securewithtrace 0.40.0 → 0.41.0

package/dist/index.js

@@ -22144,7 +22144,7 @@ var AgentSessionFailureReasonValues = [
   "INTERNAL"
 ];
 var AgentSessionFailureReason = external_exports.enum(AgentSessionFailureReasonValues);
-var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC"];
+var AgentSessionProviderValues = ["BEDROCK", "ANTHROPIC", "OPENAI"];
 var AgentSessionProvider = external_exports.enum(AgentSessionProviderValues);
 var AgentSessionEventKindValues = [
   "AGENT_TEXT",
@@ -22283,6 +22283,9 @@ var AgentSessionSummarySchema = external_exports.object({
   status: AgentSessionStatus,
   waitingReason: AgentSessionWaitingReason.nullable(),
   failureReason: AgentSessionFailureReason.nullable(),
+  /** Sanitized, shape-only failure description (e.g. a provider refusal message) — never customer
+   *  data. In the summary so the staff console can show WHY a listed session failed. */
+  failureDetails: external_exports.string().nullable(),
   objective: external_exports.string(),
   provider: AgentSessionProvider,
   model: external_exports.string(),
@@ -22305,8 +22308,6 @@ var AgentSessionRepositoryPinSchema = external_exports.object({
   commitSha: external_exports.string()
 });
 var AgentSessionDetailSchema = AgentSessionSummarySchema.extend({
-  /** Sanitized, shape-only failure description — never customer data. */
-  failureDetails: external_exports.string().nullable(),
   sdkSessionId: external_exports.string().nullable(),
   promptVersion: external_exports.string(),
   toolsetVersion: external_exports.string(),
@@ -29593,6 +29594,11 @@ var ResumeCodeUploadResponseSchema = external_exports.object({
 var ListCodeUploadsResponseSchema = external_exports.object({
   uploads: external_exports.array(CodeUploadSchema)
 });
+var DownloadCodeUploadResponseSchema = external_exports.object({
+  upload: CodeUploadSchema,
+  downloadUrl: external_exports.url(),
+  expiresAt: external_exports.coerce.date()
+});
 
 // ../../packages/api-contracts/src/contracts/v1/code-upload.ts
 var c12 = initContract();
@@ -29646,6 +29652,15 @@ var codeUploadContract = c12.router({
       ...commonErrors
     }
   },
+  downloadCodeUpload: {
+    method: "GET",
+    path: "/organizations/:organizationId/code-uploads/:codeUploadId/download",
+    pathParams: CodeUploadIdParamsSchema,
+    responses: {
+      200: DownloadCodeUploadResponseSchema,
+      ...commonErrors
+    }
+  },
   deleteCodeUpload: {
     method: "DELETE",
     path: "/organizations/:organizationId/code-uploads/:codeUploadId",
@@ -37240,7 +37255,7 @@ async function requestDeviceAuthorization(clientId) {
   }
   return await response.json();
 }
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 async function pollForToken(clientId, deviceCode, options = {}) {
   const expiresIn = options.expiresIn ?? 300;
   let interval = options.interval ?? 5;
@@ -37925,18 +37940,18 @@ var proto = Object.defineProperties(() => {
     }
   }
 });
-var createStyler = (open2, close, parent) => {
+var createStyler = (open3, close, parent) => {
   let openAll;
   let closeAll;
   if (parent === void 0) {
-    openAll = open2;
+    openAll = open3;
     closeAll = close;
   } else {
-    openAll = parent.openAll + open2;
+    openAll = parent.openAll + open3;
     closeAll = close + parent.closeAll;
   }
   return {
-    open: open2,
+    open: open3,
     close,
     openAll,
     closeAll,
@@ -47290,6 +47305,11 @@ Examples:
   });
 }
 
+// src/upload/download.ts
+import { createHash as createHash2 } from "crypto";
+import { open as open2, rename, rm, stat } from "fs/promises";
+import { basename as basename4, join as join7, resolve } from "path";
+
 // src/upload/prepare.ts
 import { createHash } from "crypto";
 import { createReadStream, statSync as statSync4 } from "fs";
@@ -47433,6 +47453,128 @@ async function prepareUploadFile(filePath, options = {}) {
   };
 }
 
+// src/upload/download.ts
+var CodeUploadDownloadError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodeUploadDownloadError";
+  }
+};
+function safeDownloadFilename(upload) {
+  const extension = requiredExtensionForKind(upload.artifactKind);
+  const fallback = `app${extension}`;
+  const stripped = Array.from(basename4(upload.originalFilename.replace(/\\/g, "/")), (char) => {
+    const code = char.codePointAt(0) ?? 0;
+    return code <= 31 || code === 127 ? "_" : char;
+  }).join("").trim();
+  if (stripped.length === 0 || stripped === "." || stripped === "..") return fallback;
+  return stripped.toLowerCase().endsWith(extension) ? stripped : `${stripped}${extension}`;
+}
+async function resolveDownloadDestination(upload, outOption) {
+  const filename = safeDownloadFilename(upload);
+  if (outOption === void 0) return resolve(process.cwd(), filename);
+  const target = resolve(outOption);
+  try {
+    const info = await stat(target);
+    if (info.isDirectory()) return join7(target, filename);
+  } catch {
+  }
+  return target;
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function downloadCodeUploadToFile(upload, downloadUrl, destination, options = {}) {
+  const fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  const partialPath = `${destination}.part`;
+  let response;
+  try {
+    response = await fetchImpl(downloadUrl, { method: "GET", redirect: "manual" });
+  } catch (error48) {
+    const detail = error48 instanceof Error ? error48.message : "network error";
+    throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
+  }
+  if (!response.ok || response.body === null) {
+    if (response.body !== null) await response.body.cancel();
+    throw new CodeUploadDownloadError(
+      `Storage answered HTTP ${response.status} instead of the build bytes. Retry; the download link may have expired.`
+    );
+  }
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    const declared = Number(contentLength);
+    if (!Number.isSafeInteger(declared) || declared !== upload.sizeBytes) {
+      await response.body.cancel();
+      throw new CodeUploadDownloadError(
+        `Storage declared ${contentLength} bytes; the upload record says ${upload.sizeBytes}.`
+      );
+    }
+  }
+  await rm(partialPath, { force: true });
+  const file2 = await open2(partialPath, "wx");
+  const hash2 = createHash2("sha256");
+  const reader = response.body.getReader();
+  let downloadedBytes = 0;
+  options.onProgress?.(progress(0, upload.sizeBytes));
+  try {
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      downloadedBytes += chunk.value.byteLength;
+      if (downloadedBytes > upload.sizeBytes) {
+        await reader.cancel();
+        throw new CodeUploadDownloadError(
+          `Storage sent more than the ${upload.sizeBytes} bytes on record.`
+        );
+      }
+      hash2.update(chunk.value);
+      await writeAll(file2, chunk.value);
+      options.onProgress?.(progress(downloadedBytes, upload.sizeBytes));
+    }
+    await file2.close();
+    if (downloadedBytes !== upload.sizeBytes) {
+      throw new CodeUploadDownloadError(
+        `Download ended after ${downloadedBytes} of ${upload.sizeBytes} bytes.`
+      );
+    }
+    const digest = hash2.digest("hex");
+    if (digest !== upload.archiveSha256) {
+      throw new CodeUploadDownloadError(
+        "Downloaded bytes do not match the SHA-256 recorded at upload time."
+      );
+    }
+    await rename(partialPath, destination);
+  } catch (error48) {
+    await file2.close().catch(() => void 0);
+    await rm(partialPath, { force: true });
+    if (error48 instanceof CodeUploadDownloadError) throw error48;
+    const detail = error48 instanceof Error ? error48.message : "unknown error";
+    throw new CodeUploadDownloadError(`Download from storage failed: ${detail}.`);
+  }
+}
+function progress(downloadedBytes, totalBytes) {
+  return {
+    downloadedBytes,
+    totalBytes,
+    fraction: totalBytes === 0 ? 1 : downloadedBytes / totalBytes
+  };
+}
+async function writeAll(file2, bytes) {
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await file2.write(bytes, offset, bytes.byteLength - offset);
+    if (bytesWritten === 0) {
+      throw new CodeUploadDownloadError("Writing the build to disk stalled.");
+    }
+    offset += bytesWritten;
+  }
+}
+
 // src/upload/multipart.ts
 var MAX_CONCURRENT_UPLOADS = 3;
 var MAX_PART_ATTEMPTS = 3;
@@ -47445,7 +47587,7 @@ async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts
   if (!Number.isSafeInteger(uploadedBytes) || uploadedBytes < 0 || uploadedBytes > totalBytes) {
     throw new Error("Invalid multipart progress: uploaded byte count is outside the archive.");
   }
-  options.onProgress?.(progress(uploadedBytes, totalBytes));
+  options.onProgress?.(progress2(uploadedBytes, totalBytes));
   if (parts.length === 0) return;
   const urls = new Map(parts.map((part) => [part.partNumber, part.uploadUrl]));
   const refreshUrls = createUrlRefresher(urls, options.refreshParts);
@@ -47462,7 +47604,7 @@ async function uploadCodeArchiveParts(filePath, totalBytes, partSizeBytes, parts
         const body = await readFileSlice(filePath, start, end);
         await uploadPartWithRetry(part.partNumber, urls, body, fetchPart, wait, refreshUrls);
         uploadedBytes += body.byteLength;
-        options.onProgress?.(progress(uploadedBytes, totalBytes));
+        options.onProgress?.(progress2(uploadedBytes, totalBytes));
       }
     })
   );
@@ -47550,7 +47692,7 @@ function assertPresignedUploadUrl(value) {
     throw new Error("Invalid multipart upload: part URLs must use HTTPS.");
   }
 }
-function progress(uploadedBytes, totalBytes) {
+function progress2(uploadedBytes, totalBytes) {
   return {
     uploadedBytes,
     totalBytes,
@@ -47558,13 +47700,13 @@ function progress(uploadedBytes, totalBytes) {
   };
 }
 function defaultWait(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+  return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
 
 // src/upload/commands.ts
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["READY", "REJECTED", "FAILED", "DELETING"]);
 var DEFAULT_RUNTIME = {
-  wait: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  wait: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
   pollIntervalMs: 3e3,
   fetch: (input, init) => globalThis.fetch(input, init)
 };
@@ -47677,6 +47819,53 @@ function failReadOp5(action, status, body) {
   );
   process.exit(1);
 }
+function failDownloadOp(codeUploadId, status, body) {
+  const { message, errorCode } = readErrorFields(body);
+  if (status === UNAUTHORIZED_STATUS2) {
+    exitAuthFailed();
+  }
+  if (status === 403) {
+    console.error(
+      colorError(
+        "Only an organization admin (or Trace staff) on a pentest-enabled organization can download builds."
+      )
+    );
+    process.exit(1);
+  }
+  if (status === 404) {
+    console.error(colorError(message ?? "No code upload with that id."));
+    process.exit(1);
+  }
+  if (status === 409) {
+    if (errorCode === "CODE_UPLOAD_NOT_BUILD") {
+      console.error(
+        colorError(
+          message ?? "Only APK and IPA builds can be downloaded. Source archives stay on the server."
+        )
+      );
+    } else if (errorCode === "CODE_UPLOAD_NOT_READY") {
+      console.error(
+        colorError(
+          message ?? "The build must be ready and pass malware scanning before it can be downloaded."
+        )
+      );
+      console.error(`Wait for it with: tracecli upload wait ${codeUploadId}`);
+    } else {
+      console.error(colorError(message ?? "Conflict (status 409)."));
+    }
+    process.exit(1);
+  }
+  if (status === 503) {
+    console.error(
+      colorError(message ?? "Source archive uploads are not configured on this server.")
+    );
+    process.exit(1);
+  }
+  console.error(
+    colorError(`Failed to download build (status ${status})${message ? `: ${message}` : "."}`)
+  );
+  process.exit(1);
+}
 function resumeHint(codeUploadId, filePath) {
   return `Resume with: tracecli upload resume ${codeUploadId} ${filePath}`;
 }
@@ -47766,11 +47955,18 @@ function outputUpload(upload, output) {
   }
   console.log(renderUploadDetail(upload));
 }
-function writeProgress(progress2) {
+function writeProgress(progress3) {
+  if (!process.stderr.isTTY) return;
+  const pct = Math.floor(progress3.fraction * 100);
+  process.stderr.write(
+    `\rUploading ${pct}% (${formatArchiveBytes(progress3.uploadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
+  );
+}
+function writeDownloadProgress(progress3) {
   if (!process.stderr.isTTY) return;
-  const pct = Math.floor(progress2.fraction * 100);
+  const pct = Math.floor(progress3.fraction * 100);
   process.stderr.write(
-    `\rUploading ${pct}% (${formatArchiveBytes(progress2.uploadedBytes)} / ${formatArchiveBytes(progress2.totalBytes)})`
+    `\rDownloading ${pct}% (${formatArchiveBytes(progress3.downloadedBytes)} / ${formatArchiveBytes(progress3.totalBytes)})`
   );
 }
 function finishProgress() {
@@ -48084,6 +48280,76 @@ async function runGet4(codeUploadIdArg, options) {
   const upload = await requireUpload(organizationId, codeUploadId);
   outputUpload(upload, output);
 }
+async function runDownload(codeUploadIdArg, options, runtime) {
+  const output = parseOutput(options.output);
+  const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.codeUpload.downloadCodeUpload({
+      params: { organizationId, codeUploadId }
+    })
+  );
+  if (result.status !== SUCCESS_STATUS) {
+    failDownloadOp(codeUploadId, result.status, result.body);
+  }
+  const { upload, downloadUrl } = result.body;
+  const destination = await resolveDownloadDestination(upload, options.out);
+  if (!options.force && await pathExists(destination)) {
+    console.error(
+      colorError(`${destination} already exists. Pass --force to overwrite it or --out <path>.`)
+    );
+    process.exit(1);
+  }
+  if (output === "table") {
+    console.error(
+      `Downloading ${sanitizeDisplay(upload.displayName)} (${formatArchiveBytes(upload.sizeBytes)}) to ${destination}`
+    );
+  }
+  try {
+    await downloadCodeUploadToFile(upload, downloadUrl, destination, {
+      fetch: runtime.fetch,
+      onProgress: writeDownloadProgress
+    });
+    finishProgress();
+  } catch (error48) {
+    finishProgress();
+    const detail = error48 instanceof Error ? error48.message : "Download from storage failed.";
+    console.error(colorError(detail));
+    process.exit(1);
+  }
+  if (output === "json") {
+    console.log(
+      JSON.stringify(
+        {
+          upload,
+          path: destination,
+          sizeBytes: upload.sizeBytes,
+          archiveSha256: upload.archiveSha256
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (output === "tsv") {
+    console.log(["codeUploadId", "path", "sizeBytes", "archiveSha256"].join("	"));
+    console.log(
+      [
+        tsvSafe(upload.codeUploadId),
+        tsvSafe(destination),
+        String(upload.sizeBytes),
+        tsvSafe(upload.archiveSha256)
+      ].join("	")
+    );
+    return;
+  }
+  console.log(
+    colorSuccess(
+      `Saved ${sanitizeDisplay(upload.displayName)} to ${destination} (${formatArchiveBytes(upload.sizeBytes)}, SHA-256 verified).`
+    )
+  );
+}
 async function runWait(codeUploadIdArg, options, runtime) {
   const output = parseOutput(options.output);
   const codeUploadId = requireUuid(codeUploadIdArg, "code upload id");
@@ -48208,6 +48474,23 @@ Examples:
     await runResume(codeUploadId, file2, options, runtime);
   });
 }
+function createDownloadCommand(runtime) {
+  return new Command("download").description("Download an APK or IPA build that finished malware scanning").argument("<codeUploadId>", "Upload UUID of the build").option("--out <path>", "File to write, or an existing directory (default: working directory)").option("-f, --force", "Overwrite an existing file").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Only READY builds with a clean malware scan can be downloaded. Source ZIPs
+are not downloadable. The file is written under the name it was uploaded
+with and its size and SHA-256 are checked against the upload record before
+it is moved into place.
+
+Examples:
+  tracecli upload download <codeUploadId>
+  tracecli upload download <codeUploadId> --out ./builds/
+  tracecli upload download <codeUploadId> --out ./release.apk --force`
+  ).action(async (codeUploadId, options) => {
+    await runDownload(codeUploadId, options, runtime);
+  });
+}
 function createWaitCommand(runtime) {
   return new Command("wait").description("Wait until an upload finishes malware scanning and validation").argument("<codeUploadId>", "Upload UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").action(async (codeUploadId, options) => {
     await runWait(codeUploadId, options, runtime);
@@ -48233,11 +48516,12 @@ Examples:
 }
 function createUploadCommand(runtime = {}) {
   const resolved = resolveRuntime(runtime);
-  const upload = new Command("upload").alias("code-upload").description("Upload source archives (and separately, mobile builds) for pentest");
+  const upload = new Command("upload").alias("code-upload").description("Upload source archives and mobile builds for pentest; download builds back");
   upload.addCommand(createCreateCommand5(resolved));
   upload.addCommand(createBuildCommand(resolved));
   upload.addCommand(createListCommand7());
   upload.addCommand(createGetCommand4());
+  upload.addCommand(createDownloadCommand(resolved));
   upload.addCommand(createResumeCommand(resolved));
   upload.addCommand(createWaitCommand(resolved));
   upload.addCommand(createDeleteCommand5());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {