praetorian-cli 2.4.1__tar.gz → 2.4.3__tar.gz

{praetorian_cli-2.4.1/praetorian_cli.egg-info → praetorian_cli-2.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.1
+Version: 2.4.3
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

praetorian_cli-2.4.3/praetorian_cli/handlers/access.py

@@ -0,0 +1,209 @@
+import os
+
+import click
+
+from praetorian_cli.handlers.chariot import chariot
+from praetorian_cli.handlers.cli_decorators import cli_handler
+
+
+def extract_prefix(email):
+    """Extract the profile prefix from a Guard account email.
+
+    Takes the portion after '+' and before '@'.
+    If no '+' exists, uses the full local part (before '@').
+
+    Examples:
+        chariot+proceptbiorobotics@praetorian.com -> proceptbiorobotics
+        chariot+grant_street_group-ztw@praetorian.com -> grant_street_group-ztw
+        user@example.com -> user
+    """
+    local_part = email.split('@')[0]
+    if '+' in local_part:
+        return local_part.split('+', 1)[1]
+    return local_part
+
+
+def extract_account_id(credential_key):
+    """Extract the AWS account ID from a credential key.
+
+    Keys look like: #account#chariot+client@praetorian.com#amazon#325281727610
+    The account ID is the last segment.
+    """
+    return credential_key.rstrip('#').split('#')[-1]
+
+
+def build_aws_config_profiles(account_email, prefix, credential_id, root_account_id, sub_accounts, category='env-integration'):
+    """Build a list of (profile_name, profile_dict) tuples for AWS config.
+
+    Args:
+        account_email: The Guard account email (used in credential_process command)
+        prefix: The profile name prefix
+        credential_id: The credential UUID
+        root_account_id: The root AWS account ID
+        sub_accounts: List of dicts with 'Id' key from Organizations list_accounts,
+                      or empty list if not an org.
+        category: The credential category (e.g., 'env-integration', 'cloud')
+    Returns:
+        List of (profile_name, dict) where dict has credential_process, region, output keys.
+    """
+    profiles = []
+
+    # Collect all account IDs (root + sub-accounts), deduplicated
+    all_account_ids = [root_account_id]
+    for acct in sub_accounts:
+        if acct['Id'] != root_account_id:
+            all_account_ids.append(acct['Id'])
+
+    for account_id in all_account_ids:
+        profile_name = f'{prefix}-{account_id}'
+        credential_process = (
+            f'guard --account {account_email} get credential {credential_id} '
+            f'--category {category} --type aws --format credential-process '
+            f'--parameters accountId {account_id}'
+        )
+        profiles.append((profile_name, {
+            'credential_process': credential_process,
+            'region': 'us-east-1',
+            'output': 'json',
+        }))
+
+    return profiles
+
+
+def write_aws_config(profiles, config_path=None):
+    """Write AWS config profiles, preserving existing unrelated profiles.
+
+    Args:
+        profiles: List of (profile_name, profile_dict) tuples.
+        config_path: Path to AWS config file. Defaults to ~/.aws/config.
+    """
+    from configparser import ConfigParser
+    from pathlib import Path
+
+    if config_path is None:
+        config_path = os.path.join(Path.home(), '.aws', 'config')
+
+    config = ConfigParser()
+    if os.path.exists(config_path):
+        config.read(config_path)
+
+    for profile_name, profile_data in profiles:
+        section = f'profile {profile_name}'
+        if not config.has_section(section):
+            config.add_section(section)
+        for key, value in profile_data.items():
+            config.set(section, key, value)
+
+    parent_dir = os.path.dirname(config_path)
+    if parent_dir:
+        os.makedirs(parent_dir, exist_ok=True)
+    with open(config_path, 'w') as f:
+        config.write(f)
+
+
+@chariot.group()
+def access():
+    """Configure credential access for cloud providers."""
+    pass
+
+
+@access.command()
+@cli_handler
+@click.option('--account', default=None, help='Guard account email to discover AWS credentials for (also inherited from guard --account)')
+@click.option('--prefix', default=None, help='Override the profile name prefix (default: derived from email)')
+def aws(sdk, account, prefix):
+    """Generate AWS CLI config profiles from Guard credentials.
+
+    Discovers AWS credentials for the given account, enumerates sub-accounts
+    via Organizations (if applicable), and writes ~/.aws/config profiles that
+    use guard as the credential_process.
+
+    The --account can be provided here or as the top-level guard --account flag.
+
+    \b
+    Example usages:
+        - guard --account chariot+client@praetorian.com access aws
+        - guard access aws --account chariot+client@praetorian.com
+        - guard access aws --account chariot+client@praetorian.com --prefix myclient
+    """
+    import boto3
+
+    # Resolve account: explicit --account on this command, or inherited from guard --account
+    if account is None:
+        account = sdk.keychain.account
+    if account is None:
+        raise click.ClickException('--account is required. Provide it here or as guard --account.')
+
+    sdk.keychain.assume_role(account)
+
+    if prefix is None:
+        prefix = extract_prefix(account)
+
+    # List credentials and filter to AWS type
+    creds_response = sdk.credentials.list()
+    credentials_list = creds_response[0] if isinstance(creds_response, tuple) else []
+
+    aws_credentials = [c for c in credentials_list if c.get('type', '') == 'aws']
+
+    if not aws_credentials:
+        click.echo(f'No AWS credentials found for account {account}')
+        return
+
+    all_profiles = []
+
+    for cred in aws_credentials:
+        credential_id = cred.get('credentialId', '')
+        account_key = cred.get('accountKey', '')
+        category = cred.get('category', 'env-integration')
+        root_account_id = extract_account_id(account_key)
+
+        # Fetch the root credential to get temp AWS creds
+        try:
+            result = sdk.credentials.get(credential_id, category, 'aws', ['token'])
+        except Exception as e:
+            click.echo(f'Warning: failed to get credential {credential_id}: {e}')
+            continue
+
+        access_key = result.get('credentialValue', {}).get('accessKeyId')
+        secret_key = result.get('credentialValue', {}).get('secretAccessKey')
+        session_token = result.get('credentialValue', {}).get('sessionToken')
+
+        if not access_key:
+            click.echo(f'Warning: credential {credential_id} returned no access key')
+            continue
+
+        # Try Organizations to discover sub-accounts
+        sub_accounts = []
+        try:
+            org_client = boto3.client(
+                'organizations',
+                aws_access_key_id=access_key,
+                aws_secret_access_key=secret_key,
+                aws_session_token=session_token,
+                region_name='us-east-1'
+            )
+            paginator = org_client.get_paginator('list_accounts')
+            for page in paginator.paginate():
+                sub_accounts.extend(page['Accounts'])
+        except Exception:
+            # Not an org account — that's fine, just use the root
+            pass
+
+        profiles = build_aws_config_profiles(
+            account_email=account,
+            prefix=prefix,
+            credential_id=credential_id,
+            root_account_id=root_account_id,
+            sub_accounts=sub_accounts,
+            category=category,
+        )
+        all_profiles.extend(profiles)
+
+    if not all_profiles:
+        click.echo(f'No AWS profiles could be generated for account {account}')
+        return
+
+    write_aws_config(all_profiles)
+    click.echo(f'Wrote {len(all_profiles)} AWS profile(s) to ~/.aws/config:')
+    for profile_name, _ in all_profiles:
+        click.echo(f'  {profile_name}')

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/add.py

@@ -6,7 +6,7 @@ import click
 
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler, praetorian_only
-from praetorian_cli.handlers.utils import error, parse_configuration_value
+from praetorian_cli.handlers.utils import error, parse_configuration_value, parse_kv_entries
 from praetorian_cli.sdk.model.globals import AddRisk, Asset, Seed, Kind
 
 
@@ -357,40 +357,71 @@ def webpage(sdk, url, parent):
     sdk.webpage.add(url, parent)
 
 
-@add.command()
+@add.group(invoke_without_command=True)
 @cli_handler
-@click.option('-r', '--resource-key', required=True, help='The resource key for the credential (e.g., account key)')
-@click.option('-c', '--category', required=True,
+@click.option('-r', '--resource-key', help='The resource key for the credential (e.g., account key)')
+@click.option('-c', '--category',
               type=click.Choice(['integration', 'cloud', 'env-integration']),
               help='The category of the credential')
-@click.option('-t', '--type', 'cred_type', required=True,
-              help='The type of credential (aws, gcp, azure, static, ssh_key, json, active-directory, default)')
-@click.option('-l', '--label', required=True, help='A human-readable label for the credential')
+@click.option('-t', '--type', 'cred_type',
+              help='The type of credential (aws, gcp, azure, static-token, ssh-key, '
+                   'json-credential, active-directory, burp-authentication, web-auth, etc.)')
+@click.option('-l', '--label', help='A human-readable label for the credential')
 @click.option('-p', '--param', 'parameters', multiple=True,
               help='Parameter in format key=value (can be specified multiple times)')
-def credential(sdk, resource_key, category, cred_type, label, parameters):
+@click.pass_context
+def credential(ctx, sdk, resource_key, category, cred_type, label, parameters):
     """ Add a credential
 
-    This command adds a credential to the credential broker. Credentials can be used
-    for authentication with various cloud providers, integrations, and environment services.
+    Without a subcommand, adds a credential generically — you provide all of category,
+    type, label, and params. Use the typed subcommands (e.g. `webauth`) for friendlier
+    UX when adding a known credential type.
 
     \b
     Example usages:
         - guard add credential --resource-key "C.0c6cf7104f516b08-OGMPG" --category env-integration --type active-directory --label "Robb Stark" --param username=robb.stark --param password=sexywolfy --param domain=north.sevenkingdoms.local
         - guard add credential -r "C.example-key" -c cloud -t aws --label "AWS Production" -p region=us-east-1 -p role_arn=arn:aws:iam::123456789012:role/MyRole
-        - guard add credential -r "C.example-key" -c integration -t static --label "API Token" -p token=abc123xyz
+        - guard add credential -r "C.example-key" -c integration -t static-token --label "API Token" -p token=abc123xyz
     """
-    # Parse parameters from key=value format
-    params = {}
-    for param in parameters:
-        if '=' not in param:
-            error(f"Parameter '{param}' is not in the format key=value")
-            return
-        key, value = param.split('=', 1)
-        params[key] = value
+    if ctx.invoked_subcommand is not None:
+        return
+
+    missing = [name for name, val in
+               [('--resource-key', resource_key), ('--category', category),
+                ('--type', cred_type), ('--label', label)] if not val]
+    if missing:
+        error(f"Missing required option(s): {', '.join(missing)}")
+
+    params = parse_kv_entries(parameters, label='Param')
 
     try:
         result = sdk.credentials.add(resource_key, category, cred_type, label, params)
         click.echo(json.dumps(result, indent=2))
     except Exception as e:
         error(f'Unable to add credential. Error: {e}')
+
+
+@credential.command('webauth')
+@cli_handler
+@click.option('-k', '--resource-key', required=True,
+              help='Web-application key (e.g., #webapplication#https://app.example.com)')
+@click.option('-l', '--label', required=True, help='A human-readable label for the credential')
+@click.option('-H', '--header', 'headers', multiple=True, required=True,
+              help='Header in format Name=Value (can be specified multiple times)')
+def credential_webauth(sdk, resource_key, label, headers):
+    """ Add a static-token web-auth credential to a WebApplication.
+
+    Persists a header bag (e.g. an Authorization bearer token) that Chariot
+    capabilities and Burp Enterprise will use when scanning the target.
+
+    \b
+    Example usage:
+        - guard add credential webauth -k "#webapplication#https://app.example.com" -l "Prod token" -H "Authorization=Bearer abc123" -H "X-Tenant=acme"
+    """
+    headers_dict = parse_kv_entries(headers, label='Header')
+    parameters = {'method': 'static-token', 'headers': headers_dict}
+    try:
+        result = sdk.credentials.add(resource_key, 'env-integration', 'web-auth', label, parameters)
+        click.echo(json.dumps(result, indent=2))
+    except Exception as e:
+        error(f'Unable to add web-auth credential. Error: {e}')

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/configure.py

@@ -6,7 +6,7 @@ from praetorian_cli.sdk.keychain import Keychain, DEFAULT_API, DEFAULT_CLIENT_ID
 @click.pass_context
 def configure(click_context):
     """Configure the CLI with API key authentication."""
-    
+
     api_key_id = click.prompt("Enter your API Key ID")
     api_key_secret = click.prompt("Enter your API Key secret", hide_input=True)
 

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/delete.py

@@ -193,4 +193,61 @@ def webpage(chariot, key):
     Arguments:
         - KEY: the key of an existing webpage
     """
-    chariot.webpage.delete(key)
+    chariot.webpage.delete(key)
+
+
+@delete.group()
+def credential():
+    """ Delete a credential via the broker
+
+    For web-auth credentials shared across multiple WebApplications, this only
+    detaches the credential from the given resource_key — the underlying
+    credential is fully removed once it has no remaining attachments.
+
+    Use the typed subcommands (e.g. `webauth`) for friendlier UX, or `generic`
+    when deleting a credential type that doesn't have a typed subcommand yet.
+    """
+    pass
+
+
+@credential.command('generic')
+@cli_handler
+@click.argument('credential_id', required=True)
+@click.option('-r', '--resource-key', required=True,
+              help='The resource key the credential is attached to (e.g., web-application key, account key)')
+@click.option('-t', '--type', 'cred_type', required=True,
+              help='The credential type (e.g., active-directory, burp-authentication)')
+def credential_generic(chariot, credential_id, resource_key, cred_type):
+    """ Delete a credential of any type (escape hatch).
+
+    \b
+    Arguments:
+        - CREDENTIAL_ID: the ID of the credential to delete
+
+    \b
+    Example usage:
+        - guard delete credential generic def-456 -r "#asset#example.com#1.2.3.4" -t active-directory
+    """
+    chariot.credentials.delete(credential_id, resource_key, cred_type)
+
+
+@credential.command('webauth')
+@cli_handler
+@click.argument('credential_id', required=True)
+@click.option('-k', '--resource-key', required=True,
+              help='Web-application key (e.g., #webapplication#https://app.example.com)')
+def credential_webauth(chariot, credential_id, resource_key):
+    """ Delete a web-auth credential from a WebApplication.
+
+    Detaches the credential from this WebApplication; the underlying credential
+    is fully removed once it has no remaining attachments.
+
+    \b
+    Arguments:
+        - CREDENTIAL_ID: the ID of the web-auth credential to delete
+
+    \b
+    Example usage:
+        - guard delete credential webauth abc-123 -k "#webapplication#https://app.example.com"
+    """
+    chariot.credentials.delete(credential_id, resource_key, 'web-auth')

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/engagement.py

@@ -18,16 +18,17 @@ from praetorian_cli.handlers.add import add
 @click.option('--type', 'customer_type', type=click.Choice(['ENGAGEMENT', 'MANAGED', 'SAAS', 'PILOT', 'FREEMIUM']),
               default='ENGAGEMENT', show_default=True, help='Customer type')
 @click.option('--collaborator', multiple=True, help='Additional collaborator emails (format: email:role)')
-def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator):
+@click.option('--allowed-domain', multiple=True, help='Allowed email domains for collaborators (e.g., acme.com)')
+def create_customer(sdk, email, display_name, scan_level, customer_type, collaborator, allowed_domain):
     """ Create a new customer account on the Guard platform
 
     Creates a Cognito user, Guard account, and adds default collaborators.
 
     \b
     Example usages:
-        - guard add customer --email ops@acme.com --name "ACME Corp"
-        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED
-        - guard add customer --email ops@acme.com --name "ACME Corp" --collaborator "analyst@praetorian.com:admin"
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --type MANAGED --allowed-domain acme.com
+        - guard add customer --email ops@acme.com --name "ACME Corp" --allowed-domain acme.com --collaborator "analyst@praetorian.com:admin"
     """
     body = {
         'username': email,
@@ -47,6 +48,8 @@ def create_customer(sdk, email, display_name, scan_level, customer_type, collabo
                 collabs.append({'email': c, 'role': 'admin'})
         body['collaborators'] = collabs
 
+    body['allowed_domains'] = [d.lower().strip() for d in allowed_domain]
+
     result = sdk.post('customer/onboard', body)
     click.echo(f'Customer created: {email} ({display_name})')
     print_json(result)

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/export.py

@@ -28,6 +28,9 @@ def export():
 @click.option('--retest/--no-retest', default=False,
               help='Include retest status badges and sections')
 @click.option('--version', 'report_version', default='1.0', help='Report version string')
+@click.option('--sow', default='', help='Statement of Work identifier (expands %%SOW%% shortcode).')
+@click.option('--footer', default='', help='Custom page-footer text (overrides the report title when set).')
+@click.option('--confidential-label', 'confidential_label', default='', help='Confidentiality label shown on cover, header, and footer (defaults to "Confidential").')
 @click.option('--format', 'export_format', type=click.Choice(['pdf', 'zip']),
               default='pdf', help='Export format')
 @click.option('--group-by', type=click.Choice(['attack_surface', 'tag']),
@@ -48,7 +51,7 @@ def export():
               help='Skip downloading the file; just print the job result')
 def report(chariot, title, client_name, status_filter, risk_keys,
            target, start_date, end_date, report_date, draft, retest,
-           report_version, export_format, group_by, shared,
+           report_version, sow, footer, confidential_label, export_format, group_by, shared,
            executive_summary, narratives, appendix, output,
            timeout, no_download):
     """ Generate and download a PDF or ZIP report.
@@ -84,6 +87,9 @@ def report(chariot, title, client_name, status_filter, risk_keys,
         draft=draft,
         retest=retest,
         version=report_version,
+        sow=sow,
+        footer=footer,
+        confidential_label=confidential_label,
         export_format=export_format,
         group_by=group_by,
         shared_output=shared,

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/list.py

@@ -99,7 +99,12 @@ def integrations(chariot, filter, details, offset, page):
 
 @list.command()
 @list_params('group of the job asset')
-def jobs(chariot, filter, details, offset, page):
+@click.option('-c', '--capability', default=None, help='Filter by capability name (e.g., nuclei, portscan, diana-agent)')
+@click.option('-s', '--status', type=click.Choice(['JQ', 'JR', 'JP', 'JF']),
+              default=None, help='Filter by job status (JQ=queued, JR=running, JP=passed, JF=failed)')
+@click.option('-t', '--target', default=None, help='Filter by target DNS or hostname')
+@click.option('--summary', is_flag=True, default=False, help='Show job count summary by capability and status')
+def jobs(chariot, capability, status, target, summary, filter, details, offset, page):
     """
     List jobs
 
@@ -110,10 +115,24 @@ def jobs(chariot, filter, details, offset, page):
     Example usages:
         - guard list jobs
         - guard list jobs --filter www.example.com
+        - guard list jobs --capability nuclei
+        - guard list jobs --capability diana-agent --details
+        - guard list jobs --status JR
+        - guard list jobs --target api.example.com
+        - guard list jobs --summary
         - guard list jobs --details
         - guard list jobs --page all
     """
-    render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
+    if summary:
+        print_json(chariot.jobs.summary(pagination_size(page)))
+    elif capability:
+        render_list_results(chariot.jobs.list_by_capability(capability, offset, pagination_size(page)), details)
+    elif status:
+        render_list_results(chariot.jobs.list_by_status(status, offset, pagination_size(page)), details)
+    elif target:
+        render_list_results(chariot.jobs.list_by_target(target, offset, pagination_size(page)), details)
+    else:
+        render_list_results(chariot.jobs.list(filter, offset, pagination_size(page)), details)
 
 
 @list.command()

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/run.py

@@ -124,27 +124,34 @@ def run():
     pass
 
 
-@run.command('tool')
+@run.command(
+    'tool',
+    context_settings={'ignore_unknown_options': True, 'allow_extra_args': True},
+)
 @cli_handler
 @click.argument('tool_name')
 @click.argument('target')
+@click.argument('tool_args', nargs=-1, type=click.UNPROCESSED)
 @click.option('-c', '--config', 'extra_config', default='', help='Extra JSON config to merge')
 @click.option('--credential', multiple=True, help='Credential ID(s) to use')
 @click.option('--wait', is_flag=True, default=False, help='Wait for job completion and show results')
 @click.option('--ask', 'use_agent', is_flag=True, default=False, help='Run via Marcus AI agent instead of direct job')
 @click.option('--local', is_flag=True, default=False, help='Run locally using installed binary')
 @click.option('--remote', is_flag=True, default=False, help='Force remote job execution on Guard backend')
-def tool(sdk, tool_name, target, extra_config, credential, wait, use_agent, local, remote):
+def tool(sdk, tool_name, target, tool_args, extra_config, credential, wait, use_agent, local, remote):
     """ Execute a named security tool against a target
 
     By default, runs LOCALLY if the binary is installed, otherwise schedules
-    a remote job. Use --local or --remote to force.
+    a remote job. Use --local or --remote to force. Any additional arguments
+    after the target are forwarded to the local binary. Use `--` to pass
+    flags that collide with our own options.
 
     \b
     Example usages:
-        guard run tool brutus 10.0.1.5
-        guard run tool nuclei example.com --remote
-        guard run tool titus github.com/org/repo
+        guard run tool brutus 10.0.1.5:22
+        guard run tool brutus 10.0.1.5:22 --protocol ssh -U users.txt
+        guard run tool brutus 10.0.1.5:22 -- --wait
+        guard run tool nuclei example.com --remote -c '{"templates":"cves/"}'
     """
     from praetorian_cli.runners.local import is_installed as _is_installed
 
@@ -152,11 +159,26 @@ def tool(sdk, tool_name, target, extra_config, credential, wait, use_agent, loca
     if not cap:
         error(f'Unknown capability: {tool_name}. Use "guard run capabilities" to see available capabilities.')
 
-    # Decide local vs remote
+    # --local / --remote / --ask are mutually exclusive routing flags.
+    mode_flags = [('--local', local), ('--remote', remote), ('--ask', use_agent)]
+    set_flags = [name for name, v in mode_flags if v]
+    if len(set_flags) > 1:
+        error(f'Mutually exclusive flags: {", ".join(set_flags)}. Choose one.')
+
+    tool_args = list(tool_args or [])
+
+    # Decide local vs remote first so we can validate tool_args against the resolved path.
     run_local = local or (not remote and not use_agent and _is_installed(tool_name.lower()))
 
+    if tool_args and (remote or use_agent or not run_local):
+        error(
+            'Extra arguments after the target are only supported when running locally. '
+            'Install the tool locally ("guard run install %s") or encode settings as JSON '
+            'via -c \'{"key":"value"}\'.' % tool_name.lower()
+        )
+
     if run_local:
-        _run_local(sdk, tool_name.lower(), target, extra_config)
+        _run_local(sdk, tool_name.lower(), target, extra_config, tool_args)
     elif use_agent:
         target_key, warning = resolve_target(sdk, target, cap['target_type'])
         if not target_key:
@@ -376,7 +398,7 @@ def _run_via_agent(sdk, cap, target_key):
         error(str(e))
 
 
-def _run_local(sdk, tool_name, target, extra_config):
+def _run_local(sdk, tool_name, target, extra_config, tool_args=None):
     """Run a tool locally using the installed binary."""
     from praetorian_cli.runners.local import LocalRunner, get_tool_plugin
 
@@ -392,7 +414,7 @@ def _run_local(sdk, tool_name, target, extra_config):
         raw_target = parts[-1] if len(parts) > 3 else parts[2] if len(parts) > 2 else target
 
     plugin = get_tool_plugin(tool_name)
-    args = plugin.build_args(raw_target, extra_config)
+    args = plugin.build_args(raw_target, extra_config, pass_through=list(tool_args or []))
 
     click.echo(f'Running {tool_name} locally against {raw_target}...')
     click.echo(f'Command: {tool_name} {" ".join(args)}')
@@ -408,6 +430,10 @@ def _run_local(sdk, tool_name, target, extra_config):
         proc.wait(timeout=600)
     except subprocess.TimeoutExpired:
         proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except Exception:
+            pass
         click.echo('\nTimed out (10 min).', err=True)
 
     stderr = proc.stderr.read() if proc.stderr else ''

{praetorian_cli-2.4.1 → praetorian_cli-2.4.3}/praetorian_cli/handlers/update.py

@@ -16,8 +16,10 @@ def update():
 @click.argument('key', required=True)
 @click.option('-s', '--status', type=click.Choice([s.value for s in Asset]), help='The status of the asset')
 @click.option('-f', '--surface', required=False, default='', help=f'Attack surface of the asset', show_default=False)
-def asset(chariot, key, status, surface):
-    """ Update the status or surface of an asset
+@click.option('--secret', default=None,
+              help='For WebApplication assets, the credential ID to set as the default credential')
+def asset(chariot, key, status, surface, secret):
+    """ Update the status, surface, or default credential of an asset
 
     \b
     Argument:
@@ -27,8 +29,9 @@ def asset(chariot, key, status, surface):
     Example usages:
         - guard update asset "#asset#www.example.com#1.2.3.4" -s F
         - guard update asset "#asset#www.example.com#1.2.3.4" -f internal
+        - guard update asset "#webapplication#https://app.example.com" --secret abc-123
     """
-    chariot.assets.update(key, status, surface)
+    chariot.assets.update(key, status, surface, secret=secret)
 
 
 @update.command()