iamsecure 0.1.2 → 0.1.3

package/bin/iamsecure.js

@@ -121,13 +121,18 @@ try {
     }
   }
   if (values.ui) {
-    const { url } = await serveDashboard(report, {
+    const { url, replaced } = await serveDashboard(report, {
       port: Number(values.port),
       open: !values['no-open'],
       rescan: runScan,
       aiProvider: values.ai ?? null,
       analyze: values.ai ? makeAnalyzer({ provider: values.ai, model: values['ai-model'] }) : undefined,
     });
+    if (replaced) console.log(c.dim(`\nStopped the previous dashboard (${replaced.root}) and took over port ${replaced.port}.`));
+    const port = Number(new URL(url).port);
+    if (port !== Number(values.port)) {
+      console.log(c.yellow(`\n⚠ Port ${values.port} is busy by another app, using ${port}.`));
+    }
     console.log(`\n${c.bold('Dashboard:')} ${c.cyan(url)}  ${c.dim('(Ctrl+C to stop)')}`);
   }
 } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iamsecure",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Scan a codebase for vulnerable dependencies and insecure code, ranked by real-world risk \u2014 with an optional AI second opinion.",
   "author": "Ravindra Bisht",
   "repository": {

package/src/scan.js

@@ -7,7 +7,7 @@ import { scanSecrets } from "./code/secrets.js";
 import { loadExploitData } from "./risk/exploit.js";
 import { scoreFindings } from "./risk/score.js";
 
-export const VERSION = "0.1.2";
+export const VERSION = "0.1.3";
 
 /**
  * Run a full scan and return a JSON-serialisable report.

package/src/ui/index.html

@@ -409,6 +409,7 @@ function groupRow(name, list) {
 function header(r) {
   const s = r.summary;
   const p = r.stats.packages;
+  document.title = `${r.project.name} — iamsecure`;
   $('#crumb').innerHTML = `<span>Projects</span><span class="sep">›</span><span>${esc(r.project.name)}</span>`;
   $('#counters').innerHTML = LEVELS.map((l) => `
     <button class="counter ${l} ${s.byRisk[l] ? 'has' : ''} ${state.level === l ? 'on' : ''}" data-level="${l}" title="Show only ${l} (real risk)">

package/src/ui/server.js

@@ -1,8 +1,11 @@
 import http from 'node:http';
+import net from 'node:net';
 import fs from 'node:fs';
+import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { cacheDir } from '../util/cache.js';
 
 const PAGE = fileURLToPath(new URL('./index.html', import.meta.url));
 
@@ -14,16 +17,64 @@ function openBrowser(url) {
   } catch {}
 }
 
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Each running dashboard records {pid, port, secret, root} in a user-only file, so a newer run can
+// ask it to stop. Only someone who can read that file knows the secret, so websites can't do it.
+const lockFile = (port) => path.join(cacheDir, `dashboard-${port}.json`);
+
+function portFree(port) {
+  return new Promise((resolve) => {
+    const probe = net.createServer();
+    probe.once('error', () => resolve(false));
+    probe.listen(port, '127.0.0.1', () => probe.close(() => resolve(true)));
+  });
+}
+
+/** Ask the dashboard holding `port` to shut down. Returns its lock info if it stopped, else null. */
+async function stopPrevious(port) {
+  let info;
+  try {
+    info = JSON.parse(fs.readFileSync(lockFile(port), 'utf8'));
+  } catch {
+    return null; // not one of ours (or from a version without this feature)
+  }
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/shutdown`, {
+      method: 'POST',
+      headers: { 'x-iamsecure-shutdown': info.secret },
+      signal: AbortSignal.timeout(2000),
+    });
+    if (!res.ok) return null;
+  } catch {
+    return null;
+  }
+  for (let i = 0; i < 40; i++) {
+    if (await portFree(port)) return info;
+    await sleep(100);
+  }
+  return null;
+}
+
 function listen(server, port, attempts = 20) {
+  // One 'listening' handler that reads the port actually bound. (A callback per attempt would
+  // also fire for the failed attempts and report the busy port — opening another dashboard.)
   return new Promise((resolve, reject) => {
-    const tryPort = (p, left) => {
-      server.once('error', (err) => {
-        if (err.code === 'EADDRINUSE' && left > 0) tryPort(p + 1, left - 1);
-        else reject(err);
-      });
-      server.listen(p, '127.0.0.1', () => resolve(p));
+    let p = port;
+    const onError = (err) => {
+      if (err.code === 'EADDRINUSE' && attempts-- > 0) server.listen(++p, '127.0.0.1');
+      else {
+        server.off('listening', onListening);
+        reject(err);
+      }
+    };
+    const onListening = () => {
+      server.off('error', onError);
+      resolve(server.address().port);
     };
-    tryPort(port, attempts);
+    server.on('error', onError);
+    server.once('listening', onListening);
+    server.listen(p, '127.0.0.1');
   });
 }
 
@@ -36,7 +87,14 @@ function listen(server, port, attempts = 20) {
 export async function serveDashboard(initialReport, { port = 4477, open = true, rescan, analyze, aiProvider = null } = {}) {
   let report = initialReport;
   const token = crypto.randomBytes(16).toString('hex');
+  const shutdownSecret = crypto.randomBytes(24).toString('hex');
   let busy = false;
+  let lockPath = null;
+  const removeLock = () => {
+    try {
+      if (lockPath && JSON.parse(fs.readFileSync(lockPath, 'utf8')).pid === process.pid) fs.unlinkSync(lockPath);
+    } catch {}
+  };
 
   const server = http.createServer(async (req, res) => {
     const host = (req.headers.host ?? '').split(':')[0];
@@ -62,6 +120,15 @@ export async function serveDashboard(initialReport, { port = 4477, open = true,
         .replace('__IAMSECURE_AI__', JSON.stringify(aiProvider));
       return send(200, html, 'text/html; charset=utf-8');
     }
+    if (req.method === 'POST' && url.pathname === '/api/shutdown') {
+      if (req.headers['x-iamsecure-shutdown'] !== shutdownSecret) return send(403, { error: 'forbidden' });
+      send(200, { ok: true });
+      console.log('\nThis dashboard was replaced by a newer `iamsecure --ui` run. Stopping.');
+      removeLock();
+      server.close();
+      setTimeout(() => process.exit(0), 100);
+      return;
+    }
     if (!url.pathname.startsWith('/api/')) return send(404, { error: 'not found' });
     if (req.headers['x-iamsecure-token'] !== token) return send(401, { error: 'bad token' });
 
@@ -90,8 +157,24 @@ export async function serveDashboard(initialReport, { port = 4477, open = true,
     }
   });
 
+  // Replace an older iamsecure dashboard on the same port instead of piling up new ones.
+  const replaced = (await portFree(port)) ? null : await stopPrevious(port);
+
   const actual = await listen(server, port);
+  lockPath = lockFile(actual);
+  try {
+    fs.mkdirSync(cacheDir, { recursive: true });
+    fs.writeFileSync(lockPath, JSON.stringify({ pid: process.pid, port: actual, secret: shutdownSecret, root: report.project.root, startedAt: new Date().toISOString() }), { mode: 0o600 });
+  } catch {}
+  process.once('exit', removeLock);
+  for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.once(sig, () => {
+      removeLock();
+      process.exit(sig === 'SIGINT' ? 130 : 0);
+    });
+  }
+
   const url = `http://localhost:${actual}/`;
   if (open) openBrowser(url);
-  return { url, server };
+  return { url, server, replaced };
 }