@nodatachat/guard 2.4.0 → 2.5.1

package/dist/cli.js

@@ -26,7 +26,7 @@ const reporter_1 = require("./reporter");
 const scheduler_1 = require("./fixers/scheduler");
 const vault_crypto_1 = require("./vault-crypto");
 const capsule_dir_1 = require("./capsule-dir");
-const VERSION = "2.4.0";
+const VERSION = "2.5.1";
 async function main() {
     const args = process.argv.slice(2);
     // ── Subcommand routing ──
@@ -114,6 +114,77 @@ async function main() {
         licenseKey = process.env.NDC_LICENSE || process.env.NODATA_LICENSE_KEY || process.env.NODATA_API_KEY || process.env.NDC_API_KEY;
     if (!dbUrl)
         dbUrl = process.env.DATABASE_URL;
+    // ── Auto-detect from .env files ──
+    // Guard reads .env files to find DATABASE_URL and license keys.
+    // ALL values stay local — never sent anywhere.
+    // If DB URL is found, Guard asks for explicit consent before connecting.
+    if (!dbUrl || !licenseKey) {
+        const envResult = readEnvFiles(projectDir);
+        if (!licenseKey && envResult.licenseKey) {
+            licenseKey = envResult.licenseKey;
+            if (!ciMode)
+                console.log(`\n  \x1b[32m✓\x1b[0m Found license key in ${envResult.licenseSource}`);
+        }
+        // Try direct DB URL first
+        let detectedDbUrl = envResult.dbUrl;
+        let detectedDbSource = envResult.dbSource;
+        // If no direct DB URL found, try to construct from Supabase URL
+        // Supabase projects have a predictable connection string format
+        if (!detectedDbUrl && envResult.supabaseUrl && !ciMode) {
+            const match = envResult.supabaseUrl.match(/https:\/\/([a-z0-9]+)\.supabase\.co/);
+            if (match) {
+                const projectRef = match[1];
+                console.log("");
+                console.log("  ╔══════════════════════════════════════════╗");
+                console.log("  ║  \x1b[33mSupabase project detected\x1b[0m                 ║");
+                console.log("  ╚══════════════════════════════════════════╝");
+                console.log(`  Project:  ${projectRef}.supabase.co`);
+                console.log("");
+                console.log("  \x1b[2mTo verify DB encryption, Guard needs a direct connection.\x1b[0m");
+                console.log("  \x1b[2mFind it in: Supabase Dashboard → Settings → Database → URI\x1b[0m");
+                console.log("");
+                const password = await askConsent("  Paste your database password (or press Enter to skip): ", true);
+                if (password && typeof password === "string" && password.trim()) {
+                    detectedDbUrl = `postgresql://postgres.${projectRef}:${password.trim()}@aws-0-eu-central-1.pooler.supabase.com:6543/postgres`;
+                    detectedDbSource = "Supabase (auto-constructed)";
+                }
+                else {
+                    console.log("  \x1b[33m→\x1b[0m No password — skipping database scan\n");
+                }
+            }
+        }
+        if (!dbUrl && detectedDbUrl) {
+            // Mask the connection string for display (show host only)
+            const masked = maskDbUrl(detectedDbUrl);
+            if (ciMode) {
+                // CI mode: auto-consent (operator set up the env)
+                dbUrl = detectedDbUrl;
+                console.log(`[nodata-guard] Using database from ${detectedDbSource}`);
+            }
+            else {
+                // Interactive: ask for consent
+                console.log("");
+                console.log("  ╔══════════════════════════════════════════╗");
+                console.log("  ║  \x1b[33mDatabase connection found\x1b[0m                ║");
+                console.log("  ╚══════════════════════════════════════════╝");
+                console.log(`  Source:  ${detectedDbSource}`);
+                console.log(`  URL:     ${masked}`);
+                console.log("");
+                console.log("  \x1b[2mGuard will connect to your database to verify encryption.\x1b[0m");
+                console.log("  \x1b[2mOnly checks if values START WITH encryption prefixes.\x1b[0m");
+                console.log("  \x1b[2mNo data values are read, copied, or sent anywhere.\x1b[0m");
+                console.log("");
+                const consent = await askConsent("  Connect to database? (y/n): ");
+                if (consent) {
+                    dbUrl = detectedDbUrl;
+                    console.log(`  \x1b[32m✓\x1b[0m Database scan enabled\n`);
+                }
+                else {
+                    console.log("  \x1b[33m→\x1b[0m Skipping database scan — code-only mode\n");
+                }
+            }
+        }
+    }
     // Shared Protect config fallback (~/.nodata/config.json)
     if (!licenseKey) {
         try {
@@ -583,6 +654,135 @@ function loadOrCreateConfig(projectDir, overrides) {
         },
     });
 }
+// ═══════════════════════════════════════════════════════════
+// Consent & display helpers
+// ═══════════════════════════════════════════════════════════
+function maskDbUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const host = parsed.hostname;
+        const port = parsed.port || (url.includes("6543") ? "6543" : "5432");
+        const db = parsed.pathname.replace("/", "") || "postgres";
+        const user = parsed.username ? parsed.username.slice(0, 8) + "..." : "***";
+        return `${user}@${host}:${port}/${db}`;
+    }
+    catch {
+        // Fallback: show first 20 chars + mask
+        return url.slice(0, 20) + "...****";
+    }
+}
+function askConsent(prompt, returnRaw) {
+    return new Promise((resolve) => {
+        const readline = require("readline");
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(prompt, (answer) => {
+            rl.close();
+            if (returnRaw) {
+                resolve(answer);
+            }
+            else {
+                const a = answer.trim().toLowerCase();
+                resolve(a === "y" || a === "yes" || a === "כ" || a === "כן");
+            }
+        });
+    });
+}
+function readEnvFiles(projectDir) {
+    const result = {
+        dbUrl: null, dbSource: "",
+        licenseKey: null, licenseSource: "",
+        supabaseUrl: null, supabaseKey: null,
+    };
+    // Priority order — more specific files override general ones
+    const envFiles = [
+        ".env",
+        ".env.local",
+        ".env.development",
+        ".env.development.local",
+        ".env.production",
+        ".env.production.local",
+    ];
+    // Keys that contain database connection strings
+    const DB_KEYS = [
+        "DATABASE_URL",
+        "DIRECT_URL",
+        "POSTGRES_URL",
+        "POSTGRES_PRISMA_URL",
+        "POSTGRES_URL_NON_POOLING",
+        "PG_CONNECTION_STRING",
+        "DB_URL",
+        "SUPABASE_DB_URL",
+        "DATABASE_CONNECTION_STRING",
+    ];
+    // Keys that contain license/API keys
+    const LICENSE_KEYS = [
+        "NDC_LICENSE",
+        "NODATA_LICENSE_KEY",
+        "NODATA_API_KEY",
+        "NDC_API_KEY",
+        "NDC_PROTECT_KEY",
+        "CAPSULE_LICENSE_KEY",
+        "CAPSULE_API_KEY",
+    ];
+    const SUPABASE_URL_KEYS = [
+        "NEXT_PUBLIC_SUPABASE_URL",
+        "SUPABASE_URL",
+        "VITE_SUPABASE_URL",
+        "REACT_APP_SUPABASE_URL",
+        "NUXT_PUBLIC_SUPABASE_URL",
+    ];
+    const SUPABASE_KEY_KEYS = [
+        "SUPABASE_SERVICE_ROLE_KEY",
+        "SUPABASE_SERVICE_KEY",
+    ];
+    for (const envFile of envFiles) {
+        const filePath = (0, path_1.resolve)(projectDir, envFile);
+        if (!(0, fs_1.existsSync)(filePath))
+            continue;
+        try {
+            const content = (0, fs_1.readFileSync)(filePath, "utf-8");
+            const lines = content.split("\n");
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed || trimmed.startsWith("#"))
+                    continue;
+                const eqIdx = trimmed.indexOf("=");
+                if (eqIdx < 1)
+                    continue;
+                const key = trimmed.slice(0, eqIdx).trim();
+                let val = trimmed.slice(eqIdx + 1).trim();
+                // Strip quotes
+                if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+                    val = val.slice(1, -1);
+                }
+                if (!val)
+                    continue;
+                // Check DB keys
+                if (!result.dbUrl && DB_KEYS.includes(key)) {
+                    if (val.startsWith("postgres") || val.startsWith("pg://") || val.includes("5432") || val.includes("6543")) {
+                        result.dbUrl = val;
+                        result.dbSource = envFile;
+                    }
+                }
+                // Check license keys
+                if (!result.licenseKey && LICENSE_KEYS.includes(key)) {
+                    result.licenseKey = val;
+                    result.licenseSource = envFile;
+                }
+                // Check Supabase URL (for fallback DB construction)
+                if (!result.supabaseUrl && SUPABASE_URL_KEYS.includes(key)) {
+                    result.supabaseUrl = val;
+                }
+                // Check Supabase service role key
+                if (!result.supabaseKey && SUPABASE_KEY_KEYS.includes(key)) {
+                    result.supabaseKey = val;
+                }
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    return result;
+}
 function handleAttest(args) {
     let licenseKey;
     let projectDir = process.cwd();
@@ -715,9 +915,17 @@ function printHelp() {
     ✓ Prove — cryptographic proof chain of scan results
     ✓ Monitor — track score over time via dashboard
 
+  Auto-detection:
+    Guard automatically reads .env files to find DATABASE_URL
+    and license keys. If a database is found, Guard asks for
+    your explicit consent before connecting. All values stay
+    local — never sent anywhere. In CI mode (--ci), consent
+    is automatic (operator configured the environment).
+
   What we NEVER do:
     ✗ Modify your code, database, or configuration
     ✗ Receive data values, source code, or credentials
+    ✗ Read actual data from your database (only checks prefixes)
 
   Important:
     Recommendations require understanding of YOUR system —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",