securewithtrace 0.20.0 → 0.20.1

package/dist/index.js

@@ -24235,6 +24235,14 @@ var ScanTriggerTypeValues = [
 var ScanTriggerType = external_exports.enum(ScanTriggerTypeValues);
 
 // ../../packages/api-contracts/src/schemas/api/v1/scan.api.ts
+var ScanProviderValues = ["bedrock"];
+var ScanConfigurationSchema = external_exports.object({
+  /**
+   * Override the LLM provider used for this scan.
+   * Staff-only — must be enforced server-side.
+   */
+  provider: external_exports.enum(ScanProviderValues).optional()
+}).strict();
 var ScanIdParamsSchema = OrgIdParamsSchema.extend({
   scanId: external_exports.uuid()
 });
@@ -24244,7 +24252,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     webApplicationId: external_exports.uuid(),
     targetUrl: external_exports.url(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SAST"),
@@ -24252,7 +24260,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SCA"),
@@ -24260,7 +24268,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   }),
   external_exports.object({
     scanMode: external_exports.literal("SECRETS"),
@@ -24268,7 +24276,7 @@ var CreateScanRequestSchema = external_exports.discriminatedUnion("scanMode", [
     branch: external_exports.string().optional(),
     scanType: external_exports.enum(["FULL", "INCREMENTAL"]).optional(),
     userProvidedContext: external_exports.string().optional(),
-    scanConfiguration: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    scanConfiguration: ScanConfigurationSchema.optional()
   })
 ]);
 var ScanResponseSchema = external_exports.object({
@@ -26673,7 +26681,7 @@ Examples:
     const existingToken = readToken();
     if (existingToken) {
       console.log(
-        `${colorWarning("You are already logged in.")} Run \`trace auth logout\` first to re-authenticate.`
+        `${colorWarning("You are already logged in.")} Run \`tracecli auth logout\` first to re-authenticate.`
       );
       return;
     }
@@ -26771,6 +26779,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("loggedIn	expired	hasRefreshToken	userId	orgId	activeOrg");
       console.log(
         [
           String(info.loggedIn),
@@ -26840,6 +26849,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("name	slug	organizationId	active");
       for (const item of items) {
         console.log(
           [
@@ -26893,6 +26903,7 @@ Examples:
       return;
     }
     if (options.output === "tsv") {
+      console.log("name	slug	organizationId	source");
       console.log(
         [
           tsvSafe(active.name),
@@ -27353,7 +27364,15 @@ function resolveShell(shellOption) {
   return shell;
 }
 function createCompletionCommand(program3) {
-  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).action((options) => {
+  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).addHelpText(
+    "after",
+    `
+Examples:
+  tracecli completion --shell bash
+  tracecli completion --shell zsh
+  tracecli completion --shell fish
+  tracecli completion  # auto-detects shell from $SHELL`
+  ).action((options) => {
     const shell = resolveShell(options.shell);
     const script = generateCompletion(program3, shell);
     const writtenPath = writeCompletionFile(shell, script);
@@ -27457,6 +27476,10 @@ Run \`tracecli pentest list\` to see available pentests.`
 }
 function createListCommand() {
   return new Command("list").description("List pentests for your organization").option(
+    "--status <status>",
+    "Filter by status (SCOPING, IN_PROGRESS, REMEDIATION, CLOSED)",
+    (value) => value.toUpperCase()
+  ).option(
     "-L, --limit <n>",
     `Max results to return (default: ${DEFAULT_LIMIT}, max: ${MAX_LIMIT})`,
     (v) => {
@@ -27471,6 +27494,7 @@ function createListCommand() {
     `
 Examples:
   tracecli pentest list
+  tracecli pentest list --status IN_PROGRESS
   tracecli pentest list --limit 10
   tracecli pentest list --output json | jq '.[].title'
   tracecli pentest list --output tsv | cut -f1,2`
@@ -27489,8 +27513,12 @@ Examples:
       console.error(`Failed to list pentests (status ${result.status}).`);
       process.exit(1);
     }
+    let filteredPentests = result.body;
+    if (options.status) {
+      filteredPentests = filteredPentests.filter((p2) => p2.status === options.status);
+    }
     const limit = options.limit ?? DEFAULT_LIMIT;
-    const pentests = result.body.slice(0, limit);
+    const pentests = filteredPentests.slice(0, limit);
     const isJson = options.output === "json";
     const isTsv = options.output === "tsv";
     if (pentests.length === 0) {
@@ -27540,89 +27568,119 @@ Examples:
   });
 }
 function createFindingsListCommand() {
-  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option(
+    "--severity <severity>",
+    "Filter by severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL)",
+    (value) => value.toUpperCase()
+  ).option(
+    "--status <status>",
+    "Filter by status (OPEN, IN_PROGRESS, CONTESTED, REMEDIATED, VERIFIED_FIXED, VERIFIED_OPEN, DISMISSED)",
+    (value) => value.toUpperCase()
+  ).option(
+    "-L, --limit <n>",
+    `Max results to return (default: ${DEFAULT_LIMIT}, max: ${MAX_LIMIT})`,
+    (v) => {
+      const n = Number.parseInt(v, 10);
+      if (Number.isNaN(n) || n < 1) {
+        throw new Error("--limit must be a positive integer");
+      }
+      return Math.min(n, MAX_LIMIT);
+    }
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Examples:
   tracecli pentest findings list --pentest PT-3
+  tracecli pentest findings list --pentest PT-3 --severity CRITICAL
+  tracecli pentest findings list --pentest PT-3 --status OPEN --limit 20
   tracecli pentest findings list --pentest PT-3 --output json
   tracecli pentest findings list --pentest PT-3 --output tsv | cut -f1,4`
-  ).action(async (options) => {
-    const organizationId = await resolveOrganizationId();
-    const pentestId = await resolvePentestId(organizationId, options.pentest);
-    const result = await authenticatedRequest(
-      (client) => client.pentestFinding.listFindings({
-        params: { organizationId, pentestId }
-      })
-    );
-    if (result.status === 401) {
-      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
-      process.exit(1);
-    }
-    if (result.status === 404) {
-      console.error(
-        `Pentest '${options.pentest}' not found. Verify the ID with \`tracecli pentest list\`.`
+  ).action(
+    async (options) => {
+      const organizationId = await resolveOrganizationId();
+      const pentestId = await resolvePentestId(organizationId, options.pentest);
+      const result = await authenticatedRequest(
+        (client) => client.pentestFinding.listFindings({
+          params: { organizationId, pentestId }
+        })
       );
-      process.exit(1);
-    }
-    if (result.status !== 200) {
-      console.error(`Failed to list findings (status ${result.status}).`);
-      process.exit(1);
-    }
-    const findings = result.body;
-    const isJson = options.output === "json";
-    const isTsv = options.output === "tsv";
-    if (findings.length === 0) {
+      if (result.status === 401) {
+        console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+        process.exit(1);
+      }
+      if (result.status === 404) {
+        console.error(
+          `Pentest '${options.pentest}' not found. Verify the ID with \`tracecli pentest list\`.`
+        );
+        process.exit(1);
+      }
+      if (result.status !== 200) {
+        console.error(`Failed to list findings (status ${result.status}).`);
+        process.exit(1);
+      }
+      let filteredFindings = result.body;
+      if (options.severity) {
+        filteredFindings = filteredFindings.filter((f) => f.severity === options.severity);
+      }
+      if (options.status) {
+        filteredFindings = filteredFindings.filter((f) => f.status === options.status);
+      }
+      filteredFindings.sort(
+        (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
+      );
+      const limit = options.limit ?? DEFAULT_LIMIT;
+      const findings = filteredFindings.slice(0, limit);
+      const isJson = options.output === "json";
+      const isTsv = options.output === "tsv";
+      if (findings.length === 0) {
+        if (isJson) {
+          console.log("[]");
+        } else if (isTsv) {
+          console.log("severity	status	category	title	cweIds	cvssScore");
+        } else {
+          console.log("No findings found for this pentest.");
+        }
+        return;
+      }
       if (isJson) {
-        console.log("[]");
-      } else if (isTsv) {
-        console.log("severity	status	category	title	cweIds	cvssScore");
-      } else {
-        console.log("No findings found for this pentest.");
+        console.log(JSON.stringify(findings, null, 2));
+        return;
       }
-      return;
-    }
-    if (isJson) {
-      console.log(JSON.stringify(findings, null, 2));
-      return;
-    }
-    const sorted = [...findings].sort(
-      (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
-    );
-    if (isTsv) {
-      console.log("severity	status	category	title	cweIds	cvssScore");
-      for (const finding of sorted) {
-        const cols = [
-          finding.severity,
-          finding.status,
-          tsvSafe2(finding.category),
-          tsvSafe2(finding.title),
-          finding.cweIds.join(";"),
-          finding.cvssScore != null ? String(finding.cvssScore) : ""
-        ];
-        console.log(cols.join("	"));
+      if (isTsv) {
+        console.log("severity	status	category	title	cweIds	cvssScore");
+        for (const finding of findings) {
+          const cols = [
+            finding.severity,
+            finding.status,
+            tsvSafe2(finding.category),
+            tsvSafe2(finding.title),
+            finding.cweIds.join(";"),
+            finding.cvssScore != null ? String(finding.cvssScore) : ""
+          ];
+          console.log(cols.join("	"));
+        }
+        return;
       }
-      return;
-    }
-    console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
+      console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
 `);
-    for (const finding of sorted) {
-      const sev = formatFindingSeverity(finding.severity);
-      const severityLabel = colorSeverity(finding.severity, sev);
-      const status = formatStatus(finding.status);
-      const cwes = finding.cweIds.length > 0 ? ` | ${finding.cweIds.join(", ")}` : "";
-      const score = finding.cvssScore != null ? ` | CVSS ${finding.cvssScore.toFixed(1)}` : "";
-      console.log(`  [${severityLabel}] ${finding.title}`);
-      console.log(`         ${finding.category} \xB7 ${status}${cwes}${score}`);
-      if (finding.repositories.length > 0) {
-        for (const repo of finding.repositories) {
-          const location = repo.filePath ? `${repo.repositoryName} \xB7 ${repo.filePath}${repo.startLine != null ? `:${repo.startLine}` : ""}` : repo.repositoryName;
-          console.log(`         ${location}`);
+      for (const finding of findings) {
+        const sev = formatFindingSeverity(finding.severity);
+        const severityLabel = colorSeverity(finding.severity, sev);
+        const status = formatStatus(finding.status);
+        const cwes = finding.cweIds.length > 0 ? ` | ${finding.cweIds.join(", ")}` : "";
+        const score = finding.cvssScore != null ? ` | CVSS ${finding.cvssScore.toFixed(1)}` : "";
+        console.log(`  [${severityLabel}] ${finding.title}`);
+        console.log(`         ${finding.category} \xB7 ${status}${cwes}${score}`);
+        if (finding.repositories.length > 0) {
+          for (const repo of finding.repositories) {
+            const location = repo.filePath ? `${repo.repositoryName} \xB7 ${repo.filePath}${repo.startLine != null ? `:${repo.startLine}` : ""}` : repo.repositoryName;
+            console.log(`         ${location}`);
+          }
         }
+        console.log("");
       }
-      console.log("");
     }
-  });
+  );
 }
 function createFindingsCommand() {
   const findings = new Command("findings").description("Manage pentest findings");
@@ -27917,6 +27975,22 @@ function printRepositoriesTsv(repositories) {
     );
   }
 }
+function printRepositoriesTable(repositories) {
+  const headers = ["Repository URL", "Platform", "Status"];
+  const rows = repositories.map(
+    (repo) => [
+      stripAnsi(String(repo.repositoryUrl)),
+      stripAnsi(String(repo.platform)).toUpperCase(),
+      repo.status === "CONNECTED" ? "connected" : "disconnected"
+    ]
+  );
+  const colWidths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const pad = (s, w3) => s.padEnd(w3);
+  console.log(headers.map((h, i) => pad(h, colWidths[i] ?? h.length)).join("  "));
+  for (const row of rows) {
+    console.log(row.map((cell, i) => pad(cell, colWidths[i] ?? 0)).join("  "));
+  }
+}
 function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
@@ -28040,7 +28114,7 @@ function addRepositoryFilterOptions(command) {
     "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED",
     collectFilterExpression,
     []
-  ).option("-o, --output <format>", "Output format: table (default), json, tsv").option(
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option(
     "-L, --limit <n>",
     `Maximum repositories to display (default ${DEFAULT_LIMIT2}, max ${MAX_LIMIT2})`,
     parseListLimit,
@@ -28098,12 +28172,7 @@ async function runRepositoryListCommand(options) {
     printRepositoriesTsv(displayedRepositories);
     return;
   }
-  for (const repo of displayedRepositories) {
-    const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
-    const url2 = stripAnsi(String(repo.repositoryUrl));
-    const platform = stripAnsi(String(repo.platform)).toLowerCase();
-    console.log(`${url2}  (${platform}, ${status})`);
-  }
+  printRepositoriesTable(displayedRepositories);
 }
 async function runDependencyFilter(organizationId, options) {
   const dependency = options.dependency;
@@ -28164,6 +28233,7 @@ async function runDependencyFilter(organizationId, options) {
     return;
   }
   if (options.output === "tsv") {
+    console.log("repository	versions");
     for (const repo of displayedRepos) {
       console.log(`${tsvSafe(repo.fullName)}	${tsvSafe(repo.versions.join(","))}`);
     }
@@ -28517,16 +28587,87 @@ function resolveRegistryUrl() {
   if (typeof override === "string" && override.trim().length > 0) {
     return override;
   }
-  return `https://registry.npmjs.org/${encodeURIComponent(CLI_PACKAGE_NAME)}/latest`;
+  return `https://registry.npmjs.org/${encodeURIComponent(CLI_PACKAGE_NAME)}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function selectNewestVersion(versions) {
+  let newestVersion = null;
+  for (const version2 of versions) {
+    if (newestVersion === null) {
+      newestVersion = version2;
+      continue;
+    }
+    const comparison = compareSemver(version2, newestVersion);
+    if (comparison !== null && comparison > 0) {
+      newestVersion = version2;
+    }
+  }
+  return newestVersion;
+}
+function isStableSemver(version2) {
+  const parsed = parseSemver(version2);
+  return parsed !== null && parsed.prerelease.length === 0;
+}
+function extractPublishedVersions(payload) {
+  const versionsField = payload["versions"];
+  if (!isRecord(versionsField)) {
+    return [];
+  }
+  const publishedVersions = [];
+  for (const version2 of Object.keys(versionsField)) {
+    if (parseSemver(version2) !== null) {
+      publishedVersions.push(version2);
+    }
+  }
+  return publishedVersions;
+}
+function extractDistTagLatestVersion(payload) {
+  const distTags = payload["dist-tags"];
+  if (!isRecord(distTags)) {
+    return null;
+  }
+  if (typeof distTags["latest"] !== "string") {
+    return null;
+  }
+  const candidate = distTags["latest"].trim();
+  if (candidate.length === 0 || parseSemver(candidate) === null) {
+    return null;
+  }
+  return candidate;
+}
+function extractLatestEndpointVersion(payload) {
+  if (typeof payload["version"] !== "string") {
+    return null;
+  }
+  const candidate = payload["version"].trim();
+  if (candidate.length === 0 || parseSemver(candidate) === null) {
+    return null;
+  }
+  return candidate;
 }
 function extractLatestVersionFromRegistryPayload(payload) {
-  if (typeof payload !== "object" || payload === null) {
+  if (!isRecord(payload)) {
     return null;
   }
-  if ("version" in payload && typeof payload.version === "string" && payload.version.trim().length > 0) {
-    return payload.version;
+  const publishedVersions = extractPublishedVersions(payload);
+  const hasPublishedVersions = publishedVersions.length > 0;
+  const publishedVersionSet = new Set(publishedVersions);
+  const distTagLatestVersion = extractDistTagLatestVersion(payload);
+  if (distTagLatestVersion && (!hasPublishedVersions || publishedVersionSet.has(distTagLatestVersion))) {
+    return distTagLatestVersion;
   }
-  return null;
+  const latestEndpointVersion = extractLatestEndpointVersion(payload);
+  if (latestEndpointVersion && (!hasPublishedVersions || publishedVersionSet.has(latestEndpointVersion))) {
+    return latestEndpointVersion;
+  }
+  const stablePublishedVersions = publishedVersions.filter((version2) => isStableSemver(version2));
+  const newestStableVersion = selectNewestVersion(stablePublishedVersions);
+  if (newestStableVersion) {
+    return newestStableVersion;
+  }
+  return selectNewestVersion(publishedVersions);
 }
 async function fetchLatestVersionFromRegistry() {
   try {
@@ -28593,15 +28734,21 @@ async function maybeNotifyUpdateAvailable(commandName) {
     return;
   }
   noticePrinted = true;
-  console.error("");
-  console.error(
-    `A new tracecli version is available: ${availability.currentVersion} -> ${availability.latestVersion}`
-  );
-  console.error("Run `tracecli upgrade` to install the latest version.");
-  console.error("");
-}
-function resolveUpgradePlan() {
-  const packageSpec = `${CLI_PACKAGE_NAME}@latest`;
+  const lines = [
+    `A new tracecli version is available: ${availability.currentVersion} -> ${availability.latestVersion}`,
+    "Run `tracecli upgrade` to install the latest version."
+  ];
+  const maxLen = Math.max(...lines.map((l) => l.length));
+  const pad = (s) => s + " ".repeat(maxLen - s.length);
+  const top = `\u256D${"\u2500".repeat(maxLen + 2)}\u256E`;
+  const bottom = `\u2570${"\u2500".repeat(maxLen + 2)}\u256F`;
+  const boxed = [top, ...lines.map((l) => `\u2502 ${pad(l)} \u2502`), bottom].join("\n");
+  console.log("");
+  console.log(colorMuted(boxed));
+  console.log("");
+}
+function resolveUpgradePlan(targetVersion) {
+  const packageSpec = targetVersion ? `${CLI_PACKAGE_NAME}@${targetVersion}` : `${CLI_PACKAGE_NAME}@latest`;
   if (Bun.which("npm")) {
     return { command: "npm", args: ["install", "-g", packageSpec] };
   }
@@ -28665,7 +28812,7 @@ Examples:
       console.log("Upgrade cancelled.");
       return;
     }
-    const plan = resolveUpgradePlan();
+    const plan = resolveUpgradePlan(availability.latestVersion);
     if (!plan) {
       console.error(
         `No supported package manager found (npm, bun, pnpm). Install the latest version manually from https://www.npmjs.com/package/${CLI_PACKAGE_NAME}`
@@ -28899,7 +29046,7 @@ function createVulnerabilitiesCommand() {
 // src/index.ts
 var program2 = new Command();
 program2.name("tracecli").description("Trace CLI").version(CLI_VERSION);
-program2.hook("preAction", async (_thisCommand, actionCommand) => {
+program2.hook("postAction", async (_thisCommand, actionCommand) => {
   await maybeNotifyUpdateAvailable(actionCommand.name());
 });
 program2.action(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {