feat: SDElements integration — projects, tasks, threats, users

[kolatts]

Summary

• Adds pncli sde command group with 8 read-only subcommands against the SDElements REST API v2
• Supports both cloud (*.sdelements.com) and on-premise deployments via configurable baseUrl
• Follows the same integration pattern as Jira, SonarQube, Confluence, and Bitbucket

Commands

Command	Description
sde server-info	Server version/release info (super-user only)
sde whoami	Current authenticated user
sde users	List users with filtering
sde projects	List projects with filtering and pagination
sde project	Get single project by ID
sde tasks	List countermeasures for a project
sde task	Get single countermeasure
sde threats	List threats for a project

All list commands support --all for full pagination, or --page/--page-size for manual control.

Configuration

{
  "sde": {
    "baseUrl": "https://your-org.sdelements.com",
    "token": "<api-token>"
  },
  "defaults": {
    "sde": { "project": "42" }
  }
}

Env vars: PNCLI_SDE_BASE_URL, PNCLI_SDE_TOKEN. Default project also settable per-repo via .pncli.json.

Notes

• Auth uses Authorization: Token <token> (SDElements format) rather than Bearer
• Connectivity test in pncli config test uses GET /api/v2/users/me/ (avoids super-user requirement of /server-info/)
• SDElements project IDs are numeric; resolveProject() parses and validates them

Test plan

• npm run build — clean TypeScript compilation
• pncli sde --help — all 8 subcommands listed
• pncli config init — SDElements prompts appear
• pncli sde whoami --dry-run — request uses Token auth header, correct URL
• pncli config test — SDE connectivity result appears
• Against a live SDElements instance: pncli sde whoami, pncli sde projects --all, pncli sde tasks --project <id>

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new SDElements service integration to pncli, following the existing “service client + commands + config” pattern used for Jira/Sonar/etc., enabling read-only querying of SDElements API v2 resources from the CLI.

Changes:

• Introduces pncli sde command group with subcommands for server info, current user, users, projects, tasks (countermeasures), and threats.
• Adds SDElements configuration support (config init/test, env vars, resolved config + masking) and HTTP client support with Authorization: Token ….
• Defines TypeScript response types for SDElements API v2.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/types/sde.ts	Adds SDElements API v2 response type definitions (server info, users, projects, tasks, threats, pagination).
src/types/config.ts	Extends config schema with sde config + defaults.sde.
src/services/sde/commands.ts	Registers pncli sde subcommands and wires them to the SDE client, including default project resolution.
src/services/sde/client.ts	Implements SDElements REST API v2 client methods and pagination helpers.
src/services/config/commands.ts	Extends config init prompts and config test connectivity checks for SDElements.
src/lib/http.ts	Adds http.sde() and http.sdePaginate() plus Token auth header support.
src/lib/config.ts	Adds env var support and resolved config masking for SDElements.
src/cli.ts	Registers the new SDE command group in the CLI.
copilot-instructions.md	Documents the new pncli sde commands and flags.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

resolveProject() uses parseInt(project, 10), which will accept partially-numeric strings like "42abc" (parses to 42). Since the CLI help/error says project IDs are numeric, this should be a stricter validation (e.g., /^\d+$/ check before parsing, and optionally enforce id > 0).

Suggested change

	const id = parseInt(project, 10);
	if (isNaN(id)) throw new PncliError(`Invalid project ID: ${project}. SDElements project IDs are numeric.`);
	if (!/^\d+$/.test(project)) throw new PncliError(`Invalid project ID: ${project}. SDElements project IDs are numeric.`);
	const id = parseInt(project, 10);
	if (id <= 0) throw new PncliError(`Invalid project ID: ${project}. SDElements project IDs are numeric.`);