rafter-cli 0.11.2__tar.gz → 0.11.4__tar.gz

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.11.2
+Version: 0.11.4
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team
@@ -166,7 +166,7 @@ Export Rafter policy for agent platforms.
 
 ```bash
 # Filter high-severity vulnerabilities (SARIF levels: error, warning, note)
-rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.level=="error")'
+rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.severity=="error")'
 
 # CI gate
 if rafter get SCAN_ID --format json | jq -e '.vulnerabilities | length > 0'; then

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/README.md

@@ -139,7 +139,7 @@ Export Rafter policy for agent platforms.
 
 ```bash
 # Filter high-severity vulnerabilities (SARIF levels: error, warning, note)
-rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.level=="error")'
+rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.severity=="error")'
 
 # CI gate
 if rafter get SCAN_ID --format json | jq -e '.vulnerabilities | length > 0'; then

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.11.2"
+version = "0.11.4"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/agent.py

@@ -223,7 +223,7 @@ def _install_claude_code_hooks(root: Path, quiet: bool = False) -> None:
     post_hook = {"type": "command", "command": post_command}
     settings["hooks"]["PreToolUse"].extend([
         {"matcher": "Bash", "hooks": [pre_hook]},
-        {"matcher": "Write|Edit", "hooks": [pre_hook]},
+        {"matcher": "Write|Edit|MultiEdit", "hooks": [pre_hook]},
     ])
     # Narrow to tools that produce scannable output (shell output + file
     # writes). Firing posttool on every tool — including Read and MCP calls —
@@ -733,9 +733,9 @@ def _install_gemini_mcp(root: Path, quiet: bool = False) -> bool:
 
 # Cursor hook events covered by rafter (rf-svn3).
 _CURSOR_HOOK_EVENTS: tuple[tuple[str, str], ...] = (
-    ("preToolUse", "rafter hook pretool --format cursor"),
-    ("postToolUse", "rafter hook posttool --format cursor"),
-    ("beforeShellExecution", "rafter hook pretool --format cursor"),
+    ("preToolUse", "hook pretool --format cursor"),
+    ("postToolUse", "hook posttool --format cursor"),
+    ("beforeShellExecution", "hook pretool --format cursor"),
 )
 
 # Skills shipped as both Cursor rules and Claude Code / Codex / Gemini skills.
@@ -783,6 +783,44 @@ def _install_codex_hooks(root: Path, quiet: bool = False) -> None:
     _init_print(quiet, fmt.success(f"Installed PostToolUse hooks to {hooks_path}"))
 
 
+def _install_gemini_hooks(root: Path, quiet: bool = False) -> None:
+    """Install Rafter BeforeTool/AfterTool hooks into <root>/.gemini/settings.json.
+
+    Mirrors Node's installGeminiHooks. Gemini matchers are regexes against its
+    built-in tool names; the mutating ones are matched explicitly.
+    """
+    gemini_dir = root / ".gemini"
+    gemini_dir.mkdir(parents=True, exist_ok=True)
+    settings_path = gemini_dir / "settings.json"
+
+    settings: dict[str, Any] = {}
+    if settings_path.exists():
+        try:
+            settings = json.loads(settings_path.read_text())
+        except (json.JSONDecodeError, ValueError):
+            _init_alert(quiet, fmt.warning("Existing Gemini settings.json was unreadable, creating new one"))
+
+    hooks = settings.setdefault("hooks", {})
+    rafter_bin = _resolve_rafter_path()
+    for event, sub, matcher in (
+        ("BeforeTool", "pretool", "run_shell_command|write_file|replace"),
+        ("AfterTool", "posttool", ".*"),
+    ):
+        entries = hooks.get(event) or []
+        entries = [
+            e for e in entries
+            if not any(f"hook {sub}" in str(h.get("command", "")) for h in (e.get("hooks") or []))
+        ]
+        entries.append({
+            "matcher": matcher,
+            "hooks": [{"type": "command", "command": f"{rafter_bin} hook {sub} --format gemini", "timeout": 5000}],
+        })
+        hooks[event] = entries
+
+    settings_path.write_text(json.dumps(settings, indent=2))
+    _init_print(quiet, fmt.success(f"Installed hooks to {settings_path}"))
+
+
 def _install_cursor_hooks(root: Path, quiet: bool = False) -> None:
     """Install Cursor hooks at <root>/.cursor/hooks.json.
 
@@ -804,7 +842,11 @@ def _install_cursor_hooks(root: Path, quiet: bool = False) -> None:
     config.setdefault("version", 1)
     config.setdefault("hooks", {})
 
-    for event, command in _CURSOR_HOOK_EVENTS:
+    # The resolved path, as for the Claude Code and Codex hooks: Cursor runs
+    # hooks without the user's shell PATH, where a bare `rafter` may not resolve.
+    rafter_bin = _resolve_rafter_path()
+    for event, args in _CURSOR_HOOK_EVENTS:
+        command = f"{rafter_bin} {args}"
         entries = config["hooks"].get(event)
         if not isinstance(entries, list):
             entries = []
@@ -1505,6 +1547,7 @@ def init(
                 _init_alert(quiet, fmt.error(f"Failed to install Gemini CLI skills: {skills_error}"))
             else:
                 _register_gemini_skills(root / ".agents" / "skills", quiet=quiet)
+            _install_gemini_hooks(root, quiet=quiet)
             if gemini_ok and scope == "user":
                 manager.set("agent.environments.gemini.enabled", True)
         except Exception as e:

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/agent_components.py

@@ -205,7 +205,7 @@ def _claude_code_hooks() -> ComponentSpec:
                 del hooks["SessionStart"]
         hooks["PreToolUse"].extend([
             {"matcher": "Bash", "hooks": [pre]},
-            {"matcher": "Write|Edit", "hooks": [pre]},
+            {"matcher": "Write|Edit|MultiEdit", "hooks": [pre]},
         ])
         # Narrow to tools that produce scannable output (shell output + file
         # writes); avoids firing posttool on every Read/MCP call (latency).
@@ -594,8 +594,9 @@ def _gemini_hooks() -> ComponentSpec:
         h["AfterTool"] = _filter_hooks(h["AfterTool"], lambda e: _hook_entry_has_rafter(e, "rafter hook posttool"))
         # Explicit Gemini built-in tool names per geminicli.com/docs/hooks/reference
         # (rf-044o verification).
+        #  No tool is named `edit`: Gemini's edit tool is `replace`.
         h["BeforeTool"].append({
-            "matcher": "run_shell_command|write_file|replace|edit",
+            "matcher": "run_shell_command|write_file|replace",
             "hooks": [{"type": "command", "command": "rafter hook pretool --format gemini", "timeout": 5000}],
         })
         h["AfterTool"].append({

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/hook.py

@@ -455,8 +455,9 @@ def _writes_rafter_security_config(file_path: str) -> bool:
 def _evaluate_write(tool_input: dict) -> dict:
     # rf-vnxs: checked FIRST, and before the no-content early return, because a
     # truncating write with empty content disables the hook just as well as one
-    # carrying JSON.
-    if _writes_rafter_security_config(tool_input.get("file_path", "")):
+    # carrying JSON. apply_patch names its targets only in the patch headers.
+    targets = [tool_input.get("file_path", ""), *tool_input.get("patch_paths", [])]
+    if any(_writes_rafter_security_config(t) for t in targets):
         return {
             "decision": "deny",
             "reason": (
@@ -572,7 +573,8 @@ def _normalize_write_input(tool_name: str, tool_input: dict) -> dict:
 
     Continue's Write names its path ``filepath``; MultiEdit and Windsurf's
     pre_write_code carry ``edits[].new_string``; Codex's apply_patch carries
-    the whole patch in ``command``.
+    the whole patch in ``command``, with its target paths in the patch
+    headers (``patch_paths``).
     """
     out = dict(tool_input)
     if "file_path" not in out and isinstance(tool_input.get("filepath"), str):
@@ -585,9 +587,28 @@ def _normalize_write_input(tool_name: str, tool_input: dict) -> dict:
             )
         elif tool_name == "apply_patch" and isinstance(tool_input.get("command"), str):
             out["content"] = tool_input["command"]
+    if tool_name == "apply_patch" and isinstance(tool_input.get("command"), str):
+        out["patch_paths"] = _apply_patch_paths(tool_input["command"])
     return out
 
 
+# The apply_patch format carries its targets only in hunk headers, which Codex
+# matches on the trimmed line (codex-rs/apply-patch, apply_patch.lark).
+_APPLY_PATCH_HEADERS = ("*** Add File: ", "*** Update File: ", "*** Delete File: ", "*** Move to: ")
+
+
+def _apply_patch_paths(patch: str) -> list[str]:
+    """Every path an apply_patch names."""
+    paths = []
+    for raw in patch.split("\n"):
+        line = raw.strip()
+        for header in _APPLY_PATCH_HEADERS:
+            if line.startswith(header):
+                paths.append(line[len(header):].strip())
+                break
+    return paths
+
+
 def _deny_on_error(exc: Exception) -> dict:
     reason = f"rafter hook error: {type(exc).__name__}: {exc}; denying to be safe"
     print(reason, file=sys.stderr)

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/issues/issue_builder.py

@@ -17,10 +17,28 @@ class IssueDraft:
 
 @dataclass
 class BackendVulnerability:
-    rule_id: str
-    level: str
-    message: str
-    file: str
+    """Backend vulnerability from `GET /api/static/scan` (`rafter get <id> --format json`).
+
+    The real API shape (`toRafterFindings()` on the backend) is
+    `rule_id`/`severity`/`title`/`description`/`file_path`/`line_start`/
+    `line_end` plus optional `cwe`/`confidence`. `level`/`message`/`file`/
+    `line` are the pre-rename names, kept as a fallback for old cached
+    payloads and existing tests, never the primary source.
+    """
+
+    rule_id: str = ""
+    severity: str = ""
+    title: str = ""
+    description: str = ""
+    file_path: str | None = None
+    line_start: int | None = None
+    line_end: int | None = None
+    cwe: str | None = None
+    confidence: str | None = None
+    # Pre-rename names.
+    level: str = ""
+    message: str = ""
+    file: str = ""
     line: int | None = None
 
 
@@ -67,24 +85,31 @@ def _truncate(s: str, max_len: int) -> str:
 
 
 def build_from_backend_vulnerability(vuln: BackendVulnerability) -> IssueDraft:
-    sev = _severity_label(vuln.level)
-    emoji = _severity_emoji(vuln.level)
-    fp = fingerprint(vuln.file, vuln.rule_id)
+    rule_id = vuln.rule_id or "unknown-rule"
+    level = vuln.severity or vuln.level or "note"
+    summary = vuln.title or vuln.message or "Security finding"
+    details = vuln.description or vuln.message or summary
+    file = vuln.file_path or vuln.file or "unknown file"
+    line = vuln.line_start if vuln.line_start is not None else vuln.line
+
+    sev = _severity_label(level)
+    emoji = _severity_emoji(level)
+    fp = fingerprint(file, rule_id)
 
-    title = f"{emoji} [{sev.upper()}] {vuln.rule_id}: {_truncate(vuln.message, 80)}"
+    title = f"{emoji} [{sev.upper()}] {rule_id}: {_truncate(summary, 80)}"
 
     body = f"## Security Finding\n\n"
-    body += f"**Rule:** `{vuln.rule_id}`\n"
+    body += f"**Rule:** `{rule_id}`\n"
     body += f"**Severity:** {sev}\n"
-    body += f"**File:** `{vuln.file}`"
-    if vuln.line:
-        body += f" (line {vuln.line})"
+    body += f"**File:** `{file}`"
+    if line:
+        body += f" (line {line})"
     body += "\n\n"
-    body += f"### Description\n\n{vuln.message}\n\n"
-    body += f"### Remediation\n\nReview and fix the finding in `{vuln.file}`.\n"
+    body += f"### Description\n\n{details}\n\n"
+    body += f"### Remediation\n\nReview and fix the finding in `{file}`.\n"
     body += "\n---\n*Created by [Rafter CLI](https://rafter.so) — security for AI builders*\n"
 
-    labels = ["security", f"severity:{sev}", f"rule:{vuln.rule_id}"]
+    labels = ["security", f"severity:{sev}", f"rule:{rule_id}"]
 
     return IssueDraft(
         title=title,

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/issues/issues_app.py

@@ -268,10 +268,19 @@ def _drafts_from_backend(scan_id: str, api_key: str | None) -> list[IssueDraft]:
     return [
         build_from_backend_vulnerability(
             BackendVulnerability(
-                rule_id=v["ruleId"],
-                level=v.get("level", "warning"),
-                message=v.get("message", ""),
-                file=v.get("file", ""),
+                rule_id=v.get("rule_id") or v.get("ruleId") or "",
+                severity=v.get("severity") or "",
+                title=v.get("title") or "",
+                description=v.get("description") or "",
+                file_path=v.get("file_path"),
+                line_start=v.get("line_start"),
+                line_end=v.get("line_end"),
+                cwe=v.get("cwe"),
+                confidence=v.get("confidence"),
+                # Pre-rename names — fallback for old cached payloads.
+                level=v.get("level") or "",
+                message=v.get("message") or "",
+                file=v.get("file") or "",
                 line=v.get("line"),
             )
         )

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/notify.py

@@ -57,19 +57,81 @@ def _detect_platform(url: str) -> str:
     return "generic"
 
 
+def _severity_tier(raw: str | None) -> str:
+    """Map a raw severity/level to a display tier.
+
+    Uses the same rules as the GitHub Action (github-action/action.yml) and
+    ``rafter get``, so notify agrees with both. A value outside the known set is
+    kept verbatim so a finding is never silently dropped.
+    """
+    s = (raw or "").lower()
+    if s == "critical":
+        return "critical"
+    if s in ("error", "high"):
+        return "high"
+    if s in ("warning", "medium"):
+        return "medium"
+    if s in ("note", "low"):
+        return "low"
+    return s or "unknown"
+
+
+def _normalize_scan(scan_data: dict) -> dict:
+    """Read findings from the real scan shape (``vulnerabilities[]``).
+
+    Falls back to the legacy ``findings[]`` for old cached payloads. Counts are
+    derived from each finding's own severity — never from ``summary`` — so a
+    finding cannot be lost to a summary field this code does not read. "Clean"
+    is therefore reported only when there are genuinely zero findings.
+    """
+    raw = scan_data.get("vulnerabilities")
+    if not isinstance(raw, list):
+        raw = scan_data.get("findings")
+    if not isinstance(raw, list):
+        raw = []
+
+    counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+    findings = []
+    for v in raw:
+        tier = _severity_tier(v.get("severity") or v.get("level"))
+        if tier in counts:
+            counts[tier] += 1
+        title = (
+            v.get("title")
+            or v.get("rule_id")
+            or v.get("ruleId")
+            or v.get("message")
+            or "Unknown"
+        )
+        file = v.get("file_path") or v.get("file")
+        line = v.get("line_start") if v.get("line_start") is not None else v.get("line")
+        location = v.get("location") or file or ""
+        if not v.get("location") and file and line is not None:
+            location = f"{file}:{line}"
+        findings.append({"severity": tier, "title": title, "location": location})
+
+    return {
+        "findings": findings,
+        "critical": counts["critical"],
+        "high": counts["high"],
+        "medium": counts["medium"],
+        "low": counts["low"],
+        "total": len(findings),
+    }
+
+
 def _format_slack_payload(scan_data: dict) -> dict:
     """Format scan results as a Slack message with Block Kit."""
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
     scan_id = scan_data.get("scan_id", "")
-    findings = scan_data.get("findings", [])
-    summary = scan_data.get("summary", {})
-
-    critical = summary.get("critical", 0)
-    high = summary.get("high", 0)
-    medium = summary.get("medium", 0)
-    low = summary.get("low", 0)
-    total = critical + high + medium + low
+    norm = _normalize_scan(scan_data)
+    findings = norm["findings"]
+    critical = norm["critical"]
+    high = norm["high"]
+    medium = norm["medium"]
+    low = norm["low"]
+    total = norm["total"]
 
     # Status emoji
     if status == "completed" and total == 0:
@@ -140,12 +202,9 @@ def _format_slack_payload(scan_data: dict) -> dict:
     if findings:
         finding_lines = []
         for f in findings[:5]:
-            sev = f.get("severity", "unknown").upper()
-            title = f.get("title", f.get("rule_id", "Unknown"))
-            location = f.get("location", f.get("file", ""))
-            line = f"• `[{sev}]` {title}"
-            if location:
-                line += f" — {location}"
+            line = f"• `[{f['severity'].upper()}]` {f['title']}"
+            if f["location"]:
+                line += f" — {f['location']}"
             finding_lines.append(line)
 
         if len(findings) > 5:
@@ -179,14 +238,13 @@ def _format_discord_payload(scan_data: dict) -> dict:
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
     scan_id = scan_data.get("scan_id", "")
-    findings = scan_data.get("findings", [])
-    summary = scan_data.get("summary", {})
-
-    critical = summary.get("critical", 0)
-    high = summary.get("high", 0)
-    medium = summary.get("medium", 0)
-    low = summary.get("low", 0)
-    total = critical + high + medium + low
+    norm = _normalize_scan(scan_data)
+    findings = norm["findings"]
+    critical = norm["critical"]
+    high = norm["high"]
+    medium = norm["medium"]
+    low = norm["low"]
+    total = norm["total"]
 
     # Embed color
     if status == "completed" and total == 0:
@@ -237,12 +295,9 @@ def _format_discord_payload(scan_data: dict) -> dict:
     if findings:
         finding_lines = []
         for f in findings[:5]:
-            sev = f.get("severity", "unknown").upper()
-            title = f.get("title", f.get("rule_id", "Unknown"))
-            location = f.get("location", f.get("file", ""))
-            line = f"• `[{sev}]` {title}"
-            if location:
-                line += f" — {location}"
+            line = f"• `[{f['severity'].upper()}]` {f['title']}"
+            if f["location"]:
+                line += f" — {f['location']}"
             finding_lines.append(line)
 
         if len(findings) > 5:
@@ -271,8 +326,7 @@ def _format_generic_payload(scan_data: dict) -> dict:
     """Format scan results as a plain JSON payload with text field."""
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
-    summary = scan_data.get("summary", {})
-    total = sum(summary.get(k, 0) for k in ("critical", "high", "medium", "low"))
+    total = _normalize_scan(scan_data)["total"]
 
     if status == "completed" and total == 0:
         status_text = "Clean — no issues found"

{rafter_cli-0.11.2 → rafter_cli-0.11.4}/rafter_cli/commands/policy.py

@@ -23,7 +23,7 @@ def _generate_claude_config() -> str:
                     "hooks": [{"type": "command", "command": "rafter hook pretool"}],
                 },
                 {
-                    "matcher": "Write|Edit",
+                    "matcher": "Write|Edit|MultiEdit",
                     "hooks": [{"type": "command", "command": "rafter hook pretool"}],
                 },
             ],