| """``hermes security`` subcommand parser.""" | |
| from __future__ import annotations | |
| from typing import Callable | |
| from hermes_cli.subcommands._shared import add_json_flag | |
| def build_security_parser(subparsers, *, cmd_security: Callable) -> None: | |
| """Attach the ``security`` subcommand to ``subparsers``.""" | |
| security_parser = subparsers.add_parser( | |
| "security", help="Supply-chain audit (OSV.dev) for venv, plugins, and MCP servers", | |
| description="On-demand vulnerability scan against OSV.dev. Covers the Hermes " | |
| "venv (installed PyPI dists), Python deps declared by plugins under " | |
| "~/.hermes/plugins/, and pinned npx/uvx MCP servers in config.yaml. " | |
| "Does NOT scan globally-installed packages or editor/browser extensions.") | |
| security_subparsers = security_parser.add_subparsers( | |
| dest="security_command", metavar="<subcommand>") | |
| audit_parser = security_subparsers.add_parser( | |
| "audit", help="Run a one-shot supply-chain audit", | |
| description="Query OSV.dev for known vulnerabilities in installed components.") | |
| add_json_flag(audit_parser, "Emit machine-readable JSON instead of human-readable text") | |
| audit_parser.add_argument( | |
| "--fail-on", default="critical", choices=["low", "moderate", "high", "critical"], | |
| help="Exit non-zero when any finding meets this severity (default: critical)") | |
| audit_parser.add_argument( | |
| "--skip-venv", action="store_true", help="Skip scanning the Hermes Python venv") | |
| audit_parser.add_argument( | |
| "--skip-plugins", action="store_true", help="Skip scanning plugin requirements files") | |
| audit_parser.add_argument( | |
| "--skip-mcp", action="store_true", help="Skip scanning pinned MCP servers in config.yaml") | |
| audit_parser.set_defaults(func=cmd_security) | |
| security_parser.set_defaults(func=cmd_security) | |