corgea-cli 1.8.8__tar.gz → 1.9.1__tar.gz

corgea_cli-1.9.1/.codex/hooks.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./harness post-edit codex"
+          }
+        ]
+      }
+    ]
+  }
+}

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/.github/workflows/npm-publish.yml

@@ -51,7 +51,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: refs/tags/${{ needs.prepare.outputs.tag_name }}
 

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/.github/workflows/release-binaries.yml

@@ -40,7 +40,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/.github/workflows/release.yml

@@ -22,6 +22,7 @@ jobs:
   linux-x86:
     runs-on: ${{ matrix.platform.runner }}
     strategy:
+      fail-fast: false
       matrix:
         platform:
           - runner: ubuntu-latest
@@ -30,13 +31,27 @@ jobs:
             target: x86
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Prepare resilient maturin download for manylinux Docker
+        run: |
+          bin_dir="${RUNNER_TEMP}/maturin-docker-bin"
+          mkdir -p "$bin_dir"
+          cat > "$bin_dir/curl" <<'EOF'
+          #!/bin/bash
+          set -euo pipefail
+          if [[ " $* " == *" PyO3/maturin/releases "* ]]; then
+            exec /usr/bin/curl --fail --retry 5 --retry-delay 3 --retry-all-errors "$@"
+          fi
+          exec /usr/bin/curl "$@"
+          EOF
+          chmod +x "$bin_dir/curl"
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist
           manylinux: auto
+          docker-options: -v ${{ runner.temp }}/maturin-docker-bin/curl:/usr/local/bin/curl:ro
           before-script-linux: |
             # If we're running on rhel centos, install needed packages.
             if command -v yum &> /dev/null; then
@@ -45,6 +60,26 @@ jobs:
                 # If we're running on debian-based system.
                 apt update -y && apt-get install -y libssl-dev openssl pkg-config musl-tools
             fi
+      - name: Assert manylinux wheel compatibility tags
+        run: |
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if ((${#wheels[@]} == 0)); then
+            echo "No wheels found in dist/"
+            exit 1
+          fi
+          for wheel in "${wheels[@]}"; do
+            base=$(basename "$wheel")
+            if [[ "$base" == *manylinux_2_3[0-9]* ]]; then
+              echo "Wheel tag too new for broad Linux support: $base"
+              exit 1
+            fi
+            if [[ ! "$base" =~ manylinux2014 ]]; then
+              echo "Expected manylinux2014 compatibility tag, got: $base"
+              exit 1
+            fi
+            echo "OK: $base"
+          done
       - name: Upload wheels
         uses: actions/upload-artifact@v4
         with:
@@ -61,7 +96,7 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -83,7 +118,7 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -98,7 +133,7 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:

corgea_cli-1.9.1/.github/workflows/staging-contract.yml

@@ -0,0 +1,34 @@
+name: Staging vuln-api contract
+
+# The deterministic staging-target contract tests are #[ignore]d so the
+# default `./harness ci` gate stays hermetic (no network). This scheduled,
+# non-blocking job runs them against the live staging worker so endpoint /
+# schema / seed drift is caught out-of-band instead of shipping undetected.
+# It does not gate PRs — failures here signal "the staging contract moved",
+# not "this PR is broken".
+
+on:
+  schedule:
+    # Daily at 07:00 UTC.
+    - cron: "0 7 * * *"
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  staging-contract:
+    name: vuln-api staging contract (non-blocking)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run ignored staging contract tests
+        run: cargo test --test vuln_api_contract -- --ignored

corgea_cli-1.9.1/.github/workflows/test.yml

@@ -0,0 +1,33 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+
+jobs:
+  rust-tests:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: CI gate
+        run: ./harness ci

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/.github/workflows/update_docs..yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run AI Docs Sync
         uses: Corgea/internal_actions/sync-docs-action@main

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/.gitignore

@@ -3,5 +3,9 @@
 .DS_Store
 .dccache
 *.zip
+*.profraw
 node_modules/
 /packages/*/vendor/
+
+.claude/
+CLAUDE.md

corgea_cli-1.9.1/AGENTS.md

@@ -0,0 +1,24 @@
+# AGENTS.md
+
+This subproject is the Corgea developer CLI (Rust → npm + pip via maturin).
+
+## Commands
+
+- After edits: `./harness check` — clippy fix, format, tests, suppression report
+- Pre-commit: `./harness pre-commit` — staged Rust files only (auto via git hook)
+- CI: `./harness ci` — strict clippy (`-D warnings`), format check, dep audit, tests + coverage gate (min 13%)
+- Audit: `./harness audit` — `cargo audit` for known dep vulnerabilities
+- Coverage: `./harness coverage [--min=N]` — cargo-llvm-cov; HTML report under `target/llvm-cov/`; fails if line coverage < N (default 13)
+- Lint: `./harness lint` — clippy + format check, no fixes
+- Test: `./harness test` — `cargo test`
+- Fix: `./harness fix` — clippy fix + format
+- Setup: `./harness setup-hooks` — install `.git/hooks/pre-commit`
+- Auto-format: `./harness post-edit` — runs `cargo fmt` on changed Rust files (wire into your editor/agent's post-edit hook)
+
+Add `--verbose` to stream raw command output instead of the quiet summary.
+
+Coverage needs LLVM's `llvm-cov`/`llvm-profdata`. On a rustup toolchain, run
+`rustup component add llvm-tools-preview`. On a non-rustup toolchain (e.g.
+Homebrew Rust) those are missing, so point cargo-llvm-cov at a system LLVM:
+`LLVM_COV="$(brew --prefix llvm)/bin/llvm-cov" LLVM_PROFDATA="$(brew --prefix llvm)/bin/llvm-profdata" ./harness coverage`.
+CI uses its own toolchain and is unaffected.

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/Cargo.lock

@@ -105,6 +105,18 @@ dependencies = [
  "derive_arbitrary",
 ]
 
+[[package]]
+name = "async-compression"
+version = "0.4.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -287,6 +299,23 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
+[[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -340,11 +369,13 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.8.8"
+version = "1.9.1"
 dependencies = [
  "chrono",
  "clap",
+ "corgea",
  "dirs",
+ "env_logger",
  "git2",
  "globset",
  "http",
@@ -352,14 +383,17 @@ dependencies = [
  "hyper",
  "hyper-util",
  "ignore",
+ "log",
  "open",
  "openssl",
  "quick-xml",
  "regex",
  "reqwest",
+ "semver",
  "serde",
  "serde_derive",
  "serde_json",
+ "serde_yaml_ng",
  "tempfile",
  "termcolor",
  "tokio",
@@ -523,6 +557,29 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1092,6 +1149,30 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "jiff"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.34"
@@ -1441,6 +1522,21 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "potential_utf"
 version = "0.1.3"
@@ -1560,6 +1656,7 @@ version = "0.12.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
 dependencies = [
+ "async-compression",
  "base64",
  "bytes",
  "cookie",
@@ -1586,6 +1683,7 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
@@ -1695,6 +1793,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -1759,6 +1863,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_yaml_ng"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -2169,6 +2286,12 @@ version = "1.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f63a545481291138910575129486daeaf8ac54aee4387fe7906919f7830c7d9d"
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "url"
 version = "2.5.7"

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/Cargo.toml

@@ -1,23 +1,40 @@
 [package]
 name = "corgea"
-version = "1.8.8"
+version = "1.9.1"
 edition = "2021"
 readme = "README.md"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
+[[bin]]
+name = "corgea"
+path = "src/main.rs"
+
+[features]
+# Compiles the in-crate vuln-api test stub (`vuln_api_stub`). Enabled for all
+# test builds via the self dev-dependency below; never part of release builds.
+test-stub = []
+
+[dev-dependencies]
+corgea = { path = ".", features = ["test-stub"] }
+tempfile = "3.12.0"
+
 [dependencies]
 clap = { version = "4.4.13", features = ["derive"] }
 dirs = "5.0.1"
 reqwest = { version = "0.12.23", default-features = false, features = [
     "blocking",
     "cookies",
+    "gzip",
     "json",
     "multipart",
     "native-tls",
     "system-proxy",
 ] }
 toml = "0.8.8"
+log = "0.4"
+env_logger = "0.11"
+semver = "1"
 serde = { version = "1.0.195", features = ["derive"] }
 serde_json = "1.0.111"
 serde_derive = "1.0.195"
@@ -40,6 +57,7 @@ http-body-util = "0.1"
 url = "2.5"
 open = "5.0"
 urlencoding = "2.1"
+serde_yaml_ng = "0.10"
 
 [target.'cfg(not(target_os = "windows"))'.dependencies]
 openssl = { version = "0.10", features = ["vendored"] }

{corgea_cli-1.8.8 → corgea_cli-1.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.8.8
+Version: 1.9.1
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

corgea_cli-1.9.1/README.md

@@ -0,0 +1,130 @@
+# Corgea CLI
+Corgea CLI is a powerful developer tool that helps you find and fix security vulnerabilities in your code. Using our AI-powered scanner (blast) and our platform, Corgea identifies complex security issues like business logic flaws, authentication vulnerabilities, and other hard-to-find bugs. The CLI provides commands to scan your codebase, inspect findings, interact with fixes, and much more - all designed with a great developer experience in mind.
+
+
+For full documentation, visit https://docs.corgea.app/cli
+
+## Installation
+
+### Using npm
+```
+npm install -g @corgea/cli
+```
+The npm package bundles native binaries for all supported platforms. The correct binary for your OS and architecture is selected automatically at runtime.
+
+### Using pip
+```
+pip install corgea-cli
+```
+
+### Manual Installation
+You can get the latest binaries for your OS from https://github.com/Corgea/cli/releases.
+
+### Setup
+Once the binary is installed, login with your token from the Corgea app.
+```
+corgea login <token>
+```
+
+## Dependency Inventory (offline)
+
+`corgea deps` builds a dependency inventory from npm, Python, and Java manifests
+and lockfiles, then evaluates a pinning policy (DEP rules). Runs fully offline —
+no token or network required.
+
+```bash
+corgea deps scan                       # table report for the current directory
+corgea deps scan --format agent        # compact TSV for coding agents
+corgea deps scan --format json         # JSON inventory on stdout
+corgea deps scan --format quiet        # no stdout; exit code still applies
+corgea deps scan --fail-on high        # exit 1 if any finding is >= high
+corgea deps scan --out-format json     # machine-readable (json or sarif)
+corgea deps graph --format json        # print the resolved dependency graph
+corgea deps explain <package> --format agent  # show why a package is present
+corgea deps diff --base origin/main --format json
+corgea deps sbom --format cyclonedx    # emit a CycloneDX SBOM
+corgea deps policy init --exist-ok     # write starter policy, or keep existing file
+```
+
+`corgea deps` defaults to `--format agent` when an agent environment is detected (`AI_AGENT`, `CODEX_SANDBOX`, `CLAUDECODE`, and related agent variables). Use `--format human` to force the normal terminal output.
+
+See [Dependency Scanning (CLI)](https://docs.corgea.app/cli/deps) for the full flag and exit-code reference.
+
+## Install Gate
+
+Prefix a package-manager install with `corgea` to vet every package it would
+install — named **and transitive** — against Corgea's vulnerability API *before*
+anything lands on disk. Known-vulnerable or malicious versions block the install;
+a clean set runs the underlying command untouched. Works with `pip`, `npm`,
+`yarn`, `pnpm`, and `uv`.
+
+No token required — baseline public CVE checks run out of the box. Try it:
+
+```bash
+corgea npm install lodash@4.17.20      # blocks: known-vulnerable (CVE-2025-13465), exits 1
+corgea pip install requests            # resolves, checks the verdict, then runs pip
+corgea npm install axios@^1.0.0        # ranges resolve to a concrete version first
+corgea pip --force install <pkg>       # print findings but install anyway
+corgea pip list                        # non-install subcommands pass straight through
+```
+
+`corgea pip install` and `corgea npm install` resolve the **full would-install
+set** (named + transitive) via a safe dry-run, so a vulnerable *transitive*
+dependency blocks too. Blocked findings steer to the fix: each advisory shows
+`fixed in <version>`, and the gate prints the safe version to install instead.
+
+The gate also blocks **freshly published** packages — anything published within
+the recency window (default 14 days) — to catch just-shipped typosquats and
+hijacks before advisory feeds catch up. It is on by default; turn it off with
+`recency_gate = false` in `~/.corgea/config.toml`, retune the window with
+`recency_threshold_days`, or pass `--force` for a one-off install.
+
+Logging in (`corgea login`) upgrades the gate to authenticated enforcement —
+unverifiable packages, resolution errors, and lookup failures then fail closed
+(public mode warns and continues). Wrapper flags (`--force`, `--json`) go between
+the manager and its command: `corgea npm --force install <pkg>`.
+
+See [the CLI docs](https://docs.corgea.app/cli) for the full flag and exit-code reference.
+
+## Development Setup
+
+### Prerequisites
+- Python 3.8 or higher
+- Rust toolchain (for maturin)
+
+### Using venv (Python Virtual Environment)
+1. Create and activate a virtual environment:
+   ``` 
+   python -m venv .venv
+   source .venv/bin/activate  # On Unix/macOS
+   .venv\Scripts\activate     # On Windows
+   ```
+
+2. Install dependencies:
+   ```
+   pip install maturin
+   ```
+
+3. Build and install the package in development mode:
+   ```
+   maturin develop
+   ```
+
+### Using Conda
+1. Create and activate a conda environment:
+   ```
+   conda create -n corgea-cli python=3.8
+   conda activate corgea-cli
+   ```
+
+2. Install dependencies:
+   ```
+   pip install maturin
+   ```
+
+3. Build and install the package in development mode:
+   ```
+   maturin develop
+   ```
+
+Note: After making changes to Rust code, you'll need to run `maturin develop` again to rebuild the package.