securewithtrace 0.51.0 → 0.52.0

package/dist/index.js

@@ -17612,14 +17612,16 @@ var SEGMENT = new RegExp(`[A-Za-z0-9_+-]{${MIN_RUN},}`, "g");
 
 // ../../packages/core/src/agent-session/versions.ts
 var COORDINATOR_TOOLSET_VERSION = "coordinator-tools-v4";
-var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v7";
-var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v8";
+var OPERATOR_REVIEW_PROMPT_VERSION = "operator-review-v9";
+var OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION = "operator-review-v10";
 var OPERATOR_REVIEW_V1_PROMPT_VERSION = "operator-review-v1";
 var OPERATOR_REVIEW_V2_PROMPT_VERSION = "operator-review-v2";
 var OPERATOR_REVIEW_V3_PROMPT_VERSION = "operator-review-v3";
 var OPERATOR_REVIEW_V4_PROMPT_VERSION = "operator-review-v4";
 var OPERATOR_REVIEW_V5_PROMPT_VERSION = "operator-review-v5";
 var OPERATOR_REVIEW_V6_PROMPT_VERSION = "operator-review-v6";
+var OPERATOR_REVIEW_V7_PROMPT_VERSION = "operator-review-v7";
+var OPERATOR_REVIEW_V8_PROMPT_VERSION = "operator-review-v8";
 var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V1_PROMPT_VERSION,
   OPERATOR_REVIEW_V2_PROMPT_VERSION,
@@ -17627,6 +17629,8 @@ var OPERATOR_REVIEW_PROMPT_VERSIONS = [
   OPERATOR_REVIEW_V4_PROMPT_VERSION,
   OPERATOR_REVIEW_V5_PROMPT_VERSION,
   OPERATOR_REVIEW_V6_PROMPT_VERSION,
+  OPERATOR_REVIEW_V7_PROMPT_VERSION,
+  OPERATOR_REVIEW_V8_PROMPT_VERSION,
   OPERATOR_REVIEW_PROMPT_VERSION,
   OPERATOR_REVIEW_FALLBACK_PROMPT_VERSION
 ];
@@ -18243,6 +18247,16 @@ var REVIEW_OOB_PROFILE_SUCCESSIONS = [
       toolsetVersion: "operator-tools-v10"
     }
   },
+  {
+    successor: {
+      promptVersion: OPERATOR_REVIEW_V7_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v12"
+    },
+    predecessor: {
+      promptVersion: OPERATOR_REVIEW_V8_PROMPT_VERSION,
+      toolsetVersion: "operator-tools-v10"
+    }
+  },
   {
     successor: {
       promptVersion: OPERATOR_REVIEW_PROMPT_VERSION,
@@ -23382,6 +23396,10 @@ var ResumeAgentSessionRequestSchema = external_exports.object({
    *  keeps the row's current target. */
   launchTarget: AgentSessionLaunchTarget.optional()
 });
+var SetAgentSessionBudgetRequestSchema = external_exports.object({
+  /** The session's new lifetime ceiling, past spend included. Must exceed recorded spend. */
+  maxUsd: external_exports.number().positive().max(MAX_AGENT_SESSION_MAX_USD)
+});
 var ClaimLocalLaunchResponseSchema = external_exports.object({
   agentSessionId: external_exports.uuid(),
   runAttemptId: external_exports.uuid(),
@@ -23894,6 +23912,22 @@ var agentSessionContract = c2.router({
       500: ErrorResponseSchema
     }
   },
+  setBudget: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/agent-sessions/:agentSessionId/budget",
+    pathParams: AgentSessionIdParamsSchema,
+    body: SetAgentSessionBudgetRequestSchema,
+    responses: {
+      200: AgentSessionDetailSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      // errorCode names the refusal; SESSION_NOT_LIVE means resume with the budget instead.
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   // The host image this environment's agent-session task definition runs. Reads
   // config, mints nothing: it exists so a staff CLI can pull the image BEFORE it
   // creates or resumes a LOCAL session, keeping the boot deadline off the pull.
@@ -45204,7 +45238,9 @@ var OPENAI_SESSION_TYPES = [
   "RETEST",
   "REPORT",
   "RECON",
-  "API_COVERAGE"
+  "API_COVERAGE",
+  "PRODUCT_RECON",
+  "CODE_REVIEW"
 ];
 var AGENT_SESSION_MODELS = [
   {
@@ -49259,7 +49295,7 @@ function createSetScanningBranchCommand() {
   return new Command("set-scanning-branch").description("Switch the scanning branch for one or every repository in the org").argument(
     "[repositoryUrl]",
     "Repository URL (omit when using --all-repos to switch every repo)"
-  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every connected repository in the organization").option(
+  ).requiredOption("--branch <name>", "New scanning branch name").option("--all-repos", "Apply the switch to every GitHub repository in the organization").option(
     "--migrate-open-vulns",
     "Relabel open vulnerabilities from the previous branch to the new branch"
   ).option("-o, --output <format>", "Output format: table (default), json", "table").addHelpText(
@@ -53974,6 +54010,46 @@ function anySecretFlag(opts) {
 function anyPasswordFlag(opts) {
   return opts.passwordStdin === true || opts.passwordFile !== void 0 || opts.passwordEnv !== void 0;
 }
+function anyUsernameFlag(opts) {
+  return opts.usernameStdin === true || opts.usernameFile !== void 0 || opts.usernameEnv !== void 0;
+}
+function anySecretValueFlag(opts) {
+  return opts.secretStdin === true || opts.secretFile !== void 0 || opts.secretEnv !== void 0;
+}
+function withArticle(kebab) {
+  return `${/^(api|ssh)-/.test(kebab) ? "An" : "A"} ${kebab}`;
+}
+function rotateFlagProblem(type, opts) {
+  const kebab = credentialTypeKebab(type);
+  if (type === "USERNAME_PASSWORD") {
+    if (anySecretValueFlag(opts)) {
+      return `${withArticle(kebab)} credential takes --username-* and --password-*, not --secret-*.`;
+    }
+    if (!anyUsernameFlag(opts) || !anyPasswordFlag(opts)) {
+      return "Pass both --username-* and --password-*: the login is replaced as a pair.";
+    }
+    if (usesStdin(usernameOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --username-file/-env for the other.";
+    }
+    return null;
+  }
+  if (anyUsernameFlag(opts)) {
+    return `${withArticle(kebab)} credential has no username. Pass the new secret with --secret-*.`;
+  }
+  if (type === "SSH_PRIVATE_KEY") {
+    if (!anySecretValueFlag(opts)) {
+      return "Pass the key with --secret-* too: an SSH key and its passphrase are replaced together.";
+    }
+    if (usesStdin(secretOpts(opts)) && usesStdin(passwordOpts(opts))) {
+      return "Only one secret can come from stdin. Use --password-file/-env for the passphrase.";
+    }
+    return null;
+  }
+  if (anyPasswordFlag(opts)) {
+    return `${withArticle(kebab)} credential has no password. Pass the new secret with --secret-*.`;
+  }
+  return null;
+}
 function secretOpts(opts) {
   return { stdin: opts.secretStdin, file: opts.secretFile, env: opts.secretEnv };
 }
@@ -53989,7 +54065,11 @@ function failWriteOp3(action, status, body, notFoundLabel) {
     exitAuthFailed();
   }
   if (status === 403) {
-    console.error(colorError(`Only Trace staff can ${action} credentials.`));
+    console.error(
+      colorError(
+        `You can't ${action} credentials here. That needs an organization admin signed in with \`tracecli auth login\`; API keys are rejected.`
+      )
+    );
     process.exit(1);
   }
   if (status === 404) {
@@ -54306,6 +54386,43 @@ async function buildCreateBody(type, label, options) {
     }
   }
 }
+async function buildRotateBody(type, options) {
+  switch (type) {
+    case "USERNAME_PASSWORD": {
+      const username = await resolveSecret("username", "username", usernameOpts(options));
+      const password2 = await resolveSecret("password", "password", passwordOpts(options));
+      return { credentialType: type, username, password: password2 };
+    }
+    case "SSH_PRIVATE_KEY": {
+      const privateKeyPem = await resolveSecret("private key PEM", "secret", secretOpts(options));
+      const passphrase = anyPasswordFlag(options) ? await resolveSecret("key passphrase", "password", passwordOpts(options)) : void 0;
+      return {
+        credentialType: type,
+        privateKeyPem,
+        ...passphrase !== void 0 ? { passphrase } : {}
+      };
+    }
+    case "SESSION_STATE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("session state capture", "secret", secretOpts(options))
+      };
+    case "MAGIC_AUTH":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("test-account email", "secret", secretOpts(options))
+      };
+    case "BEARER_TOKEN":
+    case "JWT_TOKEN":
+    case "API_KEY":
+    case "PASSPHRASE":
+    case "COOKIE":
+      return {
+        credentialType: type,
+        secretValue: await resolveSecret("secret value", "secret", secretOpts(options))
+      };
+  }
+}
 async function runList3(options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
@@ -54356,12 +54473,7 @@ async function runUpdate3(credentialId, options) {
   const output = parseOutput(options.output);
   requireEnvId(options.env);
   requireCredId(credentialId);
-  if (anySecretFlag(options)) {
-    console.error(
-      colorError("Secrets are immutable on update. Delete and recreate the credential to rotate.")
-    );
-    process.exit(1);
-  }
+  const rotating = anySecretFlag(options);
   if (options.clearAuthConfig && anyAuthFlag(options)) {
     console.error(colorError("Pass either --clear-auth-config or auth-config flags, not both."));
     process.exit(1);
@@ -54374,16 +54486,32 @@ async function runUpdate3(credentialId, options) {
   }
   const organizationId = await resolveOrganizationId();
   const params3 = { organizationId, environmentId: options.env, credentialId };
+  const current = rotating || !options.clearAuthConfig && anyAuthFlag(options) ? await authenticatedRequest((client) => client.credential.getCredential({ params: params3 })) : null;
+  if (current && current.status !== SUCCESS_STATUS) {
+    failReadOp3("get credential", current.status, current.body, credentialId);
+  }
+  let rotateBody;
+  if (current && rotating) {
+    const type = current.body.credentialType;
+    const problem = rotateFlagProblem(type, options) ?? (options.clearAuthConfig && (type === "SSH_PRIVATE_KEY" || type === "SESSION_STATE") ? `${withArticle(credentialTypeKebab(type))} credential's auth config can't be cleared, so --clear-auth-config would fail after the secret had already changed.` : null);
+    if (problem) {
+      console.error(colorError(problem));
+      process.exit(1);
+    }
+    try {
+      rotateBody = await buildRotateBody(type, options);
+    } catch (error48) {
+      if (error48 instanceof SecretInputError) {
+        console.error(colorError(error48.message));
+        process.exit(1);
+      }
+      throw error48;
+    }
+  }
   let authConfig;
   if (options.clearAuthConfig) {
     authConfig = null;
-  } else if (anyAuthFlag(options)) {
-    const current = await authenticatedRequest(
-      (client) => client.credential.getCredential({ params: params3 })
-    );
-    if (current.status !== SUCCESS_STATUS) {
-      failReadOp3("get credential", current.status, current.body, credentialId);
-    }
+  } else if (current && anyAuthFlag(options)) {
     const type = current.body.credentialType;
     const foreign = rejectForeignAuthFlags(type, options);
     if (foreign) {
@@ -54403,24 +54531,44 @@ async function runUpdate3(credentialId, options) {
     ...options.moveEnv !== void 0 ? { environmentId: options.moveEnv } : {},
     ...authConfig !== void 0 ? { authConfig } : {}
   };
-  if (Object.keys(body).length === 0) {
+  const patching = Object.keys(body).length > 0;
+  if (!rotateBody && !patching) {
     console.error(
       colorError(
-        "Nothing to update. Pass --label, --move-env, auth-config flags, or --clear-auth-config."
+        "Nothing to update. Pass --label, --move-env, auth-config flags, --clear-auth-config, or a new secret."
       )
     );
     process.exit(1);
   }
-  const result = await authenticatedRequest(
-    (client) => client.credential.updateCredential({ params: params3, body })
-  );
-  if (result.status !== SUCCESS_STATUS) {
-    failWriteOp3("update", result.status, result.body, credentialId);
+  let updated;
+  if (rotateBody) {
+    const secret = rotateBody;
+    const rotated = await authenticatedRequest(
+      (client) => client.credential.rotateCredentialSecret({ params: params3, body: secret })
+    );
+    if (rotated.status !== SUCCESS_STATUS) {
+      failWriteOp3("update", rotated.status, rotated.body, credentialId);
+    }
+    updated = rotated.body;
+  }
+  if (patching) {
+    const result = await authenticatedRequest(
+      (client) => client.credential.updateCredential({ params: params3, body })
+    );
+    if (result.status !== SUCCESS_STATUS) {
+      if (rotateBody) {
+        console.error(colorError("The secret was rotated, but the other changes were not saved."));
+      }
+      failWriteOp3("update", result.status, result.body, credentialId);
+    }
+    updated = result.body;
   }
+  if (!updated) return;
   if (output === "table") {
-    console.log(colorSuccess(`Updated credential ${sanitizeDisplay(result.body.label)}`));
+    const verb = rotateBody ? patching ? "Rotated the secret and updated" : "Rotated the secret of" : "Updated";
+    console.log(colorSuccess(`${verb} credential ${sanitizeDisplay(updated.label)}`));
   }
-  outputCredential(result.body, output);
+  outputCredential(updated, output);
 }
 function failMfaOp(action, status, body, credentialId) {
   const { message, errorCode } = readErrorFields(body);
@@ -55101,18 +55249,22 @@ function createGetCommand2() {
   });
 }
 function createUpdateCommand2() {
-  const command = new Command("update").description("Update a credential (label, environment, or auth config; secrets are immutable)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
+  const command = new Command("update").description("Update a credential (label, environment, auth config, or secret)").argument("<credentialId>", "Credential UUID").requiredOption("--env <environmentId>", "Current parent environment UUID").option("--label <label>", "New label").option("--move-env <environmentId>", "Move to a different environment (same application)").option("--clear-auth-config", "Remove the auth config (sends null)").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table");
   addSecretInputOptions(command);
   addAuthConfigOptions(command).addHelpText(
     "after",
     `
 Auth-config flags must match the credential's existing type (looked up automatically).
-Secrets cannot be changed here \u2014 delete and recreate to rotate.
+A secret flag rotates the secret in place: the credential keeps its ID and scan history.
+A username/password credential takes both --username-* and --password-*; an SSH key
+takes --secret-* for the key and --password-* for its passphrase, if it has one.
 
 Examples:
   tracecli credential update <id> --env <envId> --label "prod (rotated 2026-06)"
   tracecli credential update <id> --env <envId> --login-url https://acme.com/signin
-  tracecli credential update <id> --env <envId> --clear-auth-config`
+  tracecli credential update <id> --env <envId> --clear-auth-config
+  vault read -field=token secret/x | tracecli credential update <id> --env <envId> --secret-stdin
+  tracecli credential update <id> --env <envId> --username-env LOGIN_USER --password-env LOGIN_PASS`
   );
   return command.action(async (credentialId, options) => {
     await runUpdate3(credentialId, options);
@@ -59119,7 +59271,7 @@ function createFindingsCommand() {
   findings.addCommand(createGetFindingCommand());
   findings.addCommand(createGetFindingReproCommand());
   findings.addCommand(createStatusUpdateCommand());
-  findings.addCommand(createAttachEvidenceCommand());
+  findings.addCommand(createAttachEvidenceCommand(), { hidden: true });
   findings.addCommand(createCreateFindingCommand(), { hidden: true });
   findings.addCommand(createCopyFindingsCommand(), { hidden: true });
   findings.addCommand(createPublishFindingsCommand(), { hidden: true });
@@ -59671,7 +59823,7 @@ Examples:
 function createPentestCommand() {
   const pentest = new Command("pentest").description("Manage pentests");
   pentest.addCommand(createListCommand7());
-  pentest.addCommand(createUpdateCommand4());
+  pentest.addCommand(createUpdateCommand4(), { hidden: true });
   pentest.addCommand(createCreatePentestCommand(), { hidden: true });
   pentest.addCommand(createVisibilityCommand(), { hidden: true });
   pentest.addCommand(createQuestionnaireCommand());
@@ -61405,7 +61557,7 @@ function parseVulnerabilityFilter(expression) {
   const match = expression.match(/^([^!=]+)(!=|=)(.+)$/);
   if (!match?.[1] || !match[2] || !match[3]) {
     return {
-      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. cweId=CWE-89).`
+      error: `Invalid filter expression '${expression}'. Expected format: field=value or field!=value (e.g. scanMode=SAST).`
     };
   }
   const field = match[1].trim();
@@ -61646,7 +61798,7 @@ function createListCommand9() {
     }
   ).option(
     "-f, --filter <expression>",
-    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: vulnerabilityType, cweId, scanMode (and any other API-supported field).",
+    "Additional filter expression: field=value or field!=value. Repeatable. Supported fields: scanMode (SAST, SCA, SECRETS, DAST), severity, status, repositoryId.",
     (value, previous) => [...previous, value],
     []
   ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").option("-w, --web", "Open the vulnerabilities dashboard in a browser").option("--no-pager", "Disable the interactive arrow-key pager for table output").addHelpText(
@@ -61656,8 +61808,7 @@ Examples:
   tracecli vulnerabilities list
   tracecli vulnerabilities list --severity CRITICAL --status OPEN
   tracecli vulnerabilities list --repo securewithtrace/trace --limit 50
-  tracecli vulnerabilities list --filter cweId=CWE-89
-  tracecli vulnerabilities list --filter vulnerabilityType=SAST --filter scanMode=sast
+  tracecli vulnerabilities list --filter scanMode=SECRETS
   tracecli vulnerabilities list --output json | jq '.[].title'
   tracecli vulnerabilities list --output tsv | cut -f1,7
   tracecli vulnerabilities list --no-pager
@@ -61780,7 +61931,7 @@ program2.addCommand(createEnvironmentCommand());
 program2.addCommand(createCredentialCommand());
 program2.addCommand(createInboxCommand());
 program2.addCommand(createRepoCommand());
-program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createVulnerabilitiesCommand(), { hidden: true });
 program2.addCommand(createCodeSizeCommand());
 program2.addCommand(createUploadCommand());
 program2.addCommand(createPentestCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {