securewithtrace 0.21.7 → 0.23.0

package/README.md

@@ -66,7 +66,8 @@ tracecli vulnerabilities list --severity HIGH
 ```bash
 tracecli auth login
 tracecli auth status
-tracecli auth logout
+tracecli auth logout           # prompts for confirmation interactively
+tracecli auth logout --no-confirm  # skip prompt (for CI/scripts)
 ```
 
 ### Organization context
@@ -86,14 +87,23 @@ When your account belongs to multiple organizations, use `tracecli org switch` t
 # List org repositories known to Trace
 tracecli repo list
 
+# Show the next page of repositories
+tracecli repo list --page 2 --limit 30
+
+# Show all matching repositories
+tracecli repo list --all
+
 # List only connected GitHub repositories that match "trace"
 tracecli repo list --platform GITHUB --status CONNECTED --query trace
 
 # Advanced filtering syntax (repeatable)
 tracecli repo list --filter "platform=GITHUB" --filter "repo:trace" --filter "status!=DISCONNECTED"
 
-# Alias command for filtering
+# Alias command for filtering (all repo list flags are supported)
 tracecli repo filter --filter "language:typescript" --filter "branch=main"
+tracecli repo filter --language typescript --limit 10
+tracecli repo filter --output json | jq '.[].repositoryUrl'
+tracecli repo filter --output tsv | cut -f1
 
 # Find repositories that use a specific dependency
 tracecli repo list --dependency lodash
@@ -105,7 +115,7 @@ tracecli repo list --dependency lodash@4.17.21
 tracecli repo list --dependency @types/node@20
 
 # Dependency results as JSON
-tracecli repo list --dependency react --json | jq '.[].fullName'
+tracecli repo list --dependency react --output json | jq '.[].fullName'
 
 # Clone by owner/repo shorthand
 tracecli repo clone securewithtrace/trace
@@ -117,6 +127,16 @@ tracecli repo clone securewithtrace/trace --branch main --depth 1
 ### Vulnerabilities
 
 ```bash
+# Fetch a single vulnerability by display ID, numeric ID, or UUID
+tracecli vulnerabilities get TRACE-123
+
+# Open the vulnerability detail page in a browser
+tracecli vulnerabilities get TRACE-123 --web
+
+# JSON or TSV output for scripting
+tracecli vulnerabilities get TRACE-123 --output json
+tracecli vulnerabilities get TRACE-123 --output tsv | cut -f1,10
+
 # List vulnerabilities across your organization (default: 30 results)
 tracecli vulnerabilities list
 
@@ -173,6 +193,8 @@ Repository filter options:
   - Supported fields: `platform`, `status`, `url`, `repo`, `branch`, `language`
   - Supported operators: `=` (exact), `!=` (not exact), `:` (contains), `!:` (not contains)
 - `--dependency`: filter by dependency name with optional `@version` (e.g. `lodash`, `lodash@4.17`, `@types/node@20`)
+- `--page`: choose which page of results to display when using `--limit` (default: 1)
+- `--all`: display all matching repositories (disables pagination)
 
 ### Pentests
 
@@ -198,7 +220,7 @@ tracecli pentest findings list --pentest PT-3 --output json
 # Findings as TSV
 tracecli pentest findings list --pentest PT-3 --output tsv | cut -f1,4
 
-# Open pentests dashboard in browser
+# Open the pentest detail page in a browser
 tracecli pentest findings list --pentest PT-3 --web
 ```
 
@@ -216,7 +238,7 @@ Flags for `pentest findings list`:
 |------|-----------|-------------|
 | `--pentest <id>` | | Pentest display ID (e.g. `PT-3`) or UUID (required) |
 | `--output <format>` | `-o` | Output format: `table` (default), `json`, `tsv` |
-| `--web` | `-w` | Open pentests dashboard in browser |
+| `--web` | `-w` | Open the pentest detail page in a browser |
 
 ### Upgrades
 

package/dist/index.js

@@ -24600,6 +24600,15 @@ var ScanMode2 = external_exports.enum(ScanModeValues2);
 var VulnerabilityIdParamsSchema = OrgIdParamsSchema.extend({
   vulnerabilityId: external_exports.uuid()
 });
+var VulnerabilityLookupIdSchema = external_exports.union([
+  external_exports.uuid(),
+  external_exports.string().regex(/^(?:TRACE-)?0*[1-9]\d*$/i, {
+    message: "vulnerabilityId must be a UUID, a positive integer, or TRACE-<number>"
+  })
+]);
+var VulnerabilityLookupIdParamsSchema = OrgIdParamsSchema.extend({
+  vulnerabilityId: VulnerabilityLookupIdSchema
+});
 var VulnerabilitySourceSchema = external_exports.object({
   branch: external_exports.string().nullable(),
   commitSha: external_exports.string().nullable(),
@@ -24802,9 +24811,10 @@ var vulnerabilityContract = c17.router({
   getVulnerability: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId",
-    pathParams: VulnerabilityIdParamsSchema,
+    pathParams: VulnerabilityLookupIdParamsSchema,
     responses: {
       200: VulnerabilityResponseSchema,
+      400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -24814,7 +24824,7 @@ var vulnerabilityContract = c17.router({
   updateVulnerability: {
     method: "PATCH",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId",
-    pathParams: VulnerabilityIdParamsSchema,
+    pathParams: VulnerabilityLookupIdParamsSchema,
     body: UpdateVulnerabilityRequestSchema,
     responses: {
       200: VulnerabilityResponseSchema,
@@ -24842,7 +24852,7 @@ var vulnerabilityContract = c17.router({
   deleteVulnerability: {
     method: "DELETE",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId",
-    pathParams: VulnerabilityIdParamsSchema,
+    pathParams: VulnerabilityLookupIdParamsSchema,
     responses: {
       204: DeleteResponseSchema,
       401: ErrorResponseSchema,
@@ -24854,7 +24864,7 @@ var vulnerabilityContract = c17.router({
   retestVulnerability: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/retest",
-    pathParams: VulnerabilityIdParamsSchema,
+    pathParams: VulnerabilityLookupIdParamsSchema,
     body: null,
     responses: {
       201: ScanResponseSchema,
@@ -24881,7 +24891,7 @@ var vulnerabilityContract = c17.router({
   getVulnerabilityRetests: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/retests",
-    pathParams: VulnerabilityIdParamsSchema,
+    pathParams: VulnerabilityLookupIdParamsSchema,
     responses: {
       200: ScanArrayResponseSchema,
       401: ErrorResponseSchema,
@@ -24893,10 +24903,10 @@ var vulnerabilityContract = c17.router({
 });
 
 // ../../packages/api-contracts/src/schemas/api/v1/vulnerability-note.api.ts
-var VulnerabilityNoteParamsSchema = OrgIdParamsSchema.extend({
-  vulnerabilityId: external_exports.uuid()
+var VulnerabilityLookupNoteParamsSchema = OrgIdParamsSchema.extend({
+  vulnerabilityId: VulnerabilityLookupIdSchema
 });
-var VulnerabilityNoteIdParamsSchema = VulnerabilityNoteParamsSchema.extend({
+var VulnerabilityLookupNoteIdParamsSchema = VulnerabilityLookupNoteParamsSchema.extend({
   noteId: external_exports.uuid()
 });
 var VulnerabilityNoteResponseSchema = external_exports.object({
@@ -24924,9 +24934,10 @@ var vulnerabilityNoteContract = c18.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
-    pathParams: VulnerabilityNoteParamsSchema,
+    pathParams: VulnerabilityLookupNoteParamsSchema,
     responses: {
       200: ListVulnerabilityNotesResponseSchema,
+      400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -24936,7 +24947,7 @@ var vulnerabilityNoteContract = c18.router({
   createNote: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
-    pathParams: VulnerabilityNoteParamsSchema,
+    pathParams: VulnerabilityLookupNoteParamsSchema,
     body: CreateVulnerabilityNoteRequestSchema,
     responses: {
       201: VulnerabilityNoteResponseSchema,
@@ -24950,7 +24961,7 @@ var vulnerabilityNoteContract = c18.router({
   updateNote: {
     method: "PATCH",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes/:noteId",
-    pathParams: VulnerabilityNoteIdParamsSchema,
+    pathParams: VulnerabilityLookupNoteIdParamsSchema,
     body: UpdateVulnerabilityNoteRequestSchema,
     responses: {
       200: VulnerabilityNoteResponseSchema,
@@ -24964,9 +24975,10 @@ var vulnerabilityNoteContract = c18.router({
   deleteNote: {
     method: "DELETE",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes/:noteId",
-    pathParams: VulnerabilityNoteIdParamsSchema,
+    pathParams: VulnerabilityLookupNoteIdParamsSchema,
     responses: {
       204: DeleteResponseSchema,
+      400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       403: ErrorResponseSchema,
       404: ErrorResponseSchema,
@@ -25051,7 +25063,7 @@ var WebhookEventTypeSchema = external_exports.enum([
 ]);
 var WebhookEndpointStatusSchema = external_exports.enum(["enabled", "disabled"]);
 var WebhookDeliveryStatusSchema = external_exports.enum(["succeeded", "failed"]);
-var WebhookDeliverySourceSchema = external_exports.enum(["test", "mock"]);
+var WebhookDeliverySourceSchema = external_exports.enum(["test", "mock", "event"]);
 var WebhookEndpointSchema = external_exports.object({
   webhookId: external_exports.uuid(),
   organizationId: external_exports.uuid(),
@@ -26535,6 +26547,44 @@ function getClientId() {
   );
 }
 var SAFE_ORGANIZATION_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+var ORG_FILTER_FIELDS = ["name", "slug"];
+function parseOrgFilter(expression) {
+  const match = expression.match(/^([^=!:]+)(!=|!:|=|:)(.*)$/);
+  if (!match || !match[1] || !match[2] || match[3] === void 0) {
+    throw new Error(
+      `Invalid filter expression: '${expression}'. Format: <field><operator><value> (e.g. name:acme)`
+    );
+  }
+  const field = match[1].trim();
+  const operator = match[2];
+  const value = match[3].trim();
+  if (!ORG_FILTER_FIELDS.includes(field)) {
+    throw new Error(
+      `Unknown filter field '${field}'. Supported fields: ${ORG_FILTER_FIELDS.join(", ")}`
+    );
+  }
+  if (value.length === 0) {
+    throw new Error(
+      `Invalid filter expression: '${expression}'. Value cannot be empty after the operator.`
+    );
+  }
+  return { field, operator, value };
+}
+function matchesOrgFilter(item, filter) {
+  const raw = filter.field === "name" ? item.name : item.slug;
+  const cellLower = raw.toLowerCase();
+  const valueLower = filter.value.toLowerCase();
+  switch (filter.operator) {
+    case "=":
+      return cellLower === valueLower;
+    case "!=":
+      return cellLower !== valueLower;
+    case ":":
+      return cellLower.includes(valueLower);
+    case "!:":
+      return !cellLower.includes(valueLower);
+  }
+}
 function sanitizeForOutput(value) {
   return value.replace(/[\r\n\t]/g, " ").trim();
 }
@@ -26784,12 +26834,25 @@ ${colorSuccess(`Authenticated as ${displayName} (${tokenResponse.user.email})`)}
   });
 }
 function createLogoutCommand() {
-  return new Command("logout").description("Log out of Trace").addHelpText(
+  return new Command("logout").description("Log out of Trace").option("--no-confirm", "Skip confirmation prompt (for CI/scripts)").addHelpText(
     "after",
     `
 Examples:
-  tracecli auth logout`
-  ).action(() => {
+  tracecli auth logout
+  tracecli auth logout --no-confirm`
+  ).action(async (options) => {
+    if (options.confirm && process.stdin.isTTY && process.stdout.isTTY) {
+      const readline = createInterface2({ input: process.stdin, output: process.stdout });
+      try {
+        const answer = await readline.question("Are you sure you want to log out? [Y/n] ");
+        if (answer.trim().toLowerCase() === "n" || answer.trim().toLowerCase() === "no") {
+          console.log("Logout cancelled.");
+          return;
+        }
+      } finally {
+        readline.close();
+      }
+    }
     const removed = removeToken();
     if (removed) {
       console.log(
@@ -26845,6 +26908,9 @@ Examples:
     const info = buildAuthStatusInfo(token, refreshToken, selectedOrganizationId);
     if (options.output === "json") {
       console.log(JSON.stringify(info, null, 2));
+      if (!info.loggedIn) {
+        process.exit(1);
+      }
       return;
     }
     if (options.output === "tsv") {
@@ -26859,11 +26925,14 @@ Examples:
           info.activeOrg ?? ""
         ].join("	")
       );
+      if (!info.loggedIn) {
+        process.exit(1);
+      }
       return;
     }
     if (!info.loggedIn) {
-      console.log(colorError("Not logged in. Run `tracecli auth login` to authenticate."));
-      return;
+      console.error(colorError("Not logged in. Run `tracecli auth login` to authenticate."));
+      process.exit(1);
     }
     console.log("Logged in to Trace");
     if (info.userId) {
@@ -26903,7 +26972,12 @@ function createOrgListCommand() {
       throw new Error("--limit must be a positive integer");
     }
     return n;
-  }).option("-w, --web", "Open the organization settings in a browser").addHelpText(
+  }).option(
+    "-f, --filter <expression>",
+    "Filter expression (repeatable). Fields: name, slug. Operators: = exact, != not exact, : contains, !: not contains",
+    (val, prev) => [...prev, val],
+    []
+  ).option("-w, --web", "Open the organization settings in a browser").addHelpText(
     "after",
     `
 Examples:
@@ -26911,70 +26985,88 @@ Examples:
   tracecli org list --output json
   tracecli org list --output tsv | cut -f1
   tracecli org list --limit 5
+  tracecli org list --filter "name:acme"
+  tracecli org list --filter "slug!=internal"
   tracecli org list --web`
-  ).action(async (options) => {
-    if (options.web) {
-      const slug = await resolveOrganizationSlug();
-      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings`;
-      const opened = await openBrowser(url2);
-      if (!opened) {
-        console.log(`Open in browser: ${url2}`);
+  ).action(
+    async (options) => {
+      if (options.web) {
+        const slug = await resolveOrganizationSlug();
+        const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings`;
+        const opened = await openBrowser(url2);
+        if (!opened) {
+          console.log(`Open in browser: ${url2}`);
+        }
+        return;
       }
-      return;
-    }
-    const organizationContext = await fetchOrganizationContext();
-    const allItems = organizationContext.organizations.map(
-      (organization) => ({
-        ...organization,
-        active: organization.organizationId === organizationContext.activeOrganization.organizationId,
-        selected: organization.organizationId === organizationContext.selectedOrganizationId
-      })
-    );
-    const items = options.limit !== void 0 ? allItems.slice(0, options.limit) : allItems;
-    if (options.output === "json") {
-      console.log(JSON.stringify(items, null, 2));
-      return;
-    }
-    if (options.output === "tsv") {
-      console.log("name	slug	organizationId	active");
-      for (const item of items) {
+      const parsedFilters = [];
+      for (const expr of options.filter) {
+        try {
+          parsedFilters.push(parseOrgFilter(expr));
+        } catch (err) {
+          console.error(err instanceof Error ? err.message : String(err));
+          process.exit(1);
+        }
+      }
+      const organizationContext = await fetchOrganizationContext();
+      const allItems = organizationContext.organizations.map(
+        (organization) => ({
+          ...organization,
+          active: organization.organizationId === organizationContext.activeOrganization.organizationId,
+          selected: organization.organizationId === organizationContext.selectedOrganizationId
+        })
+      );
+      const filteredItems = allItems.filter(
+        (item) => parsedFilters.every((f) => matchesOrgFilter(item, f))
+      );
+      const items = options.limit !== void 0 ? filteredItems.slice(0, options.limit) : filteredItems;
+      if (options.output === "json") {
+        console.log(JSON.stringify(items, null, 2));
+        return;
+      }
+      if (options.output === "tsv") {
+        console.log("name	slug	organizationId	active");
+        for (const item of items) {
+          console.log(
+            [
+              tsvSafe(item.name),
+              tsvSafe(item.slug),
+              tsvSafe(item.organizationId),
+              item.active ? "true" : "false"
+            ].join("	")
+          );
+        }
+        return;
+      }
+      const headers = ["", "Name", "Slug", "Org ID"];
+      const rows = items.map((item) => {
+        const labels = [item.active ? "active" : null, item.selected ? "selected" : null].filter(
+          Boolean
+        );
+        const marker = item.active ? "*" : " ";
+        const nameSuffix = labels.length > 0 ? ` [${labels.join(", ")}]` : "";
+        return [
+          marker,
+          sanitizeForOutput(item.name) + nameSuffix,
+          sanitizeForOutput(item.slug),
+          item.organizationId
+        ];
+      });
+      const colWidths = headers.map(
+        (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
+      );
+      const pad = (s, w3) => s.padEnd(w3);
+      console.log(headers.map((h, i) => pad(h, colWidths[i] ?? h.length)).join("  "));
+      for (const row of rows) {
+        console.log(row.map((cell, i) => pad(cell, colWidths[i] ?? 0)).join("  "));
+      }
+      if (organizationContext.staleSelectionDetected) {
         console.log(
-          [
-            tsvSafe(item.name),
-            tsvSafe(item.slug),
-            tsvSafe(item.organizationId),
-            item.active ? "true" : "false"
-          ].join("	")
+          "\nYour previous organization selection is no longer available and was reset."
         );
       }
-      return;
-    }
-    const headers = ["", "Name", "Slug", "Org ID"];
-    const rows = items.map((item) => {
-      const labels = [item.active ? "active" : null, item.selected ? "selected" : null].filter(
-        Boolean
-      );
-      const marker = item.active ? "*" : " ";
-      const nameSuffix = labels.length > 0 ? ` [${labels.join(", ")}]` : "";
-      return [
-        marker,
-        sanitizeForOutput(item.name) + nameSuffix,
-        sanitizeForOutput(item.slug),
-        item.organizationId
-      ];
-    });
-    const colWidths = headers.map(
-      (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
-    );
-    const pad = (s, w3) => s.padEnd(w3);
-    console.log(headers.map((h, i) => pad(h, colWidths[i] ?? h.length)).join("  "));
-    for (const row of rows) {
-      console.log(row.map((cell, i) => pad(cell, colWidths[i] ?? 0)).join("  "));
-    }
-    if (organizationContext.staleSelectionDetected) {
-      console.log("\nYour previous organization selection is no longer available and was reset.");
     }
-  });
+  );
 }
 function createOrgCurrentCommand() {
   return new Command("current").description("Show the active organization used by CLI commands").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the organization settings in a browser").addHelpText(
@@ -27031,15 +27123,42 @@ Examples:
   });
 }
 function createOrgSwitchCommand() {
-  return new Command("switch").description("Switch the active organization for subsequent CLI commands").argument("[organization]", "Organization ID, slug, name, or menu selection index").addHelpText(
+  return new Command("switch").description("Switch the active organization for subsequent CLI commands").argument("[organization]", "Organization ID, slug, name, or menu selection index").option("-w, --web", "Open the organization settings page in a browser instead of switching").addHelpText(
     "after",
     `
 Examples:
   tracecli org switch
   tracecli org switch engineering
-  tracecli org switch org_01KJTJFFG497Z1C54Z07AP6NA3`
-  ).action(async (organization) => {
+  tracecli org switch org_01KJTJFFG497Z1C54Z07AP6NA3
+  tracecli org switch engineering --web`
+  ).action(async (organization, options) => {
     const normalizedOrganizationInput = organization?.trim() ?? "";
+    if (options.web) {
+      if (normalizedOrganizationInput.length > 0) {
+        const organizationContext2 = await fetchOrganizationContext();
+        const selection = resolveOrganizationSelectionInput(
+          organizationContext2.organizations,
+          normalizedOrganizationInput
+        );
+        if ("error" in selection) {
+          console.error(selection.error);
+          process.exit(1);
+        }
+        const url2 = `${getAppBaseUrl()}/dashboard/${selection.organization.slug}/settings`;
+        const opened = await openBrowser(url2);
+        if (!opened) {
+          console.log(`Open in browser: ${url2}`);
+        }
+      } else {
+        const slug = await resolveOrganizationSlug();
+        const url2 = `${getAppBaseUrl()}/dashboard/${slug}/settings`;
+        const opened = await openBrowser(url2);
+        if (!opened) {
+          console.log(`Open in browser: ${url2}`);
+        }
+      }
+      return;
+    }
     if (normalizedOrganizationInput.length === 0 && (!process.stdin.isTTY || !process.stdout.isTTY)) {
       console.error(
         "Missing required argument 'organization'. Run `tracecli org switch <organization>` in non-interactive environments."
@@ -27705,7 +27824,7 @@ function createFindingsListCommand() {
       }
       return Math.min(n, MAX_LIMIT);
     }
-  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the pentests dashboard in a browser").addHelpText(
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the pentest detail page in a browser").addHelpText(
     "after",
     `
 Examples:
@@ -27719,7 +27838,9 @@ Examples:
     async (options) => {
       if (options.web) {
         const slug = await resolveOrganizationSlug();
-        const url2 = `${getAppBaseUrl()}/dashboard/${slug}/pentests`;
+        const numericMatch = options.pentest.match(/^(?:PT-)?(\d+)$/i);
+        const pentestUrlId = numericMatch?.[1] ?? options.pentest;
+        const url2 = `${getAppBaseUrl()}/dashboard/${slug}/pentests/${pentestUrlId}`;
         const opened = await openBrowser(url2);
         if (!opened) {
           console.log(`Open in browser: ${url2}`);
@@ -27873,6 +27994,7 @@ function extractRepoName(input) {
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
 var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
 var DEFAULT_LIMIT2 = 30;
+var DEFAULT_PAGE = 1;
 var MAX_LIMIT2 = 100;
 var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
 var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
@@ -28090,6 +28212,44 @@ function parseListLimit(value) {
   }
   return n;
 }
+function parseListPage(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 1) {
+    throw new Error("--page must be a positive integer");
+  }
+  return n;
+}
+function paginateResults(items, options) {
+  if (options.all) {
+    return {
+      items: [...items],
+      pagination: null
+    };
+  }
+  const limit = options.limit ?? DEFAULT_LIMIT2;
+  const page = options.page ?? DEFAULT_PAGE;
+  const totalItems = items.length;
+  const totalPages = Math.max(1, Math.ceil(totalItems / limit));
+  if (page > totalPages) {
+    throw new Error(
+      `--page ${page} is out of range for ${totalItems} matching results with --limit ${limit}. Use --page between 1 and ${totalPages}, or pass --all.`
+    );
+  }
+  const startIndex = (page - 1) * limit;
+  const endIndex = Math.min(startIndex + limit, totalItems);
+  return {
+    items: items.slice(startIndex, endIndex),
+    pagination: {
+      totalItems,
+      totalPages,
+      page,
+      hasNextPage: page < totalPages,
+      hasPreviousPage: page > 1,
+      startIndex,
+      endIndex
+    }
+  };
+}
 function printRepositoriesTsv(repositories) {
   console.log("repositoryUrl	platform	status	defaultBranch	language");
   for (const repo of repositories) {
@@ -28126,6 +28286,19 @@ function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
 }
+function printPaginationHint(pagination, noun, nextPageFilterHint) {
+  if (!pagination || pagination.totalPages <= 1) {
+    return;
+  }
+  const shownStart = pagination.startIndex + 1;
+  const shownEnd = pagination.endIndex;
+  console.log(
+    `Showing ${shownStart}-${shownEnd} of ${pagination.totalItems} ${noun} (page ${pagination.page}/${pagination.totalPages}).`
+  );
+  if (pagination.hasNextPage) {
+    console.log(`Use --page ${pagination.page + 1}${nextPageFilterHint} (or --all) to see more.`);
+  }
+}
 function extractErrorMessage(body) {
   if (typeof body === "object" && body !== null && "message" in body && typeof body.message === "string") {
     const message = body.message.trim();
@@ -28251,6 +28424,11 @@ function addRepositoryFilterOptions(command) {
     parseListLimit,
     DEFAULT_LIMIT2
   ).option(
+    "--page <n>",
+    `Page number to display when results exceed --limit (default ${DEFAULT_PAGE})`,
+    parseListPage,
+    DEFAULT_PAGE
+  ).option("--all", "Display all matching repositories (disables pagination)").option(
     "--dependency <pkg>",
     "Filter repositories that use a dependency (e.g. lodash, lodash@4.17.21, @types/node@20)"
   ).option("-w, --web", "Open the repositories dashboard in a browser");
@@ -28302,8 +28480,17 @@ async function runRepositoryListCommand(options) {
     console.log("No repositories found.");
     return;
   }
-  const limit = options.limit ?? DEFAULT_LIMIT2;
-  const displayedRepositories = filteredRepositories.slice(0, limit);
+  let displayedRepositories;
+  let pagination = null;
+  try {
+    const paginatedResult = paginateResults(filteredRepositories, options);
+    displayedRepositories = paginatedResult.items;
+    pagination = paginatedResult.pagination;
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown pagination error.";
+    console.error(`Invalid pagination options: ${message}`);
+    process.exit(1);
+  }
   if (options.output === "json") {
     console.log(JSON.stringify(displayedRepositories, null, 2));
     return;
@@ -28313,6 +28500,11 @@ async function runRepositoryListCommand(options) {
     return;
   }
   printRepositoriesTable(displayedRepositories);
+  printPaginationHint(
+    pagination,
+    "repositories",
+    options.filter.length > 0 ? " with the same --filter flags" : ""
+  );
 }
 async function runDependencyFilter(organizationId, options) {
   const dependency = options.dependency;
@@ -28366,8 +28558,17 @@ async function runDependencyFilter(organizationId, options) {
     console.log(`No repositories found using dependency '${label}'.`);
     return;
   }
-  const limit = options.limit ?? DEFAULT_LIMIT2;
-  const displayedRepos = repos.slice(0, limit);
+  let displayedRepos;
+  let pagination = null;
+  try {
+    const paginatedResult = paginateResults(repos, options);
+    displayedRepos = paginatedResult.items;
+    pagination = paginatedResult.pagination;
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown pagination error.";
+    console.error(`Invalid pagination options: ${message}`);
+    process.exit(1);
+  }
   if (options.output === "json") {
     console.log(JSON.stringify(displayedRepos, null, 2));
     return;
@@ -28383,6 +28584,7 @@ async function runDependencyFilter(organizationId, options) {
     const versions = repo.versions.join(", ");
     console.log(`${repo.fullName}  (${versions})`);
   }
+  printPaginationHint(pagination, "repositories", "");
 }
 function createListCommand2() {
   return addRepositoryFilterOptions(
@@ -28393,6 +28595,8 @@ function createListCommand2() {
 Examples:
   tracecli repo list
   tracecli repo list --platform GITHUB --status CONNECTED
+  tracecli repo list --page 2 --limit 30
+  tracecli repo list --all
   tracecli repo list --output json | jq '.[].repositoryUrl'
   tracecli repo list --output tsv | cut -f1
   tracecli repo list --filter "language:typescript" --limit 10
@@ -28410,7 +28614,11 @@ function createFilterCommand() {
     `
 Examples:
   tracecli repo filter --filter "platform=GITHUB" --filter "status=CONNECTED"
-  tracecli repo filter --language typescript --output json
+  tracecli repo filter --page 2 --limit 30
+  tracecli repo filter --all
+  tracecli repo filter --language typescript --limit 10
+  tracecli repo filter --output json | jq '.[].repositoryUrl'
+  tracecli repo filter --output tsv | cut -f1
   tracecli repo filter --web`
   ).action(async (options) => {
     await runRepositoryListCommand(options);
@@ -29119,6 +29327,110 @@ function printVulnerabilitiesTsv(vulnerabilities) {
     console.log(cols.join("	"));
   }
 }
+function printVulnerabilityDetail(vulnerability) {
+  const severity = colorSeverity(vulnerability.severity, formatSeverity(vulnerability.severity));
+  const status = formatStatus(vulnerability.status);
+  const metadata = [
+    `Type: ${vulnerability.vulnerabilityType}`,
+    vulnerability.scanMode ? `Scan mode: ${vulnerability.scanMode}` : null,
+    vulnerability.cweId ? vulnerability.cweId : null
+  ].filter((value) => value !== null);
+  const sourceDetails = [
+    vulnerability.source.branch ? `Branch: ${vulnerability.source.branch}` : null,
+    vulnerability.source.pullRequestNumber !== null ? `PR #${vulnerability.source.pullRequestNumber}${vulnerability.source.pullRequestTitle ? ` (${vulnerability.source.pullRequestTitle})` : ""}` : null
+  ].filter((value) => value !== null);
+  console.log(`  [${severity}] ${vulnerability.traceId} ${vulnerability.title}`);
+  console.log(
+    `         ${vulnerability.repositoryName} \xB7 ${vulnerability.codeSnippet.filePath}:${vulnerability.codeSnippet.startLine} \xB7 ${status}`
+  );
+  if (metadata.length > 0) {
+    console.log(`         ${metadata.join(" | ")}`);
+  }
+  if (sourceDetails.length > 0) {
+    console.log(`         ${sourceDetails.join(" | ")}`);
+  }
+  console.log(`         Vulnerability ID: ${vulnerability.vulnerabilityId}`);
+  console.log("");
+  console.log(vulnerability.description);
+}
+function printVulnerabilityDetailTsv(vulnerability) {
+  console.log(
+    "traceId	vulnerabilityId	severity	status	repository	file	line	cweId	scanMode	title	description"
+  );
+  const cols = [
+    vulnerability.traceId,
+    vulnerability.vulnerabilityId,
+    vulnerability.severity,
+    vulnerability.status,
+    vulnerability.repositoryName,
+    vulnerability.codeSnippet.filePath,
+    String(vulnerability.codeSnippet.startLine),
+    vulnerability.cweId ?? "",
+    vulnerability.scanMode ?? "",
+    vulnerability.title,
+    vulnerability.description
+  ].map(sanitizeTsvField);
+  console.log(cols.join("	"));
+}
+function createGetCommand() {
+  return new Command("get").description("Get a vulnerability by display ID or UUID").argument("<id>", "Vulnerability display ID (e.g. TRACE-123 or 123) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerability detail page in a browser").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli vulnerabilities get TRACE-123
+  tracecli vulnerabilities get 123
+  tracecli vulnerabilities get 00000000-0000-4000-8000-000000000123
+  tracecli vulnerabilities get TRACE-123 --output json
+  tracecli vulnerabilities get TRACE-123 --output tsv
+  tracecli vulnerabilities get TRACE-123 --web`
+  ).action(async (identifier, options) => {
+    if (options.web) {
+      const slug = await resolveOrganizationSlug();
+      const url2 = `${getAppBaseUrl()}/dashboard/${slug}/vulnerabilities/${identifier}`;
+      const opened = await openBrowser(url2);
+      if (!opened) {
+        console.log(`Open in browser: ${url2}`);
+      }
+      return;
+    }
+    const organizationId = await resolveOrganizationId();
+    const result = await authenticatedRequest(
+      (client) => client.vulnerability.getVulnerability({
+        params: { organizationId, vulnerabilityId: identifier }
+      })
+    );
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (result.status === 400) {
+      console.error(
+        `Invalid vulnerability identifier '${identifier}'. Use TRACE-<number>, a positive integer, or a UUID.`
+      );
+      process.exit(1);
+    }
+    if (result.status === 404) {
+      console.error(
+        `Vulnerability '${identifier}' not found.
+Run \`tracecli vulnerabilities list\` to see available vulnerabilities.`
+      );
+      process.exit(1);
+    }
+    if (result.status !== 200) {
+      console.error(`Failed to fetch vulnerability (status ${result.status}).`);
+      process.exit(1);
+    }
+    if (options.output === "json") {
+      console.log(JSON.stringify(result.body, null, 2));
+      return;
+    }
+    if (options.output === "tsv") {
+      printVulnerabilityDetailTsv(result.body);
+      return;
+    }
+    printVulnerabilityDetail(result.body);
+  });
+}
 function createListCommand3() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
     "--severity <severity>",
@@ -29246,6 +29558,7 @@ Examples:
 }
 function createVulnerabilitiesCommand() {
   const vulnerabilities = new Command("vulnerabilities").description("Manage vulnerabilities");
+  vulnerabilities.addCommand(createGetCommand());
   vulnerabilities.addCommand(createListCommand3());
   return vulnerabilities;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.21.7",
+  "version": "0.23.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {