rafter-cli 0.8.9__tar.gz → 0.9.0__tar.gz

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.8.9
+Version: 0.9.0
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team
@@ -15,12 +15,12 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: click (>=8.0.0,<9.0.0)
 Requires-Dist: mcp (>=1.9.0,<2.0.0)
-Requires-Dist: python-dotenv (>=1.0.1,<2.0.0)
+Requires-Dist: python-dotenv (>=1.2.2,<2.0.0)
 Requires-Dist: pyyaml (>=6.0.1,<7.0.0)
-Requires-Dist: requests (>=2.31.0,<3.0.0)
+Requires-Dist: requests (>=2.33.0,<3.0.0)
 Requires-Dist: rich (>=13.7.1,<14.0.0)
 Requires-Dist: typer (>=0.15.0,<0.16.0)
-Requires-Dist: urllib3 (>=2.6.0,<3)
+Requires-Dist: urllib3 (>=2.7.0,<3)
 Requires-Dist: watchdog (>=4.0.0,<5.0.0)
 Description-Content-Type: text/markdown
 

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.8.9"
+version = "0.9.0"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"
@@ -11,9 +11,9 @@ python = ">=3.10,<4.0"
 typer = "^0.15.0"
 click = ">=8.0.0,<9.0.0"
 rich = "^13.7.1"
-python-dotenv = "^1.0.1"
-requests = "^2.31.0"
-urllib3 = ">=2.6.0,<3"
+python-dotenv = "^1.2.2"
+requests = "^2.33.0"
+urllib3 = ">=2.7.0,<3"
 pyyaml = "^6.0.1"
 mcp = "^1.9.0"
 watchdog = "^4.0.0"

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/agent.py

@@ -205,8 +205,11 @@ def _install_claude_code_hooks(root: Path) -> None:
         {"matcher": "Bash", "hooks": [pre_hook]},
         {"matcher": "Write|Edit", "hooks": [pre_hook]},
     ])
+    # Narrow to tools that produce scannable output (shell output + file
+    # writes). Firing posttool on every tool — including Read and MCP calls —
+    # added latency to operations that never produce secrets to redact.
     settings["hooks"]["PostToolUse"].extend([
-        {"matcher": ".*", "hooks": [post_hook]},
+        {"matcher": "Bash|Write|Edit|MultiEdit", "hooks": [post_hook]},
     ])
 
     settings_path.write_text(json.dumps(settings, indent=2) + "\n")
@@ -264,6 +267,7 @@ def _print_dry_run_plan(
     want_continue: bool,
     want_aider: bool,
     want_hermes: bool,
+    want_opencode: bool,
     want_betterleaks: bool,
     want_skill_scanner: bool,
     risk_level: str,
@@ -382,6 +386,11 @@ def _print_dry_run_plan(
         print("Hermes (--with-hermes):")
         W(root / ".hermes" / "config.yaml", "mcp_servers.rafter entry merged into existing YAML")
 
+    if want_opencode:
+        print()
+        print("OpenCode (--with-opencode):")
+        W(root / ".config" / "opencode" / "opencode.json", "mcp.rafter local/stdio entry merged into existing JSON")
+
     if want_openclaw:
         print()
         print("OpenClaw (--with-openclaw):")
@@ -629,6 +638,15 @@ _RAFTER_MCP_ENTRY = {
     "args": ["mcp", "serve"],
 }
 
+# OpenCode's schema differs: the block is `mcp` (not `mcpServers`), each local
+# server carries type: "local", and command + args are a single `command`
+# array. Verified against https://opencode.ai/docs/mcp-servers/ (sable-l8e5).
+_RAFTER_OPENCODE_MCP_ENTRY = {
+    "type": "local",
+    "command": [_RAFTER_MCP_ENTRY["command"], *_RAFTER_MCP_ENTRY["args"]],
+    "enabled": True,
+}
+
 
 def _install_claude_code_mcp(root: Path) -> bool:
     """Install MCP server config for Claude Code (<root>/.mcp.json).
@@ -1052,6 +1070,45 @@ def _install_hermes_mcp(root: Path) -> bool:
     return True
 
 
+def _install_opencode_mcp(root: Path) -> bool:
+    """Install MCP server config for OpenCode (<root>/.config/opencode/opencode.json).
+
+    OpenCode reads a global config at ~/.config/opencode/opencode.json and a
+    project-level opencode.json (project takes precedence). We register the
+    local stdio server ``rafter mcp serve`` under the ``mcp`` block. OpenCode's
+    schema differs from Cursor/Windsurf: the block is ``mcp`` (not
+    ``mcpServers``), each local server carries ``type: "local"``, and the
+    command + arguments are a single ``command`` array. A ``$schema`` pointer is
+    seeded on first write. Any existing keys / other MCP servers are preserved.
+    Verified against https://opencode.ai/docs/mcp-servers/ (sable-l8e5).
+    """
+    opencode_dir = root / ".config" / "opencode"
+    config_path = opencode_dir / "opencode.json"
+
+    opencode_dir.mkdir(parents=True, exist_ok=True)
+
+    config: dict[str, Any] = {}
+    if config_path.exists():
+        try:
+            loaded = json.loads(config_path.read_text())
+            if isinstance(loaded, dict):
+                config = loaded
+        except (json.JSONDecodeError, ValueError):
+            rprint(fmt.warning("Existing OpenCode opencode.json was unreadable, creating new one"))
+
+    if "$schema" not in config:
+        config["$schema"] = "https://opencode.ai/config.json"
+    mcp = config.get("mcp")
+    if not isinstance(mcp, dict):
+        mcp = {}
+        config["mcp"] = mcp
+    mcp["rafter"] = {**_RAFTER_OPENCODE_MCP_ENTRY}
+
+    config_path.write_text(json.dumps(config, indent=2) + "\n")
+    rprint(fmt.success(f"Installed Rafter MCP server to {config_path}"))
+    return True
+
+
 @agent_app.command()
 def init(
     risk_level: str = typer.Option("moderate", "--risk-level", help="minimal, moderate, or aggressive"),
@@ -1066,6 +1123,7 @@ def init(
     with_windsurf: bool = typer.Option(False, "--with-windsurf", help="Install Windsurf integration"),
     with_continue: bool = typer.Option(False, "--with-continue", help="Install Continue.dev integration"),
     with_hermes: bool = typer.Option(False, "--with-hermes", help="Install Hermes integration"),
+    with_opencode: bool = typer.Option(False, "--with-opencode", help="Install OpenCode integration"),
     all_integrations: bool = typer.Option(False, "--all", help="Install all detected integrations and download Betterleaks"),
     update: bool = typer.Option(False, "--update", help="Re-download betterleaks and reinstall integrations without resetting config"),
     local: bool = typer.Option(
@@ -1105,6 +1163,7 @@ def init(
     has_continue_dev = scope == "user" and (home / ".continue").exists()
     has_aider = scope == "user" and (home / ".aider.conf.yml").exists()
     has_hermes = scope == "user" and (home / ".hermes").exists()
+    has_opencode = scope == "user" and (home / ".config" / "opencode").exists()
 
     # Resolve opt-in flags. In --local scope, --all is restricted to platforms with
     # a project-local config story (claudeCode, codex, gemini, cursor).
@@ -1129,6 +1188,12 @@ def init(
     # reads ~/.hermes/config.yaml; project-local install story isn't
     # established. Excluded from --all in --local for the same reason (sable-gyw).
     want_hermes = with_hermes or (all_integrations and not local)
+    # OpenCode: MCP-based, user scope only. OpenCode reads a global config at
+    # ~/.config/opencode/opencode.json; a project-local install story via
+    # --local isn't wired here, so (like Hermes) it's excluded from --all in
+    # --local scope. It supports MCP local/stdio servers and AGENTS.md natively
+    # (https://opencode.ai/docs/mcp-servers/, sable-l8e5).
+    want_opencode = with_opencode or (all_integrations and not local)
     want_betterleaks = with_betterleaks or (all_integrations and not local)
     # skill-scanner is heavy and opt-in only — deliberately NOT folded into --all.
     want_skill_scanner = with_skill_scanner
@@ -1153,6 +1218,8 @@ def init(
         detected.append("Aider")
     if has_hermes:
         detected.append("Hermes")
+    if has_opencode:
+        detected.append("OpenCode")
 
     if detected:
         rprint(fmt.info(f"Detected environments: {', '.join(detected)}"))
@@ -1180,6 +1247,8 @@ def init(
             rprint(fmt.warning("Aider requested but not detected (~/.aider.conf.yml not found)"))
         if want_hermes and not has_hermes:
             rprint(fmt.warning("Hermes requested but not detected (~/.hermes not found)"))
+        if want_opencode and not has_opencode:
+            rprint(fmt.warning("OpenCode requested but not detected (~/.config/opencode not found)"))
 
     # --dry-run: print every file path the command would touch, then exit
     # before any filesystem write happens (rf-hrtd). Built from the same
@@ -1197,6 +1266,7 @@ def init(
             want_continue=want_continue and (has_continue_dev or local),
             want_aider=want_aider and (has_aider or local),
             want_hermes=want_hermes and has_hermes,
+            want_opencode=want_opencode and has_opencode,
             want_betterleaks=want_betterleaks,
             want_skill_scanner=want_skill_scanner,
             risk_level=risk_level,
@@ -1427,6 +1497,19 @@ def init(
         except Exception as e:
             rprint(fmt.error(f"Failed to install Hermes integration: {e}"))
 
+    # Install OpenCode integration if opted in (sable-l8e5).
+    # User scope only — OpenCode reads a global config at
+    # ~/.config/opencode/opencode.json. MCP-based: we register the local stdio
+    # server `rafter mcp serve` under the `mcp` block.
+    opencode_ok = False
+    if want_opencode and has_opencode:
+        try:
+            opencode_ok = _install_opencode_mcp(root)
+            if opencode_ok:
+                manager.set("agent.environments.opencode.enabled", True)
+        except Exception as e:
+            rprint(fmt.error(f"Failed to install OpenCode integration: {e}"))
+
     # Install global instruction files for platforms that support them
     _install_global_instructions(
         claude_code=claude_code_ok,
@@ -1442,7 +1525,7 @@ def init(
     rprint(fmt.success("Agent security initialized!"))
     rprint()
 
-    any_integration = openclaw_ok or claude_code_ok or codex_ok or gemini_ok or cursor_ok or windsurf_ok or continue_ok or aider_ok or hermes_ok
+    any_integration = openclaw_ok or claude_code_ok or codex_ok or gemini_ok or cursor_ok or windsurf_ok or continue_ok or aider_ok or hermes_ok or opencode_ok
 
     if any_integration:
         rprint("Next steps:")
@@ -1462,6 +1545,10 @@ def init(
             rprint("  - Restart Continue.dev to load MCP server")
         if aider_ok:
             rprint("  - Restart Aider to load RAFTER.md from .aider.conf.yml read:")
+        if hermes_ok:
+            rprint("  - Restart Hermes to load MCP server")
+        if opencode_ok:
+            rprint("  - Restart OpenCode to load MCP server")
     elif scope == "project":
         rprint("No integrations were installed. In --local mode, pass one or more opt-in flags:")
         rprint("  rafter agent init --local --with-claude-code")
@@ -1489,6 +1576,8 @@ def init(
             rprint("  rafter agent init --with-aider           # Aider only")
         if has_hermes:
             rprint("  rafter agent init --with-hermes          # Hermes only")
+        if has_opencode:
+            rprint("  rafter agent init --with-opencode        # OpenCode only")
     else:
         rprint("No agent environments detected. Install an agent tool and re-run with --with-<tool>.")
 
@@ -2816,6 +2905,34 @@ def _check_hermes() -> _CheckResult:
     return _CheckResult(name, True, "MCP server configured")
 
 
+def _check_opencode() -> _CheckResult:
+    """Check if OpenCode integration is healthy (sable-l8e5).
+
+    OpenCode uses ~/.config/opencode/opencode.json with an ``mcp`` block
+    (local/stdio servers carry type: "local").
+    """
+    name = "OpenCode"
+    home = Path.home()
+    opencode_dir = home / ".config" / "opencode"
+
+    if not opencode_dir.exists():
+        return _CheckResult(name, False, "Not detected — run 'rafter agent init --with-opencode' to enable", optional=True)
+
+    config_path = opencode_dir / "opencode.json"
+    if not config_path.exists():
+        return _CheckResult(name, False, f"Config not found: {config_path} — run 'rafter agent init --with-opencode'", optional=True)
+
+    try:
+        loaded = json.loads(config_path.read_text()) or {}
+    except (OSError, json.JSONDecodeError, ValueError) as e:
+        return _CheckResult(name, False, f"Cannot read config: {e}", optional=True)
+
+    servers = loaded.get("mcp") if isinstance(loaded, dict) else None
+    if not (isinstance(servers, dict) and servers.get("rafter")):
+        return _CheckResult(name, False, "Rafter MCP server not configured — run 'rafter agent init --with-opencode'", optional=True)
+    return _CheckResult(name, True, "MCP server configured")
+
+
 def _probe_claude_code() -> _CheckResult:
     """Runtime probe of the Claude Code hook integration (rf-65zg).
 
@@ -2917,6 +3034,7 @@ def verify(
         _check_continue_dev(),
         _check_aider(),
         _check_hermes(),
+        _check_opencode(),
     ]
 
     if probe:
@@ -3531,6 +3649,7 @@ def status(
         {"name": "Windsurf", "flag": "--with-windsurf", "config_dir": home / ".codeium" / "windsurf", "config_file": home / ".codeium" / "windsurf" / "mcp_config.json", "needle": "rafter"},
         {"name": "Continue.dev", "flag": "--with-continue", "config_dir": home / ".continue", "config_file": home / ".continue" / "config.json", "needle": "rafter"},
         {"name": "Hermes", "flag": "--with-hermes", "config_dir": home / ".hermes", "config_file": home / ".hermes" / "config.yaml", "needle": "rafter"},
+        {"name": "OpenCode", "flag": "--with-opencode", "config_dir": home / ".config" / "opencode", "config_file": home / ".config" / "opencode" / "opencode.json", "needle": "rafter"},
     ]
 
     for agent in mcp_agents:
@@ -3627,6 +3746,7 @@ def _detect_agent_platforms() -> list[str]:
         ("continue", home / ".continue"),
         ("aider", home / ".aider.conf.yml"),
         ("hermes", home / ".hermes"),
+        ("opencode", home / ".config" / "opencode"),
     ]
     return [name for name, path in candidates if path.exists()]
 

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/agent_components.py

@@ -124,6 +124,15 @@ def _filter_hooks(arr: list[Any] | None, predicate: Callable[[Any], bool]) -> li
 
 RAFTER_MCP_ENTRY: dict[str, Any] = {"command": "rafter", "args": ["mcp", "serve"]}
 
+# OpenCode's schema differs: the block is `mcp` (not `mcpServers`), each local
+# server carries type: "local", and command + args are a single `command`
+# array. Verified against https://opencode.ai/docs/mcp-servers/ (sable-l8e5).
+RAFTER_OPENCODE_MCP_ENTRY: dict[str, Any] = {
+    "type": "local",
+    "command": [RAFTER_MCP_ENTRY["command"], *RAFTER_MCP_ENTRY["args"]],
+    "enabled": True,
+}
+
 
 # ── Skill template lookup ─────────────────────────────────────────────
 
@@ -186,7 +195,9 @@ def _claude_code_hooks() -> ComponentSpec:
             {"matcher": "Bash", "hooks": [pre]},
             {"matcher": "Write|Edit", "hooks": [pre]},
         ])
-        hooks["PostToolUse"].append({"matcher": ".*", "hooks": [post]})
+        # Narrow to tools that produce scannable output (shell output + file
+        # writes); avoids firing posttool on every Read/MCP call (latency).
+        hooks["PostToolUse"].append({"matcher": "Bash|Write|Edit|MultiEdit", "hooks": [post]})
         _write_json(settings_path, s)
 
     def uninstall() -> None:
@@ -895,6 +906,61 @@ def _hermes_mcp() -> ComponentSpec:
     )
 
 
+def _opencode_mcp() -> ComponentSpec:
+    """OpenCode MCP server entry (~/.config/opencode/opencode.json).
+
+    OpenCode's schema differs from Cursor/Windsurf: the block is ``mcp`` (not
+    ``mcpServers``), each local server carries ``type: "local"``, and command +
+    args are a single ``command`` array. A ``$schema`` pointer is seeded on
+    first write. Verified against https://opencode.ai/docs/mcp-servers/
+    (sable-l8e5).
+    """
+    home = Path.home()
+    detect_dir = home / ".config" / "opencode"
+    config_path = detect_dir / "opencode.json"
+
+    def is_installed() -> bool:
+        cfg = _read_json(config_path)
+        mcp = cfg.get("mcp") if isinstance(cfg, dict) else None
+        return isinstance(mcp, dict) and bool(mcp.get("rafter"))
+
+    def install() -> None:
+        detect_dir.mkdir(parents=True, exist_ok=True)
+        cfg = _read_json(config_path)
+        # Guard against valid-but-non-object top-level JSON (list/str/number).
+        if not isinstance(cfg, dict):
+            cfg = {}
+        if "$schema" not in cfg:
+            cfg["$schema"] = "https://opencode.ai/config.json"
+        mcp = cfg.get("mcp")
+        if not isinstance(mcp, dict):
+            mcp = {}
+            cfg["mcp"] = mcp
+        mcp["rafter"] = dict(RAFTER_OPENCODE_MCP_ENTRY)
+        _write_json(config_path, cfg)
+
+    def uninstall() -> None:
+        if not config_path.exists():
+            return
+        cfg = _read_json(config_path)
+        mcp = cfg.get("mcp") if isinstance(cfg, dict) else None
+        if isinstance(mcp, dict) and "rafter" in mcp:
+            del mcp["rafter"]
+            _write_json(config_path, cfg)
+
+    return ComponentSpec(
+        id="opencode.mcp",
+        platform="opencode",
+        kind="mcp",
+        description="OpenCode MCP server entry (~/.config/opencode/opencode.json)",
+        detect_dir=detect_dir,
+        path=config_path,
+        is_installed=is_installed,
+        install=install,
+        uninstall=uninstall,
+    )
+
+
 _AIDER_LEGACY_MCP_BLOCK_RE = re.compile(
     r"\n?#\s*Rafter security MCP server\s*\nmcp-server-command:\s*rafter\s+mcp\s+serve\s*\n?",
 )
@@ -1054,6 +1120,7 @@ def get_registry() -> list[ComponentSpec]:
             _continue_mcp(),
             _aider_read(),
             _hermes_mcp(),
+            _opencode_mcp(),
             _openclaw_skill(),
         ]
     return _REGISTRY

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/backend.py

@@ -91,6 +91,8 @@ def _do_remote_scan(
     quiet: bool,
     mode: str = "fast",
     github_token: "str | None" = None,
+    provider: "str | None" = None,
+    repo_url: "str | None" = None,
 ) -> None:
     """Shared implementation for remote backend scan — used by both `rafter run` and `rafter scan`."""
     import os as _os
@@ -98,7 +100,7 @@ def _do_remote_scan(
     key = resolve_key(api_key)
     gh_token = github_token or _os.environ.get("RAFTER_GITHUB_TOKEN")
     try:
-        repo_slug, branch_name = detect_repo(repo, branch)
+        repo_slug, branch_name, detected_provider, detected_repo_url = detect_repo(repo, branch)
     except RuntimeError as e:
         print(str(e), file=sys.stderr)
         raise typer.Exit(code=EXIT_GENERAL_ERROR)
@@ -106,12 +108,23 @@ def _do_remote_scan(
     if not (repo and branch) and not quiet:
         print(f"Repo auto-detected: {repo_slug} @ {branch_name} (note: scanning remote)", file=sys.stderr)
 
+    # Explicit flags override inferred values.
+    resolved_provider = provider or detected_provider
+    resolved_repo_url = repo_url or detected_repo_url
+
     headers = {"x-api-key": key, "Content-Type": "application/json"}
 
     body: dict = {"repository_name": repo_slug, "branch_name": branch_name, "scan_mode": mode}
     if gh_token:
         body["github_token"] = gh_token
 
+    # Additive, backward-compatible: only send provider + repo_url for non-github
+    # remotes. For github (or an unknown host that defaulted to github), omit both
+    # so the request body is byte-identical to the legacy github-only behavior.
+    if resolved_provider and resolved_provider != "github" and resolved_repo_url:
+        body["provider"] = resolved_provider
+        body["repo_url"] = resolved_repo_url
+
     resp = requests.post(
         f"{API_BASE}/static/scan",
         headers=headers,
@@ -150,11 +163,13 @@ def register_backend_commands(app: typer.Typer) -> None:
         fmt: str = typer.Option("md", "--format", "-f", help="json | md"),
         mode: str = typer.Option("fast", "--mode", "-m", help="scan mode: fast | plus"),
         github_token: str = typer.Option(None, "--github-token", envvar="RAFTER_GITHUB_TOKEN", help="GitHub PAT for private repos"),
+        provider: str = typer.Option(None, "--provider", help="git provider: gitlab | gitea | bitbucket (default: auto-detected; github requires nothing)"),
+        repo_url: str = typer.Option(None, "--repo-url", help="full https clone URL for non-github remotes (default: auto-detected)"),
         skip_interactive: bool = typer.Option(False, "--skip-interactive", help="do not wait for scan to complete"),
         quiet: bool = typer.Option(False, "--quiet", help="suppress status messages"),
     ):
         """Trigger a security scan."""
-        _do_remote_scan(repo, branch, api_key, fmt, skip_interactive, quiet, mode, github_token=github_token)
+        _do_remote_scan(repo, branch, api_key, fmt, skip_interactive, quiet, mode, github_token=github_token, provider=provider, repo_url=repo_url)
 
     @app.command()
     def get(

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/hook.py

@@ -13,7 +13,15 @@ from ..core.audit_logger import AuditLogger
 from ..core.command_interceptor import CommandInterceptor
 from ..scanners.regex_scanner import RegexScanner
 
-hook_app = typer.Typer(name="hook", help="Hook handlers for agent platform integration", no_args_is_help=True)
+# allow_extra_args / ignore_unknown_options: tolerate extra flags/args the host
+# harness appends to the hook command (e.g. Claude Code adds `--hook-json <data>`).
+# Hook input comes from stdin, so anything else is unused — discard, don't error.
+hook_app = typer.Typer(
+    name="hook",
+    help="Hook handlers for agent platform integration",
+    no_args_is_help=True,
+    context_settings={"allow_extra_args": True, "ignore_unknown_options": True},
+)
 
 _RISK_LABELS = {
     "critical": "CRITICAL", "high": "HIGH", "medium": "MEDIUM", "low": "LOW",
@@ -401,7 +409,10 @@ def _evaluate_write(tool_input: dict) -> dict:
     return {"decision": "deny", "reason": f"Secret detected in {file_path}: {', '.join(names)}"}
 
 
-@hook_app.command("pretool")
+@hook_app.command(
+    "pretool",
+    context_settings={"allow_extra_args": True, "ignore_unknown_options": True},
+)
 def pretool(
     format: str = typer.Option("claude", "--format", help="Output format: claude (default, also Codex/Continue), cursor, gemini, windsurf"),
 ):
@@ -449,7 +460,10 @@ def pretool(
         _write_pretool_decision({"decision": "allow"}, format)
 
 
-@hook_app.command("posttool")
+@hook_app.command(
+    "posttool",
+    context_settings={"allow_extra_args": True, "ignore_unknown_options": True},
+)
 def posttool(
     format: str = typer.Option("claude", "--format", help="Output format: claude (default, also Codex/Continue), cursor, gemini, windsurf"),
 ):

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/issues/issues_app.py

@@ -64,7 +64,7 @@ def from_scan(
     target_repo = repo
     if not target_repo:
         try:
-            target_repo, _ = detect_repo(repo)
+            target_repo, _, _, _ = detect_repo(repo)
         except RuntimeError as e:
             print_stderr(fmt.error(str(e)))
             raise typer.Exit(code=EXIT_GENERAL_ERROR)
@@ -165,7 +165,7 @@ def from_text(
     target_repo = repo
     if not target_repo:
         try:
-            target_repo, _ = detect_repo(repo)
+            target_repo, _, _, _ = detect_repo(repo)
         except RuntimeError as e:
             print_stderr(fmt.error(str(e)))
             raise typer.Exit(code=EXIT_GENERAL_ERROR)

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/scan.py

@@ -50,13 +50,15 @@ def scan_default(
     fmt_: str = typer.Option("md", "--format", "-f", help="json | md"),
     mode: str = typer.Option("fast", "--mode", "-m", help="scan mode: fast | plus"),
     github_token: Optional[str] = typer.Option(None, "--github-token", envvar="RAFTER_GITHUB_TOKEN", help="GitHub PAT for private repos"),
+    provider: Optional[str] = typer.Option(None, "--provider", help="git provider: gitlab | gitea | bitbucket (default: auto-detected; github requires nothing)"),
+    repo_url: Optional[str] = typer.Option(None, "--repo-url", help="full https clone URL for non-github remotes (default: auto-detected)"),
     skip_interactive: bool = typer.Option(False, "--skip-interactive", help="do not wait for scan to complete"),
     quiet: bool = typer.Option(False, "--quiet", help="suppress status messages"),
 ):
     """Scan for security issues. Defaults to remote scan."""
     if ctx.invoked_subcommand is None:
         # No subcommand — run remote scan
-        _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token)
+        _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token, provider, repo_url)
 
 
 # ── rafter scan remote ────────────────────────────────────────────────
@@ -69,17 +71,19 @@ def scan_remote(
     fmt_: str = typer.Option("md", "--format", "-f", help="json | md"),
     mode: str = typer.Option("fast", "--mode", "-m", help="scan mode: fast | plus"),
     github_token: Optional[str] = typer.Option(None, "--github-token", envvar="RAFTER_GITHUB_TOKEN", help="GitHub PAT for private repos"),
+    provider: Optional[str] = typer.Option(None, "--provider", help="git provider: gitlab | gitea | bitbucket (default: auto-detected; github requires nothing)"),
+    repo_url: Optional[str] = typer.Option(None, "--repo-url", help="full https clone URL for non-github remotes (default: auto-detected)"),
     skip_interactive: bool = typer.Option(False, "--skip-interactive", help="do not wait for scan to complete"),
     quiet: bool = typer.Option(False, "--quiet", help="suppress status messages"),
 ):
     """Trigger a remote backend security scan (explicit alias for 'rafter run')."""
-    _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token)
+    _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token, provider, repo_url)
 
 
-def _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode="fast", github_token=None):
+def _run_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode="fast", github_token=None, provider=None, repo_url=None):
     """Shared handler: invoke remote scan (same logic as `rafter run`)."""
     from ..commands.backend import _do_remote_scan
-    _do_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token=github_token)
+    _do_remote_scan(repo, branch, api_key, fmt_, skip_interactive, quiet, mode, github_token=github_token, provider=provider, repo_url=repo_url)
 
 
 # ── rafter scan local ─────────────────────────────────────────────────

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/commands/skill_remote.py

@@ -346,6 +346,11 @@ def extract_npm_tarball(tgz_file: Path, dest_dir: Path) -> None:
             # Reject path traversal.
             if member.name.startswith("/") or ".." in member.name.split("/"):
                 continue
+            # Defense-in-depth: only extract regular files and directories.
+            # Skip symlinks/hardlinks/devices, which a malicious archive could
+            # use to redirect a later member's write outside dest_dir.
+            if not (member.isfile() or member.isdir()):
+                continue
             members.append(member)
         tf.extractall(dest_dir, members=members)  # noqa: S202
 

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/core/command_interceptor.py

@@ -6,7 +6,7 @@ from dataclasses import dataclass
 
 from .audit_logger import AuditLogger
 from .config_manager import ConfigManager
-from .risk_rules import assess_command_risk
+from .risk_rules import assess_command_risk, match_critical_pattern
 
 
 @dataclass
@@ -25,6 +25,21 @@ class CommandInterceptor:
         self._audit = AuditLogger()
 
     def evaluate(self, command: str) -> CommandEvaluation:
+        # Unconditional hard-block: catastrophic destructive commands (rm -rf /,
+        # fork bombs, disk wipes, mkfs, …) are NEVER allowed, regardless of the
+        # configured policy — or its absence. Security must not depend on a
+        # policy being present or on the chosen mode (even allow-all / a custom
+        # deny-list cannot opt out of these).
+        if assess_command_risk(command) == "critical":
+            return CommandEvaluation(
+                command=command,
+                risk_level="critical",
+                allowed=False,
+                requires_approval=False,
+                reason="Matches built-in blocked pattern (critical destructive command)",
+                matched_pattern=match_critical_pattern(command) or "builtin:critical-destructive",
+            )
+
         cfg = self._config.load_with_policy()
         policy = cfg.agent.command_policy
 

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/core/risk_rules.py

@@ -85,3 +85,16 @@ def assess_command_risk(command: str) -> str:
         if re.search(p, command, re.IGNORECASE):
             return "medium"
     return "low"
+
+
+def match_critical_pattern(command: str) -> str | None:
+    """Return the first CRITICAL pattern matching the command, or None.
+
+    Mirrors assess_command_risk's matching. Intended to be called only once a
+    command is already classified "critical" (safe-prefix exclusion is handled
+    by assess_command_risk), to surface *which* built-in rule matched.
+    """
+    for p in CRITICAL_PATTERNS:
+        if re.search(p, command, re.IGNORECASE):
+            return p
+    return None

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.8.9
+version: 0.9.0
 homepage: https://rafter.so
 metadata:
   openclaw:

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/scanners/secret_patterns.py

@@ -148,6 +148,13 @@ DEFAULT_SECRET_PATTERNS: list[Pattern] = [
         severity="critical",
         description="PyPI API token detected",
     ),
+    # DigitalOcean
+    Pattern(
+        name="DigitalOcean Personal Access Token",
+        regex=r"dop_v1_[a-f0-9]{64}",
+        severity="critical",
+        description="DigitalOcean Personal Access Token detected",
+    ),
 ]
 
 

{rafter_cli-0.8.9 → rafter_cli-0.9.0}/rafter_cli/utils/git.py

@@ -47,13 +47,65 @@ def parse_remote(url: str) -> str:
     return "/".join(parts[-2:])
 
 
+def provider_for_host(host: str) -> str:
+    """Map a git remote host to a provider.
+
+    'github' is the backward-compatible default for any host we don't
+    recognize — a GitHub user's request is unaffected, and unknown
+    self-hosted hosts fall back to the legacy behavior.
+    """
+    host = host.lower()
+    if host == "github.com":
+        return "github"
+    if host == "gitlab.com" or host.endswith(".gitlab.com"):
+        return "gitlab"
+    if host == "bitbucket.org":
+        return "bitbucket"
+    if host == "codeberg.org" or host.endswith(".gitea.io"):
+        return "gitea"
+    return "github"  # backward-compatible default
+
+
+def _split_remote(url: str) -> tuple[str, str] | None:
+    """Split a git remote URL into (host, 'owner/repo').
+
+    Handles both 'git@host:owner/repo(.git)' (scp-like) and
+    'https://host/owner/repo(.git)'. Returns None when it can't be parsed
+    into host + slug.
+    """
+    rest = re.sub(r"^(https?://|git@)", "", url)
+    rest = rest.replace(":", "/")
+    if rest.endswith(".git"):
+        rest = rest[:-4]
+    parts = [p for p in rest.split("/") if p]
+    if len(parts) < 3:  # need host + owner + repo
+        return None
+    host = parts[0]
+    slug = "/".join(parts[-2:])
+    return host, slug
+
+
+def infer_remote(url: str) -> tuple[str, str | None]:
+    """Infer (provider, repo_url) from a git remote URL.
+
+    repo_url is a canonical 'https://<host>/<owner>/<repo>' clone URL.
+    Falls back to ('github', None) when the URL can't be parsed.
+    """
+    parts = _split_remote(url)
+    if parts is None:
+        return "github", None
+    host, slug = parts
+    return provider_for_host(host), f"https://{host}/{slug}"
+
+
 def detect_repo(
     repo: str | None = None,
     branch: str | None = None,
-) -> tuple[str, str]:
+) -> tuple[str, str, str | None, str | None]:
     """Auto-detect repo slug and branch from git or CI env vars.
 
-    Returns (repo_slug, branch).
+    Returns (repo_slug, branch, provider, repo_url). provider/repo_url are
+    inferred from the git remote when the slug is auto-detected, else None.
     Raises RuntimeError if detection fails.
     """
     import os
@@ -66,9 +118,11 @@ def detect_repo(
     )
     repo_slug = repo or repo_env
     branch_name = branch or branch_env
+    provider: str | None = None
+    repo_url: str | None = None
 
     if repo_slug and branch_name:
-        return repo_slug, branch_name
+        return repo_slug, branch_name, provider, repo_url
 
     if not is_inside_repo():
         raise RuntimeError(
@@ -79,14 +133,15 @@ def detect_repo(
     if not repo_slug:
         try:
             remote_url = _run(["git", "remote", "get-url", "origin"])
-            repo_slug = parse_remote(remote_url)
         except subprocess.CalledProcessError:
             raise RuntimeError(
                 "Could not auto-detect Git repository. "
                 "Please pass --repo and --branch explicitly."
             )
+        repo_slug = parse_remote(remote_url)
+        provider, repo_url = infer_remote(remote_url)
 
     if not branch_name:
         branch_name = safe_branch()
 
-    return repo_slug, branch_name
+    return repo_slug, branch_name, provider, repo_url