praetorian-cli 2.4.0__tar.gz → 2.4.2__tar.gz

{praetorian_cli-2.4.0/praetorian_cli.egg-info → praetorian_cli-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.0
+Version: 2.4.2
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

praetorian_cli-2.4.2/praetorian_cli/handlers/access.py

@@ -0,0 +1,209 @@
+import os
+
+import click
+
+from praetorian_cli.handlers.chariot import chariot
+from praetorian_cli.handlers.cli_decorators import cli_handler
+
+
+def extract_prefix(email):
+    """Extract the profile prefix from a Guard account email.
+
+    Takes the portion after '+' and before '@'.
+    If no '+' exists, uses the full local part (before '@').
+
+    Examples:
+        chariot+proceptbiorobotics@praetorian.com -> proceptbiorobotics
+        chariot+grant_street_group-ztw@praetorian.com -> grant_street_group-ztw
+        user@example.com -> user
+    """
+    local_part = email.split('@')[0]
+    if '+' in local_part:
+        return local_part.split('+', 1)[1]
+    return local_part
+
+
+def extract_account_id(credential_key):
+    """Extract the AWS account ID from a credential key.
+
+    Keys look like: #account#chariot+client@praetorian.com#amazon#325281727610
+    The account ID is the last segment.
+    """
+    return credential_key.rstrip('#').split('#')[-1]
+
+
+def build_aws_config_profiles(account_email, prefix, credential_id, root_account_id, sub_accounts, category='env-integration'):
+    """Build a list of (profile_name, profile_dict) tuples for AWS config.
+
+    Args:
+        account_email: The Guard account email (used in credential_process command)
+        prefix: The profile name prefix
+        credential_id: The credential UUID
+        root_account_id: The root AWS account ID
+        sub_accounts: List of dicts with 'Id' key from Organizations list_accounts,
+                      or empty list if not an org.
+        category: The credential category (e.g., 'env-integration', 'cloud')
+    Returns:
+        List of (profile_name, dict) where dict has credential_process, region, output keys.
+    """
+    profiles = []
+
+    # Collect all account IDs (root + sub-accounts), deduplicated
+    all_account_ids = [root_account_id]
+    for acct in sub_accounts:
+        if acct['Id'] != root_account_id:
+            all_account_ids.append(acct['Id'])
+
+    for account_id in all_account_ids:
+        profile_name = f'{prefix}-{account_id}'
+        credential_process = (
+            f'guard --account {account_email} get credential {credential_id} '
+            f'--category {category} --type aws --format credential-process '
+            f'--parameters accountId {account_id}'
+        )
+        profiles.append((profile_name, {
+            'credential_process': credential_process,
+            'region': 'us-east-1',
+            'output': 'json',
+        }))
+
+    return profiles
+
+
+def write_aws_config(profiles, config_path=None):
+    """Write AWS config profiles, preserving existing unrelated profiles.
+
+    Args:
+        profiles: List of (profile_name, profile_dict) tuples.
+        config_path: Path to AWS config file. Defaults to ~/.aws/config.
+    """
+    from configparser import ConfigParser
+    from pathlib import Path
+
+    if config_path is None:
+        config_path = os.path.join(Path.home(), '.aws', 'config')
+
+    config = ConfigParser()
+    if os.path.exists(config_path):
+        config.read(config_path)
+
+    for profile_name, profile_data in profiles:
+        section = f'profile {profile_name}'
+        if not config.has_section(section):
+            config.add_section(section)
+        for key, value in profile_data.items():
+            config.set(section, key, value)
+
+    parent_dir = os.path.dirname(config_path)
+    if parent_dir:
+        os.makedirs(parent_dir, exist_ok=True)
+    with open(config_path, 'w') as f:
+        config.write(f)
+
+
+@chariot.group()
+def access():
+    """Configure credential access for cloud providers."""
+    pass
+
+
+@access.command()
+@cli_handler
+@click.option('--account', default=None, help='Guard account email to discover AWS credentials for (also inherited from guard --account)')
+@click.option('--prefix', default=None, help='Override the profile name prefix (default: derived from email)')
+def aws(sdk, account, prefix):
+    """Generate AWS CLI config profiles from Guard credentials.
+
+    Discovers AWS credentials for the given account, enumerates sub-accounts
+    via Organizations (if applicable), and writes ~/.aws/config profiles that
+    use guard as the credential_process.
+
+    The --account can be provided here or as the top-level guard --account flag.
+
+    \b
+    Example usages:
+        - guard --account chariot+client@praetorian.com access aws
+        - guard access aws --account chariot+client@praetorian.com
+        - guard access aws --account chariot+client@praetorian.com --prefix myclient
+    """
+    import boto3
+
+    # Resolve account: explicit --account on this command, or inherited from guard --account
+    if account is None:
+        account = sdk.keychain.account
+    if account is None:
+        raise click.ClickException('--account is required. Provide it here or as guard --account.')
+
+    sdk.keychain.assume_role(account)
+
+    if prefix is None:
+        prefix = extract_prefix(account)
+
+    # List credentials and filter to AWS type
+    creds_response = sdk.credentials.list()
+    credentials_list = creds_response[0] if isinstance(creds_response, tuple) else []
+
+    aws_credentials = [c for c in credentials_list if c.get('type', '') == 'aws']
+
+    if not aws_credentials:
+        click.echo(f'No AWS credentials found for account {account}')
+        return
+
+    all_profiles = []
+
+    for cred in aws_credentials:
+        credential_id = cred.get('credentialId', '')
+        account_key = cred.get('accountKey', '')
+        category = cred.get('category', 'env-integration')
+        root_account_id = extract_account_id(account_key)
+
+        # Fetch the root credential to get temp AWS creds
+        try:
+            result = sdk.credentials.get(credential_id, category, 'aws', ['token'])
+        except Exception as e:
+            click.echo(f'Warning: failed to get credential {credential_id}: {e}')
+            continue
+
+        access_key = result.get('credentialValue', {}).get('accessKeyId')
+        secret_key = result.get('credentialValue', {}).get('secretAccessKey')
+        session_token = result.get('credentialValue', {}).get('sessionToken')
+
+        if not access_key:
+            click.echo(f'Warning: credential {credential_id} returned no access key')
+            continue
+
+        # Try Organizations to discover sub-accounts
+        sub_accounts = []
+        try:
+            org_client = boto3.client(
+                'organizations',
+                aws_access_key_id=access_key,
+                aws_secret_access_key=secret_key,
+                aws_session_token=session_token,
+                region_name='us-east-1'
+            )
+            paginator = org_client.get_paginator('list_accounts')
+            for page in paginator.paginate():
+                sub_accounts.extend(page['Accounts'])
+        except Exception:
+            # Not an org account — that's fine, just use the root
+            pass
+
+        profiles = build_aws_config_profiles(
+            account_email=account,
+            prefix=prefix,
+            credential_id=credential_id,
+            root_account_id=root_account_id,
+            sub_accounts=sub_accounts,
+            category=category,
+        )
+        all_profiles.extend(profiles)
+
+    if not all_profiles:
+        click.echo(f'No AWS profiles could be generated for account {account}')
+        return
+
+    write_aws_config(all_profiles)
+    click.echo(f'Wrote {len(all_profiles)} AWS profile(s) to ~/.aws/config:')
+    for profile_name, _ in all_profiles:
+        click.echo(f'  {profile_name}')

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/handlers/configure.py

@@ -6,7 +6,7 @@ from praetorian_cli.sdk.keychain import Keychain, DEFAULT_API, DEFAULT_CLIENT_ID
 @click.pass_context
 def configure(click_context):
     """Configure the CLI with API key authentication."""
-    
+
     api_key_id = click.prompt("Enter your API Key ID")
     api_key_secret = click.prompt("Enter your API Key secret", hide_input=True)
 

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/handlers/engagement.py

@@ -18,16 +18,17 @@ from praetorian_cli.handlers.add import add
 @click.option('--type', 'customer_type', type=click.Choice(['ENGAGEMENT', 'MANAGED', 'SAAS', 'PILOT', 'FREEMIUM']),
               default='ENGAGEMENT', show_default=True, help='Customer type')
 @click.option('--collaborator', multiple=True, help='Additional collaborator emails (format: email:role)')
-def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator):
+@click.option('--allowed-domain', multiple=True, help='Allowed email domains for collaborators (e.g., acme.com)')
+def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator, allowed_domain):
     """ Create a new customer account on the Guard platform
 
     Creates a Cognito user, Guard account, and adds default collaborators.
 
     \b
     Example usages:
-        - guard add customer --email ops@acme.com --name "ACME Corp"
-        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED
-        - guard add customer --email ops@acme.com --name "ACME Corp" --collaborator "analyst@praetorian.com:admin"
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com --collaborator "analyst@praetorian.com:admin"
     """
     body = {
         'username': email,
@@ -47,6 +48,8 @@ def create_customer(sdk, email, display_name, scan_level, customer_type, collabo
                 collabs.append({'email': c, 'role': 'admin'})
         body['collaborators'] = collabs
 
+    body['allowed_domains'] = [d.lower().strip() for d in allowed_domain]
+
     result = sdk.post('customer/onboard', body)
     click.echo(f'Customer created: {email} ({display_name})')
     print_json(result)

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/handlers/export.py

@@ -25,6 +25,8 @@ def export():
 @click.option('--end-date', default='', help='Engagement end date (ISO format)')
 @click.option('--report-date', default='', help='Report date (ISO format). Default: today')
 @click.option('--draft/--no-draft', default=False, help='Add DRAFT watermark')
+@click.option('--retest/--no-retest', default=False,
+              help='Include retest status badges and sections')
 @click.option('--version', 'report_version', default='1.0', help='Report version string')
 @click.option('--format', 'export_format', type=click.Choice(['pdf', 'zip']),
               default='pdf', help='Export format')
@@ -45,7 +47,7 @@ def export():
 @click.option('--no-download', is_flag=True, default=False,
               help='Skip downloading the file; just print the job result')
 def report(chariot, title, client_name, status_filter, risk_keys,
-           target, start_date, end_date, report_date, draft,
+           target, start_date, end_date, report_date, draft, retest,
            report_version, export_format, group_by, shared,
            executive_summary, narratives, appendix, output,
            timeout, no_download):
@@ -80,6 +82,7 @@ def report(chariot, title, client_name, status_filter, risk_keys,
         end_date=end_date,
         report_date=report_date,
         draft=draft,
+        retest=retest,
         version=report_version,
         export_format=export_format,
         group_by=group_by,

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/handlers/list.py

@@ -99,7 +99,12 @@ def integrations(chariot, filter, details, offset, page):
 
 @list.command()
 @list_params('group of the job asset')
-def jobs(chariot, filter, details, offset, page):
+@click.option('-c', '--capability', default=None, help='Filter by capability name (e.g., nuclei, portscan, diana-agent)')
+@click.option('-s', '--status', type=click.Choice(['JQ', 'JR', 'JP', 'JF']),
+              default=None, help='Filter by job status (JQ=queued, JR=running, JP=passed, JF=failed)')
+@click.option('-t', '--target', default=None, help='Filter by target DNS or hostname')
+@click.option('--summary', is_flag=True, default=False, help='Show job count summary by capability and status')
+def jobs(chariot, capability, status, target, summary, filter, details, offset, page):
     """
     List jobs
 
@@ -110,10 +115,24 @@ def jobs(chariot, filter, details, offset, page):
     Example usages:
         - guard list jobs
         - guard list jobs --filter www.example.com
+        - guard list jobs --capability nuclei
+        - guard list jobs --capability diana-agent --details
+        - guard list jobs --status JR
+        - guard list jobs --target api.example.com
+        - guard list jobs --summary
         - guard list jobs --details
         - guard list jobs --page all
     """
-    render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
+    if summary:
+        print_json(chariot.jobs.summary(pagination_size(page)))
+    elif capability:
+        render_list_results(chariot.jobs.list_by_capability(capability, offset, pagination_size(page)), details)
+    elif status:
+        render_list_results(chariot.jobs.list_by_status(status, offset, pagination_size(page)), details)
+    elif target:
+        render_list_results(chariot.jobs.list_by_target(target, offset, pagination_size(page)), details)
+    else:
+        render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
 
 
 @list.command()

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/handlers/run.py

@@ -175,26 +175,109 @@ def tool(sdk, tool_name, target, extra_config, credential, wait, use_agent, loca
 
 @run.command('list')
 @cli_handler
-def list_tools(sdk):
-    """ List named agents and their descriptions
+@click.option('-s', '--surface', default='', help='Filter by surface (external, internal, cloud, repository, application)')
+@click.option('-e', '--executor', default='', help='Filter by executor (chariot, janus, aegis, aurelian, agent)')
+@click.option('--json', 'as_json', is_flag=True, default=False, help='Output as JSON')
+def list_tools(sdk, surface, executor, as_json):
+    """ List all available tools and capabilities
 
     \b
-    Example usage:
+    Shows all Guard capabilities with descriptions, indicating which can
+    be installed locally. Use --surface or --executor to filter.
+
+    \b
+    Example usages:
         guard run list
+        guard run list --surface external
+        guard run list --executor agent
+        guard run list --json
     """
-    click.echo(f'\n{"Agent":<16} {"Description"}')
-    click.echo(f'{"─"*16} {"─"*50}')
-    for name, desc in sorted(FRIENDLY_NAMES.items()):
-        click.echo(f'{name:<16} {desc}')
-    click.echo(f'\nUse "guard run capabilities" for the full list of backend capabilities.')
+    from praetorian_cli.runners.local import INSTALLABLE_TOOLS, list_installed
+
+    try:
+        result = sdk.capabilities.list()
+        caps = result[0] if isinstance(result, tuple) else result
+        if not isinstance(caps, list):
+            caps = []
+    except Exception:
+        caps = []
+
+    if not caps:
+        click.echo('Could not fetch capabilities from backend.', err=True)
+        click.echo(f'\nLocally installable tools:')
+        for name, info in sorted(INSTALLABLE_TOOLS.items()):
+            click.echo(f'  {name:<18} {info["description"]}')
+        return
+
+    if as_json:
+        print_json(caps)
+        return
+
+    installed = list_installed()
+
+    # Apply filters
+    if surface:
+        caps = [c for c in caps if c.get('surface', '') == surface]
+    if executor:
+        caps = [c for c in caps if c.get('executor', '') == executor]
+
+    if not caps:
+        click.echo('No capabilities match the filters.')
+        return
+
+    # Sort: installable first, then by name
+    def sort_key(c):
+        name = c.get('name', '')
+        is_installable = name in INSTALLABLE_TOOLS
+        return (not is_installable, name)
+
+    caps.sort(key=sort_key)
+
+    # Render table
+    click.echo(f'\n{"Name":<22} {"Type":<10} {"Surface":<12} {"Description"}')
+    click.echo(f'{"─"*22} {"─"*10} {"─"*12} {"─"*48}')
+
+    for c in caps:
+        name = c.get('name', '')
+        desc = c.get('description', '') or c.get('title', '')
+        cap_surface = c.get('surface', '')
+        cap_executor = c.get('executor', '')
+
+        # Determine type label
+        if name in INSTALLABLE_TOOLS:
+            if name in installed:
+                type_label = 'local ✓'
+            else:
+                type_label = 'local'
+        elif cap_executor == 'agent':
+            type_label = 'agent'
+        else:
+            type_label = 'remote'
+
+        # Truncate description
+        max_desc = 55
+        if len(desc) > max_desc:
+            desc = desc[:max_desc - 1] + '…'
+
+        click.echo(f'{name:<22} {type_label:<10} {cap_surface:<12} {desc}')
+
+    click.echo(f'\n{len(caps)} capabilities')
+    installable_count = sum(1 for c in caps if c.get('name', '') in INSTALLABLE_TOOLS)
+    installed_count = sum(1 for c in caps if c.get('name', '') in installed)
+    if installable_count:
+        click.echo(f'{installable_count} installable locally ({installed_count} installed) — use "guard run install <name>"')
 
 
 @run.command('capabilities')
 @cli_handler
 @click.option('-n', '--name', default='', help='Filter by capability name')
 @click.option('-t', '--target', default='', help='Filter by target type')
-def capabilities(sdk, name, target):
-    """ List all available capabilities from the backend
+@click.option('-e', '--executor', default='', help='Filter by executor')
+def capabilities(sdk, name, target, executor):
+    """ List all capabilities as JSON (for scripting)
+
+    \b
+    Full machine-readable output. For a human-readable view, use "guard run list".
 
     \b
     Example usages:
@@ -202,8 +285,9 @@ def capabilities(sdk, name, target):
         guard run capabilities --name nuclei
         guard run capabilities --target asset
     """
-    result = sdk.capabilities.list(name=name, target=target)
-    print_json(result)
+    result = sdk.capabilities.list(name=name, target=target, executor=executor)
+    caps = result[0] if isinstance(result, tuple) else result
+    print_json(caps)
 
 
 @run.command('install')

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/main.py

@@ -1,5 +1,6 @@
 import click
 
+import praetorian_cli.handlers.access
 import praetorian_cli.handlers.add
 import praetorian_cli.handlers.aegis
 import praetorian_cli.handlers.agent

{praetorian_cli-2.4.0 → praetorian_cli-2.4.2}/praetorian_cli/runners/local.py

@@ -71,7 +71,10 @@ def is_installed(tool_name: str) -> bool:
 def install_tool(tool_name: str, force=False) -> str:
     """Download and install a tool from GitHub releases. Returns binary path."""
     if tool_name not in INSTALLABLE_TOOLS:
-        raise ValueError(f'Unknown tool: {tool_name}. Available: {", ".join(sorted(INSTALLABLE_TOOLS))}')
+        lines = [f'Unknown tool: {tool_name}. Installable tools:']
+        for name in sorted(INSTALLABLE_TOOLS):
+            lines.append(f'  {name:<18} {INSTALLABLE_TOOLS[name]["description"]}')
+        raise ValueError('\n'.join(lines))
 
     if not force and is_installed(tool_name):
         return get_binary_path(tool_name)