securewithtrace 0.6.0 → 0.7.0

package/README.md

@@ -0,0 +1,110 @@
+# tracecli
+
+<p align="center">
+  <strong>Continuous security vulnerability intelligence from your terminal.</strong>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/securewithtrace"><img alt="npm version" src="https://img.shields.io/npm/v/securewithtrace?color=0ea5e9&label=npm"></a>
+  <a href="https://github.com/securewithtrace/trace/actions"><img alt="build status" src="https://img.shields.io/github/actions/workflow/status/securewithtrace/trace/release-please.yml?branch=main&label=release"></a>
+</p>
+
+`tracecli` is the official CLI for Trace.
+
+Use it to authenticate, browse connected repositories, clone repositories, and inspect vulnerabilities directly from the command line.
+
+## Install
+
+```bash
+npm install -g securewithtrace
+```
+
+Then verify:
+
+```bash
+tracecli --help
+```
+
+## Requirements
+
+- Bun runtime available on your PATH
+- Git (for `tracecli repo clone`)
+- A Trace account with access to at least one organization
+
+## Quick Start
+
+```bash
+# 1) Authenticate
+tracecli auth login
+
+# 2) Confirm session
+tracecli auth status
+
+# 3) List connected repositories
+tracecli repo list
+
+# 4) View vulnerabilities
+tracecli vulnerabilities list --severity HIGH
+```
+
+## What You Can Do
+
+- **Authenticate securely** with device authorization flow (`auth login/logout/status`)
+- **List repositories** connected to your Trace organization (`repo list`)
+- **Clone repositories** with secure token handling (`repo clone`)
+- **Filter vulnerabilities** by repo, severity, and status (`vulnerabilities list`)
+- **Export results as JSON** for automation (`vulnerabilities list --json`)
+
+## Command Reference
+
+### Authentication
+
+```bash
+tracecli auth login
+tracecli auth status
+tracecli auth logout
+```
+
+### Repositories
+
+```bash
+# List org repositories known to Trace
+tracecli repo list
+
+# Clone by owner/repo shorthand
+tracecli repo clone securewithtrace/trace
+
+# Clone specific branch with shallow depth
+tracecli repo clone securewithtrace/trace --branch main --depth 1
+```
+
+### Vulnerabilities
+
+```bash
+# List vulnerabilities across your organization
+tracecli vulnerabilities list
+
+# Filter by repository
+tracecli vulnerabilities list --repo securewithtrace/trace
+
+# Filter by severity and status
+tracecli vulnerabilities list --severity CRITICAL --status OPEN
+
+# Machine-readable output
+tracecli vulnerabilities list --json
+```
+
+Supported filter values:
+
+- `--severity`: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`
+- `--status`: `OPEN`, `IN_PROGRESS`, `FIXED`, `IGNORED`, `FALSE_POSITIVE`
+
+## Security Notes
+
+- Auth tokens are stored at `~/.trace/token`.
+- `repo clone` uses secure credential flow for GitHub clones when available.
+- Credentials are not persisted in Git remote URLs after clone completes.
+
+## Links
+
+- Website: https://securewithtrace.com

package/dist/index.js

@@ -3583,10 +3583,373 @@ function showBanner() {
 `);
 }
 
+// src/completion/index.ts
+function extractCommandTree(cmd) {
+  const BUILTIN_FLAGS = /* @__PURE__ */ new Set(["--help", "-h", "--version", "-V"]);
+  const options = cmd.options.filter((o) => !o.hidden).filter((o) => !BUILTIN_FLAGS.has(o.long ?? "") && !BUILTIN_FLAGS.has(o.short ?? "")).map((o) => ({
+    flags: o.flags,
+    long: o.long ?? "",
+    short: o.short ?? null,
+    description: o.description,
+    takesValue: o.required || o.optional
+  }));
+  const subcommands = cmd.commands.filter((c21) => !c21._hidden).map((c21) => extractCommandTree(c21));
+  return {
+    name: cmd.name(),
+    description: cmd.description(),
+    options,
+    subcommands
+  };
+}
+function escapeForShell(s) {
+  return s.replace(/'/g, "'\\''");
+}
+function generateBashCompletion(tree, binName) {
+  const lines = [];
+  lines.push("#!/usr/bin/env bash");
+  lines.push(`# Bash completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell bash`);
+  lines.push("#");
+  lines.push("# To enable, add to your ~/.bashrc:");
+  lines.push(`#   eval "$(${binName} completion --shell bash)"`);
+  lines.push("");
+  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}_completions`;
+  lines.push(`${funcName}() {`);
+  lines.push("  local cur prev words cword");
+  lines.push("  _get_comp_words_by_ref -n : cur prev words cword 2>/dev/null || {");
+  lines.push(`    cur="\${COMP_WORDS[COMP_CWORD]}"`);
+  lines.push(`    prev="\${COMP_WORDS[COMP_CWORD-1]}"`);
+  lines.push(`    words=("\${COMP_WORDS[@]}")`);
+  lines.push(`    cword="\${COMP_CWORD}"`);
+  lines.push("  }");
+  lines.push("");
+  lines.push("  # Build the command chain (skip the binary name at index 0)");
+  lines.push(`  local cmd_chain=""`);
+  lines.push("  local i");
+  lines.push("  for (( i=1; i<cword; i++ )); do");
+  lines.push(`    case "\${words[i]}" in`);
+  lines.push("      -*) ;; # skip options");
+  lines.push(`      *) cmd_chain="\${cmd_chain} \${words[i]}" ;;`);
+  lines.push("    esac");
+  lines.push("  done");
+  lines.push(`  cmd_chain="\${cmd_chain## }" # trim leading space`);
+  lines.push("");
+  const cases = collectBashCases(tree, "");
+  lines.push(`  local completions=""`);
+  lines.push(`  case "\${cmd_chain}" in`);
+  for (const [path, { subcommands, options }] of cases) {
+    const pattern = path === "" ? `''` : `'${escapeForShell(path)}'`;
+    const all = [...subcommands, ...options];
+    lines.push(`    ${pattern})`);
+    lines.push(`      completions="${all.join(" ")}"`);
+    lines.push("      ;;");
+  }
+  lines.push("    *)");
+  lines.push(`      completions=""`);
+  lines.push("      ;;");
+  lines.push("  esac");
+  lines.push("");
+  lines.push(`  COMPREPLY=( $(compgen -W "\${completions}" -- "\${cur}") )`);
+  lines.push("  return 0");
+  lines.push("}");
+  lines.push("");
+  lines.push(`complete -o default -F ${funcName} ${binName}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function collectBashCases(tree, prefix) {
+  const cases = /* @__PURE__ */ new Map();
+  const subcommandNames = tree.subcommands.map((c21) => c21.name);
+  const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
+  const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
+  const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
+  cases.set(prefix, { subcommands: subcommandNames, options: allOptions });
+  for (const sub of tree.subcommands) {
+    const subPath = prefix ? `${prefix} ${sub.name}` : sub.name;
+    const subCases = collectBashCases(sub, subPath);
+    for (const [k, v] of subCases) {
+      cases.set(k, v);
+    }
+  }
+  return cases;
+}
+function generateZshCompletion(tree, binName) {
+  const lines = [];
+  lines.push(`#compdef ${binName}`);
+  lines.push(`# Zsh completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell zsh`);
+  lines.push("#");
+  lines.push("# To enable, add to your ~/.zshrc:");
+  lines.push(`#   eval "$(${binName} completion --shell zsh)"`);
+  lines.push("");
+  const funcName = `_${binName.replace(/[^a-zA-Z0-9]/g, "_")}`;
+  lines.push(`${funcName}() {`);
+  lines.push("  local -a commands");
+  lines.push("  local line state");
+  lines.push("");
+  generateZshCommandBlock(tree, lines, "  ", binName, true);
+  lines.push("}");
+  lines.push("");
+  generateZshSubFunctions(tree, lines, binName);
+  lines.push(`compdef ${funcName} ${binName}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function generateZshCommandBlock(tree, lines, indent, _binName, isRoot) {
+  if (tree.subcommands.length > 0) {
+    lines.push(`${indent}_arguments -C \\`);
+    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
+    if (isRoot) {
+      lines.push(`${indent}  '(-V --version)'{-V,--version}'[Show version]' \\`);
+    }
+    for (const opt of tree.options) {
+      const desc = escapeForShell(opt.description);
+      if (opt.takesValue) {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
+        }
+      } else {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
+        }
+      }
+    }
+    lines.push(`${indent}  '1: :->command' \\`);
+    lines.push(`${indent}  '*::arg:->args'`);
+    lines.push("");
+    lines.push(`${indent}case "$state" in`);
+    lines.push(`${indent}  command)`);
+    lines.push(`${indent}    commands=(`);
+    for (const sub of tree.subcommands) {
+      const desc = escapeForShell(sub.description);
+      lines.push(`${indent}      '${sub.name}:${desc}'`);
+    }
+    lines.push(`${indent}    )`);
+    lines.push(`${indent}    _describe 'command' commands`);
+    lines.push(`${indent}    ;;`);
+    lines.push(`${indent}  args)`);
+    lines.push(`${indent}    case "$line[1]" in`);
+    for (const sub of tree.subcommands) {
+      const subFunc = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
+      lines.push(`${indent}      ${sub.name}) ${subFunc} ;;`);
+    }
+    lines.push(`${indent}    esac`);
+    lines.push(`${indent}    ;;`);
+    lines.push(`${indent}esac`);
+  } else {
+    lines.push(`${indent}_arguments \\`);
+    lines.push(`${indent}  '(-h --help)'{-h,--help}'[Show help]' \\`);
+    for (const opt of tree.options) {
+      const desc = escapeForShell(opt.description);
+      if (opt.takesValue) {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]:value: ' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]:value: ' \\`);
+        }
+      } else {
+        if (opt.short) {
+          lines.push(
+            `${indent}  '(${opt.short} ${opt.long})'{${opt.short},${opt.long}}'[${desc}]' \\`
+          );
+        } else {
+          lines.push(`${indent}  '${opt.long}[${desc}]' \\`);
+        }
+      }
+    }
+    lines.push(`${indent}  '*:file:_files'`);
+  }
+}
+function generateZshSubFunctions(tree, lines, binName) {
+  for (const sub of tree.subcommands) {
+    const funcName = `_${tree.name.replace(/[^a-zA-Z0-9]/g, "_")}_${sub.name.replace(/[^a-zA-Z0-9]/g, "_")}`;
+    lines.push(`${funcName}() {`);
+    generateZshCommandBlock(sub, lines, "  ", binName, false);
+    lines.push("}");
+    lines.push("");
+    if (sub.subcommands.length > 0) {
+      generateZshSubFunctions(sub, lines, binName);
+    }
+  }
+}
+function generateFishCompletion(tree, binName) {
+  const lines = [];
+  lines.push(`# Fish completion for ${binName}`);
+  lines.push(`# Generated by ${binName} completion --shell fish`);
+  lines.push("#");
+  lines.push(`# To enable, add to your ~/.config/fish/completions/${binName}.fish:`);
+  lines.push(`#   ${binName} completion --shell fish | source`);
+  lines.push("");
+  lines.push(`complete -c ${binName} -f`);
+  lines.push("");
+  generateFishCommands(tree, lines, binName, []);
+  lines.push("");
+  return lines.join("\n");
+}
+function generateFishCommands(tree, lines, binName, parentPath) {
+  const condition = buildFishCondition(binName, parentPath);
+  for (const sub of tree.subcommands) {
+    const desc = sub.description.replace(/'/g, "\\'");
+    lines.push(`complete -c ${binName} ${condition} -a '${sub.name}' -d '${desc}'`);
+  }
+  for (const opt of tree.options) {
+    const desc = opt.description.replace(/'/g, "\\'");
+    const longFlag = opt.long.replace(/^--/, "");
+    const parts = [`complete -c ${binName} ${condition}`];
+    if (opt.short) {
+      parts.push(`-s '${opt.short.replace(/^-/, "")}'`);
+    }
+    parts.push(`-l '${longFlag}'`);
+    parts.push(`-d '${desc}'`);
+    if (opt.takesValue) {
+      parts.push("-r");
+    }
+    lines.push(parts.join(" "));
+  }
+  for (const sub of tree.subcommands) {
+    const subPath = [...parentPath, sub.name];
+    generateFishCommands(sub, lines, binName, subPath);
+  }
+}
+function buildFishCondition(binName, parentPath) {
+  if (parentPath.length === 0) {
+    return `-n '__fish_use_subcommand'`;
+  }
+  if (parentPath.length === 1) {
+    return `-n '__fish_seen_subcommand_from ${parentPath[0]}'`;
+  }
+  const conditions = parentPath.map((p) => `__fish_seen_subcommand_from ${p}`);
+  return `-n '${conditions.join("; and ")}'`;
+}
+function generateCompletion(program3, shell, binName) {
+  const name = binName ?? program3.name();
+  const tree = extractCommandTree(program3);
+  switch (shell) {
+    case "bash":
+      return generateBashCompletion(tree, name);
+    case "zsh":
+      return generateZshCompletion(tree, name);
+    case "fish":
+      return generateFishCompletion(tree, name);
+  }
+}
+
+// src/completion/install.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var TRACE_DIR2 = ".trace";
+function completionFileName(shell) {
+  switch (shell) {
+    case "bash":
+      return "tracecli-completion.bash";
+    case "zsh":
+      return "tracecli-completion.zsh";
+    case "fish":
+      return "tracecli-completion.fish";
+  }
+}
+function getTraceDir() {
+  return join2(homedir2(), TRACE_DIR2);
+}
+function getCompletionFilePath(shell) {
+  return join2(getTraceDir(), completionFileName(shell));
+}
+function writeCompletionFile(shell, script) {
+  const dir = getTraceDir();
+  if (!existsSync2(dir)) {
+    mkdirSync2(dir, { recursive: true });
+  }
+  const filePath = getCompletionFilePath(shell);
+  writeFileSync2(filePath, script, "utf-8");
+  return filePath;
+}
+function getSetupInstructions(shell) {
+  const traceDir = `~/${TRACE_DIR2}`;
+  switch (shell) {
+    case "bash":
+      return [
+        "Add the following line to your .bashrc file:",
+        "",
+        "  # The next line enables shell command completion for Trace",
+        `  source ${traceDir}/tracecli-completion.bash`,
+        ""
+      ].join("\n");
+    case "zsh":
+      return [
+        "Add the following lines to your .zshrc file:",
+        "",
+        "  # The next lines enable shell command completion for Trace",
+        `  fpath=(${traceDir} $fpath)`,
+        "  autoload -Uz compinit && compinit -i",
+        ""
+      ].join("\n");
+    case "fish":
+      return [
+        "Copy the completion file to your fish completions directory:",
+        "",
+        `  cp ${traceDir}/tracecli-completion.fish ~/.config/fish/completions/tracecli.fish`,
+        ""
+      ].join("\n");
+  }
+}
+
+// src/completion/commands.ts
+var SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
+function detectShell() {
+  const shellEnv = process.env["SHELL"] ?? "";
+  if (shellEnv.endsWith("/bash") || shellEnv.endsWith("/bash.exe")) {
+    return "bash";
+  }
+  if (shellEnv.endsWith("/zsh")) {
+    return "zsh";
+  }
+  if (shellEnv.endsWith("/fish")) {
+    return "fish";
+  }
+  return null;
+}
+function resolveShell(shellOption) {
+  const shell = shellOption ?? detectShell();
+  if (!shell) {
+    console.error(
+      `Could not detect shell. Please specify one with --shell <${SUPPORTED_SHELLS.join("|")}>.`
+    );
+    process.exit(1);
+  }
+  if (!SUPPORTED_SHELLS.includes(shell)) {
+    console.error(
+      `Unsupported shell: '${shell}'. Supported shells: ${SUPPORTED_SHELLS.join(", ")}.`
+    );
+    process.exit(1);
+  }
+  return shell;
+}
+function createCompletionCommand(program3) {
+  return new Command("completion").description("Generate shell completion script").option("--shell <shell>", `Shell type (${SUPPORTED_SHELLS.join(", ")})`).action((options) => {
+    const shell = resolveShell(options.shell);
+    const script = generateCompletion(program3, shell);
+    const writtenPath = writeCompletionFile(shell, script);
+    console.log(`Completion file written to ${writtenPath}`);
+    console.log("");
+    console.log(getSetupInstructions(shell));
+  });
+}
+
 // src/repo/commands.ts
-import { chmodSync, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync, mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
 var util;
@@ -23952,9 +24315,9 @@ function urlWithUsername(httpsUrl) {
   return url2.toString();
 }
 function createAskPassScript(token) {
-  const dir = mkdtempSync(join2(tmpdir(), "trace-askpass-"));
-  const scriptPath = join2(dir, "askpass.sh");
-  writeFileSync2(scriptPath, `#!/bin/sh
+  const dir = mkdtempSync(join3(tmpdir(), "trace-askpass-"));
+  const scriptPath = join3(dir, "askpass.sh");
+  writeFileSync3(scriptPath, `#!/bin/sh
 echo '${token.replace(/'/g, "'\\''")}'
 `, {
     mode: 448
@@ -24250,10 +24613,8 @@ program2.action(() => {
   showBanner();
   program2.outputHelp();
 });
-program2.command("echo").description("Echo a message back to the terminal").argument("<message...>", "message to echo").action((messageParts) => {
-  console.log(messageParts.join(" "));
-});
 program2.addCommand(createAuthCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
+program2.addCommand(createCompletionCommand(program2));
 program2.parse();

package/package.json

@@ -1,11 +1,21 @@
 {
   "name": "securewithtrace",
-  "version": "0.6.0",
-  "description": "Trace CLI",
+  "version": "0.7.0",
+  "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {
     "tracecli": "./dist/index.js"
   },
+  "homepage": "https://securewithtrace.com",
+  "keywords": [
+    "trace",
+    "tracecli",
+    "security",
+    "vulnerability",
+    "devsecops",
+    "cli",
+    "appsec"
+  ],
   "scripts": {
     "build": "tsup",
     "lint": "biome check .",