securewithtrace 0.9.0 → 0.11.0

package/dist/index.js

@@ -3682,7 +3682,7 @@ function extractCommandTree(cmd) {
     description: o.description,
     takesValue: o.required || o.optional
   }));
-  const subcommands = cmd.commands.filter((c24) => !c24._hidden).map((c24) => extractCommandTree(c24));
+  const subcommands = cmd.commands.filter((c25) => !c25._hidden).map((c25) => extractCommandTree(c25));
   return {
     name: cmd.name(),
     description: cmd.description(),
@@ -3748,7 +3748,7 @@ function generateBashCompletion(tree, binName) {
 }
 function collectBashCases(tree, prefix) {
   const cases = /* @__PURE__ */ new Map();
-  const subcommandNames = tree.subcommands.map((c24) => c24.name);
+  const subcommandNames = tree.subcommands.map((c25) => c25.name);
   const optionNames = tree.options.flatMap((o) => o.short ? [o.long, o.short] : [o.long]);
   const extraOptions = prefix === "" ? ["--help", "--version"] : ["--help"];
   const allOptions = [.../* @__PURE__ */ new Set([...optionNames, ...extraOptions])];
@@ -10803,7 +10803,7 @@ var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
 function isValidBase64URL(data) {
   if (!base64url.test(data))
     return false;
-  const base643 = data.replace(/[-_]/g, (c24) => c24 === "-" ? "+" : "/");
+  const base643 = data.replace(/[-_]/g, (c25) => c25 === "-" ? "+" : "/");
   const padded = base643.padEnd(Math.ceil(base643.length / 4) * 4, "=");
   return isValidBase64(padded);
 }
@@ -20847,9 +20847,9 @@ var ZodDate2 = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
   inst._zod.processJSONSchema = (ctx, json2, params) => dateProcessor(inst, ctx, json2, params);
   inst.min = (value, params) => inst.check(_gte(value, params));
   inst.max = (value, params) => inst.check(_lte(value, params));
-  const c24 = inst._zod.bag;
-  inst.minDate = c24.minimum ? new Date(c24.minimum) : null;
-  inst.maxDate = c24.maximum ? new Date(c24.maximum) : null;
+  const c25 = inst._zod.bag;
+  inst.minDate = c25.minimum ? new Date(c25.minimum) : null;
+  inst.maxDate = c25.maximum ? new Date(c25.maximum) : null;
 });
 function date3(params) {
   return _date(ZodDate2, params);
@@ -22161,6 +22161,331 @@ var chatSessionContract = c2.router({
   }
 });
 
+// ../../packages/api-contracts/src/schemas/domain/dependency.schema.ts
+var PackageEcosystemValues = [
+  "NPM",
+  "PYPI",
+  "CARGO",
+  "MAVEN",
+  "GOLANG",
+  "RUBYGEMS",
+  "NUGET",
+  "COMPOSER",
+  "UNKNOWN"
+];
+var PackageEcosystem = external_exports.enum(PackageEcosystemValues);
+var DependencyScopeValues = ["PRODUCTION", "DEV", "PEER", "OPTIONAL", "BUNDLED"];
+var DependencyScope = external_exports.enum(DependencyScopeValues);
+var DependencySourceValues = ["REGISTRY", "WORKSPACE", "GIT", "FILE", "URL"];
+var DependencySource = external_exports.enum(DependencySourceValues);
+var DependencyIndexStatusValues = [
+  "PENDING",
+  "INDEXING",
+  "COMPLETED",
+  "PARTIAL",
+  "FAILED"
+];
+var DependencyIndexStatus = external_exports.enum(DependencyIndexStatusValues);
+
+// ../../packages/api-contracts/src/schemas/api/v1/dependency.api.ts
+var RepositoryDependencyParamsSchema = OrgIdParamsSchema.extend({
+  repositoryId: external_exports.uuid()
+});
+var PackageDependencyParamsSchema = OrgIdParamsSchema.extend({
+  packageId: external_exports.uuid()
+});
+var FailedManifestSchema = external_exports.object({
+  filePath: external_exports.string(),
+  ecosystem: PackageEcosystem,
+  error: external_exports.string(),
+  severity: external_exports.enum(["warning", "error"])
+});
+var VersionEntrySchema = external_exports.object({
+  version: external_exports.string(),
+  versionConstraint: external_exports.string().nullable(),
+  isDirect: external_exports.boolean(),
+  scope: DependencyScope,
+  source: DependencySource,
+  depthFromRoot: external_exports.number(),
+  /** Manifest files where this specific version appears. */
+  manifestFiles: external_exports.array(external_exports.string())
+});
+var DependencyIndexSchema = external_exports.object({
+  indexId: external_exports.uuid(),
+  status: DependencyIndexStatus,
+  commitSha: external_exports.string().nullable(),
+  packageCount: external_exports.number(),
+  ecosystems: external_exports.array(PackageEcosystem),
+  manifestFiles: external_exports.array(external_exports.string()),
+  failedManifests: external_exports.array(FailedManifestSchema),
+  durationMs: external_exports.number().nullable(),
+  indexedAt: external_exports.coerce.date().nullable(),
+  errorMessage: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date()
+});
+var DependencySearchRequestSchema = external_exports.object({
+  query: external_exports.string().min(1).max(200),
+  ecosystem: PackageEcosystem.optional(),
+  isDirect: external_exports.boolean().optional(),
+  scope: DependencyScope.optional(),
+  repositoryIds: external_exports.array(external_exports.uuid()).optional(),
+  /** Exact version match, e.g. "1.2.3". */
+  version: external_exports.string().max(100).optional(),
+  /** Version prefix match, e.g. "1.2" matches "1.2.0", "1.2.3", etc. */
+  versionPrefix: external_exports.string().max(50).optional(),
+  page: external_exports.number().int().min(1).default(1).optional(),
+  pageSize: external_exports.number().int().min(1).max(100).default(20).optional(),
+  sortBy: external_exports.enum(["name", "repositoryCount"]).default("repositoryCount").optional(),
+  sortOrder: external_exports.enum(["asc", "desc"]).default("desc").optional()
+});
+var PackageSearchResultSchema = external_exports.object({
+  packageId: external_exports.uuid(),
+  name: external_exports.string(),
+  ecosystem: PackageEcosystem,
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      fullName: external_exports.string(),
+      /** All resolved versions of this package in this repository. */
+      versions: external_exports.array(VersionEntrySchema)
+    })
+  )
+});
+var DependencySearchResponseSchema = external_exports.object({
+  packages: external_exports.array(PackageSearchResultSchema),
+  total: external_exports.number(),
+  page: external_exports.number(),
+  pageSize: external_exports.number()
+});
+var DependencyAutocompleteQuerySchema = external_exports.object({
+  q: external_exports.string().min(1).max(200),
+  ecosystem: external_exports.enum(PackageEcosystemValues).optional()
+});
+var AutocompleteSuggestionSchema = external_exports.object({
+  packageId: external_exports.uuid(),
+  name: external_exports.string(),
+  ecosystem: PackageEcosystem,
+  repositoryCount: external_exports.number()
+});
+var DependencyAutocompleteResponseSchema = external_exports.object({
+  suggestions: external_exports.array(AutocompleteSuggestionSchema)
+});
+var ListRepoDependenciesQuerySchema = external_exports.object({
+  search: external_exports.string().max(200).optional(),
+  isDirect: external_exports.enum(["true", "false"]).transform((v) => v === "true").optional(),
+  scope: DependencyScope.optional(),
+  ecosystem: external_exports.enum(PackageEcosystemValues).optional(),
+  /** Exact version match, e.g. "1.2.3". */
+  version: external_exports.string().max(100).optional(),
+  /** Version prefix match, e.g. "1.2" matches "1.2.0", "1.2.3", etc. */
+  versionPrefix: external_exports.string().max(50).optional(),
+  page: external_exports.coerce.number().int().min(1).default(1).optional(),
+  pageSize: external_exports.coerce.number().int().min(1).max(200).default(50).optional(),
+  sortBy: external_exports.enum(["name", "ecosystem"]).default("name").optional(),
+  sortOrder: external_exports.enum(["asc", "desc"]).default("asc").optional()
+});
+var RepoDependencySchema = external_exports.object({
+  packageId: external_exports.uuid(),
+  name: external_exports.string(),
+  ecosystem: PackageEcosystem,
+  /** All resolved versions of this package in the repository. */
+  versions: external_exports.array(VersionEntrySchema)
+});
+var ListRepoDependenciesResponseSchema = external_exports.object({
+  dependencies: external_exports.array(RepoDependencySchema),
+  total: external_exports.number(),
+  page: external_exports.number(),
+  pageSize: external_exports.number(),
+  /** All manifest files discovered in this repository. */
+  manifestFiles: external_exports.array(external_exports.string())
+});
+var PackageRepositoriesQuerySchema = external_exports.object({
+  /** Exact version match, e.g. "1.2.3". */
+  version: external_exports.string().max(100).optional(),
+  /** Version prefix match, e.g. "1.2" matches "1.2.0", "1.2.3", etc. */
+  versionPrefix: external_exports.string().max(50).optional(),
+  page: external_exports.coerce.number().int().min(1).default(1).optional(),
+  pageSize: external_exports.coerce.number().int().min(1).max(100).default(25).optional()
+});
+var PackageRepositoriesResponseSchema = external_exports.object({
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      fullName: external_exports.string(),
+      htmlUrl: external_exports.string().nullable(),
+      /** All resolved versions of this package in this repository. */
+      versions: external_exports.array(VersionEntrySchema)
+    })
+  ),
+  total: external_exports.number(),
+  page: external_exports.number(),
+  pageSize: external_exports.number()
+});
+var DependencyIndexResponseSchema = external_exports.object({
+  latestIndex: DependencyIndexSchema.nullable()
+});
+var TriggerReindexResponseSchema = external_exports.object({
+  indexId: external_exports.uuid(),
+  status: DependencyIndexStatus
+});
+var BulkIndexStatusResponseSchema = external_exports.object({
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      fullName: external_exports.string(),
+      status: DependencyIndexStatus.nullable(),
+      packageCount: external_exports.number().nullable(),
+      indexedAt: external_exports.coerce.date().nullable()
+    })
+  )
+});
+var DependencyFilterOptionsResponseSchema = external_exports.object({
+  /** Repositories that have at least one indexed dependency. */
+  repositories: external_exports.array(
+    external_exports.object({
+      repositoryId: external_exports.uuid(),
+      name: external_exports.string()
+    })
+  ),
+  ecosystems: external_exports.array(PackageEcosystem),
+  scopes: external_exports.array(DependencyScope)
+});
+var DependencySummaryResponseSchema = external_exports.object({
+  totalPackages: external_exports.number(),
+  totalRepositories: external_exports.number(),
+  ecosystemBreakdown: external_exports.record(PackageEcosystem, external_exports.number()),
+  lastIndexedAt: external_exports.coerce.date().nullable(),
+  indexingInProgress: external_exports.number()
+});
+
+// ../../packages/api-contracts/src/contracts/v1/dependency.ts
+var c3 = initContract();
+var dependencyContract = c3.router({
+  /** Cross-repo dependency search. Two-phase: pg_trgm on Package, then join repos. */
+  searchDependencies: {
+    method: "POST",
+    path: "/organizations/:organizationId/dependencies/search",
+    pathParams: OrgIdParamsSchema,
+    body: DependencySearchRequestSchema,
+    responses: {
+      200: DependencySearchResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Autocomplete for dependency names across all repos in org. */
+  autocompleteDependencies: {
+    method: "GET",
+    path: "/organizations/:organizationId/dependencies/autocomplete",
+    pathParams: OrgIdParamsSchema,
+    query: DependencyAutocompleteQuerySchema,
+    responses: {
+      200: DependencyAutocompleteResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** List dependencies for a specific repository, deduplicated by package. */
+  listRepositoryDependencies: {
+    method: "GET",
+    path: "/organizations/:organizationId/repositories/:repositoryId/dependencies",
+    pathParams: RepositoryDependencyParamsSchema,
+    query: ListRepoDependenciesQuerySchema,
+    responses: {
+      200: ListRepoDependenciesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Reverse lookup: which repositories use a given package. */
+  listPackageRepositories: {
+    method: "GET",
+    path: "/organizations/:organizationId/dependencies/packages/:packageId/repositories",
+    pathParams: PackageDependencyParamsSchema,
+    query: PackageRepositoriesQuerySchema,
+    responses: {
+      200: PackageRepositoriesResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Get dependency indexing status for a repository. */
+  getDependencyIndex: {
+    method: "GET",
+    path: "/organizations/:organizationId/repositories/:repositoryId/dependency-index",
+    pathParams: RepositoryDependencyParamsSchema,
+    responses: {
+      200: DependencyIndexResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Trigger a manual re-index of a repository's dependencies. */
+  triggerReindex: {
+    method: "POST",
+    path: "/organizations/:organizationId/repositories/:repositoryId/dependency-index",
+    pathParams: RepositoryDependencyParamsSchema,
+    body: null,
+    responses: {
+      201: TriggerReindexResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Available filter options for dependency search dropdowns. */
+  getFilterOptions: {
+    method: "GET",
+    path: "/organizations/:organizationId/dependencies/filter-options",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: DependencyFilterOptionsResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Bulk index status for all repos in org (dashboard view). */
+  getBulkIndexStatus: {
+    method: "GET",
+    path: "/organizations/:organizationId/dependencies/index-status",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: BulkIndexStatusResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  /** Org-wide dependency summary with ecosystem breakdown. */
+  getDependencySummary: {
+    method: "GET",
+    path: "/organizations/:organizationId/dependencies/summary",
+    pathParams: OrgIdParamsSchema,
+    responses: {
+      200: DependencySummaryResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  }
+});
+
 // ../../packages/api-contracts/src/schemas/api/v1/docker-scout-integration.api.ts
 var DockerScoutIntegrationIdParamsSchema = OrgIdParamsSchema.extend({
   dockerScoutIntegrationId: external_exports.uuid()
@@ -22180,8 +22505,8 @@ var DockerScoutIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/docker-scout-integration.ts
-var c3 = initContract();
-var dockerScoutIntegrationContract = c3.router({
+var c4 = initContract();
+var dockerScoutIntegrationContract = c4.router({
   createDockerScoutIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/docker-scout-integration",
@@ -22242,9 +22567,7 @@ var GitHubCallbackQuerySchema = external_exports.object({
 });
 var GitHubCallbackRequestSchema = external_exports.object({
   installationId: external_exports.number().int(),
-  setupAction: external_exports.enum(["install", "update", "request"]),
-  githubAccountId: external_exports.number().int().optional(),
-  githubAccountLogin: external_exports.string().min(1).optional()
+  setupAction: external_exports.enum(["install", "update", "request"])
 });
 var GitHubInstallationResponseSchema = external_exports.object({
   installationId: external_exports.uuid(),
@@ -22274,13 +22597,14 @@ var GitHubRepoSchema = external_exports.object({
   fullName: external_exports.string(),
   private: external_exports.boolean(),
   htmlUrl: external_exports.string().url(),
-  defaultBranch: external_exports.string()
+  defaultBranch: external_exports.string(),
+  language: external_exports.string().nullable()
 });
 var ListGitHubInstallationReposResponseSchema = external_exports.array(GitHubRepoSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/github.ts
-var c4 = initContract();
-var githubCallbackContract = c4.router(
+var c5 = initContract();
+var githubCallbackContract = c5.router(
   {
     handleCallback: {
       method: "POST",
@@ -22300,7 +22624,7 @@ var githubCallbackContract = c4.router(
     pathPrefix: "/v1/github"
   }
 );
-var githubContract = c4.router({
+var githubContract = c5.router({
   generateInstallLink: {
     method: "POST",
     path: "/organizations/:organizationId/github/install-link",
@@ -22370,8 +22694,8 @@ var UpdateKnowledgeBaseResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-base.ts
-var c5 = initContract();
-var knowledgeBaseContract = c5.router({
+var c6 = initContract();
+var knowledgeBaseContract = c6.router({
   getKnowledgeBase: {
     method: "GET",
     path: "/organizations/:organizationId/knowledge-base",
@@ -22592,8 +22916,8 @@ var UpdateRepoDocumentContentResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/knowledge-document.ts
-var c6 = initContract();
-var knowledgeDocumentContract = c6.router({
+var c7 = initContract();
+var knowledgeDocumentContract = c7.router({
   createDocument: {
     method: "POST",
     path: "/organizations/:organizationId/knowledge-documents",
@@ -22902,8 +23226,8 @@ var LlmProviderKeyResponseSchema = external_exports.object({
 var ListLlmProviderKeysResponseSchema = external_exports.array(LlmProviderKeyResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/llm-provider-key.ts
-var c7 = initContract();
-var llmProviderKeyContract = c7.router({
+var c8 = initContract();
+var llmProviderKeyContract = c8.router({
   createLlmProviderKey: {
     method: "POST",
     path: "/organizations/:organizationId/llm-provider-keys",
@@ -23018,8 +23342,8 @@ var LogoDeleteRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/organization.ts
-var c8 = initContract();
-var organizationContract = c8.router({
+var c9 = initContract();
+var organizationContract = c9.router({
   listOrganizations: {
     method: "GET",
     path: "/organizations",
@@ -23101,10 +23425,12 @@ var PentestStatusValues = ["SCOPING", "IN_PROGRESS", "REMEDIATION", "CLOSED"];
 var PentestStatus = external_exports.enum(PentestStatusValues);
 var PentestFindingStatusValues = [
   "OPEN",
+  "IN_PROGRESS",
   "CONTESTED",
   "REMEDIATED",
   "VERIFIED_FIXED",
-  "VERIFIED_OPEN"
+  "VERIFIED_OPEN",
+  "DISMISSED"
 ];
 var PentestFindingStatus = external_exports.enum(PentestFindingStatusValues);
 var PentestFindingSeverityValues = [
@@ -23129,7 +23455,7 @@ var RetestOutcome = external_exports.enum(RetestOutcomeValues);
 
 // ../../packages/api-contracts/src/schemas/api/v1/pentest.api.ts
 var PentestIdParamsSchema = OrgIdParamsSchema.extend({
-  pentestId: external_exports.uuid()
+  pentestId: external_exports.string().min(1)
 });
 var PentestResponseSchema = external_exports.object({
   pentestId: external_exports.uuid(),
@@ -23170,8 +23496,8 @@ var UpdatePentestRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest.ts
-var c9 = initContract();
-var pentestContract = c9.router({
+var c10 = initContract();
+var pentestContract = c10.router({
   listPentests: {
     method: "GET",
     path: "/organizations/:organizationId/pentests",
@@ -23276,12 +23602,15 @@ var PentestFindingResponseSchema = external_exports.object({
   cvssVector: external_exports.string().nullable(),
   cvssScore: external_exports.number().nullable(),
   owaspCategory: external_exports.string().nullable(),
+  proofOfConcept: external_exports.string().nullable(),
+  remediation: external_exports.string().nullable(),
   publishedAt: external_exports.coerce.date().nullable(),
   createdById: external_exports.uuid(),
   createdByName: external_exports.string(),
   createdAt: external_exports.coerce.date(),
   updatedAt: external_exports.coerce.date(),
-  repositories: external_exports.array(PentestFindingRepositorySchema)
+  repositories: external_exports.array(PentestFindingRepositorySchema),
+  vulnerabilityIds: external_exports.array(external_exports.uuid())
 });
 var ListPentestFindingsResponseSchema = external_exports.array(PentestFindingResponseSchema);
 var CreatePentestFindingRequestSchema = external_exports.object({
@@ -23294,6 +23623,8 @@ var CreatePentestFindingRequestSchema = external_exports.object({
   cvssVector: external_exports.string().max(200).optional(),
   cvssScore: external_exports.number().min(0).max(10).optional(),
   owaspCategory: external_exports.string().max(200).optional(),
+  proofOfConcept: external_exports.string().max(5e4).optional(),
+  remediation: external_exports.string().max(5e4).optional(),
   repositories: external_exports.array(
     external_exports.object({
       repositoryId: external_exports.uuid(),
@@ -23302,7 +23633,8 @@ var CreatePentestFindingRequestSchema = external_exports.object({
       startLine: external_exports.number().int().optional(),
       endLine: external_exports.number().int().optional()
     })
-  ).optional()
+  ).optional(),
+  vulnerabilityIds: external_exports.array(external_exports.uuid()).optional()
 });
 var UpdatePentestFindingRequestSchema = external_exports.object({
   title: external_exports.string().min(1).max(500).optional(),
@@ -23314,6 +23646,8 @@ var UpdatePentestFindingRequestSchema = external_exports.object({
   cvssVector: external_exports.string().max(200).nullable().optional(),
   cvssScore: external_exports.number().min(0).max(10).nullable().optional(),
   owaspCategory: external_exports.string().max(200).nullable().optional(),
+  proofOfConcept: external_exports.string().max(5e4).nullable().optional(),
+  remediation: external_exports.string().max(5e4).nullable().optional(),
   publishedAt: external_exports.coerce.date().nullable().optional(),
   repositories: external_exports.array(
     external_exports.object({
@@ -23323,7 +23657,8 @@ var UpdatePentestFindingRequestSchema = external_exports.object({
       startLine: external_exports.number().int().optional(),
       endLine: external_exports.number().int().optional()
     })
-  ).optional()
+  ).optional(),
+  vulnerabilityIds: external_exports.array(external_exports.uuid()).optional()
 });
 var PentestFindingContestResponseSchema = external_exports.object({
   contestId: external_exports.uuid(),
@@ -23384,6 +23719,13 @@ var UpdatePentestFindingNoteRequestSchema = external_exports.object({
 var ParseFindingMarkdownRequestSchema = external_exports.object({
   markdown: external_exports.string().min(1).max(1e5)
 });
+var ParsedFindingVulnerabilitySchema = external_exports.object({
+  title: external_exports.string(),
+  description: external_exports.string().nullable(),
+  affectedRepos: external_exports.array(external_exports.string()),
+  codeSnippet: external_exports.string().nullable(),
+  exploitConditions: external_exports.string().nullable()
+});
 var ParseFindingMarkdownResponseSchema = external_exports.object({
   title: external_exports.string(),
   description: external_exports.string(),
@@ -23393,12 +23735,28 @@ var ParseFindingMarkdownResponseSchema = external_exports.object({
   cweIds: external_exports.array(external_exports.string()),
   cvssVector: external_exports.string().nullable(),
   cvssScore: external_exports.number().nullable(),
-  owaspCategory: external_exports.string().nullable()
+  owaspCategory: external_exports.string().nullable(),
+  proofOfConcept: external_exports.string().nullable(),
+  remediation: external_exports.string().nullable(),
+  vulnerabilities: external_exports.array(ParsedFindingVulnerabilitySchema)
+});
+var ParseTaskStatusSchema = external_exports.enum(["pending", "completed", "failed"]);
+var StartParseTaskResponseSchema = external_exports.object({
+  taskId: external_exports.string()
+});
+var ParseTaskIdParamsSchema = PentestFindingParamsSchema.extend({
+  taskId: external_exports.string()
+});
+var GetParseTaskStatusResponseSchema = external_exports.object({
+  taskId: external_exports.string(),
+  status: ParseTaskStatusSchema,
+  result: ParseFindingMarkdownResponseSchema.nullable(),
+  error: external_exports.string().nullable()
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pentest-finding.ts
-var c10 = initContract();
-var pentestFindingContract = c10.router({
+var c11 = initContract();
+var pentestFindingContract = c11.router({
   // ─── Findings ───
   listFindings: {
     method: "GET",
@@ -23599,6 +23957,33 @@ var pentestFindingContract = c10.router({
       404: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  // ─── Async AI parsing (polling) ───
+  startParseTask: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/parse-markdown/tasks",
+    pathParams: PentestFindingParamsSchema,
+    body: ParseFindingMarkdownRequestSchema,
+    responses: {
+      202: StartParseTaskResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  getParseTaskStatus: {
+    method: "GET",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/parse-markdown/tasks/:taskId",
+    pathParams: ParseTaskIdParamsSchema,
+    responses: {
+      200: GetParseTaskStatusResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 
@@ -23627,6 +24012,7 @@ var RepositoryResponseSchema = external_exports.object({
   platform: external_exports.enum(PlatformValues),
   status: external_exports.enum(RepositoryStatusValues),
   defaultBranch: external_exports.string(),
+  primaryLanguage: external_exports.string().nullable().optional(),
   createdAt: external_exports.date(),
   updatedAt: external_exports.date()
 });
@@ -23640,8 +24026,8 @@ var CloneTokenResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/repository.ts
-var c11 = initContract();
-var repositoryContract = c11.router({
+var c12 = initContract();
+var repositoryContract = c12.router({
   createRepository: {
     method: "POST",
     path: "/organizations/:organizationId/repositories",
@@ -23839,8 +24225,8 @@ var ListScanLogsResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/scan.ts
-var c12 = initContract();
-var scanContract = c12.router({
+var c13 = initContract();
+var scanContract = c13.router({
   createScan: {
     method: "POST",
     path: "/organizations/:organizationId/scans",
@@ -23945,8 +24331,8 @@ var UserResponseSchema = external_exports.object({
 var ListUsersResponseSchema = external_exports.array(UserResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/user.ts
-var c13 = initContract();
-var userContract = c13.router({
+var c14 = initContract();
+var userContract = c14.router({
   listUsers: {
     method: "GET",
     path: "/organizations/:organizationId/users",
@@ -24018,8 +24404,8 @@ var VantaIntegrationResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vanta-integration.ts
-var c14 = initContract();
-var vantaIntegrationContract = c14.router({
+var c15 = initContract();
+var vantaIntegrationContract = c15.router({
   createVantaIntegration: {
     method: "POST",
     path: "/organizations/:organizationId/vanta-integration",
@@ -24244,8 +24630,8 @@ var UpdateVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability.ts
-var c15 = initContract();
-var vulnerabilityContract = c15.router({
+var c16 = initContract();
+var vulnerabilityContract = c16.router({
   filterVulnerabilities: {
     method: "POST",
     path: "/organizations/:organizationId/vulnerabilities/filter",
@@ -24383,15 +24769,15 @@ var VulnerabilityNoteResponseSchema = external_exports.object({
 });
 var ListVulnerabilityNotesResponseSchema = external_exports.array(VulnerabilityNoteResponseSchema);
 var CreateVulnerabilityNoteRequestSchema = external_exports.object({
-  content: external_exports.string().min(1).max(1e4)
+  content: external_exports.string().max(1e4)
 });
 var UpdateVulnerabilityNoteRequestSchema = external_exports.object({
-  content: external_exports.string().min(1).max(1e4)
+  content: external_exports.string().max(1e4)
 });
 
 // ../../packages/api-contracts/src/contracts/v1/vulnerability-note.ts
-var c16 = initContract();
-var vulnerabilityNoteContract = c16.router({
+var c17 = initContract();
+var vulnerabilityNoteContract = c17.router({
   listNotes: {
     method: "GET",
     path: "/organizations/:organizationId/vulnerabilities/:vulnerabilityId/notes",
@@ -24463,8 +24849,8 @@ var WebApplicationResponseSchema = external_exports.object({
 var ListWebApplicationsResponseSchema = external_exports.array(WebApplicationResponseSchema);
 
 // ../../packages/api-contracts/src/contracts/v1/web-application.ts
-var c17 = initContract();
-var webApplicationContract = c17.router({
+var c18 = initContract();
+var webApplicationContract = c18.router({
   listWebApplications: {
     method: "GET",
     path: "/organizations/:organizationId/web-applications",
@@ -24603,8 +24989,8 @@ var ListWebhookDeliveriesResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/webhook-settings.ts
-var c18 = initContract();
-var webhookSettingsContract = c18.router({
+var c19 = initContract();
+var webhookSettingsContract = c19.router({
   listWebhookEndpoints: {
     method: "GET",
     path: "/organizations/:organizationId/webhook-settings/endpoints",
@@ -24742,8 +25128,8 @@ var webhookSettingsContract = c18.router({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/index.ts
-var c19 = initContract();
-var v1Contract = c19.router(
+var c20 = initContract();
+var v1Contract = c20.router(
   {
     admin: adminContract,
     scan: scanContract,
@@ -24762,7 +25148,8 @@ var v1Contract = c19.router(
     webApplication: webApplicationContract,
     chatSession: chatSessionContract,
     pentest: pentestContract,
-    pentestFinding: pentestFindingContract
+    pentestFinding: pentestFindingContract,
+    dependency: dependencyContract
   },
   {
     pathPrefix: "/v1"
@@ -24770,8 +25157,8 @@ var v1Contract = c19.router(
 );
 
 // ../../packages/api-contracts/src/contracts/index.ts
-var c20 = initContract();
-var contract = c20.router({
+var c21 = initContract();
+var contract = c21.router({
   v1: v1Contract
 });
 
@@ -24781,8 +25168,8 @@ var GitHubWebhookResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks/github.ts
-var c21 = initContract();
-var githubWebhookContract = c21.router(
+var c22 = initContract();
+var githubWebhookContract = c22.router(
   {
     handleWebhook: {
       method: "POST",
@@ -24807,8 +25194,8 @@ var HealthResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/health.ts
-var c22 = initContract();
-var healthContract = c22.router({
+var c23 = initContract();
+var healthContract = c23.router({
   getHealth: {
     method: "GET",
     path: "/health",
@@ -24857,8 +25244,8 @@ var UpdatePrVulnerabilityRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/v1/pr-vulnerability.ts
-var c23 = initContract();
-var prVulnerabilityContract = c23.router(
+var c24 = initContract();
+var prVulnerabilityContract = c24.router(
   {
     listPrVulnerabilities: {
       method: "GET",
@@ -25057,6 +25444,11 @@ function formatStatus(status) {
 }
 
 // src/pentest/commands.ts
+var DEFAULT_LIMIT = 30;
+var MAX_LIMIT = 100;
+function tsvSafe(value) {
+  return value.replace(/[\t\n\r]/g, " ");
+}
 function formatDate(date5) {
   if (!date5) {
     return "\u2014";
@@ -25098,6 +25490,10 @@ async function resolvePentestId(organizationId, identifier) {
       params: { organizationId }
     })
   );
+  if (result.status === 401) {
+    console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+    process.exit(1);
+  }
   if (result.status !== 200) {
     console.error(`Failed to list pentests (status ${result.status}).`);
     process.exit(1);
@@ -25113,30 +25509,72 @@ Run \`tracecli pentest list\` to see available pentests.`
   return pentest.pentestId;
 }
 function createListCommand() {
-  return new Command("list").description("List pentests for your organization").option("--json", "Output as JSON").action(async (options) => {
+  return new Command("list").description("List pentests for your organization").option(
+    "-L, --limit <n>",
+    `Max results to return (default: ${DEFAULT_LIMIT}, max: ${MAX_LIMIT})`,
+    (v) => {
+      const n = Number.parseInt(v, 10);
+      if (Number.isNaN(n) || n < 1) {
+        throw new Error("--limit must be a positive integer");
+      }
+      return Math.min(n, MAX_LIMIT);
+    }
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli pentest list
+  tracecli pentest list --limit 10
+  tracecli pentest list --output json | jq '.[].title'
+  tracecli pentest list --output tsv | cut -f1,2`
+  ).action(async (options) => {
     const organizationId = await resolveOrganizationId();
     const result = await authenticatedRequest(
       (client) => client.pentest.listPentests({
         params: { organizationId }
       })
     );
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
     if (result.status !== 200) {
       console.error(`Failed to list pentests (status ${result.status}).`);
       process.exit(1);
     }
-    const pentests = result.body;
+    const limit = options.limit ?? DEFAULT_LIMIT;
+    const pentests = result.body.slice(0, limit);
+    const isJson = options.output === "json";
+    const isTsv = options.output === "tsv";
     if (pentests.length === 0) {
-      if (options.json) {
+      if (isJson) {
         console.log("[]");
+      } else if (isTsv) {
+        console.log("displayId	title	status	startedAt	endedAt	findingsTotal");
       } else {
         console.log("No pentests found.");
       }
       return;
     }
-    if (options.json) {
+    if (isJson) {
       console.log(JSON.stringify(pentests, null, 2));
       return;
     }
+    if (isTsv) {
+      console.log("displayId	title	status	startedAt	endedAt	findingsTotal");
+      for (const pt of pentests) {
+        const cols = [
+          `PT-${pt.displayId}`,
+          tsvSafe(pt.title),
+          pt.status,
+          pt.startedAt ? String(pt.startedAt) : "",
+          pt.endedAt ? String(pt.endedAt) : "",
+          String(pt.findingCounts.total)
+        ];
+        console.log(cols.join("	"));
+      }
+      return;
+    }
     console.log(`Found ${pentests.length} pentest${pentests.length === 1 ? "" : "s"}:
 `);
     for (const pt of pentests) {
@@ -25155,7 +25593,14 @@ function createListCommand() {
   });
 }
 function createFindingsListCommand() {
-  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("--json", "Output as JSON").action(async (options) => {
+  return new Command("list").description("List findings for a pentest").requiredOption("--pentest <id>", "Pentest display ID (e.g. PT-3) or UUID").option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli pentest findings list --pentest PT-3
+  tracecli pentest findings list --pentest PT-3 --output json
+  tracecli pentest findings list --pentest PT-3 --output tsv | cut -f1,4`
+  ).action(async (options) => {
     const organizationId = await resolveOrganizationId();
     const pentestId = await resolvePentestId(organizationId, options.pentest);
     const result = await authenticatedRequest(
@@ -25163,28 +25608,57 @@ function createFindingsListCommand() {
         params: { organizationId, pentestId }
       })
     );
+    if (result.status === 401) {
+      console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+      process.exit(1);
+    }
+    if (result.status === 404) {
+      console.error(
+        `Pentest '${options.pentest}' not found. Verify the ID with \`tracecli pentest list\`.`
+      );
+      process.exit(1);
+    }
     if (result.status !== 200) {
       console.error(`Failed to list findings (status ${result.status}).`);
       process.exit(1);
     }
     const findings = result.body;
+    const isJson = options.output === "json";
+    const isTsv = options.output === "tsv";
     if (findings.length === 0) {
-      if (options.json) {
+      if (isJson) {
         console.log("[]");
+      } else if (isTsv) {
+        console.log("severity	status	category	title	cweIds	cvssScore");
       } else {
         console.log("No findings found for this pentest.");
       }
       return;
     }
-    if (options.json) {
+    if (isJson) {
       console.log(JSON.stringify(findings, null, 2));
       return;
     }
-    console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
-`);
     const sorted = [...findings].sort(
       (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
     );
+    if (isTsv) {
+      console.log("severity	status	category	title	cweIds	cvssScore");
+      for (const finding of sorted) {
+        const cols = [
+          finding.severity,
+          finding.status,
+          tsvSafe(finding.category),
+          tsvSafe(finding.title),
+          finding.cweIds.join(";"),
+          finding.cvssScore != null ? String(finding.cvssScore) : ""
+        ];
+        console.log(cols.join("	"));
+      }
+      return;
+    }
+    console.log(`Found ${findings.length} finding${findings.length === 1 ? "" : "s"}:
+`);
     for (const finding of sorted) {
       const sev = formatFindingSeverity(finding.severity);
       const status = formatStatus(finding.status);
@@ -25262,6 +25736,9 @@ function extractRepoName(input) {
   return input;
 }
 var BRANCH_NAME_PATTERN = /^[a-zA-Z0-9._/+-]+$/;
+var TRACE_GIT_ASKPASS_TOKEN_ENV = "TRACE_GIT_ASKPASS_TOKEN";
+var REPOSITORY_PLATFORMS = ["GITHUB", "GITLAB", "BITBUCKET"];
+var REPOSITORY_STATUSES = ["CONNECTED", "DISCONNECTED"];
 function validateBranchName(branch) {
   if (branch.startsWith("-")) {
     throw new Error(`Invalid branch name: '${branch}' \u2014 branch names cannot start with a dash`);
@@ -25271,29 +25748,268 @@ function validateBranchName(branch) {
   }
   return branch;
 }
-function createListCommand2() {
-  return new Command("list").description("List repositories in your organization").action(async () => {
-    const organizationId = await resolveOrganizationId();
-    const result = await authenticatedRequest(
-      (client) => client.repository.listRepositories({
-        params: { organizationId }
-      })
+function parseCloneDepth(value) {
+  const depth = Number.parseInt(value, 10);
+  if (!Number.isInteger(depth) || depth < 1) {
+    throw new Error("--depth must be a positive integer");
+  }
+  return depth;
+}
+function normalizeForMatching(value) {
+  return value.trim().toLowerCase();
+}
+function normalizePlatform(value, source) {
+  const normalized = value.trim().toUpperCase();
+  if (REPOSITORY_PLATFORMS.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${REPOSITORY_PLATFORMS.join(", ")}. Received '${value}'.`
+  );
+}
+function normalizeStatus(value, source) {
+  const normalized = value.trim().toUpperCase();
+  if (REPOSITORY_STATUSES.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `${source} must be one of: ${REPOSITORY_STATUSES.join(", ")}. Received '${value}'.`
+  );
+}
+function normalizeFilterField(rawField) {
+  const field = rawField.trim().toLowerCase();
+  switch (field) {
+    case "platform":
+      return "platform";
+    case "status":
+      return "status";
+    case "url":
+    case "repository":
+    case "repositoryurl":
+    case "repository_url":
+      return "repository_url";
+    case "repo":
+    case "name":
+    case "repository_name":
+      return "repo_name";
+    case "branch":
+    case "defaultbranch":
+    case "default_branch":
+      return "default_branch";
+    case "language":
+    case "primarylanguage":
+    case "primary_language":
+      return "language";
+    default:
+      throw new Error(
+        `Unknown repository filter field '${rawField}'. Supported fields: platform, status, url, repo, branch, language.`
+      );
+  }
+}
+function parseFilterOperator(rawOperator) {
+  switch (rawOperator) {
+    case "=":
+      return "exact";
+    case "!=":
+      return "not_exact";
+    case ":":
+      return "contains";
+    case "!:":
+      return "not_contains";
+    default:
+      throw new Error(`Unsupported filter operator '${rawOperator}'. Use one of: =, !=, :, !:.`);
+  }
+}
+function parseRepositoryFilterExpression(expression) {
+  const trimmed = expression.trim();
+  const match = /^([a-zA-Z][a-zA-Z0-9_-]*)(!=|!:|=|:)(.+)$/.exec(trimmed);
+  if (!match) {
+    throw new Error(
+      `Invalid filter '${expression}'. Expected format: <field><operator><value> (e.g., platform=GITHUB, repo:trace, status!=DISCONNECTED).`
     );
-    if (result.status !== 200) {
-      console.error(`Failed to list repositories (status ${result.status}).`);
-      process.exit(1);
+  }
+  const rawField = match[1];
+  const rawOperator = match[2];
+  const rawValue = match[3];
+  if (!rawField || !rawOperator || !rawValue) {
+    throw new Error(`Invalid filter '${expression}'.`);
+  }
+  const value = rawValue.trim();
+  if (!value) {
+    throw new Error(`Invalid filter '${expression}': value cannot be empty.`);
+  }
+  const field = normalizeFilterField(rawField);
+  const operator = parseFilterOperator(rawOperator);
+  if (field === "platform") {
+    normalizePlatform(value, "--filter");
+  }
+  if (field === "status") {
+    normalizeStatus(value, "--filter");
+  }
+  return { field, operator, value };
+}
+function doesValueMatchFilter(candidate, filterValue, operator, exactMatchOnly) {
+  const normalizedCandidate = normalizeForMatching(candidate);
+  const normalizedFilter = normalizeForMatching(filterValue);
+  if (exactMatchOnly || operator === "exact" || operator === "not_exact") {
+    const matches2 = normalizedCandidate === normalizedFilter;
+    return operator === "not_exact" ? !matches2 : matches2;
+  }
+  const matches = normalizedCandidate.includes(normalizedFilter);
+  return operator === "not_contains" ? !matches : matches;
+}
+function matchParsedFilter(repo, parsedFilter) {
+  switch (parsedFilter.field) {
+    case "platform":
+      return doesValueMatchFilter(repo.platform, parsedFilter.value, parsedFilter.operator, true);
+    case "status":
+      return doesValueMatchFilter(repo.status, parsedFilter.value, parsedFilter.operator, true);
+    case "repository_url":
+      return doesValueMatchFilter(
+        repo.repositoryUrl,
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "repo_name":
+      return doesValueMatchFilter(
+        extractRepoName(repo.repositoryUrl),
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "default_branch":
+      return doesValueMatchFilter(
+        repo.defaultBranch,
+        parsedFilter.value,
+        parsedFilter.operator,
+        false
+      );
+    case "language": {
+      const language = repo.primaryLanguage ?? "";
+      return doesValueMatchFilter(language, parsedFilter.value, parsedFilter.operator, false);
     }
-    const repos = result.body;
-    if (repos.length === 0) {
-      console.log("No repositories found.");
-      return;
+  }
+}
+function filterRepositories(repositories, options) {
+  const parsedFilters = (options.filters ?? []).map(
+    (expression) => parseRepositoryFilterExpression(expression)
+  );
+  const normalizedPlatform = options.platform ? normalizePlatform(options.platform, "--platform") : void 0;
+  const normalizedStatus = options.status ? normalizeStatus(options.status, "--status") : void 0;
+  const normalizedQuery = options.query ? normalizeForMatching(options.query) : void 0;
+  const normalizedDefaultBranch = options.defaultBranch ? normalizeForMatching(options.defaultBranch) : void 0;
+  const normalizedLanguage = options.language ? normalizeForMatching(options.language) : void 0;
+  return repositories.filter((repo) => {
+    if (normalizedPlatform && repo.platform.toUpperCase() !== normalizedPlatform) {
+      return false;
+    }
+    if (normalizedStatus && repo.status.toUpperCase() !== normalizedStatus) {
+      return false;
+    }
+    if (normalizedDefaultBranch && !normalizeForMatching(repo.defaultBranch).includes(normalizedDefaultBranch)) {
+      return false;
     }
-    for (const repo of repos) {
-      const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
-      const url2 = stripAnsi(String(repo.repositoryUrl));
-      const platform = stripAnsi(String(repo.platform)).toLowerCase();
-      console.log(`${url2}  (${platform}, ${status})`);
+    const repoLanguage = normalizeForMatching(repo.primaryLanguage ?? "");
+    if (normalizedLanguage && !repoLanguage.includes(normalizedLanguage)) {
+      return false;
+    }
+    if (normalizedQuery) {
+      const normalizedUrl = normalizeForMatching(repo.repositoryUrl);
+      const normalizedBranch = normalizeForMatching(repo.defaultBranch);
+      const normalizedName = normalizeForMatching(extractRepoName(repo.repositoryUrl));
+      if (!normalizedUrl.includes(normalizedQuery) && !normalizedBranch.includes(normalizedQuery) && !repoLanguage.includes(normalizedQuery) && !normalizedName.includes(normalizedQuery)) {
+        return false;
+      }
     }
+    for (const parsedFilter of parsedFilters) {
+      if (!matchParsedFilter(repo, parsedFilter)) {
+        return false;
+      }
+    }
+    return true;
+  });
+}
+function collectFilterExpression(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function toRepositoryListFilterOptions(options) {
+  return {
+    ...options.platform ? { platform: options.platform } : {},
+    ...options.status ? { status: options.status } : {},
+    ...options.query ? { query: options.query } : {},
+    ...options.defaultBranch ? { defaultBranch: options.defaultBranch } : {},
+    ...options.language ? { language: options.language } : {},
+    ...options.filter.length > 0 ? { filters: options.filter } : {}
+  };
+}
+function addRepositoryFilterOptions(command) {
+  return command.option(
+    "--platform <platform>",
+    "Filter by platform (GITHUB, GITLAB, BITBUCKET)",
+    (value) => value.toUpperCase()
+  ).option(
+    "--status <status>",
+    "Filter by status (CONNECTED, DISCONNECTED)",
+    (value) => value.toUpperCase()
+  ).option("--query <query>", "Case-insensitive search across URL, repo, branch, and language").option("--default-branch <branch>", "Filter by default branch (case-insensitive contains)").option("--language <language>", "Filter by primary language (case-insensitive contains)").option(
+    "--filter <expression>",
+    "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, language!:typescript",
+    collectFilterExpression,
+    []
+  ).option("--json", "Output as JSON");
+}
+async function runRepositoryListCommand(options) {
+  let filteredRepositories;
+  const organizationId = await resolveOrganizationId();
+  const result = await authenticatedRequest(
+    (client) => client.repository.listRepositories({
+      params: { organizationId }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to list repositories (status ${result.status}).`);
+    process.exit(1);
+  }
+  try {
+    filteredRepositories = filterRepositories(result.body, toRepositoryListFilterOptions(options));
+  } catch (error48) {
+    const message = error48 instanceof Error ? error48.message : "Unknown filter parsing error.";
+    console.error(`Invalid repository filter: ${message}`);
+    process.exit(1);
+  }
+  if (filteredRepositories.length === 0) {
+    if (options.platform || options.status || options.query || options.defaultBranch || options.language || options.filter.length > 0) {
+      console.log("No repositories found matching the provided filters.");
+      return;
+    }
+    console.log("No repositories found.");
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(filteredRepositories, null, 2));
+    return;
+  }
+  for (const repo of filteredRepositories) {
+    const status = repo.status === "CONNECTED" ? "connected" : "disconnected";
+    const url2 = stripAnsi(String(repo.repositoryUrl));
+    const platform = stripAnsi(String(repo.platform)).toLowerCase();
+    console.log(`${url2}  (${platform}, ${status})`);
+  }
+}
+function createListCommand2() {
+  return addRepositoryFilterOptions(
+    new Command("list").description("List repositories in your organization")
+  ).action(async (options) => {
+    await runRepositoryListCommand(options);
+  });
+}
+function createFilterCommand() {
+  return addRepositoryFilterOptions(
+    new Command("filter").description("Filter repositories in your organization")
+  ).action(async (options) => {
+    await runRepositoryListCommand(options);
   });
 }
 function urlWithUsername(httpsUrl) {
@@ -25302,14 +26018,21 @@ function urlWithUsername(httpsUrl) {
   url2.password = "";
   return url2.toString();
 }
-function createAskPassScript(token) {
+function createAskPassScript() {
   const dir = mkdtempSync(join3(tmpdir(), "trace-askpass-"));
   const scriptPath = join3(dir, "askpass.sh");
-  writeFileSync3(scriptPath, `#!/bin/sh
-echo '${token.replace(/'/g, "'\\''")}'
-`, {
-    mode: 448
-  });
+  writeFileSync3(
+    scriptPath,
+    `#!/bin/sh
+if [ -z "\${${TRACE_GIT_ASKPASS_TOKEN_ENV}:-}" ]; then
+  exit 1
+fi
+printf '%s\\n' "$${TRACE_GIT_ASKPASS_TOKEN_ENV}"
+`,
+    {
+      mode: 448
+    }
+  );
   chmodSync(scriptPath, 448);
   return scriptPath;
 }
@@ -25329,7 +26052,8 @@ async function fetchCloneToken(repoUrl) {
       return null;
     }
     if (result.status === 200) {
-      return result.body.token;
+      const token = result.body.token.trim();
+      return token.length > 0 ? token : null;
     }
     return null;
   } catch {
@@ -25337,7 +26061,7 @@ async function fetchCloneToken(repoUrl) {
   }
 }
 function createCloneCommand() {
-  return new Command("clone").description("Clone a repository").argument("<repository>", "Repository URL or owner/repo shorthand").argument("[directory]", "Directory to clone into").option("--branch <branch>", "Branch to clone").option("--depth <depth>", "Shallow clone depth", Number.parseInt).action(
+  return new Command("clone").description("Clone a repository").argument("<repository>", "Repository URL or owner/repo shorthand").argument("[directory]", "Directory to clone into").option("--branch <branch>", "Branch to clone").option("--depth <depth>", "Shallow clone depth", parseCloneDepth).action(
     async (repository, directory, options) => {
       const cloneUrl = resolveRepoUrl(repository);
       const targetDir = directory ?? extractRepoName(repository);
@@ -25359,8 +26083,9 @@ function createCloneCommand() {
       console.log(`Cloning ${cloneUrl} into ${targetDir}...`);
       const extraEnv = {};
       if (installationToken) {
-        askPassScript = createAskPassScript(installationToken);
+        askPassScript = createAskPassScript();
         extraEnv["GIT_ASKPASS"] = askPassScript;
+        extraEnv[TRACE_GIT_ASKPASS_TOKEN_ENV] = installationToken;
         extraEnv["GIT_TERMINAL_PROMPT"] = "0";
       }
       try {
@@ -25371,7 +26096,7 @@ function createCloneCommand() {
         });
         const exitCode = await proc.exited;
         if (exitCode !== 0) {
-          process.exit(exitCode);
+          process.exit(1);
         }
         if (installationToken) {
           const resetProc = Bun.spawn(["git", "remote", "set-url", "origin", cloneUrl], {
@@ -25398,13 +26123,14 @@ function createCloneCommand() {
 function createRepoCommand() {
   const repo = new Command("repo").description("Manage repositories");
   repo.addCommand(createListCommand2());
+  repo.addCommand(createFilterCommand());
   repo.addCommand(createCloneCommand());
   return repo;
 }
 
 // src/vulnerabilities/commands.ts
-import { createInterface } from "readline";
-var DEFAULT_PAGE_SIZE = 25;
+var DEFAULT_LIMIT2 = 30;
+var MAX_LIMIT2 = 100;
 async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
   const result = await authenticatedRequest(
     (client) => client.repository.listRepositories({
@@ -25416,21 +26142,18 @@ async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier)
     process.exit(1);
   }
   const repos = result.body;
-  const match = repos.find((r) => {
-    const url2 = r.repositoryUrl;
-    if (url2.endsWith(`/${repoIdentifier}`)) {
-      return true;
-    }
-    if (url2.endsWith(`/${repoIdentifier}.git`)) {
-      return true;
-    }
-    if (url2 === repoIdentifier) {
-      return true;
+  const isBareNameOnly = !repoIdentifier.includes("/") && !repoIdentifier.startsWith("http");
+  if (!isBareNameOnly) {
+    const match = repos.find((r) => {
+      const url2 = r.repositoryUrl;
+      if (url2.endsWith(`/${repoIdentifier}`)) return true;
+      if (url2.endsWith(`/${repoIdentifier}.git`)) return true;
+      if (url2 === repoIdentifier) return true;
+      return false;
+    });
+    if (match) {
+      return match.repositoryId;
     }
-    return false;
-  });
-  if (match) {
-    return match.repositoryId;
   }
   const byName = repos.filter((r) => {
     const segments = r.repositoryUrl.replace(/\.git$/, "").split("/");
@@ -25484,15 +26207,26 @@ function printVulnerabilities(vulnerabilities) {
     console.log("");
   }
 }
-async function promptContinue(displayed, total) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    rl.question(`Showing ${displayed} of ${total}. Show more? [Y/n] `, (answer) => {
-      rl.close();
-      const trimmed = answer.trim().toLowerCase();
-      resolve(trimmed === "" || trimmed === "y" || trimmed === "yes");
-    });
-  });
+function sanitizeTsvField(value) {
+  return value.replace(/[\t\n\r]/g, " ");
+}
+function printVulnerabilitiesTsv(vulnerabilities) {
+  const sorted = [...vulnerabilities].sort(
+    (a, b) => (SEVERITY_ORDER[a.severity] ?? 99) - (SEVERITY_ORDER[b.severity] ?? 99)
+  );
+  console.log("severity	status	repository	file	line	traceId	title");
+  for (const vuln of sorted) {
+    const cols = [
+      vuln.severity,
+      vuln.status,
+      vuln.repositoryName,
+      vuln.codeSnippet.filePath,
+      String(vuln.codeSnippet.startLine),
+      vuln.traceId,
+      vuln.title
+    ].map(sanitizeTsvField);
+    console.log(cols.join("	"));
+  }
 }
 function createListCommand3() {
   return new Command("list").description("List vulnerabilities for your organization").option("--repo <repo>", "Filter by repository name or owner/repo").option(
@@ -25503,13 +26237,26 @@ function createListCommand3() {
     "--status <status>",
     "Filter by status (OPEN, IN_PROGRESS, FIXED, IGNORED, FALSE_POSITIVE)",
     (value) => value.toUpperCase()
-  ).option("--page-size <size>", "Number of results per page", (v) => {
-    const n = Number.parseInt(v, 10);
-    if (Number.isNaN(n) || n < 1) {
-      throw new Error("--page-size must be a positive integer");
-    }
-    return Math.min(n, 200);
-  }).option("--json", "Output as JSON").action(
+  ).option(
+    "-L, --limit <n>",
+    `Max results to return (default: ${DEFAULT_LIMIT2}, max: ${MAX_LIMIT2})`,
+    (v) => {
+      const n = Number.parseInt(v, 10);
+      if (Number.isNaN(n) || n < 1) {
+        throw new Error("--limit must be a positive integer");
+      }
+      return Math.min(n, MAX_LIMIT2);
+    }
+  ).option("-o, --output <format>", "Output format: table, json, tsv (default: table)", "table").addHelpText(
+    "after",
+    `
+Examples:
+  tracecli vulnerabilities list
+  tracecli vulnerabilities list --severity CRITICAL --status OPEN
+  tracecli vulnerabilities list --repo securewithtrace/trace --limit 50
+  tracecli vulnerabilities list --output json | jq '.[].title'
+  tracecli vulnerabilities list --output tsv | cut -f1,7`
+  ).action(
     async (options) => {
       const organizationId = await resolveOrganizationId();
       const conditions = [];
@@ -25529,57 +26276,54 @@ function createListCommand3() {
         sortBy: "severity",
         sortOrder: "desc"
       };
-      const pageSize = options.pageSize ?? DEFAULT_PAGE_SIZE;
+      const limit = options.limit ?? DEFAULT_LIMIT2;
+      const isJson = options.output === "json";
+      const isTsv = options.output === "tsv";
+      const collected = [];
       let page = 1;
-      let totalDisplayed = 0;
-      let total = 0;
-      const allJsonVulnerabilities = [];
-      while (true) {
+      const pageSize = Math.min(limit, 100);
+      while (collected.length < limit) {
         const result = await authenticatedRequest(
           (client) => client.vulnerability.filterVulnerabilities({
             params: { organizationId },
             body: { ...filterBody, page, pageSize }
           })
         );
+        if (result.status === 401) {
+          console.error("Authentication failed. Run `tracecli auth login` to re-authenticate.");
+          process.exit(1);
+        }
         if (result.status !== 200) {
           console.error(`Failed to list vulnerabilities (status ${result.status}).`);
           process.exit(1);
         }
-        total = result.body.total;
         const vulnerabilities = result.body.statusGroups.flatMap((g) => g.vulnerabilities);
-        if (page === 1 && vulnerabilities.length === 0) {
-          if (options.json) {
-            console.log("[]");
-          } else {
-            console.log("No vulnerabilities found.");
-          }
-          return;
-        }
-        if (options.json) {
-          allJsonVulnerabilities.push(...vulnerabilities);
-        } else {
-          if (page === 1) {
-            console.log(`Found ${total} vulnerabilit${total === 1 ? "y" : "ies"}:
-`);
-          }
-          printVulnerabilities(vulnerabilities);
-        }
-        totalDisplayed += vulnerabilities.length;
-        if (totalDisplayed >= total || vulnerabilities.length < pageSize) {
-          break;
-        }
-        if (options.json) {
-          page++;
-          continue;
-        }
-        const wantMore = await promptContinue(totalDisplayed, total);
-        if (!wantMore) {
+        collected.push(...vulnerabilities);
+        if (vulnerabilities.length < pageSize || collected.length >= result.body.total) {
           break;
         }
         page++;
       }
-      if (options.json) {
-        console.log(JSON.stringify(allJsonVulnerabilities, null, 2));
+      const items = collected.slice(0, limit);
+      if (items.length === 0) {
+        if (isJson) {
+          console.log("[]");
+        } else if (isTsv) {
+          console.log("severity	status	repository	file	line	traceId	title");
+        } else {
+          console.log("No vulnerabilities found.");
+        }
+        return;
+      }
+      if (isJson) {
+        console.log(JSON.stringify(items, null, 2));
+      } else if (isTsv) {
+        printVulnerabilitiesTsv(items);
+      } else {
+        const total = collected.length;
+        console.log(`Found ${total} vulnerabilit${total === 1 ? "y" : "ies"}:
+`);
+        printVulnerabilities(items);
       }
     }
   );