@pretense/cli 0.6.11 → 0.6.12

package/dist/{chunk-5GO2CY5W.js → chunk-K3L4E6HN.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.11" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.12" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-5GO2CY5W.js";
+} from "./chunk-K3L4E6HN.js";
 import {
   __commonJS,
   __toESM,
@@ -7565,8 +7565,8 @@ var DETECTOR_FRAMEWORKS = {
   "swift-bic": ["FADP", "GDPR", "UK_GDPR"],
   "twilio-account-sid": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
   "twilio-auth-token": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
-  "uk-nhs-number-labeled": ["GDPR", "UK_GDPR"],
-  "uk-nino-labeled": ["APPI", "AU_PRIVACY", "CCPA_CPRA", "CJIS", "DPDP", "FADP", "FISMA", "GDPR", "IRS_1075", "ISO_27001", "ISO_27701", "LGPD", "PDPA_SG", "PDPA_TH", "PIPA_KR", "PIPEDA", "PIPL", "POPIA", "UK_GDPR"],
+  "uk-nhs-number-labeled": ["UK_GDPR"],
+  "uk-nino-labeled": ["UK_GDPR"],
   "us-ein": ["APRA_CPS234", "DORA", "GLBA", "IRS_1075", "NYDFS_500", "SOX"],
   "vat-number": ["FADP", "GDPR", "UK_GDPR"],
   "vault-token": ["APRA_CPS234", "DORA", "FISMA", "FedRAMP", "HITRUST", "ISO_27001", "ISO_27701", "NIS2", "NIST_800_171", "NIST_800_53", "NYDFS_500", "SOC2", "SOX"],
@@ -16425,11 +16425,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.11" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.12" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "b21055a9648ee90cddf55cbe5f9ad921f2363665".length > 0 ? "b21055a9648ee90cddf55cbe5f9ad921f2363665" : UNKNOWN_COMMIT;
+  return "cd2bfc0670d3c8aadaa5a163493ba152391489a1".length > 0 ? "cd2bfc0670d3c8aadaa5a163493ba152391489a1" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -16517,10 +16517,15 @@ var PlanEnforcer = class {
     }
     const QUOTA_PERIOD_DAYS3 = 7;
     const resetDate = new Date(Date.now() + QUOTA_PERIOD_DAYS3 * 864e5).toISOString().split("T")[0];
-    if (worstBlocked || overallPercent >= 100) {
+    const atOrOverLimit = (key) => {
+      const check = limits[key];
+      return check.limit !== void 0 && check.limit !== null && (check.current ?? 0) >= check.limit;
+    };
+    const anyAtOrOverLimit = metricKeys.some(atOrOverLimit);
+    if (worstBlocked || anyAtOrOverLimit) {
       for (const key of metricKeys) {
         const check = limits[key];
-        if ((check.usagePercent ?? 0) >= 100 && check.limit !== void 0 && check.limit !== null) {
+        if (atOrOverLimit(key)) {
           worstMetric = key;
           worstCurrent = check.current ?? 0;
           worstLimit = check.limit;
@@ -16839,7 +16844,10 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
   (async () => {
     const reader = upstreamResp.body?.getReader();
     if (!reader) {
-      await writer.close();
+      try {
+        await writer.close();
+      } catch {
+      }
       return;
     }
     let lineBuffer = "";
@@ -16897,9 +16905,17 @@ async function streamWithRollingBuffer(upstreamResp, map, provider, requestId) {
         if (tail) await writer.write(encoder.encode(tail));
       }
     } finally {
-      await writer.close();
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      try {
+        await writer.close();
+      } catch {
+      }
     }
-  })();
+  })().catch(() => {
+  });
   return new Response(readable, {
     status: upstreamResp.status,
     headers: {
@@ -17025,7 +17041,6 @@ function getTelemetryEmitter(dashboardUrl, pushToken) {
   _emitter = new TelemetryEmitter(url, token);
   return _emitter;
 }
-var TIER_ORDER2 = { free: 0, pro: 1, enterprise: 2 };
 var riskScorer = new RiskScorer();
 function detectUpstream(path2, overrideHeader) {
   if (overrideHeader) return overrideHeader;
@@ -17034,12 +17049,66 @@ function detectUpstream(path2, overrideHeader) {
   if (path2.includes("/v1beta/") || path2.includes("/v1/models")) return "https://generativelanguage.googleapis.com";
   return "https://api.openai.com";
 }
-function detectProvider(upstream) {
-  if (upstream.includes("anthropic")) return "anthropic";
-  if (upstream.includes("openai")) return "openai";
-  if (upstream.includes("google")) return "google";
+function detectProviderFromPath(path2) {
+  if (path2.includes("/v1/messages")) return "anthropic";
+  if (path2.includes("/v1beta/") || path2.includes("/v1/models")) return "google";
+  if (path2.includes("/v1/chat/completions") || path2.includes("/v1/completions")) return "openai";
   return "openai-compatible";
 }
+function modelFromPath(path2) {
+  const m = path2.match(/\/models\/([^:/?]+)/);
+  return m?.[1];
+}
+var _tierCache = /* @__PURE__ */ new Map();
+var TIER_CACHE_OK_MS = 6e4;
+var TIER_CACHE_FAIL_MS = 1e4;
+var TIER_VALIDATE_TIMEOUT_MS = 3e3;
+function tierApiRoot() {
+  const raw2 = (process.env["PRETENSE_API_URL"] ?? "https://api.pretense.ai").trim();
+  const normalized = /^https?:\/\//i.test(raw2) ? raw2 : `https://${raw2}`;
+  return normalized.replace(/\/$/, "");
+}
+async function validateDashboardKeyTier(apiKey) {
+  const url = `${tierApiRoot()}/api/cli/auth/validate`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIER_VALIDATE_TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      body: "{}",
+      signal: controller.signal
+    });
+    if (!resp.ok) return { tier: "free", ok: false };
+    const body = await resp.json();
+    if (body["valid"] === false) return { tier: "free", ok: true };
+    switch (String(body["plan"]).toUpperCase()) {
+      case "PRO":
+        return { tier: "pro", ok: true };
+      case "ENTERPRISE":
+        return { tier: "enterprise", ok: true };
+      case "FREE":
+        return { tier: "free", ok: true };
+      default:
+        return { tier: "free", ok: false };
+    }
+  } catch {
+    return { tier: "free", ok: false };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveKeyTier(apiKey) {
+  if (!apiKey) return "free";
+  const fromPrefix = tierFromApiKey(apiKey);
+  if (fromPrefix) return fromPrefix;
+  if (!apiKey.startsWith("prtns_")) return "free";
+  const cached = _tierCache.get(apiKey);
+  if (cached && cached.expiresAt > Date.now()) return cached.tier;
+  const { tier, ok } = await validateDashboardKeyTier(apiKey);
+  _tierCache.set(apiKey, { tier, expiresAt: Date.now() + (ok ? TIER_CACHE_OK_MS : TIER_CACHE_FAIL_MS) });
+  return tier;
+}
 function extractAllText(body) {
   const parts = [];
   if (typeof body["system"] === "string") parts.push(body["system"]);
@@ -17054,6 +17123,19 @@ function extractAllText(body) {
     }
   }
   if (typeof body["prompt"] === "string") parts.push(body["prompt"]);
+  const gWalkParts = (v) => {
+    if (!Array.isArray(v)) return;
+    for (const part of v) {
+      if (part && typeof part["text"] === "string") parts.push(part["text"]);
+    }
+  };
+  if (Array.isArray(body["contents"])) {
+    for (const c of body["contents"]) {
+      if (c) gWalkParts(c["parts"]);
+    }
+  }
+  const sysInstr = body["systemInstruction"] ?? body["system_instruction"];
+  if (sysInstr && typeof sysInstr === "object") gWalkParts(sysInstr["parts"]);
   return parts.join("\n");
 }
 var TRANSFORM_MAX_DEPTH = 256;
@@ -17377,11 +17459,7 @@ function createProxy(opts = {}) {
     }
     {
       const _apiKey = c.req.header("x-pretense-api-key") ?? c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
-      const _keyTier = tierFromApiKey(_apiKey);
-      const _effectiveTier = (() => {
-        if (!_keyTier) return "free";
-        return TIER_ORDER2[_keyTier] <= TIER_ORDER2[planCfg.tier] ? _keyTier : planCfg.tier;
-      })();
+      const _effectiveTier = await resolveKeyTier(_apiKey);
       const _requestEnforcer = new PlanEnforcer(_effectiveTier, planCfg.tenantId);
       const QUOTA_PERIOD_DAYS3 = 7;
       const _periodMs = QUOTA_PERIOD_DAYS3 * 864e5;
@@ -17450,8 +17528,8 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
       }
     }
     const upstream = detectUpstream(c.req.path, c.req.header("x-pretense-upstream"));
-    const provider = detectProvider(upstream);
-    const model = body["model"] ?? "unknown";
+    const provider = detectProviderFromPath(c.req.path);
+    const model = body["model"] ?? (provider === "google" ? modelFromPath(c.req.path) : void 0) ?? "unknown";
     const fullText = extractAllText(body);
     const scanT0 = performance.now();
     const deep = tokenizeBodyDeep(
@@ -17648,12 +17726,26 @@ ${_upgradeTier === "enterprise" ? "Enterprise offers unlimited mutations \u2014
     });
     delete headers["host"];
     delete headers["content-length"];
+    delete headers["expect"];
+    delete headers["connection"];
+    delete headers["keep-alive"];
+    delete headers["transfer-encoding"];
+    delete headers["te"];
+    delete headers["upgrade"];
     headers["host"] = new URL(upstream).host;
     headers["x-pretense-request-id"] = requestId;
     if (riskResult.recommendation === "warn") {
       headers["x-pretense-risk-score"] = String(riskResult.score);
     }
-    const forwardBody = JSON.stringify(mutatedBody);
+    let forwardBody;
+    try {
+      forwardBody = JSON.stringify(mutatedBody);
+    } catch {
+      return c.json(
+        { error: { type: "invalid_request", message: "Request body is too deeply nested to process" } },
+        400
+      );
+    }
     const originalSize = fullText.length;
     const processedSize = forwardBody.length;
     let upstreamResp;
@@ -17786,6 +17878,15 @@ function startProxy(opts = {}) {
     });
   }
 }
+function renderClientEnvLines(port, protocol) {
+  const base = `${protocol}://localhost:${port}`;
+  return [
+    "  Point your AI client at Pretense:",
+    `    ANTHROPIC_BASE_URL=${base}`,
+    `    OPENAI_BASE_URL=${base}/v1`,
+    `    GOOGLE_GEMINI_BASE_URL=${base}`
+  ].join("\n") + "\n";
+}
 function printBanner(port, protocol, tls) {
   const tlsLabel = tls ? " [TLS]" : "";
   const version = productVersion();
@@ -17800,10 +17901,9 @@ function printBanner(port, protocol, tls) {
 \u2502   Proxy:      ${protocol}://localhost:${port}${tls ? " " : "           "}\u2502
 \u2502   Health:     ${protocol}://localhost:${port}/health    \u2502
 \u2502                                             \u2502
-\u2502   ANTHROPIC_BASE_URL=${protocol}://localhost:${port}    \u2502
-\u2502                                             \u2502
 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\x1B[0m
-`
+
+` + renderClientEnvLines(port, protocol) + "\n"
   );
 }
 var isMain = process.argv[1]?.endsWith("server.js") || process.argv[1]?.endsWith("server.ts");
@@ -18806,9 +18906,21 @@ function scanCommand() {
         process.exit(1);
       }
     } else {
+      if (process.stdin.isTTY) {
+        console.error(
+          chalk4.yellow("\n  x Nothing to scan.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+        );
+        process.exit(USAGE_EXIT);
+      }
       const chunks = [];
       for await (const chunk of process.stdin) chunks.push(chunk);
       content = Buffer.concat(chunks).toString("utf-8");
+      if (content.trim() === "") {
+        console.error(
+          chalk4.yellow("\n  x Nothing to scan \u2014 no file argument and empty input.\n") + chalk4.dim("  Scan this project:   ") + chalk4.cyan("pretense scan .") + "\n" + chalk4.dim("  Scan a path:         ") + chalk4.cyan("pretense scan <file-or-dir>") + "\n" + chalk4.dim("  Or pipe content:     ") + chalk4.cyan("cat file | pretense scan") + "\n"
+        );
+        process.exit(USAGE_EXIT);
+      }
     }
     const rawResult = await scanContent(content, opts, file);
     const filteredMatches = filterBySeverity(rawResult.matches, opts?.severity);
@@ -18881,18 +18993,25 @@ function statusCommand() {
     const fingerprintPath = join8(dir, ".pretense", "fingerprint.json");
     const configPath = join8(dir, "pretense.yaml");
     console.log(chalk5.cyan("\n  Pretense Status\n"));
-    let proxyRunning = false;
-    try {
-      const resp = await fetch("http://localhost:9339/health", { signal: AbortSignal.timeout(1e3) });
-      if (resp.ok) {
+    const record = readProxyRecord(pidFilePath());
+    if (record && !isProcessAlive(record.pid)) {
+      console.log(
+        chalk5.yellow(
+          `  \u25CB Proxy not running  ${chalk5.dim(`(stale record for pid ${record.pid}; run: pretense start)`)}`
+        )
+      );
+    } else {
+      const port = record && record.port > 0 ? record.port : 9339;
+      try {
+        const resp = await fetch(`http://localhost:${port}/health`, { signal: AbortSignal.timeout(1e3) });
+        if (!resp.ok) throw new Error(`health returned ${resp.status}`);
         const health = await resp.json();
-        proxyRunning = true;
-        console.log(chalk5.green(`  \u2713 Proxy running on :9339 (uptime: ${health["uptime"]}s)`));
+        console.log(chalk5.green(`  \u2713 Proxy running on :${port} (uptime: ${health["uptime"]}s)`));
         const stats = health["stats"];
         console.log(chalk5.dim(`    Requests: ${stats["requestsProcessed"] ?? 0} | Mutations: ${stats["mutationsApplied"] ?? 0} | Blocked: ${stats["secretsBlocked"] ?? 0}`));
+      } catch {
+        console.log(chalk5.yellow(`  \u25CB Proxy not running  ${chalk5.dim("(run: pretense start)")}`));
       }
-    } catch {
-      console.log(chalk5.yellow(`  \u25CB Proxy not running  ${chalk5.dim("(run: pretense start)")}`));
     }
     if (existsSync8(configPath)) {
       console.log(chalk5.green(`  \u2713 Config: pretense.yaml`));
@@ -20407,7 +20526,8 @@ function quickstartCommand() {
     console.log(`  ${chalk13.green("2.")} ${chalk13.cyan("pretense install")}          Install pre-commit + pre-push git hooks`);
     console.log(`  ${chalk13.green("3.")} Set your LLM client to use the proxy:`);
     console.log(`     ${chalk13.dim("ANTHROPIC_BASE_URL=http://localhost:9339 claude")}`);
-    console.log(`     ${chalk13.dim("OPENAI_BASE_URL=http://localhost:9339/openai openai ...")}
+    console.log(`     ${chalk13.dim("OPENAI_BASE_URL=http://localhost:9339/v1 openai ...")}`);
+    console.log(`     ${chalk13.dim("GOOGLE_GEMINI_BASE_URL=http://localhost:9339 gemini ...")}
 `);
     console.log(chalk13.bold.green("  Protected. Happy coding.\n"));
   });

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-5GO2CY5W.js";
+} from "./chunk-K3L4E6HN.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.11",
+  "version": "0.6.12",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,14 +23,14 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
-    "@pretense/protocol": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
-    "@pretense/learner": "0.2.0",
     "@pretense/billing": "0.1.0",
+    "@pretense/protocol": "0.1.0",
+    "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
-    "@pretense/scanner-rs": "0.2.0",
     "@pretense/scanner": "0.2.0",
+    "@pretense/scanner-rs": "0.2.0",
     "@pretense/store": "0.2.0"
   },
   "publishConfig": {