securewithtrace 0.50.0 → 0.52.0

package/dist/index.js

@@ -17612,14 +17612,16 @@ var SEGMENT = new RegExp(`[A-Za-z0-9_+-]{${MIN_RUN},}`, "g");
 
 // ../../packages/core/src/agent-session/versions.ts
 var COORDINATOR_TOOLSET_VERSION = "coordinator-tools-v4";
-var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v7";
-var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v8";
+var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v9";
+var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v10";
 var OPERATOR_REVIEW_V1_PROMPT_VERSION = "operator-review-v1";
 var OPERATOR_REVIEW_V2_PROMPT_VERSION = "operator-review-v2";
 var OPERATOR_REVIEW_V3_PROMPT_VERSION = "operator-review-v3";
 var OPERATOR_REVIEW_V4_PROMPT_VERSION = "operator-review-v4";
 var OPERATOR_REVIEW_V5_PROMPT_VERSION = "operator-review-v5";
 var OPERATOR_REVIEW_V6_PROMPT_VERSION = "operator-review-v6";
+var OPERATOR_REVIEW_V7_PROMPT_VERSION = "operator-review-v7";
+var OPERATOR_REVIEW_V8_PROMPT_VERSION = "operator-review-v8";
 var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V1_PROMPT_VERSION,
   OPERATOR_REVIEW_V2_PROMPT_VERSION,
@@ -17627,6 +17629,8 @@ var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V4_PROMPT_VERSION,
   OPERATOR_REVIEW_V5_PROMPT_VERSION,
   OPERATOR_REVIEW_V6_PROMPT_VERSION,
+  OPERATOR_REVIEW_V7_PROMPT_VERSION,
+  OPERATOR_REVIEW_V8_PROMPT_VERSION,
   OPERATOR_REVIEW_PROMPT_VERSION,
   OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION
 ];
@@ -18243,6 +18247,16 @@ var REVIEW_OOB_PROFILE_SUCCESSIONS = [
       toolsetVersion: "operator-tools-v10"
     }
   },
+  {
+    successor: {
+      promptVersion: OPERATOR_REVIEW_V7_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v12"
+    },
+    predecessor: {
+      promptVersion: OPERATOR_REVIEW_V8_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v10"
+    }
+  },
   {
     successor: {
       promptVersion: OPERATOR_REVIEW_PROMPT_VERSION,
@@ -23193,12 +23207,6 @@ var AgentSessionTypeValues = [
   "SETUP"
 ];
 var AgentSessionType = external_exports.enum(AgentSessionTypeValues);
-var SetupTenantSchema = external_exports.object({
-  admin: external_exports.boolean(),
-  member: external_exports.boolean(),
-  apiKey: external_exports.boolean()
-}).strict();
-var MAX_SETUP_TENANTS = 4;
 var AgentSessionStatusValues = [
   "LAUNCHING",
   "RUNNING",
@@ -23251,6 +23259,7 @@ var MAX_AGENT_SESSION_MAX_USD = 1500;
 var MAX_AGENT_SESSION_MAX_WALL_CLOCK_MIN = 24 * 60;
 var MAX_AGENT_SESSION_FOCUS_CHARS = 8e3;
 var MAX_AGENT_SESSION_FOCUS_BRIEF_CHARS = MAX_AGENT_SESSION_FOCUS_CHARS * 3;
+var MAX_SETUP_NOTES_CHARS = 8e3;
 var OperatorSessionPurpose = external_exports.enum(OPERATOR_PURPOSES);
 var CreateAgentSessionCommonSchema = external_exports.object({
   provider: AgentSessionProvider.optional(),
@@ -23363,16 +23372,14 @@ var CreateAgentSessionRequestSchema = external_exports.discriminatedUnion("type"
     focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional()
   }),
   // SETUP: sets up a PoC engagement's application, environment, exclusions and tenant
-  // accounts. `focus` carries the staff notes (which environment, rate limits, what is
-  // off-limits); `tenants` the accounts to aim for; `shareLink` the customer's logins.
+  // accounts from the setup notes. Strict, so a client still sending the removed `focus`,
+  // `tenants` or `shareLink` gets a 400 instead of a launch that silently lost its input.
   CreateAgentSessionCommonSchema.extend({
     type: external_exports.literal("SETUP"),
-    focus: external_exports.string().min(1).max(MAX_AGENT_SESSION_FOCUS_CHARS).optional(),
-    /** Absent = the default target, two tenants of admin + member + API key. */
-    tenants: external_exports.array(SetupTenantSchema).min(1).max(MAX_SETUP_TENANTS).optional(),
-    /** A credential share link. Stored encrypted and never returned by any read route. */
-    shareLink: external_exports.url({ protocol: /^https$/ }).max(2048).optional()
-  })
+    /** What the customer sent and what staff want: environments, rules, logins, share links.
+     *  Stored encrypted and never returned by any read route. */
+    notes: external_exports.string().trim().min(1).max(MAX_SETUP_NOTES_CHARS).optional()
+  }).strict()
 ]);
 var SendAgentSessionMessageRequestSchema = external_exports.object({
   clientRequestId: external_exports.uuid().optional(),
@@ -23389,6 +23396,10 @@ var ResumeAgentSessionRequestSchema = external_exports.object({
    *  keeps the row's current target. */
   launchTarget: AgentSessionLaunchTarget.optional()
 });
+var SetAgentSessionBudgetRequestSchema = external_exports.object({
+  /** The session's new lifetime ceiling, past spend included. Must exceed recorded spend. */
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD)
+});
 var ClaimLocalLaunchResponseSchema = external_exports.object({
   agentSessionId: external_exports.uuid(),
   runAttemptId: external_exports.uuid(),
@@ -23551,6 +23562,9 @@ var OperatorPentestContextSchema = external_exports.object({
   customerPriorityCategories: external_exports.array(external_exports.string()),
   /** Staff scope notes; defaulted so an older API's envelope still parses. */
   scopeNotes: external_exports.string().nullable().default(null),
+  /** The rendered staff-notes block (heading and never-quote line included), or null when the
+   * engagement has none or this session's type never receives them. Defaulted like `scopeNotes`. */
+  staffNotes: external_exports.string().nullable().default(null),
   /** The customer's intake answers, rendered as child briefs carry them. */
   customerIntake: external_exports.string().nullable().default(null),
   status: PentestStatus,
@@ -23898,6 +23912,22 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  setBudget: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/budget",
+    pathParams: AgentSessionIdParamsSchema,
+    body: SetAgentSessionBudgetRequestSchema,
+    responses: {
+      200: AgentSessionDetailSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // errorCode names the refusal; SESSION_NOT_LIVE means resume with the budget instead.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // The host image this environment's agent-session task definition runs. Reads
   // config, mints nothing: it exists so a staff CLI can pull the image BEFORE it
   // creates or resumes a LOCAL session, keeping the boot deadline off the pull.
@@ -28487,6 +28517,9 @@ var PentestResponseSchema = external_exports.object({
   /** Customer threat-model context — free text. Used by hypothesis-gen prompt. */
   customerConcernsContext: external_exports.string().nullable(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory),
+  /** Staff-only session guidance. Staff response only. `.optional()` for the same
+   * rolling-deploy reason as `purchaseCapUsd`: the panel row reads Unavailable without it. */
+  staffNotes: external_exports.string().nullable().optional(),
   hypothesisBudgetCapUsd: external_exports.number(),
   validationBudgetCapUsd: external_exports.number(),
   perHypothesisBudgetCapUsd: external_exports.number(),
@@ -28712,6 +28745,8 @@ var CreatePentestRequestSchema = external_exports.object({
   perHypothesisBudgetCapUsd: external_exports.number().min(0).max(1e5).optional(),
   purchaseCapUsd: external_exports.number().min(0).max(1e5).optional()
 });
+var STAFF_NOTES_MAX_CHARS = 1e4;
+var STAFF_NOTES_BRIEF_MAX_CHARS = STAFF_NOTES_MAX_CHARS * 3;
 var UpdatePentestRequestSchema = external_exports.object({
   title: external_exports.string().min(1).max(500).optional(),
   description: external_exports.string().max(1e4).nullable().optional(),
@@ -28733,6 +28768,8 @@ var UpdatePentestRequestSchema = external_exports.object({
   testType: PentestTestType.optional(),
   customerConcernsContext: external_exports.string().max(2e4).nullable().optional(),
   customerPriorityCategories: external_exports.array(CustomerPriorityCategory).max(20).optional(),
+  /** Staff-only guidance for this engagement's agent sessions; `null` clears. */
+  staffNotes: external_exports.string().max(STAFF_NOTES_MAX_CHARS).nullable().optional(),
   /** Report-cover engagement overrides. `null` clears (reverts to auto-derivation),
    * `undefined` leaves unchanged. Empty SUT is rejected — use `null` to clear. */
   systemUnderTest: external_exports.string().trim().min(1).max(200).nullable().optional(),
@@ -30394,6 +30431,46 @@ var RenewCloudCredentialsResponseSchema = external_exports.object({
   /** The most recently verified ACTIVE resource, whether or not its mint succeeded. Null when none. */
   gcpPrimaryResourceId: GcpPrefixedResourceIdSchema.nullable().optional()
 });
+var GetSessionCredentialsRequestSchema = external_exports.object({
+  runVersion: external_exports.number().int().nonnegative()
+});
+var ParsedWebCredentialSchema = external_exports.union([
+  external_exports.strictObject({
+    reference: external_exports.literal("SESSION_STATE"),
+    credentialId: external_exports.uuid(),
+    environmentId: external_exports.uuid(),
+    origin: external_exports.string()
+  }),
+  external_exports.strictObject({
+    reference: external_exports.literal("SSH_PRIVATE_KEY"),
+    credentialId: external_exports.uuid(),
+    environmentId: external_exports.uuid(),
+    host: external_exports.string(),
+    port: external_exports.number().int(),
+    username: external_exports.string()
+  }),
+  external_exports.strictObject({ username: external_exports.string(), password: external_exports.string() }),
+  external_exports.strictObject({ secretValue: external_exports.string() }),
+  external_exports.strictObject({ loginEmail: external_exports.string() })
+]);
+var WebCredentialEntrySchema = external_exports.object({
+  source: external_exports.literal("customer"),
+  label: external_exports.string(),
+  credentialType: external_exports.enum(CredentialTypeValues),
+  parsed: ParsedWebCredentialSchema,
+  authConfig: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  mfa: external_exports.object({ kind: external_exports.string() }).optional(),
+  passkeys: external_exports.number().int().positive().optional()
+});
+var SessionCredentialsResponseSchema = external_exports.object({
+  /** Empty when the type gets no web credentials or none resolved. */
+  webCredentials: external_exports.array(WebCredentialEntrySchema),
+  vercel: external_exports.object({ token: external_exports.string(), teamId: external_exports.string().nullable() }).nullable(),
+  browserAllowedBaseUrls: external_exports.array(external_exports.string()),
+  browserExclusions: external_exports.array(external_exports.string()),
+  /** API_COVERAGE only; null otherwise. Range checks stay with the host's rate parser. */
+  requestRate: external_exports.object({ perSec: external_exports.number(), burst: external_exports.number() }).nullable()
+});
 var ConvexReconRequestSchema = external_exports.object({
   runVersion: external_exports.number().int().nonnegative()
 });
@@ -31984,6 +32061,21 @@ var agentSessionInternalContract = c4.router({
       500: ErrorResponseSchema
     }
   },
+  // The session's credentials, fetched by the host at boot (AgentSessionService.getSessionCredentials).
+  getSessionCredentials: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/session-credentials",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: GetSessionCredentialsRequestSchema,
+    responses: {
+      200: SessionCredentialsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // get_convex_deployments (Convex integration PR 3): the read-only broker. Every
   // connected Convex deployment for the run's OWN org, each with its function
   // inventory. No request identifier at all — see the schema block above. No 404:
@@ -45146,7 +45238,9 @@ var OPENAI_SESSION_TYPES = [
   "RETEST",
   "REPORT",
   "RECON",
-  "API_COVERAGE"
+  "API_COVERAGE",
+  "PRODUCT_RECON",
+  "CODE_REVIEW"
 ];
 var AGENT_SESSION_MODELS = [
   {
@@ -46555,8 +46649,8 @@ var SetupVerifyResponseSchema = external_exports.object({
     })
   )
 });
-var SetupShareLinkRequestSchema = external_exports.object({ runVersion: RunVersionSchema2 });
-var SetupShareLinkResponseSchema = external_exports.object({ shareLink: external_exports.string().nullable() });
+var SetupNotesRequestSchema = external_exports.object({ runVersion: RunVersionSchema2 });
+var SetupNotesResponseSchema = external_exports.object({ notes: external_exports.string().nullable() });
 
 // ../../packages/api-contracts/src/contracts/v1/setup-session-internal.ts
 var c81 = initContract();
@@ -46600,12 +46694,12 @@ var setupSessionInternalContract = c81.router({
     body: SetupVerifyRequestSchema,
     responses: { 200: SetupVerifyResponseSchema, ...errors6 }
   },
-  getSetupShareLink: {
+  getSetupNotes: {
     method: "POST",
-    path: `${base2}/share-link`,
+    path: `${base2}/notes`,
     pathParams: pathParams2,
-    body: SetupShareLinkRequestSchema,
-    responses: { 200: SetupShareLinkResponseSchema, ...errors6 }
+    body: SetupNotesRequestSchema,
+    responses: { 200: SetupNotesResponseSchema, ...errors6 }
   }
 });
 
@@ -49201,7 +49295,7 @@ function createSetScanningBranchCommand() {
   return new Command("set-scanning-branch").description("Switch the scanning branch for one or every repository in the org").argument(
     "[repositoryUrl]",
     "Repository URL (omit when using --all-repos to switch every repo)"
-  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every connected repository in the organization").option(
+  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every GitHub repository in the organization").option(
     "--migrate-open-vulns",
     "Relabel open vulnerabilities from the previous branch to the new branch"
   ).option("-o, --output <format>", "Output format: table (default), json", "table").addHelpText(
@@ -53916,6 +54010,46 @@ function anySecretFlag(opts) {
 function anyPasswordFlag(opts) {
   return opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
 }
+function anyUsernameFlag(opts) {
+  return opts.usernameStdin === true || opts.usernameFile !== void 0 || opts.usernameEnv !== void 0;
+}
+function anySecretValueFlag(opts) {
+  return opts.secretStdin === true || opts.secretFile !== void 0 || opts.secretEnv !== void 0;
+}
+function withArticle(kebab) {
+  return `${/^(api|ssh)-/.test(kebab) ? "An" : "A"} ${kebab}`;
+}
+function rotateFlagProblem(type, opts) {
+  const kebab = credentialTypeKebab(type);
+  if (type === "USERNAME_PASSWORD") {
+    if (anySecretValueFlag(opts)) {
+      return `${withArticle(kebab)} credential takes --username-* and --password-*, not --secret-*.`;
+    }
+    if (!anyUsernameFlag(opts) || !anyPasswordFlag(opts)) {
+      return "Pass both --username-* and --password-*: the login is replaced as a pair.";
+    }
+    if (usesStdin(usernameOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --username-file/-env for the other.";
+    }
+    return null;
+  }
+  if (anyUsernameFlag(opts)) {
+    return `${withArticle(kebab)} credential has no username. Pass the new secret with --secret-*.`;
+  }
+  if (type === "SSH_PRIVATE_KEY") {
+    if (!anySecretValueFlag(opts)) {
+      return "Pass the key with --secret-* too: an SSH key and its passphrase are replaced together.";
+    }
+    if (usesStdin(secretOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --password-file/-env for the passphrase.";
+    }
+    return null;
+  }
+  if (anyPasswordFlag(opts)) {
+    return `${withArticle(kebab)} credential has no password. Pass the new secret with --secret-*.`;
+  }
+  return null;
+}
 function secretOpts(opts) {
   return { stdin: opts.secretStdin, file: opts.secretFile, env: opts.secretEnv };
 }
@@ -53931,7 +54065,11 @@ function failWriteOp3(action, status, body, notFoundLabel) {
     exitAuthFailed();
   }
   if (status === 403) {
-    console.error(colorError(`Only Trace staff can ${action} credentials.`));
+    console.error(
+      colorError(
+        `You can't ${action} credentials here. That needs an organization admin signed in with \`tracecli auth login\`; API keys are rejected.`
+      )
+    );
     process.exit(1);
   }
   if (status === 404) {
@@ -54248,6 +54386,43 @@ async function buildCreateBody(type, label, options) {
     }
   }
 }
+async function buildRotateBody(type, options) {
+  switch (type) {
+    case "USERNAME_PASSWORD": {
+      const username = await resolveSecret("username", "username", usernameOpts(options));
+      const password2 = await resolveSecret("password", "password", passwordOpts(options));
+      return { credentialType: type, username, password: password2 };
+    }
+    case "SSH_PRIVATE_KEY": {
+      const privateKeyPem = await resolveSecret("private key PEM", "secret", secretOpts(options));
+      const passphrase = anyPasswordFlag(options) ? await resolveSecret("key passphrase", "password", passwordOpts(options)) : void 0;
+      return {
+        credentialType: type,
+        privateKeyPem,
+        ...passphrase !== void 0 ? { passphrase } : {}
+      };
+    }
+    case "SESSION_STATE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("session state capture", "secret", secretOpts(options))
+      };
+    case "MAGIC_AUTH":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("test-account email", "secret", secretOpts(options))
+      };
+    case "BEARER_TOKEN":
+    case "JWT_TOKEN":
+    case "API_KEY":
+    case "PASSPHRASE":
+    case "COOKIE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("secret value", "secret", secretOpts(options))
+      };
+  }
+}
 async function runList3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
@@ -54298,12 +54473,7 @@ async function runUpdate3(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
-  if (anySecretFlag(options)) {
-    console.error(
-      colorError("Secrets are immutable on update. Delete and recreate the credential to rotate.")
-    );
-    process.exit(1);
-  }
+  const rotating = anySecretFlag(options);
   if (options.clearAuthConfig && anyAuthFlag(options)) {
     console.error(colorError("Pass either --clear-auth-config or auth-config flags, not both."));
     process.exit(1);
@@ -54316,16 +54486,32 @@ async function runUpdate3(credentialId, options) {
   }
   const organizationId = await resolveOrganizationId();
   const params3 = { organizationId, environmentId: options.env, credentialId };
+  const current = rotating || !options.clearAuthConfig && anyAuthFlag(options) ? await authenticatedRequest((client) => client.credential.getCredential({ params: params3 })) : null;
+  if (current && current.status !== SUCCESS_STATUS) {
+    failReadOp3("get credential", current.status, current.body, credentialId);
+  }
+  let rotateBody;
+  if (current && rotating) {
+    const type = current.body.credentialType;
+    const problem = rotateFlagProblem(type, options) ?? (options.clearAuthConfig && (type === "SSH_PRIVATE_KEY" || type === "SESSION_STATE") ? `${withArticle(credentialTypeKebab(type))} credential's auth config can't be cleared, so --clear-auth-config would fail after the secret had already changed.` : null);
+    if (problem) {
+      console.error(colorError(problem));
+      process.exit(1);
+    }
+    try {
+      rotateBody = await buildRotateBody(type, options);
+    } catch (error48) {
+      if (error48 instanceof SecretInputError) {
+        console.error(colorError(error48.message));
+        process.exit(1);
+      }
+      throw error48;
+    }
+  }
   let authConfig;
   if (options.clearAuthConfig) {
     authConfig = null;
-  } else if (anyAuthFlag(options)) {
-    const current = await authenticatedRequest(
-      (client) => client.credential.getCredential({ params: params3 })
-    );
-    if (current.status !== SUCCESS_STATUS) {
-      failReadOp3("get credential", current.status, current.body, credentialId);
-    }
+  } else if (current && anyAuthFlag(options)) {
     const type = current.body.credentialType;
     const foreign = rejectForeignAuthFlags(type, options);
     if (foreign) {
@@ -54345,24 +54531,44 @@ async function runUpdate3(credentialId, options) {
     ...options.moveEnv !== void 0 ? { environmentId: options.moveEnv } : {},
     ...authConfig !== void 0 ? { authConfig } : {}
   };
-  if (Object.keys(body).length === 0) {
+  const patching = Object.keys(body).length > 0;
+  if (!rotateBody && !patching) {
     console.error(
       colorError(
-        "Nothing to update. Pass --label, --move-env, auth-config flags, or --clear-auth-config."
+        "Nothing to update. Pass --label, --move-env, auth-config flags, --clear-auth-config, or a new secret."
       )
     );
     process.exit(1);
   }
-  const result = await authenticatedRequest(
-    (client) => client.credential.updateCredential({ params: params3, body })
-  );
-  if (result.status !== SUCCESS_STATUS) {
-    failWriteOp3("update", result.status, result.body, credentialId);
+  let updated;
+  if (rotateBody) {
+    const secret = rotateBody;
+    const rotated = await authenticatedRequest(
+      (client) => client.credential.rotateCredentialSecret({ params: params3, body: secret })
+    );
+    if (rotated.status !== SUCCESS_STATUS) {
+      failWriteOp3("update", rotated.status, rotated.body, credentialId);
+    }
+    updated = rotated.body;
   }
+  if (patching) {
+    const result = await authenticatedRequest(
+      (client) => client.credential.updateCredential({ params: params3, body })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      if (rotateBody) {
+        console.error(colorError("The secret was rotated, but the other changes were not saved."));
+      }
+      failWriteOp3("update", result.status, result.body, credentialId);
+    }
+    updated = result.body;
+  }
+  if (!updated) return;
   if (output === "table") {
-    console.log(colorSuccess(`Updated credential ${sanitizeDisplay(result.body.label)}`));
+    const verb = rotateBody ? patching ? "Rotated the secret and updated" : "Rotated the secret of" : "Updated";
+    console.log(colorSuccess(`${verb} credential ${sanitizeDisplay(updated.label)}`));
   }
-  outputCredential(result.body, output);
+  outputCredential(updated, output);
 }
 function failMfaOp(action, status, body, credentialId) {
   const { message, errorCode } = readErrorFields(body);
@@ -55043,18 +55249,22 @@ function createGetCommand2() {
   });
 }
 function createUpdateCommand2() {
-  const command = new Command("update").description("Update a credential (label, environment, or auth config; secrets are immutable)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
+  const command = new Command("update").description("Update a credential (label, environment, auth config, or secret)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
   addSecretInputOptions(command);
   addAuthConfigOptions(command).addHelpText(
     "after",
     `
 Auth-config flags must match the credential's existing type (looked up automatically).
-Secrets cannot be changed here \u2014 delete and recreate to rotate.
+A secret flag rotates the secret in place: the credential keeps its ID and scan history.
+A username/password credential takes both --username-* and --password-*; an SSH key
+takes --secret-* for the key and --password-* for its passphrase, if it has one.
 
 Examples:
   tracecli credential update <id> --env <envId> --label "prod (rotated 2026-06)"
   tracecli credential update <id> --env <envId> --login-url https://acme.com/signin
-  tracecli credential update <id> --env <envId> --clear-auth-config`
+  tracecli credential update <id> --env <envId> --clear-auth-config
+  vault read -field=token secret/x | tracecli credential update <id> --env <envId> --secret-stdin
+  tracecli credential update <id> --env <envId> --username-env LOGIN_USER --password-env LOGIN_PASS`
   );
   return command.action(async (credentialId, options) => {
     await runUpdate3(credentialId, options);
@@ -59061,7 +59271,7 @@ function createFindingsCommand() {
   findings.addCommand(createGetFindingCommand());
   findings.addCommand(createGetFindingReproCommand());
   findings.addCommand(createStatusUpdateCommand());
-  findings.addCommand(createAttachEvidenceCommand());
+  findings.addCommand(createAttachEvidenceCommand(), { hidden: true });
   findings.addCommand(createCreateFindingCommand(), { hidden: true });
   findings.addCommand(createCopyFindingsCommand(), { hidden: true });
   findings.addCommand(createPublishFindingsCommand(), { hidden: true });
@@ -59077,7 +59287,8 @@ function buildUpdatePentestBody(input) {
     ...input.title !== void 0 ? { title: input.title } : {},
     ...input.description !== void 0 ? { description: input.description } : {},
     ...input.customerConcernsContext !== void 0 ? { customerConcernsContext: input.customerConcernsContext } : {},
-    ...input.customerPriorityCategories !== void 0 ? { customerPriorityCategories: input.customerPriorityCategories } : {}
+    ...input.customerPriorityCategories !== void 0 ? { customerPriorityCategories: input.customerPriorityCategories } : {},
+    ...input.staffNotes !== void 0 ? { staffNotes: input.staffNotes } : {}
   };
 }
 function isEmptyPentestUpdate(body) {
@@ -59179,12 +59390,15 @@ function printPentestUpdateDetail(pt) {
       `${"Description:".padEnd(pad)} ${pt.description ? sanitizeDisplay(truncateForDisplay(pt.description)) : "\u2014"}`,
       `${"Priorities:".padEnd(pad)} ${sanitizeDisplay(formatPriorities(pt.customerPriorityCategories))}`,
       `${"Concerns:".padEnd(pad)} ${pt.customerConcernsContext ? sanitizeDisplay(truncateForDisplay(pt.customerConcernsContext)) : "\u2014"}`,
+      `${"Staff notes:".padEnd(pad)} ${pt.staffNotes ? sanitizeDisplay(truncateForDisplay(pt.staffNotes)) : "\u2014"}`,
       `${"Updated:".padEnd(pad)} ${toIso(pt.updatedAt)}`
     ].join("\n")
   );
 }
 function printPentestUpdateTsv(pt) {
-  console.log("displayId	title	status	phase	description	priorities	concerns	updatedAt");
+  console.log(
+    "displayId	title	status	phase	description	priorities	concerns	staffNotes	updatedAt"
+  );
   console.log(
     [
       `PT-${pt.displayId}`,
@@ -59194,6 +59408,7 @@ function printPentestUpdateTsv(pt) {
       tsvSafe2(sanitizeDisplay(pt.description ?? "")),
       tsvSafe2(sanitizeDisplay(pt.customerPriorityCategories.join(","))),
       tsvSafe2(sanitizeDisplay(pt.customerConcernsContext ?? "")),
+      tsvSafe2(sanitizeDisplay(pt.staffNotes ?? "")),
       toIso(pt.updatedAt)
     ].join("	")
   );
@@ -59230,16 +59445,26 @@ async function runUpdate5(pentestIdentifier, options) {
     console.error(colorError(priorities.error));
     process.exit(1);
   }
+  const staffNotes = resolveClearableOption(
+    options.staffNotes,
+    options.clearStaffNotes,
+    "staff-notes"
+  );
+  if ("error" in staffNotes) {
+    console.error(colorError(staffNotes.error));
+    process.exit(1);
+  }
   const body = buildUpdatePentestBody({
     title: options.title,
     description: description.value,
     customerConcernsContext: concerns.value,
-    customerPriorityCategories: priorities.value
+    customerPriorityCategories: priorities.value,
+    staffNotes: staffNotes.value
   });
   if (isEmptyPentestUpdate(body)) {
     console.error(
       colorError(
-        "Nothing to update. Pass at least one of --title, --description, --clear-description, --concerns, --clear-concerns, --priority, --clear-priorities."
+        "Nothing to update. Pass at least one of --title, --description, --clear-description, --concerns, --clear-concerns, --priority, --clear-priorities, --staff-notes, --clear-staff-notes."
       )
     );
     process.exit(1);
@@ -59252,19 +59477,30 @@ async function runUpdate5(pentestIdentifier, options) {
   if (result.status !== SUCCESS_STATUS) {
     failPentestUpdate(result.status, result.body, pentestIdentifier);
   }
+  if (staffNotesIgnoredByApi(body, result.body)) {
+    console.error(
+      colorError(
+        "This API does not support staff notes yet, so they were not saved. Any other fields you passed were saved."
+      )
+    );
+    process.exit(1);
+  }
   if (output === "table") {
     console.log(colorSuccess(`Updated pentest PT-${result.body.displayId}`));
   }
   outputPentestUpdate(result.body, output);
 }
+function staffNotesIgnoredByApi(body, response) {
+  return body.staffNotes !== void 0 && !("staffNotes" in response);
+}
 function createUpdateCommand4() {
   return new Command("update").description(
-    "Update pentest details and agent brief (staff-only: title, description, priorities, concerns)"
+    "Update pentest details and agent brief (staff-only: title, description, priorities, concerns, staff notes)"
   ).argument("<pentestId>", "Pentest display ID (e.g. PT-3) or UUID").option("--title <title>", "Engagement title").option("--description <text>", "Engagement description").option("--clear-description", "Clear the engagement description").option("--concerns <text>", "Agent-brief concerns (threat-model context)").option("--clear-concerns", "Clear agent-brief concerns").option(
     "--priority <category>",
     `Agent-brief priority category (repeatable). One of: ${PRIORITY_LIST}`,
     collectPriority
-  ).option("--clear-priorities", "Clear all agent-brief priority categories").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+  ).option("--clear-priorities", "Clear all agent-brief priority categories").option("--staff-notes <text>", "Guidance for the agent sessions on this pentest").option("--clear-staff-notes", "Clear the staff notes").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
     "after",
     `
 Staff-only. Requires a browser session from \`tracecli auth login\` with a Trace
@@ -59277,6 +59513,7 @@ Examples:
   tracecli pentest update PT-3 --priority AUTHN_BYPASS --priority AUTHZ_IDOR
   tracecli pentest update PT-3 --concerns "Worried about IDOR on invoice IDs"
   tracecli pentest update PT-3 --clear-concerns --clear-priorities
+  tracecli pentest update PT-3 --staff-notes "Staging is behind a Cloudflare challenge; use headed agent-browser"
   tracecli pentest update PT-3 --title "Acme Q3" -o json`
   ).action(async (pentestId, options) => {
     await runUpdate5(pentestId, options);
@@ -59586,7 +59823,7 @@ Examples:
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand7());
-  pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createUpdateCommand4(), { hidden: true });
   pentest.addCommand(createCreatePentestCommand(), { hidden: true });
   pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
@@ -61320,7 +61557,7 @@ function parseVulnerabilityFilter(expression) {
   const match = expression.match(/^([^!=]+)(!=|=)(.+)$/);
   if (!match?.[1] || !match[2] || !match[3]) {
     return {
-      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. cweId=CWE-89).`
+      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. scanMode=SAST).`
     };
   }
   const field = match[1].trim();
@@ -61561,7 +61798,7 @@ function createListCommand9() {
     }
   ).option(
     "-f, --filter <expression>",
-    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: vulnerabilityType, cweId, scanMode (and any other API-supported field).",
+    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: scanMode (SAST, SCA, SECRETS, DAST), severity, status, repositoryId.",
     (value, previous) => [...previous, value],
     []
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerabilities dashboard in a browser").option("--no-pager", "Disable the interactive arrow-key pager for table output").addHelpText(
@@ -61571,8 +61808,7 @@ Examples:
   tracecli vulnerabilities list
   tracecli vulnerabilities list --severity CRITICAL --status OPEN
   tracecli vulnerabilities list --repo securewithtrace/trace --limit 50
-  tracecli vulnerabilities list --filter cweId=CWE-89
-  tracecli vulnerabilities list --filter vulnerabilityType=SAST --filter scanMode=sast
+  tracecli vulnerabilities list --filter scanMode=SECRETS
   tracecli vulnerabilities list --output json | jq '.[].title'
   tracecli vulnerabilities list --output tsv | cut -f1,7
   tracecli vulnerabilities list --no-pager
@@ -61695,7 +61931,7 @@ program2.addCommand(createEnvironmentCommand());
 program2.addCommand(createCredentialCommand());
 program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
-program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createVulnerabilitiesCommand(), { hidden: true });
 program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {