firstResult = await request(createClient(token));
-    if (firstResult.status !== UNAUTHORIZED_STATUS) {
-      return firstResult;
-    }
-    const refreshedToken = await refreshStoredAccessToken();
-    if (!refreshedToken) {
-      return firstResult;
-    }
-    return await request(createClient(refreshedToken));
-  } catch {
-    return null;
-  }
-}
-function extractOrganizationIdFromToken(token) {
-  if (!token || token.trim().length === 0) {
-    return null;
-  }
-  const parts = token.split(".");
-  const payload = parts[1];
-  if (!payload) {
-    return null;
-  }
-  try {
-    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
-    return typeof decoded.org_id === "string" && decoded.org_id.trim().length > 0 ? decoded.org_id : null;
-  } catch {
-    return null;
-  }
-}
-var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
-function determineActiveOrganization(organizations, selectedOrganizationId, tokenOrganizationId) {
-  if (organizations.length === 0) {
-    return null;
-  }
-  if (selectedOrganizationId && SAFE_ID_PATTERN.test(selectedOrganizationId)) {
-    const selectedOrganization = organizations.find(
-      (organization) => organization.organizationId === selectedOrganizationId
-    );
-    if (selectedOrganization) {
-      return {
-        organization: selectedOrganization,
-        source: "selected",
-        staleSelectionDetected: false
-      };
-    }
-  }
-  if (tokenOrganizationId && SAFE_ID_PATTERN.test(tokenOrganizationId)) {
-    const tokenOrganization = organizations.find(
-      (organization) => organization.organizationId === tokenOrganizationId
-    );
-    if (tokenOrganization) {
-      return {
-        organization: tokenOrganization,
-        source: "default",
-        staleSelectionDetected: selectedOrganizationId != null
-      };
-    }
-  }
-  const [fallbackOrganization] = organizations;
-  if (!fallbackOrganization) {
-    return null;
-  }
-  return {
-    organization: fallbackOrganization,
-    source: "default",
-    staleSelectionDetected: selectedOrganizationId != null
-  };
-}
-async function resolveOrganizationId(client) {
-  const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequest(
-    (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
-  );
-  if (result.status !== 200) {
-    console.error(`Failed to resolve organization (status ${result.status}).`);
-    process.exit(1);
-  }
-  const organizations = result.body;
-  const selectedOrganizationId = readSelectedOrganizationId();
-  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
-  const activeOrganization = determineActiveOrganization(
-    organizations,
-    selectedOrganizationId,
-    tokenOrganizationId
-  );
-  if (!activeOrganization) {
-    console.error("No organization found for your account.");
-    process.exit(1);
-  }
-  const id = activeOrganization.organization.organizationId;
-  if (!SAFE_ID_PATTERN.test(id)) {
-    console.error("Invalid organization ID received from API.");
-    process.exit(1);
-  }
-  if (activeOrganization.staleSelectionDetected) {
-    removeSelectedOrganizationId();
-    writeSelectedOrganizationId(id);
-    if (selectedOrganizationId) {
-      console.warn(
-        `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
-      );
-    }
-  } else if (activeOrganization.source === "default") {
-    writeSelectedOrganizationId(id);
-  }
-  return id;
-}
-async function resolveOrganizationIdSafe(client) {
-  try {
-    const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequestSafe(
-      (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
-    );
-    if (!result) {
-      return null;
-    }
-    if (result.status !== 200) {
-      return null;
-    }
-    const organizations = result.body;
-    const selectedOrganizationId = readSelectedOrganizationId();
-    const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
-    const activeOrganization = determineActiveOrganization(
-      organizations,
-      selectedOrganizationId,
-      tokenOrganizationId
-    );
-    if (!activeOrganization) {
-      return null;
-    }
-    const id = activeOrganization.organization.organizationId;
-    if (!SAFE_ID_PATTERN.test(id)) {
-      return null;
-    }
-    if (activeOrganization.staleSelectionDetected) {
-      removeSelectedOrganizationId();
-      writeSelectedOrganizationId(id);
-    } else if (activeOrganization.source === "default") {
-      writeSelectedOrganizationId(id);
-    }
-    return id;
-  } catch {
-    return null;
-  }
-}
-
-// src/format.ts
-var SEVERITY_ORDER = {
-  CRITICAL: 0,
-  HIGH: 1,
-  MEDIUM: 2,
-  LOW: 3,
-  INFORMATIONAL: 4
-};
-function formatStatus(status) {
-  return status.toLowerCase().replace("_", " ");
-}
-function tsvSafe(value) {
-  return (value ?? "").replace(/[\t\r\n]/g, " ");
-}
-
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
 var wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
@@ -26362,61 +26109,331 @@ var applyStyle = (self, string4) => {
   if (styler === void 0) {
     return string4;
   }
-  const { openAll, closeAll } = styler;
-  if (string4.includes("\x1B")) {
-    while (styler !== void 0) {
-      string4 = stringReplaceAll(string4, styler.close, styler.open);
-      styler = styler.parent;
-    }
+  const { openAll, closeAll } = styler;
+  if (string4.includes("\x1B")) {
+    while (styler !== void 0) {
+      string4 = stringReplaceAll(string4, styler.close, styler.open);
+      styler = styler.parent;
+    }
+  }
+  const lfIndex = string4.indexOf("\n");
+  if (lfIndex !== -1) {
+    string4 = stringEncaseCRLFWithFirstIndex(string4, closeAll, openAll, lfIndex);
+  }
+  return openAll + string4 + closeAll;
+};
+Object.defineProperties(createChalk.prototype, styles2);
+var chalk = createChalk();
+var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
+var source_default = chalk;
+
+// src/theme.ts
+function colorSeverity(severity, text, colorizer = source_default) {
+  switch (severity) {
+    case "CRITICAL":
+      return colorizer.red.bold(text);
+    case "HIGH":
+      return colorizer.hex("#ff6b00").bold(text);
+    case "MEDIUM":
+      return colorizer.yellow(text);
+    case "LOW":
+      return colorizer.cyan(text);
+    case "INFORMATIONAL":
+      return colorizer.gray(text);
+    default:
+      return text;
+  }
+}
+function colorBanner(text, colorizer = source_default) {
+  return colorizer.cyan.bold(text);
+}
+function colorMuted(text, colorizer = source_default) {
+  return colorizer.dim(text);
+}
+function colorSuccess(text, colorizer = source_default) {
+  return colorizer.green(text);
+}
+function colorError(text, colorizer = source_default) {
+  return colorizer.red(text);
+}
+function colorWarningPrefix(text, colorizer = source_default) {
+  return `${colorizer.yellow.bold("Warning:")} ${text}`;
+}
+function colorWarning(text, colorizer = source_default) {
+  return colorizer.yellow(text);
+}
+function colorAccentBold(text, colorizer = source_default) {
+  return colorizer.bold.cyan(text);
+}
+function colorAccentUnderline(text, colorizer = source_default) {
+  return colorizer.underline.cyan(text);
+}
+
+// src/api-client.ts
+var readTokenSafe = readToken;
+var PRODUCTION_API_URL = "https://api.securewithtrace.com";
+var UNAUTHORIZED_STATUS = 401;
+function getApiBaseUrl() {
+  const raw = process.env["TRACE_API_URL"];
+  if (!raw) {
+    return PRODUCTION_API_URL;
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(
+      colorWarning(`Invalid TRACE_API_URL: '${raw}' is not a valid URL. Using default.`)
+    );
+    return PRODUCTION_API_URL;
+  }
+  if (parsed.protocol !== "https:") {
+    console.error(colorWarning("Invalid TRACE_API_URL: only https:// is allowed. Using default."));
+    return PRODUCTION_API_URL;
+  }
+  const hostname3 = parsed.hostname;
+  if (hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "0.0.0.0" || hostname3 === "::1" || hostname3.startsWith("10.") || hostname3.startsWith("192.168.") || /^172\.(1[6-9]|2[0-9]|3[01])\./.test(hostname3)) {
+    console.error(
+      colorWarning(
+        "Invalid TRACE_API_URL: private/reserved hostnames are not allowed. Using default."
+      )
+    );
+    return PRODUCTION_API_URL;
+  }
+  return raw.replace(/\/+$/, "");
+}
+function createClient(token) {
+  return initClient(v1Contract, {
+    baseUrl: getApiBaseUrl(),
+    baseHeaders: {
+      Authorization: `Bearer ${token}`
+    }
+  });
+}
+function getWorkosClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (!clientId || clientId.trim().length === 0) {
+    return null;
+  }
+  return clientId;
+}
+async function refreshStoredAccessToken() {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return null;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return tokenResponse.access_token;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return null;
+  }
+}
+async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return false;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return true;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return false;
+  }
+}
+async function authenticatedRequest(request) {
+  const token = readToken();
+  if (!token) {
+    console.error(colorError("Not logged in. Run `tracecli auth login` first."));
+    process.exit(1);
+  }
+  const firstResult = await request(createClient(token));
+  if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    return firstResult;
+  }
+  const refreshedToken = await refreshStoredAccessToken();
+  if (!refreshedToken) {
+    return firstResult;
+  }
+  return request(createClient(refreshedToken));
+}
+async function authenticatedRequestSafe(request) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const firstResult = await request(createClient(token));
+    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+      return firstResult;
+    }
+    const refreshedToken = await refreshStoredAccessToken();
+    if (!refreshedToken) {
+      return firstResult;
+    }
+    return await request(createClient(refreshedToken));
+  } catch {
+    return null;
+  }
+}
+function extractOrganizationIdFromToken(token) {
+  if (!token || token.trim().length === 0) {
+    return null;
+  }
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (!payload) {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    return typeof decoded.org_id === "string" && decoded.org_id.trim().length > 0 ? decoded.org_id : null;
+  } catch {
+    return null;
+  }
+}
+var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+function determineActiveOrganization(organizations, selectedOrganizationId, tokenOrganizationId) {
+  if (organizations.length === 0) {
+    return null;
+  }
+  if (selectedOrganizationId && SAFE_ID_PATTERN.test(selectedOrganizationId)) {
+    const selectedOrganization = organizations.find(
+      (organization) => organization.organizationId === selectedOrganizationId
+    );
+    if (selectedOrganization) {
+      return {
+        organization: selectedOrganization,
+        source: "selected",
+        staleSelectionDetected: false
+      };
+    }
+  }
+  if (tokenOrganizationId && SAFE_ID_PATTERN.test(tokenOrganizationId)) {
+    const tokenOrganization = organizations.find(
+      (organization) => organization.organizationId === tokenOrganizationId
+    );
+    if (tokenOrganization) {
+      return {
+        organization: tokenOrganization,
+        source: "default",
+        staleSelectionDetected: selectedOrganizationId != null
+      };
+    }
+  }
+  const [fallbackOrganization] = organizations;
+  if (!fallbackOrganization) {
+    return null;
+  }
+  return {
+    organization: fallbackOrganization,
+    source: "default",
+    staleSelectionDetected: selectedOrganizationId != null
+  };
+}
+async function resolveOrganizationId(client) {
+  const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
+  );
+  if (result.status !== 200) {
+    console.error(colorError(`Failed to resolve organization (status ${result.status}).`));
+    process.exit(1);
+  }
+  const organizations = result.body;
+  const selectedOrganizationId = readSelectedOrganizationId();
+  const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+  const activeOrganization = determineActiveOrganization(
+    organizations,
+    selectedOrganizationId,
+    tokenOrganizationId
+  );
+  if (!activeOrganization) {
+    console.error(colorError("No organization found for your account."));
+    process.exit(1);
   }
-  const lfIndex = string4.indexOf("\n");
-  if (lfIndex !== -1) {
-    string4 = stringEncaseCRLFWithFirstIndex(string4, closeAll, openAll, lfIndex);
+  const id = activeOrganization.organization.organizationId;
+  if (!SAFE_ID_PATTERN.test(id)) {
+    console.error(colorError("Invalid organization ID received from API."));
+    process.exit(1);
   }
-  return openAll + string4 + closeAll;
-};
-Object.defineProperties(createChalk.prototype, styles2);
-var chalk = createChalk();
-var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
-var source_default = chalk;
-
-// src/theme.ts
-function colorSeverity(severity, text, colorizer = source_default) {
-  switch (severity) {
-    case "CRITICAL":
-      return colorizer.red.bold(text);
-    case "HIGH":
-      return colorizer.hex("#ff6b00").bold(text);
-    case "MEDIUM":
-      return colorizer.yellow(text);
-    case "LOW":
-      return colorizer.cyan(text);
-    case "INFORMATIONAL":
-      return colorizer.gray(text);
-    default:
-      return text;
+  if (activeOrganization.staleSelectionDetected) {
+    removeSelectedOrganizationId();
+    writeSelectedOrganizationId(id);
+    if (selectedOrganizationId) {
+      console.warn(
+        colorWarning(
+          `Stored organization '${selectedOrganizationId}' is unavailable. Using '${activeOrganization.organization.name}' (${id}) instead.`
+        )
+      );
+    }
+  } else if (activeOrganization.source === "default") {
+    writeSelectedOrganizationId(id);
   }
+  return id;
 }
-function colorBanner(text, colorizer = source_default) {
-  return colorizer.cyan.bold(text);
-}
-function colorMuted(text, colorizer = source_default) {
-  return colorizer.dim(text);
-}
-function colorSuccess(text, colorizer = source_default) {
-  return colorizer.green(text);
-}
-function colorError(text, colorizer = source_default) {
-  return colorizer.red(text);
-}
-function colorWarning(text, colorizer = source_default) {
-  return colorizer.yellow(text);
+async function resolveOrganizationIdSafe(client) {
+  try {
+    const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
+    );
+    if (!result) {
+      return null;
+    }
+    if (result.status !== 200) {
+      return null;
+    }
+    const organizations = result.body;
+    const selectedOrganizationId = readSelectedOrganizationId();
+    const tokenOrganizationId = extractOrganizationIdFromToken(readToken());
+    const activeOrganization = determineActiveOrganization(
+      organizations,
+      selectedOrganizationId,
+      tokenOrganizationId
+    );
+    if (!activeOrganization) {
+      return null;
+    }
+    const id = activeOrganization.organization.organizationId;
+    if (!SAFE_ID_PATTERN.test(id)) {
+      return null;
+    }
+    if (activeOrganization.staleSelectionDetected) {
+      removeSelectedOrganizationId();
+      writeSelectedOrganizationId(id);
+    } else if (activeOrganization.source === "default") {
+      writeSelectedOrganizationId(id);
+    }
+    return id;
+  } catch {
+    return null;
+  }
 }
-function colorAccentBold(text, colorizer = source_default) {
-  return colorizer.bold.cyan(text);
+
+// src/format.ts
+var SEVERITY_ORDER = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3,
+  INFORMATIONAL: 4
+};
+function formatStatus(status) {
+  return status.toLowerCase().replace("_", " ");
 }
-function colorAccentUnderline(text, colorizer = source_default) {
-  return colorizer.underline.cyan(text);
+function tsvSafe(value) {
+  return (value ?? "").replace(/[\t\r\n]/g, " ");
 }
 
 // src/auth/commands.ts
@@ -26664,7 +26681,7 @@ Examples:
     const existingToken = readToken();
     if (existingToken) {
       console.log(
-        `${colorWarning("You are already logged in.")} Run \`trace auth logout\` first to re-authenticate.`
+        `${colorWarning("You are already logged in.")} Run \`tracecli auth logout\` first to re-authenticate.`
       );
       return;
     }
@@ -26762,6 +26779,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("loggedIn	expired	hasRefreshToken	userId	orgId	activeOrg");
       console.log(
         [
           String(info.loggedIn),
@@ -26831,6 +26849,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("name	slug	organizationId	active");
       for (const item of items) {
         console.log(
           [
@@ -26884,6 +26903,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("name	slug	organizationId	source");
       console.log(
         [
           tsvSafe(active.name),
@@ -27344,7 +27364,15 @@ function resolveShell(shellOption) {
   return shell;
 }
 function createCompletionCommand(program3) {
-  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).action((options) => {
+  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).addHelpText(
+    "after",
+    `
+Examples:
+  tracecli completion --shell bash
+  tracecli completion --shell zsh
+  tracecli completion --shell fish
+  tracecli completion  # auto-detects shell from $SHELL`
+  ).action((options) => {
     const shell = resolveShell(options.shell);
     const script = generateCompletion(program3, shell);
     const writtenPath = writeCompletionFile(shell, script);
@@ -27448,6 +27476,10 @@ Run \`tracecli pentest list\` to see available pentests.`
 }
 function createListCommand() {
   return new Command("list").description("List pentests for your organization").option(
+    "--status <status>",
+    "Filter by status (SCOPING, IN_PROGRESS, REMEDIATION, CLOSED)",
+    (value) => value.toUpperCase()
+  ).option(
     "-L, --limit <n>",
     `Max results to return (default: ${DEFAULT_LIMIT}, max: ${MAX_LIMIT})`,
     (v) => {
@@ -27462,6 +27494,7 @@ function createListCommand() {
     `
 Examples:
   tracecli pentest list
+  tracecli pentest list --status IN_PROGRESS
   tracecli pentest list --limit 10
   tracecli pentest list --output json | jq '.[].title'
   tracecli pentest list --output tsv | cut -f1,2`
@@ -27480,8 +27513,12 @@ Examples:
       console.error(`Failed to list pentests (status ${result.status}).`);
       process.exit(1);
     }
+    let filteredPentests = result.body;
+    if (options.status) {
+      filteredPentests = filteredPentests.filter((p2) => p2.status === options.status);
+    }
     const limit = options.limit ?? DEFAULT_LIMIT;
-    const pentests = result.body.slice(0, limit);
+    const pentests = filteredPentests.slice(0, limit);
     const isJson = options.output === "json";
     const isTsv = options.output === "tsv";
     if (pentests.length === 0) {
@@ -27531,89 +27568,119 @@ Examples:
   });
 }
 function createFindingsListCommand() {
-  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option(
+    "--severity <severity>",
+    "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL)",
+    (value) => value.toUpperCase()
+  ).option(
+    "--status <status>",
+    "Filter by status (OPEN, IN_PROGRESS, CONTESTED, REMEDIATED, VERIFIED_FIXED, VERIFIED_OPEN, DISMISSED)",
+    (value) => value.toUpperCase()
+  ).option(
+    "-L, --limit <n>",
+    `Max results to return (default: ${DEFAULT_LIMIT}, max: ${MAX_LIMIT})`,
+    (v) => {
+      const n = Number.parseInt(v, 10);
+      if (Number.isNaN(n) || n < 1) {
+        throw new Error("--limit must be a positive integer");
+      }
+      return Math.min(n, MAX_LIMIT);
+    }
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Examples:
   tracecli pentest findings list --pentest PT-3
+  tracecli pentest findings list --pentest PT-3 --severity CRITICAL
+  tracecli pentest findings list --pentest PT-3 --status OPEN --limit 20
   tracecli pentest findings list --pentest PT-3 --output json
   tracecli pentest findings list --pentest PT-3 --output tsv | cut -f1,4`
-  ).action(async (options) => {
-    const organizationId = await resolveOrganizationId();
-    const pentestId = await resolvePentestId(organizationId, options.pentest);
-    const result = await authenticatedRequest(
-      (client) => client.pentestFinding.listFindings({
-        params: { organizationId, pentestId }
-      })
-    );
-    if (result.status === 401) {
-      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
-      process.exit(1);
-    }
-    if (result.status === 404) {
-      console.error(
-        `Pentest '${options.pentest}' not found. Verify the ID with \`tracecli pentest list\`.`
+  ).action(
+    async (options) => {
+      const organizationId = await resolveOrganizationId();
+      const pentestId = await resolvePentestId(organizationId, options.pentest);
+      const result = await authenticatedRequest(
+        (client) => client.pentestFinding.listFindings({
+          params: { organizationId, pentestId }
+        })
       );
-      process.exit(1);
-    }
-    if (result.status !== 200) {
-      console.error(`Failed to list findings (status ${result.status}).`);
-      process.exit(1);
-    }
-    const findings = result.body;
-    const isJson = options.output === "json";
-    const isTsv = options.output === "tsv";
-    if (findings.length === 0) {
+      if (result.status === 401) {
+        console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+        process.exit(1);
+      }
+      if (result.status === 404) {
+        console.error(
+          `Pentest '${options.pentest}' not found. Verify the ID with \`tracecli pentest list\`.`
+        );
+        process.exit(1);
+      }
+      if (result.status !== 200) {
+        console.error(`Failed to list findings (status ${result.status}).`);
+        process.exit(1);
+      }
+      let filteredFindings = result.body;
+      if (options.severity) {
+        filteredFindings = filteredFindings.filter((f) => f.severity === options.severity);
+      }
+      if (options.status) {
+        filteredFindings = filteredFindings.filter((f) => f.status === options.status);
+      }
+      filteredFindings.sort(
+        (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
+      );
+      const limit = options.limit ?? DEFAULT_LIMIT;
+      const findings = filteredFindings.slice(0, limit);
+      const isJson = options.output === "json";
+      const isTsv = options.output === "tsv";
+      if (findings.length === 0) {
+        if (isJson) {
+          console.log("[]");
+        } else if (isTsv) {
+          console.log("severity	status	category	title	cweIds	cvssScore");
+        } else {
+          console.log("No findings found for this pentest.");
+        }
+        return;
+      }
       if (isJson) {
-        console.log("[]");
-      } else if (isTsv) {
-        console.log("severity	status	category	title	cweIds	cvssScore");
-      } else {
-        console.log("No findings found for this pentest.");
+        console.log(JSON.stringify(findings, null, 2));
+        return;
       }
-      return;
-    }
-    if (isJson) {
-      console.log(JSON.stringify(findings, null, 2));
-      return;
-    }
-    const sorted = [...findings].sort(
-      (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
-    );
-    if (isTsv) {
-      console.log("severity	status	category	title	cweIds	cvssScore");
-      for (const finding of sorted) {
-        const cols = [
-          finding.severity,
-          finding.status,
-          tsvSafe2(finding.category),
-          tsvSafe2(finding.title),
-          finding.cweIds.join(";"),
-          finding.cvssScore != null ? String(finding.cvssScore) : ""
-        ];
-        console.log(cols.join("	"));
+      if (isTsv) {
+        console.log("severity	status	category	title	cweIds	cvssScore");
+        for (const finding of findings) {
+          const cols = [
+            finding.severity,
+            finding.status,
+            tsvSafe2(finding.category),
+            tsvSafe2(finding.title),
+            finding.cweIds.join(";"),
+            finding.cvssScore != null ? String(finding.cvssScore) : ""
+          ];
+          console.log(cols.join("	"));
+        }
+        return;
       }
-      return;
-    }
-    console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
+      console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
 `);
-    for (const finding of sorted) {
-      const sev = formatFindingSeverity(finding.severity);
-      const severityLabel = colorSeverity(finding.severity, sev);
-      const status = formatStatus(finding.status);
-      const cwes = finding.cweIds.length > 0 ? ` | ${finding.cweIds.join(", ")}` : "";
-      const score = finding.cvssScore != null ? ` | CVSS ${finding.cvssScore.toFixed(1)}` : "";
-      console.log(`  [${severityLabel}] ${finding.title}`);
-      console.log(`         ${finding.category} \xB7 ${status}${cwes}${score}`);
-      if (finding.repositories.length > 0) {
-        for (const repo of finding.repositories) {
-          const location = repo.filePath ? `${repo.repositoryName} \xB7 ${repo.filePath}${repo.startLine != null ? `:${repo.startLine}` : ""}` : repo.repositoryName;
-          console.log(`         ${location}`);
+      for (const finding of findings) {
+        const sev = formatFindingSeverity(finding.severity);
+        const severityLabel = colorSeverity(finding.severity, sev);
+        const status = formatStatus(finding.status);
+        const cwes = finding.cweIds.length > 0 ? ` | ${finding.cweIds.join(", ")}` : "";
+        const score = finding.cvssScore != null ? ` | CVSS ${finding.cvssScore.toFixed(1)}` : "";
+        console.log(`  [${severityLabel}] ${finding.title}`);
+        console.log(`         ${finding.category} \xB7 ${status}${cwes}${score}`);
+        if (finding.repositories.length > 0) {
+          for (const repo of finding.repositories) {
+            const location = repo.filePath ? `${repo.repositoryName} \xB7 ${repo.filePath}${repo.startLine != null ? `:${repo.startLine}` : ""}` : repo.repositoryName;
+            console.log(`         ${location}`);
+          }
         }
+        console.log("");
       }
-      console.log("");
     }
-  });
+  );
 }
 function createFindingsCommand() {
   const findings = new Command("findings").description("Manage pentest findings");
@@ -27908,6 +27975,22 @@ function printRepositoriesTsv(repositories) {
     );
   }
 }
+function printRepositoriesTable(repositories) {
+  const headers = ["Repository URL", "Platform", "Status"];
+  const rows = repositories.map(
+    (repo) => [
+      stripAnsi(String(repo.repositoryUrl)),
+      stripAnsi(String(repo.platform)).toUpperCase(),
+      repo.status === "CONNECTED" ? "connected" : "disconnected"
+    ]
+  );
+  const colWidths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const pad = (s, w3) => s.padEnd(w3);
+  console.log(headers.map((h, i) => pad(h, colWidths[i] ?? h.length)).join("  "));
+  for (const row of rows) {
+    console.log(row.map((cell, i) => pad(cell, colWidths[i] ?? 0)).join("  "));
+  }
+}
 function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
@@ -28031,7 +28114,7 @@ function addRepositoryFilterOptions(command) {
     "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED",
     collectFilterExpression,
     []
-  ).option("-o, --output <format>", "Output format: table (default), json, tsv").option(
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
     "-L, --limit <n>",
     `Maximum repositories to display (default ${DEFAULT_LIMIT2}, max ${MAX_LIMIT2})`,
     parseListLimit,
@@ -28089,12 +28172,7 @@ async function runRepositoryListCommand(options) {
     printRepositoriesTsv(displayedRepositories);
     return;
   }
-  for (const repo of displayedRepositories) {
-    const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
-    const url2 = stripAnsi(String(repo.repositoryUrl));
-    const platform = stripAnsi(String(repo.platform)).toLowerCase();
-    console.log(`${url2}  (${platform}, ${status})`);
-  }
+  printRepositoriesTable(displayedRepositories);
 }
 async function runDependencyFilter(organizationId, options) {
   const dependency = options.dependency;
@@ -28155,6 +28233,7 @@ async function runDependencyFilter(organizationId, options) {
     return;
   }
   if (options.output === "tsv") {
+    console.log("repository	versions");
     for (const repo of displayedRepos) {
       console.log(`${tsvSafe(repo.fullName)}	${tsvSafe(repo.versions.join(","))}`);
     }
@@ -28304,7 +28383,7 @@ Examples:
         installationToken = cloneTokenResult.token;
         cloneTokenFailure = cloneTokenResult.failure;
         if (cloneTokenFailure) {
-          console.warn(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure));
+          console.warn(colorWarning(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure)));
         }
       }
       const effectiveUrl = installationToken ? urlWithUsername(cloneUrl) : cloneUrl;
@@ -28336,7 +28415,9 @@ Examples:
         if (exitCode !== 0) {
           if (!installationToken && cloneTokenFailure) {
             console.error(
-              "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+              colorError(
+                "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+              )
             );
           }
           process.exit(1);
@@ -28350,11 +28431,13 @@ Examples:
           const resetExitCode = await resetProc.exited;
           if (resetExitCode !== 0) {
             console.error(
-              "Warning: failed to reset remote URL \u2014 the token username may persist in .git/config"
+              colorWarningPrefix(
+                "failed to reset remote URL \u2014 the token username may persist in .git/config"
+              )
             );
           }
         }
-        console.log(`Repository cloned into ${targetDir}`);
+        console.log(colorSuccess(`Repository cloned into ${targetDir}`));
       } finally {
         if (askPassScript) {
           rmSync2(askPassScript.replace(/\/[^/]+$/, ""), { recursive: true, force: true });
@@ -28504,16 +28587,87 @@ function resolveRegistryUrl() {
   if (typeof override === "string" && override.trim().length > 0) {
     return override;
   }
-  return `https://registry.npmjs.org/${encodeURIComponent(CLI_PACKAGE_NAME)}/latest`;
+  return `https://registry.npmjs.org/${encodeURIComponent(CLI_PACKAGE_NAME)}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function selectNewestVersion(versions) {
+  let newestVersion = null;
+  for (const version2 of versions) {
+    if (newestVersion === null) {
+      newestVersion = version2;
+      continue;
+    }
+    const comparison = compareSemver(version2, newestVersion);
+    if (comparison !== null && comparison > 0) {
+      newestVersion = version2;
+    }
+  }
+  return newestVersion;
+}
+function isStableSemver(version2) {
+  const parsed = parseSemver(version2);
+  return parsed !== null && parsed.prerelease.length === 0;
+}
+function extractPublishedVersions(payload) {
+  const versionsField = payload["versions"];
+  if (!isRecord(versionsField)) {
+    return [];
+  }
+  const publishedVersions = [];
+  for (const version2 of Object.keys(versionsField)) {
+    if (parseSemver(version2) !== null) {
+      publishedVersions.push(version2);
+    }
+  }
+  return publishedVersions;
+}
+function extractDistTagLatestVersion(payload) {
+  const distTags = payload["dist-tags"];
+  if (!isRecord(distTags)) {
+    return null;
+  }
+  if (typeof distTags["latest"] !== "string") {
+    return null;
+  }
+  const candidate = distTags["latest"].trim();
+  if (candidate.length === 0 || parseSemver(candidate) === null) {
+    return null;
+  }
+  return candidate;
+}
+function extractLatestEndpointVersion(payload) {
+  if (typeof payload["version"] !== "string") {
+    return null;
+  }
+  const candidate = payload["version"].trim();
+  if (candidate.length === 0 || parseSemver(candidate) === null) {
+    return null;
+  }
+  return candidate;
 }
 function extractLatestVersionFromRegistryPayload(payload) {
-  if (typeof payload !== "object" || payload === null) {
+  if (!isRecord(payload)) {
     return null;
   }
-  if ("version" in payload && typeof payload.version === "string" && payload.version.trim().length > 0) {
-    return payload.version;
+  const publishedVersions = extractPublishedVersions(payload);
+  const hasPublishedVersions = publishedVersions.length > 0;
+  const publishedVersionSet = new Set(publishedVersions);
+  const distTagLatestVersion = extractDistTagLatestVersion(payload);
+  if (distTagLatestVersion && (!hasPublishedVersions || publishedVersionSet.has(distTagLatestVersion))) {
+    return distTagLatestVersion;
   }
-  return null;
+  const latestEndpointVersion = extractLatestEndpointVersion(payload);
+  if (latestEndpointVersion && (!hasPublishedVersions || publishedVersionSet.has(latestEndpointVersion))) {
+    return latestEndpointVersion;
+  }
+  const stablePublishedVersions = publishedVersions.filter((version2) => isStableSemver(version2));
+  const newestStableVersion = selectNewestVersion(stablePublishedVersions);
+  if (newestStableVersion) {
+    return newestStableVersion;
+  }
+  return selectNewestVersion(publishedVersions);
 }
 async function fetchLatestVersionFromRegistry() {
   try {
@@ -28580,15 +28734,21 @@ async function maybeNotifyUpdateAvailable(commandName) {
     return;
   }
   noticePrinted = true;
-  console.error("");
-  console.error(
-    `A new tracecli version is available: ${availability.currentVersion} -> ${availability.latestVersion}`
-  );
-  console.error("Run `tracecli upgrade` to install the latest version.");
-  console.error("");
-}
-function resolveUpgradePlan() {
-  const packageSpec = `${CLI_PACKAGE_NAME}@latest`;
+  const lines = [
+    `A new tracecli version is available: ${availability.currentVersion} -> ${availability.latestVersion}`,
+    "Run `tracecli upgrade` to install the latest version."
+  ];
+  const maxLen = Math.max(...lines.map((l) => l.length));
+  const pad = (s) => s + " ".repeat(maxLen - s.length);
+  const top = `\u256D${"\u2500".repeat(maxLen + 2)}\u256E`;
+  const bottom = `\u2570${"\u2500".repeat(maxLen + 2)}\u256F`;
+  const boxed = [top, ...lines.map((l) => `\u2502 ${pad(l)} \u2502`), bottom].join("\n");
+  console.log("");
+  console.log(colorMuted(boxed));
+  console.log("");
+}
+function resolveUpgradePlan(targetVersion) {
+  const packageSpec = targetVersion ? `${CLI_PACKAGE_NAME}@${targetVersion}` : `${CLI_PACKAGE_NAME}@latest`;
   if (Bun.which("npm")) {
     return { command: "npm", args: ["install", "-g", packageSpec] };
   }
@@ -28652,7 +28812,7 @@ Examples:
       console.log("Upgrade cancelled.");
       return;
     }
-    const plan = resolveUpgradePlan();
+    const plan = resolveUpgradePlan(availability.latestVersion);
     if (!plan) {
       console.error(
         `No supported package manager found (npm, bun, pnpm). Install the latest version manually from https://www.npmjs.com/package/${CLI_PACKAGE_NAME}`
@@ -28886,7 +29046,7 @@ function createVulnerabilitiesCommand() {
 // src/index.ts
 var program2 = new Command();
 program2.name("tracecli").description("Trace CLI").version(CLI_VERSION);
-program2.hook("preAction", async (_thisCommand, actionCommand) => {
+program2.hook("postAction", async (_thisCommand, actionCommand) => {
   await maybeNotifyUpdateAvailable(actionCommand.name());
 });
 program2.action(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.19.0",
+  "version": "0.20.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {