securewithtrace 0.50.0 → 0.51.0

package/dist/index.js

@@ -23193,12 +23193,6 @@ var AgentSessionTypeValues = [
   "SETUP"
 ];
 var AgentSessionType = external_exports.enum(AgentSessionTypeValues);
-var SetupTenantSchema = external_exports.object({
-  admin: external_exports.boolean(),
-  member: external_exports.boolean(),
-  apiKey: external_exports.boolean()
-}).strict();
-var MAX_SETUP_TENANTS = 4;
 var AgentSessionStatusValues = [
   "LAUNCHING",
   "RUNNING",
@@ -23251,6 +23245,7 @@ var MAX_AGENT_SESSION_MAX_USD = 1500;
 var MAX_AGENT_SESSION_MAX_WALL_CLOCK_MIN = 24 * 60;
 var MAX_AGENT_SESSION_FOCUS_CHARS = 8e3;
 var MAX_AGENT_SESSION_FOCUS_BRIEF_CHARS = MAX_AGENT_SESSION_FOCUS_CHARS * 3;
+var MAX_SETUP_NOTES_CHARS = 8e3;
 var OperatorSessionPurpose = external_exports.enum(OPERATOR_PURPOSES);
 var CreateAgentSessionCommonSchema = external_exports.object({
   provider: AgentSessionProvider.optional(),
@@ -23363,16 +23358,14 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
     focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional()
   }),
   // SETUP: sets up a PoC engagement's application, environment, exclusions and tenant
-  // accounts. `focus` carries the staff notes (which environment, rate limits, what is
-  // off-limits); `tenants` the accounts to aim for; `shareLink` the customer's logins.
+  // accounts from the setup notes. Strict, so a client still sending the removed `focus`,
+  // `tenants` or `shareLink` gets a 400 instead of a launch that silently lost its input.
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("SETUP"),
-    focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional(),
-    /** Absent = the default target, two tenants of admin + member + API key. */
-    tenants: external_exports.array(SetupTenantSchema).min(1).max(MAX_SETUP_TENANTS).optional(),
-    /** A credential share link. Stored encrypted and never returned by any read route. */
-    shareLink: external_exports.url({ protocol: /^https$/ }).max(2048).optional()
-  })
+    /** What the customer sent and what staff want: environments, rules, logins, share links.
+     *  Stored encrypted and never returned by any read route. */
+    notes: external_exports.string().trim().min(1).max(MAX_SETUP_NOTES_CHARS).optional()
+  }).strict()
 ]);
 var SendAgentSessionMessageRequestSchema = external_exports.object({
   clientRequestId: external_exports.uuid().optional(),
@@ -23551,6 +23544,9 @@ var OperatorPentestContextSchema = external_exports.object({
   customerPriorityCategories: external_exports.array(external_exports.string()),
   /** Staff scope notes; defaulted so an older API's envelope still parses. */
   scopeNotes: external_exports.string().nullable().default(null),
+  /** The rendered staff-notes block (heading and never-quote line included), or null when the
+   * engagement has none or this session's type never receives them. Defaulted like `scopeNotes`. */
+  staffNotes: external_exports.string().nullable().default(null),
   /** The customer's intake answers, rendered as child briefs carry them. */
   customerIntake: external_exports.string().nullable().default(null),
   status: PentestStatus,
@@ -28487,6 +28483,9 @@ var PentestResponseSchema = external_exports.object({
   /** Customer threat-model context — free text. Used by hypothesis-gen prompt. */
   customerConcernsContext: external_exports.string().nullable(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory),
+  /** Staff-only session guidance. Staff response only. `.optional()` for the same
+   * rolling-deploy reason as `purchaseCapUsd`: the panel row reads Unavailable without it. */
+  staffNotes: external_exports.string().nullable().optional(),
   hypothesisBudgetCapUsd: external_exports.number(),
   validationBudgetCapUsd: external_exports.number(),
   perHypothesisBudgetCapUsd: external_exports.number(),
@@ -28712,6 +28711,8 @@ var CreatePentestRequestSchema = external_exports.object({
   perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   purchaseCapUsd: external_exports.number().min(0).max(1e5).optional()
 });
+var STAFF_NOTES_MAX_CHARS = 1e4;
+var STAFF_NOTES_BRIEF_MAX_CHARS = STAFF_NOTES_MAX_CHARS * 3;
 var UpdatePentestRequestSchema = external_exports.object({
   title: external_exports.string().min(1).max(500).optional(),
   description: external_exports.string().max(1e4).nullable().optional(),
@@ -28733,6 +28734,8 @@ var UpdatePentestRequestSchema = external_exports.object({
   testType: PentestTestType.optional(),
   customerConcernsContext: external_exports.string().max(2e4).nullable().optional(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory).max(20).optional(),
+  /** Staff-only guidance for this engagement's agent sessions; `null` clears. */
+  staffNotes: external_exports.string().max(STAFF_NOTES_MAX_CHARS).nullable().optional(),
   /** Report-cover engagement overrides. `null` clears (reverts to auto-derivation),
    * `undefined` leaves unchanged. Empty SUT is rejected — use `null` to clear. */
   systemUnderTest: external_exports.string().trim().min(1).max(200).nullable().optional(),
@@ -30394,6 +30397,46 @@ var RenewCloudCredentialsResponseSchema = external_exports.object({
   /** The most recently verified ACTIVE resource, whether or not its mint succeeded. Null when none. */
   gcpPrimaryResourceId: GcpPrefixedResourceIdSchema.nullable().optional()
 });
+var GetSessionCredentialsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative()
+});
+var ParsedWebCredentialSchema = external_exports.union([
+  external_exports.strictObject({
+    reference: external_exports.literal("SESSION_STATE"),
+    credentialId: external_exports.uuid(),
+    environmentId: external_exports.uuid(),
+    origin: external_exports.string()
+  }),
+  external_exports.strictObject({
+    reference: external_exports.literal("SSH_PRIVATE_KEY"),
+    credentialId: external_exports.uuid(),
+    environmentId: external_exports.uuid(),
+    host: external_exports.string(),
+    port: external_exports.number().int(),
+    username: external_exports.string()
+  }),
+  external_exports.strictObject({ username: external_exports.string(), password: external_exports.string() }),
+  external_exports.strictObject({ secretValue: external_exports.string() }),
+  external_exports.strictObject({ loginEmail: external_exports.string() })
+]);
+var WebCredentialEntrySchema = external_exports.object({
+  source: external_exports.literal("customer"),
+  label: external_exports.string(),
+  credentialType: external_exports.enum(CredentialTypeValues),
+  parsed: ParsedWebCredentialSchema,
+  authConfig: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  mfa: external_exports.object({ kind: external_exports.string() }).optional(),
+  passkeys: external_exports.number().int().positive().optional()
+});
+var SessionCredentialsResponseSchema = external_exports.object({
+  /** Empty when the type gets no web credentials or none resolved. */
+  webCredentials: external_exports.array(WebCredentialEntrySchema),
+  vercel: external_exports.object({ token: external_exports.string(), teamId: external_exports.string().nullable() }).nullable(),
+  browserAllowedBaseUrls: external_exports.array(external_exports.string()),
+  browserExclusions: external_exports.array(external_exports.string()),
+  /** API_COVERAGE only; null otherwise. Range checks stay with the host's rate parser. */
+  requestRate: external_exports.object({ perSec: external_exports.number(), burst: external_exports.number() }).nullable()
+});
 var ConvexReconRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative()
 });
@@ -31984,6 +32027,21 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  // The session's credentials, fetched by the host at boot (AgentSessionService.getSessionCredentials).
+  getSessionCredentials: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/session-credentials",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: GetSessionCredentialsRequestSchema,
+    responses: {
+      200: SessionCredentialsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // get_convex_deployments (Convex integration PR 3): the read-only broker. Every
   // connected Convex deployment for the run's OWN org, each with its function
   // inventory. No request identifier at all — see the schema block above. No 404:
@@ -46555,8 +46613,8 @@ var SetupVerifyResponseSchema = external_exports.object({
     })
   )
 });
-var SetupShareLinkRequestSchema = external_exports.object({ runVersion: RunVersionSchema2 });
-var SetupShareLinkResponseSchema = external_exports.object({ shareLink: external_exports.string().nullable() });
+var SetupNotesRequestSchema = external_exports.object({ runVersion: RunVersionSchema2 });
+var SetupNotesResponseSchema = external_exports.object({ notes: external_exports.string().nullable() });
 
 // ../../packages/api-contracts/src/contracts/v1/setup-session-internal.ts
 var c81 = initContract();
@@ -46600,12 +46658,12 @@ var setupSessionInternalContract = c81.router({
     body: SetupVerifyRequestSchema,
     responses: { 200: SetupVerifyResponseSchema, ...errors6 }
   },
-  getSetupShareLink: {
+  getSetupNotes: {
     method: "POST",
-    path: `${base2}/share-link`,
+    path: `${base2}/notes`,
     pathParams: pathParams2,
-    body: SetupShareLinkRequestSchema,
-    responses: { 200: SetupShareLinkResponseSchema, ...errors6 }
+    body: SetupNotesRequestSchema,
+    responses: { 200: SetupNotesResponseSchema, ...errors6 }
   }
 });
 
@@ -59077,7 +59135,8 @@ function buildUpdatePentestBody(input) {
     ...input.title !== void 0 ? { title: input.title } : {},
     ...input.description !== void 0 ? { description: input.description } : {},
     ...input.customerConcernsContext !== void 0 ? { customerConcernsContext: input.customerConcernsContext } : {},
-    ...input.customerPriorityCategories !== void 0 ? { customerPriorityCategories: input.customerPriorityCategories } : {}
+    ...input.customerPriorityCategories !== void 0 ? { customerPriorityCategories: input.customerPriorityCategories } : {},
+    ...input.staffNotes !== void 0 ? { staffNotes: input.staffNotes } : {}
   };
 }
 function isEmptyPentestUpdate(body) {
@@ -59179,12 +59238,15 @@ function printPentestUpdateDetail(pt) {
       `${"Description:".padEnd(pad)} ${pt.description ? sanitizeDisplay(truncateForDisplay(pt.description)) : "\u2014"}`,
       `${"Priorities:".padEnd(pad)} ${sanitizeDisplay(formatPriorities(pt.customerPriorityCategories))}`,
       `${"Concerns:".padEnd(pad)} ${pt.customerConcernsContext ? sanitizeDisplay(truncateForDisplay(pt.customerConcernsContext)) : "\u2014"}`,
+      `${"Staff notes:".padEnd(pad)} ${pt.staffNotes ? sanitizeDisplay(truncateForDisplay(pt.staffNotes)) : "\u2014"}`,
       `${"Updated:".padEnd(pad)} ${toIso(pt.updatedAt)}`
     ].join("\n")
   );
 }
 function printPentestUpdateTsv(pt) {
-  console.log("displayId	title	status	phase	description	priorities	concerns	updatedAt");
+  console.log(
+    "displayId	title	status	phase	description	priorities	concerns	staffNotes	updatedAt"
+  );
   console.log(
     [
       `PT-${pt.displayId}`,
@@ -59194,6 +59256,7 @@ function printPentestUpdateTsv(pt) {
       tsvSafe2(sanitizeDisplay(pt.description ?? "")),
       tsvSafe2(sanitizeDisplay(pt.customerPriorityCategories.join(","))),
       tsvSafe2(sanitizeDisplay(pt.customerConcernsContext ?? "")),
+      tsvSafe2(sanitizeDisplay(pt.staffNotes ?? "")),
       toIso(pt.updatedAt)
     ].join("	")
   );
@@ -59230,16 +59293,26 @@ async function runUpdate5(pentestIdentifier, options) {
     console.error(colorError(priorities.error));
     process.exit(1);
   }
+  const staffNotes = resolveClearableOption(
+    options.staffNotes,
+    options.clearStaffNotes,
+    "staff-notes"
+  );
+  if ("error" in staffNotes) {
+    console.error(colorError(staffNotes.error));
+    process.exit(1);
+  }
   const body = buildUpdatePentestBody({
     title: options.title,
     description: description.value,
     customerConcernsContext: concerns.value,
-    customerPriorityCategories: priorities.value
+    customerPriorityCategories: priorities.value,
+    staffNotes: staffNotes.value
   });
   if (isEmptyPentestUpdate(body)) {
     console.error(
       colorError(
-        "Nothing to update. Pass at least one of --title, --description, --clear-description, --concerns, --clear-concerns, --priority, --clear-priorities."
+        "Nothing to update. Pass at least one of --title, --description, --clear-description, --concerns, --clear-concerns, --priority, --clear-priorities, --staff-notes, --clear-staff-notes."
       )
     );
     process.exit(1);
@@ -59252,19 +59325,30 @@ async function runUpdate5(pentestIdentifier, options) {
   if (result.status !== SUCCESS_STATUS) {
     failPentestUpdate(result.status, result.body, pentestIdentifier);
   }
+  if (staffNotesIgnoredByApi(body, result.body)) {
+    console.error(
+      colorError(
+        "This API does not support staff notes yet, so they were not saved. Any other fields you passed were saved."
+      )
+    );
+    process.exit(1);
+  }
   if (output === "table") {
     console.log(colorSuccess(`Updated pentest PT-${result.body.displayId}`));
   }
   outputPentestUpdate(result.body, output);
 }
+function staffNotesIgnoredByApi(body, response) {
+  return body.staffNotes !== void 0 && !("staffNotes" in response);
+}
 function createUpdateCommand4() {
   return new Command("update").description(
-    "Update pentest details and agent brief (staff-only: title, description, priorities, concerns)"
+    "Update pentest details and agent brief (staff-only: title, description, priorities, concerns, staff notes)"
   ).argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <title>", "Engagement title").option("--description <text>", "Engagement description").option("--clear-description", "Clear the engagement description").option("--concerns <text>", "Agent-brief concerns (threat-model context)").option("--clear-concerns", "Clear agent-brief concerns").option(
     "--priority <category>",
     `Agent-brief priority category (repeatable). One of: ${PRIORITY_LIST}`,
     collectPriority
-  ).option("--clear-priorities", "Clear all agent-brief priority categories").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  ).option("--clear-priorities", "Clear all agent-brief priority categories").option("--staff-notes <text>", "Guidance for the agent sessions on this pentest").option("--clear-staff-notes", "Clear the staff notes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Staff-only. Requires a browser session from \`tracecli auth login\` with a Trace
@@ -59277,6 +59361,7 @@ Examples:
   tracecli pentest update PT-3 --priority AUTHN_BYPASS --priority AUTHZ_IDOR
   tracecli pentest update PT-3 --concerns "Worried about IDOR on invoice IDs"
   tracecli pentest update PT-3 --clear-concerns --clear-priorities
+  tracecli pentest update PT-3 --staff-notes "Staging is behind a Cloudflare challenge; use headed agent-browser"
   tracecli pentest update PT-3 --title "Acme Q3" -o json`
   ).action(async (pentestId, options) => {
     await runUpdate5(pentestId, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {