bevor-cli 0.1.0__py3-none-any.whl

bevor_cli/configuration/creds.py

@@ -0,0 +1,52 @@
+"""Persist and load CLI credentials at ~/.bevor/credentials."""
+
+import datetime
+import json
+from pathlib import Path
+
+import typer
+from bevor_cli import output
+from pydantic import BaseModel
+
+_CREDENTIALS_PATH = Path.home() / ".bevor" / "credentials"
+
+
+class Credentials(BaseModel):
+    token: str | None = None
+
+    @property
+    def is_authenticated(self) -> bool:
+        return self.token is not None
+
+    @classmethod
+    def load(cls) -> "Credentials":
+        if not _CREDENTIALS_PATH.exists():
+            return cls()
+        try:
+            return cls.model_validate_json(_CREDENTIALS_PATH.read_text())
+        except Exception:
+            return cls()
+
+    @classmethod
+    def save(cls, token: str) -> "Credentials":
+        _CREDENTIALS_PATH.parent.mkdir(parents=True, exist_ok=True)
+        _CREDENTIALS_PATH.write_text(
+            json.dumps(
+                {"token": token, "saved_at": datetime.datetime.now(datetime.UTC).isoformat()},
+                indent=2,
+            )
+        )
+        _CREDENTIALS_PATH.chmod(0o600)
+
+        return Credentials(token=token)
+
+    @classmethod
+    def delete(cls) -> None:
+        if _CREDENTIALS_PATH.exists():
+            _CREDENTIALS_PATH.unlink()
+
+    def require_token(self) -> str:
+        if not self.token:
+            output.error("Not authenticated", hint="Run `bevor login`.")
+            raise typer.Exit(1)
+        return self.token

bevor_cli/configuration/settings.py

@@ -0,0 +1,54 @@
+"""Persist and load CLI credentials at ~/.bevor/credentials."""
+
+import json
+from pathlib import Path
+from typing import Literal, Optional
+
+from pydantic import BaseModel
+
+_CONFIG_DIR = ".bevor"
+_SETTINGS_FILE = "settings.json"
+_GLOBAL_SETTINGS_PATH = Path.home() / ".bevor" / "settings"
+
+
+class Settings(BaseModel):
+    auto_sync: bool = False
+    auto_parent: bool = False
+    override_sync_warning: bool = False
+    allow_project_change: bool = False
+    allow_workspace_change: bool = False
+    default_page_size: Optional[int] = None
+
+    @classmethod
+    def load(cls, cwd: Path | None = None) -> "Settings":
+        base = cwd or Path.cwd()
+        path = base / _CONFIG_DIR / _SETTINGS_FILE
+
+        global_settings = cls()
+        if _GLOBAL_SETTINGS_PATH.exists():
+            global_settings = cls.model_validate_json(_GLOBAL_SETTINGS_PATH.read_text())
+
+        if not path.exists():
+            return global_settings
+
+        local_settings = json.loads(path.read_text())
+
+        merged = {**global_settings.model_dump(), **local_settings}
+
+        return cls.model_validate(merged)
+
+    def store(self, state: Literal["local", "global"], cwd: Path | None = None):
+        base = cwd or Path.cwd()
+        path = base / _CONFIG_DIR / _SETTINGS_FILE
+
+        if state == "global":
+            if not _GLOBAL_SETTINGS_PATH.exists():
+                _GLOBAL_SETTINGS_PATH.parent.mkdir(parents=True, exist_ok=True)
+            _GLOBAL_SETTINGS_PATH.write_text(self.model_dump_json(indent=2))
+
+        elif state == "local":
+            if not path.exists():
+                path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(self.model_dump_json(indent=2))
+
+        return Settings.load(cwd=cwd)

bevor_cli/configuration/state.py

@@ -0,0 +1,113 @@
+"""Project-local config stored at <cwd>/.bevor/config.json."""
+
+import json
+from pathlib import Path
+from typing import Optional
+
+import typer
+from bevor_cli import output
+from bevor_sdk.types import ID
+from bevor_sdk.types.responses.graph import CodeMappingSchema
+from bevor_sdk.types.responses.security import AnalysisSchema
+from pydantic import BaseModel
+
+_CONFIG_DIR = ".bevor"
+_CONFIG_FILE = "config.json"
+
+
+def _state_path(cwd: Path | None = None) -> Path:
+    base = cwd or Path.cwd()
+    return base / _CONFIG_DIR / _CONFIG_FILE
+
+
+class State(BaseModel):
+    workspace_id: Optional[str] = None
+    project_id: Optional[str] = None
+    code_id: Optional[str] = None
+    code_fingerprint: Optional[str] = None
+    analysis_id: Optional[str] = None
+
+    @classmethod
+    def load(cls, cwd: Path | None = None) -> "State":
+        path = _state_path(cwd)
+        if not path.exists():
+            return cls()
+        try:
+            raw = json.loads(path.read_text())
+            return cls.model_validate(raw)
+        except Exception:
+            return cls()
+
+    def save(self, cwd: Path | None = None) -> None:
+        path = _state_path(cwd)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(self.model_dump_json(indent=2))
+
+    def set_workspace(self, workspace_id: str | None) -> None:
+        self.workspace_id = workspace_id
+        self.project_id = None
+        self.code_id = None
+        self.code_fingerprint = None
+        self.analysis_id = None
+
+    def set_project(self, project_id: str | None) -> None:
+        self.project_id = project_id
+        self.code_id = None
+        self.code_fingerprint = None
+        self.analysis_id = None
+
+    def set_code(self, code: CodeMappingSchema) -> None:
+        self.code_id = code.id
+        self.code_fingerprint = code.version_fingerprint
+
+    def set_analysis(self, analysis: AnalysisSchema) -> None:
+        """Point config at an analysis container (defaults to the returned head)."""
+        self.analysis_id = analysis.id
+        self.code_id = analysis.version.code_version.id
+        self.code_fingerprint = analysis.version.code_version.version_fingerprint
+
+    def clear_analysis(self) -> None:
+        self.analysis_id = None
+
+    def validate_workspace(self) -> ID:
+        if self.workspace_id:
+            return ID(self.workspace_id)
+
+        output.error("Workspace Configuration required", hint="Run `bevor link`.")
+        raise typer.Exit(1)
+
+    def validate_project(self, priority: str | None = None) -> ID:
+        if priority:
+            return ID(priority)
+        if self.project_id:
+            return ID(self.project_id)
+
+        output.error(
+            "Project Configuration required", hint="Run `bevor link` or `bevor projects select`."
+        )
+        raise typer.Exit(1)
+
+    def validate_code(self, priority: str | None = None, fallback: str | None = None) -> ID:
+        if priority:
+            return ID(priority)
+        if self.code_id:
+            return ID(self.code_id)
+        if fallback:
+            return ID(fallback)
+
+        output.error("Code Configuration required", hint="Run `bevor codes push` or `bevor codes select`.")
+        raise typer.Exit(1)
+
+    def validate_analysis(self, priority: str | None = None, fallback: str | None = None) -> ID:
+        if priority:
+            return ID(priority)
+        if self.analysis_id:
+            return ID(self.analysis_id)
+        if fallback:
+            return ID(fallback)
+
+        output.error(
+            "Analysis Configuration required",
+            hint="Run `bevor analyses create` or `bevor analyses select`.",
+        )
+        raise typer.Exit(1)

bevor_cli/findings_yaml.py

@@ -0,0 +1,291 @@
+"""Finding imports — YAML mappings from a file, directory, or raw text (multi-document streams supported)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, cast, get_args
+
+import typer
+import yaml
+from bevor_sdk.types.literals import FindingLevel
+from bevor_sdk.types.requests.security import (
+    FindingBodyDict,
+    FindingLocationLogicalDict,
+    FindingLocationNodeIdDict,
+    FindingLocationPhysicalDict,
+    FindingMetadataDict,
+)
+
+from bevor_cli import output
+
+
+class FindingFormatError(ValueError):
+    """Malformed finding YAML."""
+
+    def __init__(self, message: str, *, line: int | None = None) -> None:
+        self.line = line
+        hint = "" if line is None else f" (near document #{line})"
+        super().__init__(f"{message}{hint}")
+
+
+@dataclass(frozen=True)
+class ParsedFindingDoc:
+    """One parsed finding — one mapping from a (possibly multi-document) YAML stream."""
+
+    index: int
+    yaml: dict[str, Any]
+
+
+class FindingYamlParser:
+    """Reads, parses, and validates finding YAML from a file, directory, or raw text."""
+
+    _LOCATION_STRATEGIES = {"node_id", "physical", "logical"}
+
+    def __init__(self, sources: list[tuple[str, str]]) -> None:
+        """``sources`` is a list of (label, raw_yaml_text) pairs."""
+        self._sources = sources
+
+    @classmethod
+    def from_file(cls, path: Path) -> "FindingYamlParser":
+        if not path.is_file():
+            output.error(f"File does not exist: {path}")
+            raise typer.Exit(1)
+        return cls([(path.name, cls._read(path))])
+
+    @classmethod
+    def from_directory(cls, path: Path) -> "FindingYamlParser":
+        if not path.is_dir():
+            output.error(f"Directory does not exist: {path}")
+            raise typer.Exit(1)
+        files = sorted(path.glob("*.yaml")) + sorted(path.glob("*.yml"))
+        if not files:
+            output.error(
+                f"No .yaml / .yml entries in {path}",
+                hint="Add one or more YAML files, each containing one or more findings.",
+            )
+            raise typer.Exit(1)
+        return cls([(f.name, cls._read(f)) for f in files])
+
+    @classmethod
+    def from_text(cls, raw: str, *, label: str = "input") -> "FindingYamlParser":
+        return cls([(label, raw)])
+
+    @staticmethod
+    def _read(path: Path) -> str:
+        try:
+            return path.read_text(encoding="utf-8")
+        except OSError as exc:
+            output.error(f"Cannot read file: {exc}")
+            raise typer.Exit(1) from exc
+
+    def parse(self) -> FindingBodyDict:
+        """Validate exactly one finding across all sources."""
+        docs = self._iter_docs()
+        if not docs:
+            output.error("No findings found.")
+            raise typer.Exit(1)
+        if len(docs) > 1:
+            output.error(
+                f"Found {len(docs)} findings across the given source(s).",
+                hint="Use parse_many() / bulk import (``bevor agent submit --dir``) to submit more than one.",
+            )
+            raise typer.Exit(1)
+        label, doc = docs[0]
+        return self._validate(doc, label=label)
+
+    def parse_many(self) -> list[FindingBodyDict]:
+        """Validate every finding across all sources."""
+        return [self._validate(doc, label=label) for label, doc in self._iter_docs()]
+
+    def parse_edit(self) -> tuple[FindingMetadataDict | None, str | None]:
+        """Validate a single edit-only document (metadata fields, no location)."""
+        docs = self._iter_docs()
+        if len(docs) != 1:
+            return None, f"Expected exactly one document, found {len(docs)}."
+        _, doc = docs[0]
+        return self.validate_edit_doc(doc)
+
+    def _iter_docs(self) -> list[tuple[str, ParsedFindingDoc]]:
+        out: list[tuple[str, ParsedFindingDoc]] = []
+        for label, raw in self._sources:
+            try:
+                docs = self._parse_stream(raw)
+            except FindingFormatError as exc:
+                output.error(str(exc))
+                raise typer.Exit(1) from exc
+            for doc in docs:
+                doc_label = label if len(docs) == 1 else f"{label}#{doc.index}"
+                out.append((doc_label, doc))
+        return out
+
+    def _parse_stream(self, raw: str) -> list[ParsedFindingDoc]:
+        normalized = raw.replace("\r\n", "\n").strip("\ufeff").strip()
+        if not normalized:
+            return []
+        try:
+            payloads = list(yaml.safe_load_all(normalized))
+        except yaml.YAMLError as exc:
+            raise FindingFormatError(f"Invalid YAML: {exc}") from exc
+
+        docs: list[ParsedFindingDoc] = []
+        for i, payload in enumerate(payloads, start=1):
+            if payload is None:
+                continue
+            if not isinstance(payload, dict):
+                raise FindingFormatError(
+                    f"YAML document #{i} must be a mapping (one finding per document); "
+                    f"got {type(payload).__name__!r}",
+                )
+            docs.append(ParsedFindingDoc(index=i, yaml=payload))
+        return docs
+
+    def _validate(self, doc: ParsedFindingDoc, *, label: str) -> FindingBodyDict:
+        raw = doc.yaml
+        return FindingBodyDict(
+            tool=raw.get("tool"),
+            metadata=self._metadata(raw.get("metadata"), fid=label),
+            location=self._location(raw.get("location"), fid=label),
+        )
+
+    @staticmethod
+    def validate_edit_doc(doc: ParsedFindingDoc) -> tuple[FindingMetadataDict | None, str | None]:
+        raw = doc.yaml
+
+        explanation = raw.get("explanation")
+        if not explanation:
+            return None, "Missing non-empty ``explanation``."
+
+        required = {"type", "level", "name"}
+        missing = [k for k in required if not raw.get(k)]
+        if missing:
+            return None, (
+                f"Missing keys {missing}; required type, level, name, explanation; "
+                "optional recommendation, reference."
+            )
+
+        lvl = str(raw["level"])
+        if lvl not in get_args(FindingLevel):
+            return None, f"Invalid level {lvl!r}"
+
+        metadata = FindingMetadataDict(
+            type=str(raw["type"]),
+            level=cast(FindingLevel, lvl),
+            name=str(raw["name"]),
+            explanation=str(explanation),
+            recommendation=raw.get("recommendation"),
+            poc=raw.get("poc"),
+        )
+        return metadata, None
+
+    def _location(
+        self, raw_location: Any, *, fid: str
+    ) -> FindingLocationNodeIdDict | FindingLocationPhysicalDict | FindingLocationLogicalDict:
+        if not isinstance(raw_location, dict):
+            output.error(
+                f"{fid}: missing/invalid ``location`` mapping",
+                hint="location must be a mapping with a ``strategy`` of node_id, physical, or logical.",
+            )
+            raise typer.Exit(1)
+
+        strategy = raw_location.get("strategy")
+        if strategy not in self._LOCATION_STRATEGIES:
+            output.error(
+                f"{fid}: location.strategy must be one of {sorted(self._LOCATION_STRATEGIES)}, got {strategy!r}"
+            )
+            raise typer.Exit(1)
+
+        if strategy == "node_id":
+            node_id = raw_location.get("node_id")
+            location_id = raw_location.get("location_id")
+            if not node_id and not location_id:
+                output.error(
+                    f"{fid}: provide location.node_id and/or location.location_id (at least one)."
+                )
+                raise typer.Exit(1)
+            return FindingLocationNodeIdDict(
+                strategy="node_id", node_id=node_id, location_id=location_id
+            )
+
+        if strategy == "physical":
+            uri = raw_location.get("uri")
+            if not uri:
+                output.error(f"{fid}: location.uri is required for the physical strategy.")
+                raise typer.Exit(1)
+
+            start_line = raw_location.get("startLine")
+            end_line = raw_location.get("endLine")
+            char_offset = raw_location.get("charOffset")
+            char_length = raw_location.get("charLength")
+            byte_offset = raw_location.get("byteOffset")
+            byte_length = raw_location.get("byteLength")
+
+            sufficient = (
+                (start_line is not None and end_line is not None)
+                or (char_offset is not None and char_length is not None)
+                or (byte_offset is not None and byte_length is not None)
+            )
+            if not sufficient:
+                output.error(
+                    f"{fid}: location needs one full pair — startLine+endLine, "
+                    "charOffset+charLength, or byteOffset+byteLength.",
+                )
+                raise typer.Exit(1)
+
+            return FindingLocationPhysicalDict(
+                strategy="physical",
+                uri=uri,
+                startLine=start_line,
+                startColumn=raw_location.get("startColumn"),
+                endLine=end_line,
+                endColumn=raw_location.get("endColumn"),
+                charOffset=char_offset,
+                charLength=char_length,
+                byteOffset=byte_offset,
+                byteLength=byte_length,
+            )
+
+        fqn = raw_location.get("fully_qualified_name")
+        if not fqn:
+            output.error(
+                f"{fid}: location.fully_qualified_name is required for the logical strategy."
+            )
+            raise typer.Exit(1)
+        return FindingLocationLogicalDict(strategy="logical", fully_qualified_name=fqn)
+
+    def _metadata(self, raw_metadata: Any, *, fid: str) -> FindingMetadataDict | None:
+        if raw_metadata is None:
+            return None
+        if not isinstance(raw_metadata, dict):
+            output.error(
+                f"{fid}: ``metadata`` must be a mapping, or omitted entirely to mark this location as clean."
+            )
+            raise typer.Exit(1)
+
+        explanation = raw_metadata.get("explanation")
+        if not explanation:
+            output.error(f"{fid}: metadata missing non-empty ``explanation``.")
+            raise typer.Exit(1)
+
+        required = {"type", "level", "name"}
+        missing = [k for k in required if not raw_metadata.get(k)]
+        if missing:
+            output.error(
+                f"{fid}: metadata missing keys {missing}",
+                hint="required: type, level, name, explanation; optional: recommendation, reference.",
+            )
+            raise typer.Exit(1)
+
+        lvl = str(raw_metadata["level"])
+        if lvl not in get_args(FindingLevel):
+            output.error(f"{fid}: invalid level {lvl!r}")
+            raise typer.Exit(1)
+
+        return FindingMetadataDict(
+            type=str(raw_metadata["type"]).strip(),
+            level=cast(FindingLevel, lvl.strip()),
+            name=str(raw_metadata["name"]).strip(),
+            explanation=str(explanation).strip(),
+            recommendation=raw_metadata.get("recommendation", "").strip() or None,
+            poc=raw_metadata.get("poc", "").strip() or None,
+        )

bevor_cli/main.py

@@ -0,0 +1,33 @@
+import sys
+
+import typer
+from bevor_sdk.exceptions import BaseError, InvalidScopeError, UnauthorizedError
+
+from bevor_cli import output
+from bevor_cli.apps.main import app
+
+
+def main() -> None:
+    try:
+        app(standalone_mode=False)
+    except UnauthorizedError:
+        output.error("Unauthorized.", hint="Run `bevor login`.")
+        sys.exit(1)
+    except InvalidScopeError:
+        output.error("Unauthorized: configure a workspace and project.", hint="Run `bevor link`.")
+        sys.exit(1)
+    except BaseError as e:
+        output.error(f"API error {e.status_code}: {e.args[0]}")
+        sys.exit(1)
+    except typer.Abort:
+        output.error("Aborted.")
+        sys.exit(1)
+    except typer.Exit as e:
+        sys.exit(e.exit_code)
+    except Exception as e:
+        output.error(f"Unexpected error: {e}")
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

bevor_cli/output.py

@@ -0,0 +1,69 @@
+"""Shared output utilities: spinner, styled printing, quiet-mode suppression."""
+
+from contextlib import contextmanager
+from typing import Iterator
+
+from rich.console import Console
+from rich.progress import Progress, SpinnerColumn, TextColumn
+
+console = Console()
+err_console = Console(stderr=True)
+
+_quiet: bool = False
+
+
+def set_quiet(quiet: bool) -> None:
+    global _quiet
+    _quiet = quiet
+
+
+def is_quiet() -> bool:
+    return _quiet
+
+
+def info(msg: str) -> None:
+    """Print informational / decorative text; suppressed when --quiet is set."""
+    if not _quiet:
+        console.print(msg)
+
+
+def success(msg: str) -> None:
+    """Print a green success confirmation; suppressed when --quiet is set."""
+    if not _quiet:
+        console.print(f"[green]✓[/green] {msg}")
+
+
+def warning(msg: str, hint: str | None = None) -> None:
+    """Print a warning to stderr (never suppressed)."""
+    err_console.print(f"[bold yellow]Warning:[/bold yellow] {msg}")
+    if hint:
+        err_console.print(f"[dim]{hint}[/dim]")
+
+
+def error(msg: str, hint: str | None = None) -> None:
+    """Print an error to stderr (never suppressed)."""
+    err_console.print(f"[bold red]Error:[/bold red] {msg}")
+    if hint:
+        err_console.print(f"[dim]{hint}[/dim]")
+
+
+@contextmanager
+def spinner(msg: str) -> Iterator[None]:
+    """Display a spinner for the duration of a long-running block.
+
+    Suppressed when --quiet is set so scripts see clean stdout.
+    """
+    if _quiet:
+        yield
+        return
+    with Progress(
+        SpinnerColumn(),
+        TextColumn("[progress.description]{task.description}"),
+        console=console,
+        transient=True,
+    ) as progress:
+        progress.add_task(msg, total=None)
+        yield
+
+
+__all__ = ["set_quiet", "info", "success", "warning", "error", "spinner", "console"]

bevor_cli/select.py

@@ -0,0 +1,64 @@
+"""Interactive resolution helpers for nodes and graph resources.
+
+Graph analysis and code version IDs come from ``.bevor`` (see
+:class:`bevor_cli.client.BevorGraphClient` /
+:class:`~bevor_cli.client.BevorSecurityClient` ``require_*`` helpers).
+
+Interactive pickers remain for node shortcuts where needed.
+"""
+
+from typing import List
+
+import questionary
+
+# Sentinel value for "cancel / go back" choices.
+# questionary.Choice(value=None) silently stores the title string instead of
+# None, so we use this sentinel and map it back to None inside _select().
+_CANCEL = object()
+
+# questionary.select(use_shortcuts=True) only allows up to this many choices# (len(InquirerControl.SHORTCUT_KEYS)); longer lists need g+digits+Enter (see below).
+_QUESTIONARY_MAX_SHORTCUT_CHOICES = 36
+
+
+def _select(prompt: str, choices: List[questionary.Choice]):
+    """Arrow-key / vim-key / number-jump selector.
+
+    Returns the selected .value, or None if the user cancels (Ctrl-C / EOF).
+    Falls back to a numbered text prompt when questionary is unavailable or
+    raises (e.g. import error, piped stdin, broken TTY).
+
+    Keyboard controls (when questionary is active):
+      ↑ / k   move up
+      ↓ / j   move down
+      Enter   confirm
+      Ctrl-C  cancel → returns None
+
+    With at most 36 choices, shortcut keys (1–9, a–z) jump directly. With more
+    choices, type a 1-based line number then Enter to jump and select; Esc
+    clears the typed number.
+    """
+
+    use_shortcuts = len(choices) <= _QUESTIONARY_MAX_SHORTCUT_CHOICES
+
+    if use_shortcuts:
+        instr = "(↑↓/j/k · shortcut keys · Enter)"
+    else:
+        instr = "(↑↓/j/k · type line # then Enter · Esc clears)"
+
+    res = questionary.select(
+        prompt,
+        choices=choices,
+        use_shortcuts=use_shortcuts,
+        use_jk_keys=True,
+        instruction=instr,
+        style=questionary.Style(
+            [
+                ("highlighted", "bold"),
+                ("selected", "bold fg:ansibrightyellow"),
+                ("instruction", "fg:ansibrightblack italic"),
+                ("pointer", "bold fg:ansibrightyellow"),
+            ]
+        ),
+    ).ask()
+
+    return None if res is _CANCEL else res

bevor_cli/settings.py

@@ -0,0 +1,4 @@
+import os
+
+API_URL = os.environ.get("BEVOR_API_URL", "https://api.bevor.ai")
+APP_URL = os.environ.get("BEVOR_APP_URL", "https://app.bevor.ai")