iridium-client 0.1.0__tar.gz

iridium_client-0.1.0/.env.example

@@ -0,0 +1,17 @@
+# Iridium client configuration (copy to .env)
+
+# SaaS API base URL (no trailing slash)
+IRIDIUM_API_URL=https://api.iridium.example.com
+
+# API key for authenticated scans (optional for demo/payload dump)
+# IRIDIUM_API_KEY=iridium_live_...
+
+# Public dashboard URL (share reports)
+# IRIDIUM_PUBLIC_URL=https://iridium.example.com
+
+# Privacy: disable product analytics pings (no AST/source in pings)
+# DO_NOT_TRACK=1
+# IRIDIUM_TELEMETRY=0
+
+# Blind-graphing key for --anonymize mode
+# IRIDIUM_ANON_KEY=

iridium_client-0.1.0/.gitignore

@@ -0,0 +1,33 @@
+# Byte-compiled / cache
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+dist/
+build/
+
+# Virtual environments
+.venv/
+venv/
+
+# Iridium local state
+.iridium/
+
+# Test / tooling
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+uv.lock
+
+# IDE
+.idea/
+.vscode/
+*.swp
+
+# OS
+.DS_Store
+
+# Env secrets
+.env
+!.env.example

iridium_client-0.1.0/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.5
+Name: iridium-client
+Version: 0.1.0
+Summary: Iridium CLI — local repo scanning with cloud reachability analysis
+Project-URL: Homepage, https://github.com/mziqudhd92/Iridium
+Project-URL: Repository, https://github.com/mziqudhd92/Iridium
+Project-URL: Documentation, https://github.com/mziqudhd92/Iridium#readme
+Author: Iridium Contributors
+License: Apache-2.0
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27
+Requires-Dist: iridium-core==0.1.0
+Requires-Dist: rich>=13.0
+Requires-Dist: typer>=0.12
+Description-Content-Type: text/markdown
+
+# iridium-client
+
+Typer CLI for Iridium reachability scanning — local AST extraction with cloud SaaS analysis.
+
+## Install
+
+```bash
+pip install iridium-client
+```
+
+## CLI commands
+
+### `iridium-client demo`
+
+Run the embedded vulnerable micro-target demo (<10s, no API key, no network required for indexing).
+
+```bash
+iridium-client demo
+# or zero-install:
+uvx iridium-client demo
+```
+
+### `iridium-client scan`
+
+Index a repository locally and submit the payload to Iridium SaaS.
+
+```bash
+export IRIDIUM_API_URL=https://api.iridium.example.com
+export IRIDIUM_API_KEY=iridium_live_...
+iridium-client scan .
+```
+
+| Option | Description |
+| --- | --- |
+| `--api-url` | Override `IRIDIUM_API_URL` |
+| `--anonymize` | HMAC-hash internal symbols in payload (requires `IRIDIUM_ANON_KEY`) |
+| `--no-telemetry` | Disable product analytics pings |
+| `--on-error pass` | Show local stats if API is unreachable (default: `block`) |
+
+### `iridium-client payload dump`
+
+Dump the local scan payload as JSON (zero network).
+
+```bash
+iridium-client payload dump . --validate
+iridium-client payload dump . --output payload.json --validate
+```
+
+| Option | Description |
+| --- | --- |
+| `--validate` | Validate against `ClientScanPayload` schema |
+| `--output`, `-o` | Write JSON to file instead of stdout |
+
+## Environment variables
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `IRIDIUM_API_URL` | `https://api.iridium.example.com` | SaaS API base URL |
+| `IRIDIUM_API_KEY` | — | API key (`X-API-Key` header) |
+| `DO_NOT_TRACK` | unset | `1` disables analytics |
+| `IRIDIUM_TELEMETRY` | `1` | `0` disables analytics |
+| `IRIDIUM_ANON_KEY` | — | Key for `--anonymize` mode |
+
+Copy [`packages/iridium-client/.env.example`](.env.example) to `.env` for local development.
+
+## Development
+
+Part of the [Iridium monorepo](https://github.com/mziqudhd92/Iridium). From repo root:
+
+```bash
+uv sync
+uv run iridium-client demo
+uv run pytest packages/iridium-client/tests -v
+```

iridium_client-0.1.0/README.md

@@ -0,0 +1,74 @@
+# iridium-client
+
+Typer CLI for Iridium reachability scanning — local AST extraction with cloud SaaS analysis.
+
+## Install
+
+```bash
+pip install iridium-client
+```
+
+## CLI commands
+
+### `iridium-client demo`
+
+Run the embedded vulnerable micro-target demo (<10s, no API key, no network required for indexing).
+
+```bash
+iridium-client demo
+# or zero-install:
+uvx iridium-client demo
+```
+
+### `iridium-client scan`
+
+Index a repository locally and submit the payload to Iridium SaaS.
+
+```bash
+export IRIDIUM_API_URL=https://api.iridium.example.com
+export IRIDIUM_API_KEY=iridium_live_...
+iridium-client scan .
+```
+
+| Option | Description |
+| --- | --- |
+| `--api-url` | Override `IRIDIUM_API_URL` |
+| `--anonymize` | HMAC-hash internal symbols in payload (requires `IRIDIUM_ANON_KEY`) |
+| `--no-telemetry` | Disable product analytics pings |
+| `--on-error pass` | Show local stats if API is unreachable (default: `block`) |
+
+### `iridium-client payload dump`
+
+Dump the local scan payload as JSON (zero network).
+
+```bash
+iridium-client payload dump . --validate
+iridium-client payload dump . --output payload.json --validate
+```
+
+| Option | Description |
+| --- | --- |
+| `--validate` | Validate against `ClientScanPayload` schema |
+| `--output`, `-o` | Write JSON to file instead of stdout |
+
+## Environment variables
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `IRIDIUM_API_URL` | `https://api.iridium.example.com` | SaaS API base URL |
+| `IRIDIUM_API_KEY` | — | API key (`X-API-Key` header) |
+| `DO_NOT_TRACK` | unset | `1` disables analytics |
+| `IRIDIUM_TELEMETRY` | `1` | `0` disables analytics |
+| `IRIDIUM_ANON_KEY` | — | Key for `--anonymize` mode |
+
+Copy [`packages/iridium-client/.env.example`](.env.example) to `.env` for local development.
+
+## Development
+
+Part of the [Iridium monorepo](https://github.com/mziqudhd92/Iridium). From repo root:
+
+```bash
+uv sync
+uv run iridium-client demo
+uv run pytest packages/iridium-client/tests -v
+```

iridium_client-0.1.0/pyproject.toml

@@ -0,0 +1,32 @@
+[project]
+name = "iridium-client"
+version = "0.1.0"
+description = "Iridium CLI — local repo scanning with cloud reachability analysis"
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.11"
+authors = [{ name = "Iridium Contributors" }]
+dependencies = [
+    "iridium-core==0.1.0",
+    "typer>=0.12",
+    "httpx>=0.27",
+    "rich>=13.0",
+]
+
+[project.scripts]
+iridium-client = "iridium_client.cli:app"
+
+[project.urls]
+Homepage = "https://github.com/mziqudhd92/Iridium"
+Repository = "https://github.com/mziqudhd92/Iridium"
+Documentation = "https://github.com/mziqudhd92/Iridium#readme"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/iridium_client"]
+
+[tool.uv.sources]
+iridium-core = { workspace = true }

iridium_client-0.1.0/src/iridium_client/__init__.py

@@ -0,0 +1,3 @@
+"""Iridium CLI — local scanning and SaaS upload."""
+
+__version__ = "0.1.0"

iridium_client-0.1.0/src/iridium_client/api/client.py

@@ -0,0 +1,71 @@
+"""HTTP client for Iridium SaaS API."""
+
+from __future__ import annotations
+
+import os
+import time
+from typing import Any
+
+import httpx
+
+DEFAULT_API_URL = "https://api.iridium.example.com"
+CLIENT_VERSION = "0.1.0"
+POLL_INTERVAL_SECONDS = 2.0
+MAX_POLL_SECONDS = 300.0
+REQUEST_TIMEOUT = 30.0
+
+
+class IridiumApiClient:
+    """Thin client for /api/v1/client/* endpoints."""
+
+    def __init__(
+        self,
+        api_url: str | None = None,
+        api_key: str | None = None,
+        timeout: float = REQUEST_TIMEOUT,
+    ) -> None:
+        self.api_url = (api_url or os.environ.get("IRIDIUM_API_URL") or DEFAULT_API_URL).rstrip("/")
+        self.api_key = api_key or os.environ.get("IRIDIUM_API_KEY")
+        self.timeout = timeout
+
+    def _headers(self) -> dict[str, str]:
+        headers = {
+            "Content-Type": "application/json",
+            "X-Iridium-Client-Version": CLIENT_VERSION,
+        }
+        if self.api_key:
+            headers["X-API-Key"] = self.api_key
+        return headers
+
+    def submit_scan(self, payload: dict[str, Any]) -> dict[str, Any]:
+        """POST /api/v1/client/scan — returns 202 with scan_id."""
+        url = f"{self.api_url}/api/v1/client/scan"
+        with httpx.Client(timeout=self.timeout) as client:
+            response = client.post(url, json=payload, headers=self._headers())
+            response.raise_for_status()
+            return response.json()
+
+    def poll_scan(self, scan_id: str) -> dict[str, Any]:
+        """GET /api/v1/client/scan/{scan_id}."""
+        url = f"{self.api_url}/api/v1/client/scan/{scan_id}"
+        with httpx.Client(timeout=self.timeout) as client:
+            response = client.get(url, headers=self._headers())
+            response.raise_for_status()
+            return response.json()
+
+    def wait_for_scan(
+        self,
+        scan_id: str,
+        *,
+        poll_interval: float = POLL_INTERVAL_SECONDS,
+        max_wait: float = MAX_POLL_SECONDS,
+    ) -> dict[str, Any]:
+        """Poll until scan completes or times out."""
+        deadline = time.monotonic() + max_wait
+        while time.monotonic() < deadline:
+            result = self.poll_scan(scan_id)
+            status = result.get("status", "").lower()
+            if status in ("completed", "failed", "error"):
+                return result
+            time.sleep(poll_interval)
+        raise TimeoutError(f"scan {scan_id} did not complete within {max_wait}s")

iridium_client-0.1.0/src/iridium_client/cli.py

@@ -0,0 +1,122 @@
+"""Typer CLI entrypoint."""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Optional
+
+import typer
+from rich.console import Console
+
+from iridium_client.api.client import IridiumApiClient
+from iridium_client.demo.target import materialize_demo_target
+from iridium_client.output.terminal import (
+    render_demo_graph,
+    render_scan_results,
+    render_zero_results,
+)
+from iridium_core import WorkspaceIndexer
+from iridium_core.models.payload import ClientScanPayload
+
+app = typer.Typer(
+    name="iridium-client",
+    help="Iridium client — local AST extraction with cloud reachability analysis.",
+    no_args_is_help=True,
+)
+payload_app = typer.Typer(help="Payload utilities")
+app.add_typer(payload_app, name="payload")
+
+console = Console()
+
+
+@payload_app.command("dump")
+def payload_dump(
+    path: Path = typer.Argument(Path("."), exists=True, file_okay=False, resolve_path=True),
+    validate: bool = typer.Option(False, "--validate", help="Validate against schema"),
+    output: Optional[Path] = typer.Option(None, "--output", "-o", help="Write JSON to file"),
+) -> None:
+    """Dump local scan payload (zero network)."""
+    indexer = WorkspaceIndexer(path, use_process_pool=False)
+    payload = indexer.index()
+    if validate:
+        ClientScanPayload.model_validate(payload.model_dump())
+        console.print("[green]Payload validated successfully.[/green]")
+    text = payload.to_json(indent=2)
+    if output:
+        output.write_text(text, encoding="utf-8")
+        console.print(f"Wrote payload to {output}")
+    else:
+        console.print(text)
+
+
+@app.command()
+def scan(
+    path: Path = typer.Argument(Path("."), exists=True, file_okay=False, resolve_path=True),
+    api_url: Optional[str] = typer.Option(None, "--api-url", envvar="IRIDIUM_API_URL"),
+    anonymize: bool = typer.Option(False, "--anonymize"),
+    no_telemetry: bool = typer.Option(False, "--no-telemetry"),
+    on_error: str = typer.Option("block", "--on-error", help="pass|block"),
+) -> None:
+    """Scan a repository and submit payload to Iridium SaaS."""
+    if no_telemetry or os.environ.get("DO_NOT_TRACK") == "1":
+        os.environ["IRIDIUM_TELEMETRY"] = "0"
+
+    start = time.monotonic()
+    indexer = WorkspaceIndexer(path)
+    payload = indexer.index()
+    duration_index = time.monotonic() - start
+
+    client = IridiumApiClient(api_url=api_url)
+    try:
+        response = client.submit_scan(payload.to_api_dict())
+        scan_id = response.get("scan_id") or response.get("id")
+        if not scan_id:
+            raise RuntimeError(f"unexpected response: {response}")
+        result = client.wait_for_scan(scan_id)
+        render_scan_results(result, duration_s=time.monotonic() - start)
+    except Exception as exc:
+        if on_error == "pass":
+            console.print(f"[yellow]API unreachable ({exc}); showing local stats only.[/yellow]")
+            render_zero_results(
+                duration_s=duration_index,
+                dependency_count=payload.dependency_count,
+                entrypoint_count=payload.entrypoint_count,
+                languages=payload.languages,
+            )
+            raise typer.Exit(code=0) from exc
+        console.print(f"[red]Scan failed: {exc}[/red]")
+        raise typer.Exit(code=1) from exc
+
+
+@app.command()
+def demo() -> None:
+    """Run embedded vulnerable micro-target demo (<10s)."""
+    start = time.monotonic()
+    target = materialize_demo_target()
+    console.print(f"[dim]Demo target: {target}[/dim]")
+
+    indexer = WorkspaceIndexer(target, use_process_pool=False)
+    payload = indexer.index()
+
+    render_demo_graph()
+    console.print(
+        "\n[bold]Patch preview[/bold]\n"
+        "  - requests: 2.25.0 → 2.32.3\n"
+        "  - pins urllib3 transitive fix for CVE-2021-33503\n"
+    )
+
+    render_zero_results(
+        duration_s=time.monotonic() - start,
+        dependency_count=max(payload.dependency_count, 2),
+        entrypoint_count=max(payload.entrypoint_count, 1),
+        languages=payload.languages or ["python"],
+        reachable_count=1,
+        raw_cve_count=12,
+    )
+
+
+if __name__ == "__main__":
+    app()

iridium_client-0.1.0/src/iridium_client/demo/target.py

@@ -0,0 +1,30 @@
+"""Embedded vulnerable micro-target for demo command."""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+DEMO_APP = '''\
+"""Embedded demo target — intentionally vulnerable Flask-style handler."""
+import requests
+
+def fetch_url(url: str) -> str:
+    """Fetch remote content (pinned requests==2.25.0 has known CVEs)."""
+    response = requests.get(url, timeout=5)
+    return response.text
+
+# Simulated HTTP route entrypoint
+def handler():
+  return fetch_url("https://example.com")
+'''
+
+DEMO_REQUIREMENTS = "requests==2.25.0\nflask==2.0.0\n"
+
+
+def materialize_demo_target() -> Path:
+    """Write embedded demo target to a temp directory."""
+    tmp = Path(tempfile.mkdtemp(prefix="iridium-demo-"))
+    (tmp / "app.py").write_text(DEMO_APP, encoding="utf-8")
+    (tmp / "requirements.txt").write_text(DEMO_REQUIREMENTS, encoding="utf-8")
+    return tmp

iridium_client-0.1.0/src/iridium_client/output/terminal.py

@@ -0,0 +1,108 @@
+"""Terminal output reporter."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.tree import Tree
+
+console = Console()
+
+
+def _is_reachable_finding(finding: dict[str, Any]) -> bool:
+    if finding.get("sca_reachable") is True:
+        return True
+    if finding.get("sca_reachability") == "reachable":
+        return True
+    return finding.get("reachable") is True
+
+
+def _scan_summary_fields(result: dict[str, Any]) -> dict[str, Any]:
+    summary = result.get("summary")
+    if not isinstance(summary, dict):
+        summary = {}
+    return {
+        "dependency_count": summary.get("dependency_count", result.get("dependency_count", 0)),
+        "entrypoint_count": summary.get("entrypoint_count", result.get("entrypoint_count", 0)),
+        "languages": summary.get("languages", result.get("languages", [])),
+        "reachable_count": summary.get(
+            "reachable_finding_count",
+            result.get("reachable_finding_count", result.get("reachable_count", 0)),
+        ),
+        "raw_cve_count": summary.get("raw_cve_count", result.get("raw_cve_count")),
+        "cve_database_count": summary.get(
+            "cve_database_count", result.get("cve_database_count", 847)
+        ),
+    }
+
+
+def render_zero_results(
+    *,
+    duration_s: float,
+    dependency_count: int,
+    entrypoint_count: int,
+    languages: list[str],
+    cve_database_count: int = 847,
+    reachable_count: int = 0,
+    raw_cve_count: int | None = None,
+) -> None:
+    """Explicit negative state when no reachable vulnerabilities found."""
+    suppressed = 0
+    if raw_cve_count is not None and raw_cve_count > reachable_count:
+        suppressed = int(((raw_cve_count - reachable_count) / raw_cve_count) * 100)
+
+    lang_str = ", ".join(languages) if languages else "none"
+    lines = [
+        f"✓ Scan complete ({duration_s:.1f}s)",
+        (
+            f"  {dependency_count} dependencies analyzed · "
+            f"{entrypoint_count} API entrypoints · {lang_str}"
+        ),
+        f"  {cve_database_count} CVEs in database · {reachable_count} reachable paths detected",
+    ]
+    if suppressed:
+        lines.append(
+            f"  Iridium suppressed {suppressed}% of raw CVE noise "
+            f"({raw_cve_count - reachable_count} unreachable)"
+        )
+    lines.append("")
+    lines.append("  No action required. Run `iridium-client demo` to see reachability in action.")
+    console.print(Panel("\n".join(lines), title="Iridium", border_style="green"))
+
+
+def render_scan_results(result: dict[str, Any], *, duration_s: float) -> None:
+    """Render scan poll response."""
+    findings = result.get("findings") or []
+    reachable = [f for f in findings if _is_reachable_finding(f)]
+    summary = _scan_summary_fields(result)
+    if not reachable:
+        render_zero_results(
+            duration_s=duration_s,
+            dependency_count=int(summary["dependency_count"]),
+            entrypoint_count=int(summary["entrypoint_count"]),
+            languages=list(summary["languages"]),
+            reachable_count=int(summary["reachable_count"]),
+            raw_cve_count=summary["raw_cve_count"],
+            cve_database_count=int(summary["cve_database_count"]),
+        )
+        return
+
+    tree = Tree(f"[bold]Reachable findings ({len(reachable)})[/bold]")
+    for finding in reachable[:20]:
+        cve = finding.get("cve_id") or finding.get("rule_id", "unknown")
+        path = finding.get("path") or finding.get("package", "")
+        tree.add(f"{cve}: {path}")
+    console.print(Panel(tree, title=f"Scan complete ({duration_s:.1f}s)", border_style="yellow"))
+
+
+def render_demo_graph() -> None:
+    """ASCII reachability graph for demo command."""
+    graph = """
+  [HTTP] GET /fetch
+    └─► handler()
+          └─► requests.get(url)
+                └─► [CVE sink] CVE-2021-33503 (requests < 2.26)
+"""
+    console.print(Panel(graph.strip(), title="Reachability graph (demo)", border_style="cyan"))

iridium_client-0.1.0/tests/test_api_client.py

@@ -0,0 +1,85 @@
+"""Tests for IridiumApiClient HTTP behavior (mocked httpx)."""
+
+from unittest.mock import MagicMock, patch
+
+import httpx
+import pytest
+
+from iridium_client.api.client import IridiumApiClient
+
+
+def _sample_payload() -> dict[str, object]:
+    return {
+        "schema_version": "1",
+        "repo_fingerprint": "abcdefgh",
+        "languages": ["python"],
+    }
+
+
+def test_submit_scan_posts_with_api_key_header() -> None:
+    with patch("iridium_client.api.client.httpx.Client") as client_cls:
+        client = MagicMock()
+        client_cls.return_value.__enter__.return_value = client
+        response = MagicMock()
+        response.json.return_value = {"scan_id": "SCAN-ABC123"}
+        client.post.return_value = response
+
+        api = IridiumApiClient(api_url="https://api.example.com", api_key="secret")
+        result = api.submit_scan(_sample_payload())
+
+    assert result["scan_id"] == "SCAN-ABC123"
+    _, kwargs = client.post.call_args
+    assert kwargs["headers"]["X-API-Key"] == "secret"
+    assert kwargs["json"]["schema_version"] == "1"
+
+
+def test_poll_scan_gets_status() -> None:
+    with patch("iridium_client.api.client.httpx.Client") as client_cls:
+        client = MagicMock()
+        client_cls.return_value.__enter__.return_value = client
+        response = MagicMock()
+        response.json.return_value = {"status": "COMPLETED", "findings": []}
+        client.get.return_value = response
+
+        api = IridiumApiClient(api_url="https://api.example.com")
+        body = api.poll_scan("SCAN-ABC123")
+
+    assert body["status"] == "COMPLETED"
+    client.get.assert_called_once()
+
+
+def test_wait_for_scan_polls_until_terminal_status() -> None:
+    api = IridiumApiClient(api_url="https://api.example.com")
+    with patch.object(api, "poll_scan") as poll:
+        poll.side_effect = [
+            {"status": "RUNNING"},
+            {"status": "COMPLETED", "findings": []},
+        ]
+        with patch("iridium_client.api.client.time.sleep"):
+            result = api.wait_for_scan("SCAN-ABC123", poll_interval=0.01, max_wait=5.0)
+    assert result["status"] == "COMPLETED"
+
+
+def test_wait_for_scan_times_out() -> None:
+    api = IridiumApiClient(api_url="https://api.example.com")
+    with patch.object(api, "poll_scan", return_value={"status": "RUNNING"}):
+        with patch("iridium_client.api.client.time.monotonic", side_effect=[0.0, 0.0, 10.0]):
+            with pytest.raises(TimeoutError, match="did not complete"):
+                api.wait_for_scan("SCAN-ABC123", poll_interval=0.01, max_wait=1.0)
+
+
+def test_submit_scan_raises_on_http_error() -> None:
+    with patch("iridium_client.api.client.httpx.Client") as client_cls:
+        client = MagicMock()
+        client_cls.return_value.__enter__.return_value = client
+        response = MagicMock()
+        response.raise_for_status.side_effect = httpx.HTTPStatusError(
+            "unauthorized",
+            request=MagicMock(),
+            response=MagicMock(status_code=401),
+        )
+        client.post.return_value = response
+
+        api = IridiumApiClient(api_url="https://api.example.com", api_key="bad")
+        with pytest.raises(httpx.HTTPStatusError):
+            api.submit_scan(_sample_payload())

iridium_client-0.1.0/tests/test_cli.py

@@ -0,0 +1,31 @@
+"""Basic CLI tests."""
+
+from pathlib import Path
+from unittest.mock import patch
+
+from typer.testing import CliRunner
+
+from iridium_client.cli import app
+
+runner = CliRunner()
+
+
+def test_demo_command():
+    result = runner.invoke(app, ["demo"])
+    assert result.exit_code == 0
+    assert "Reachability graph" in result.stdout or "demo" in result.stdout.lower()
+
+
+def test_payload_dump_validate(tmp_path: Path):
+    (tmp_path / "main.py").write_text("def hello():\n    pass\n", encoding="utf-8")
+    result = runner.invoke(app, ["payload", "dump", str(tmp_path), "--validate"])
+    assert result.exit_code == 0
+    assert "schema_version" in result.stdout or "validated" in result.stdout.lower()
+
+
+def test_scan_on_error_pass(tmp_path: Path):
+    (tmp_path / "main.py").write_text("x = 1\n", encoding="utf-8")
+    with patch("iridium_client.cli.IridiumApiClient") as mock_client:
+        mock_client.return_value.submit_scan.side_effect = ConnectionError("offline")
+        result = runner.invoke(app, ["scan", str(tmp_path), "--on-error", "pass"])
+    assert result.exit_code == 0

iridium_client-0.1.0/tests/test_cli_extended.py

@@ -0,0 +1,44 @@
+"""Extended CLI behavior tests."""
+
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from typer.testing import CliRunner
+
+from iridium_client.cli import app
+
+runner = CliRunner()
+
+
+def test_scan_success_renders_results(tmp_path: Path) -> None:
+    (tmp_path / "main.py").write_text("x = 1\n", encoding="utf-8")
+    with patch("iridium_client.cli.IridiumApiClient") as mock_client_cls:
+        client = MagicMock()
+        mock_client_cls.return_value = client
+        client.submit_scan.return_value = {"scan_id": "SCAN-OK"}
+        client.wait_for_scan.return_value = {
+            "status": "COMPLETED",
+            "findings": [{"reachable": True, "cve_id": "CVE-1", "path": "pkg"}],
+        }
+        result = runner.invoke(app, ["scan", str(tmp_path)])
+    assert result.exit_code == 0
+
+
+def test_scan_block_on_error_exits_nonzero(tmp_path: Path) -> None:
+    (tmp_path / "main.py").write_text("x = 1\n", encoding="utf-8")
+    with patch("iridium_client.cli.IridiumApiClient") as mock_client:
+        mock_client.return_value.submit_scan.side_effect = ConnectionError("offline")
+        result = runner.invoke(app, ["scan", str(tmp_path), "--on-error", "block"])
+    assert result.exit_code == 1
+
+
+def test_payload_dump_writes_output_file(tmp_path: Path) -> None:
+    (tmp_path / "main.py").write_text("def f():\n    pass\n", encoding="utf-8")
+    out = tmp_path / "out.json"
+    result = runner.invoke(
+        app,
+        ["payload", "dump", str(tmp_path), "--validate", "--output", str(out)],
+    )
+    assert result.exit_code == 0
+    assert out.is_file()
+    assert '"schema_version"' in out.read_text(encoding="utf-8")

iridium_client-0.1.0/tests/test_terminal.py

@@ -0,0 +1,70 @@
+"""Tests for terminal rendering helpers."""
+
+from unittest.mock import patch
+
+from iridium_client.output.terminal import (
+    render_demo_graph,
+    render_scan_results,
+    render_zero_results,
+)
+
+
+def test_render_zero_results_prints_summary() -> None:
+    with patch("iridium_client.output.terminal.console.print") as mock_print:
+        render_zero_results(
+            duration_s=1.2,
+            dependency_count=3,
+            entrypoint_count=2,
+            languages=["python"],
+            reachable_count=0,
+            raw_cve_count=10,
+        )
+    assert mock_print.called
+    panel_arg = mock_print.call_args[0][0]
+    assert "Scan complete" in str(panel_arg.renderable)
+
+
+def test_render_scan_results_with_reachable_findings() -> None:
+    with patch("iridium_client.output.terminal.console.print") as mock_print:
+        render_scan_results(
+            {
+                "findings": [
+                    {"sca_reachable": True, "rule_id": "CVE-2024-1", "package": "requests"}
+                ],
+                "summary": {
+                    "dependency_count": 1,
+                    "entrypoint_count": 1,
+                    "languages": ["python"],
+                    "reachable_finding_count": 1,
+                    "raw_cve_count": 3,
+                },
+            },
+            duration_s=2.0,
+        )
+    assert mock_print.called
+
+
+def test_render_scan_results_with_legacy_reachable_field() -> None:
+    with patch("iridium_client.output.terminal.console.print") as mock_print:
+        render_scan_results(
+            {
+                "findings": [{"reachable": True, "cve_id": "CVE-2024-1", "path": "requests.get"}],
+                "dependency_count": 1,
+                "entrypoint_count": 1,
+                "languages": ["python"],
+            },
+            duration_s=2.0,
+        )
+    assert mock_print.called
+
+
+def test_render_scan_results_falls_back_to_zero_state() -> None:
+    with patch("iridium_client.output.terminal.render_zero_results") as mock_zero:
+        render_scan_results({"findings": []}, duration_s=1.0)
+    mock_zero.assert_called_once()
+
+
+def test_render_demo_graph_prints_panel() -> None:
+    with patch("iridium_client.output.terminal.console.print") as mock_print:
+        render_demo_graph()
+    assert mock_print.called