kryptheon-night 0.1.14 → 0.1.22

package/bin/kryptheon-night.js

@@ -32,8 +32,8 @@ const intro = require('../intro.js');
 const trouble = require('../trouble.js');
 const { howToConnect } = require('../connect.js');
 const installer = require('../installer.js');
-const finding = require('../finding.js');
 const outside = require('../outside.js');
+const schema = require('../schema.js');
 
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
@@ -88,7 +88,7 @@ function usage() {
 // names a schema: `public` is the schema almost everybody has, and a bare
 // word that is not one of these is still read as a schema so that
 // `kryptheon-night public` keeps working.
-const VERBS = ['install', 'uninstall', 'status', 'night'];
+const VERBS = ['install', 'uninstall', 'status', 'night', 'words'];
 
 /** What was asked for, and what was left to the default. */
 function readArgs(argv) {
@@ -118,6 +118,50 @@ function readArgs(argv) {
   return asked;
 }
 
+/**
+ * Keeps what the nightly run last said where the kryptheon dashboard reads
+ * it, so the answer waiting in the database is also on the page - not only
+ * what was last run from this terminal. Never fails anything: the person has
+ * their answer already, and a folder that cannot be written is not theirs to
+ * debug here.
+ */
+function keepTheNight(record) {
+  try {
+    scanner.saveNightly(scanner.nightlyFile(), record);
+  } catch (err) {
+    /* the dashboard keeps its older copy, which carries its own date */
+  }
+}
+
+/**
+ * The night's answer, made whole: its findings told with what their tables
+ * need for a right fix, plus the functions anyone can call - both read from
+ * the shape now, read only. Without the shape it is still the night's answer,
+ * just less exact.
+ */
+async function nightRecordFrom(client, latest) {
+  let plan = null;
+  const run = latest && latest.run;
+  if (run && !run.stopped) {
+    try {
+      plan = await schema.readSchema(client, run.source);
+    } catch (err) {
+      plan = null;
+    }
+  }
+  return scanner.nightlyRecord(latest, new Date().toISOString(), plan);
+}
+
+/** Reads and keeps it, for the doors that do not already hold the answer. */
+async function readAndKeepTheNight(client) {
+  try {
+    keepTheNight(await nightRecordFrom(client, await installer.latestRun(client, {})));
+  } catch (err) {
+    /* as above */
+  }
+}
+
+
 /**
  * The three doors that are not a scan.
  *
@@ -127,6 +171,7 @@ function readArgs(argv) {
  */
 async function runVerb(command, client, target) {
   if (command === 'status') {
+    await readAndKeepTheNight(client);
     const where = await installer.status(client, {});
     if (!where) {
       line('  The nightly run is not installed in this database.');
@@ -183,6 +228,7 @@ async function runVerb(command, client, target) {
       return 0;
     }
     const removed = await installer.uninstall(client, {});
+    await readAndKeepTheNight(client);
     line('  Removed.');
     line('');
     line('    the nightly job   ' + (removed.job ? 'gone' : 'there was none'));
@@ -195,7 +241,10 @@ async function runVerb(command, client, target) {
   }
 
   if (command === 'night') {
-    const where = await installer.status(client, {});
+    const latest = await installer.latestRun(client, {});
+    const record = await nightRecordFrom(client, latest);
+    keepTheNight(record);
+    const where = latest.where;
     if (!where) {
       line('  The nightly run is not installed in this database, so there is');
       line('  nothing to read back.');
@@ -205,31 +254,31 @@ async function runVerb(command, client, target) {
       line('');
       return 2;
     }
-    const quoted = '"' + String(where.schema).split('"').join('""') + '"';
-    const { rows } = await client.query(
-      'SELECT ran_at, source, stopped, attacks_run, findings, not_checked ' +
-        'FROM ' + quoted + '.runs ORDER BY ran_at DESC LIMIT 1',
-    );
-    if (!rows.length) {
+    if (!latest.run) {
       // Installed and never run is not the same as run and found nothing, and
       // saying "nothing got through" here would be the worst sentence in the
       // product printed about a night that never happened.
       line('  It is installed, and it has not run yet.');
       line('');
-      line('  The first run is at ' + (where.job ? where.job.schedule : 'whenever it is scheduled') + '.');
+      line('  It runs ' + scanner.scheduleTimes(where.job ? where.job.schedule : null) + '.');
       line('');
       return 0;
     }
-    const run = rows[0];
-    line('  From the night of ' + new Date(run.ran_at).toISOString().slice(0, 16).replace('T', ' ') +
-      ', on "' + run.source + '":');
+    const run = latest.run;
+    line('  From the night of ' + scanner.bothTimes(run.ran_at) + ', on "' + run.source + '".');
+    if (where.job) line('  It runs ' + scanner.scheduleTimes(where.job.schedule) + '.');
+    // The one part not from the night: the engine inside the database does
+    // not look at functions, so they are read now and said to be.
+    if (record.functionsReadAt) {
+      line('  Functions anyone can call were looked at just now, not overnight.');
+    }
     scanner.report({
-      stopped: run.stopped,
-      attacksRun: run.attacks_run,
-      notChecked: run.not_checked || [],
-      findings: finding.describeAll(run.findings || []),
+      stopped: record.stopped,
+      attacksRun: record.attacksRun,
+      notChecked: record.notChecked || [],
+      findings: record.findings || [],
     });
-    return run.stopped ? 2 : (run.findings || []).length ? 1 : 0;
+    return run.stopped ? 2 : scanner.exitCodeFor(record);
   }
 
   throw new Error('there is no command called ' + command);
@@ -373,6 +422,23 @@ async function runOutside(appUrl) {
   return result.findings.length ? 1 : 0;
 }
 
+/** Everything the dashboard needs to say what this command would say. */
+function wordsFor(target, connection) {
+  const given = String(connection || '').trim();
+  const unusable = given ? trouble.readConnectionString(given) : null;
+  return {
+    help: intro.whereToFindIt(),
+    consent: intro.consentLines(target),
+    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT),
+    // pg_cron reads this in the database's own time zone, which is UTC on
+    // Supabase; the dashboard turns it into the person's local time.
+    nightlyAt: installer.AT,
+    given: Boolean(given),
+    unusable: unusable,
+    warning: given && !unusable ? trouble.poolerWarning(given) : null,
+  };
+}
+
 /** Prints a block of plain lines with the indent the rest of the report uses. */
 function block(lines, write) {
   (write || line)('');
@@ -394,6 +460,17 @@ async function main() {
     process.exit(2);
   }
 
+  // The words this command says, as JSON, for the kryptheon dashboard to show
+  // on its own buttons: the help for finding the string, both consent
+  // screens, and - when KN_DATABASE_URL is given - what is wrong with it or
+  // worth warning about. Never connects, and never prints the string: the
+  // warnings name the host at most, and a string that cannot be used is
+  // described, not repeated.
+  if (asked.command === 'words') {
+    process.stdout.write(JSON.stringify(wordsFor(asked.schema || 'public', process.env.KN_DATABASE_URL || '')) + '\n');
+    return;
+  }
+
   // The outside attack. Needs no connection string, no copy and no yes: it
   // only asks the live app what it already answers any visitor, and asks for
   // counts, never rows. So nothing below - the string, the consent screen,
@@ -583,6 +660,9 @@ async function main() {
     // think about it again, which is exactly the app that is unprotected
     // three months later. The tool already knows whether the nightly run is
     // there. So it asks.
+    // Whatever the nightly run last said is kept for the dashboard too, so
+    // the page shows both answers and says which is which.
+    await readAndKeepTheNight(client);
     if (!result.stopped) await offerTheNight(client, target, canAsk);
   } catch (err) {
     // Anything that went wrong mid-scan. The copy has already been dropped by

package/finding.js

@@ -448,7 +448,10 @@ function bodyFor(finding, contents) {
     }
     return (
       'Anyone on the internet, without logging in and without an account, can read ' +
-      'this table. I did it myself just now and got back ' + finding.readable + ' ' + rowWord +
+      // Read back the next morning, "just now" would be untrue: it was the
+      // nightly run, hours earlier.
+      'this table. ' + (finding.fromNight ? 'The nightly run did it on a copy and got back ' : 'I did it myself just now and got back ') +
+      finding.readable + ' ' + rowWord +
       (holds ? ', including ' + holds : '') + '.'
     );
   }
@@ -523,8 +526,32 @@ function serverOnlyLines(finding) {
   // column saying whose row it is. The assistant applying it had to correct
   // the prompt; a less careful one would have locked the table away from the
   // members who use it.
-  const tenant = finding.authTied !== false && finding.owned === false &&
-    (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  const team = finding.authTied !== false && (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  const maker = finding.owner || finding.ownedBy;
+  // A team's row that also says who made it - created_by beside workspace_id.
+  // Found on a benchmark: the prompt said to compare created_by to auth.uid()
+  // for reading, which hides every teammate's rows and breaks the shared
+  // view the table exists for. Who made a row decides who may write it
+  // under their name, not who may see it.
+  if (team && finding.owned !== false && maker) {
+    return [
+      'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
+        'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
+        'row when they are a member of that row\'s "' + team + '" - checked through your membership ' +
+        'table, or a helper function that asks it - and give logged-out visitors nothing. Do not ' +
+        'compare "' + maker + '" to auth.uid() for reading: that hides teammates\' rows from each other ' +
+        'and breaks the feature.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting. Inserting: WITH CHECK that ' +
+        'the user is a member of the row\'s "' + team + '" AND "' + maker + '" = auth.uid(), so nobody ' +
+        'writes a row under somebody else\'s name or into a team they are not in. Updating and ' +
+        'deleting: the membership check in USING (and WITH CHECK for updating), and decide whether any ' +
+        'member may do it or only the row\'s "' + maker + '" or an admin. If only your server writes ' +
+        'this table, add no write rules at all.',
+      '',
+    ];
+  }
+  const tenant = finding.owned === false && team;
   if (tenant) {
     return [
       'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
@@ -563,6 +590,18 @@ function serverOnlyLines(finding) {
   ];
 }
 
+/**
+ * The opening of a rules fix. "Switch row level security on" is said only
+ * when it is off: told it about a table where it was already on, the person
+ * looks for a switch that is already flipped and misses the rule that is the
+ * real problem.
+ */
+function switchOn(finding) {
+  return finding.rlsEnabled
+    ? 'Row level security is already on for this table, so the rules on it are the problem: '
+    : 'Switch row level security on for this table, then ';
+}
+
 /**
  * One prompt for everything wrong with one table's rules - read and write,
  * strangers and customers - because it is one rule to replace, not four.
@@ -597,9 +636,8 @@ function groupPromptFor(members) {
     '',
   ].concat(
     serverOnlyLines(lead) || [
-        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
-          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
-          'covers far more than reading.',
+        switchOn(lead) + 'remove the rule that lets everyone in, and write separate rules for reading, ' +
+          'inserting, updating and deleting. A rule written FOR ALL covers far more than reading.',
         '',
         'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
           'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
@@ -706,9 +744,9 @@ function fixPromptFor(finding) {
       '',
     ].concat(
       serverOnlyLines(finding) || [
-          'Switch row level security on for this table, then write separate rules for ' +
-            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          switchOn(finding) + 'write separate rules for reading, inserting, updating and deleting. ' +
+            'A rule written FOR SELECT does not cover writes, and a rule written FOR ALL covers ' +
+            'far more than reading.',
           '',
           'For insert and update, use WITH CHECK comparing ' + owner +
             ' to the id of the signed-in user, so nobody can write a row under somebody ' +

package/installer.js

@@ -229,8 +229,24 @@ async function uninstall(client, options) {
   return removed;
 }
 
+/**
+ * What the nightly run last said, read out of the database: whether it is
+ * installed at all, how it is scheduled, and its newest row in runs - or null
+ * for a run that has not happened yet. Read only.
+ */
+async function latestRun(client, options) {
+  const where = await status(client, options);
+  if (!where) return { installed: false, where: null, run: null };
+  const { rows } = await client.query(
+    'SELECT ran_at, source, stopped, attacks_run, findings, not_checked FROM ' +
+      quote(where.schema) + '.runs ORDER BY ran_at DESC, id DESC LIMIT 1',
+  );
+  return { installed: true, where: where, run: rows[0] || null };
+}
+
 module.exports = {
   SCHEMA: SCHEMA,
+  latestRun: latestRun,
   AT: AT,
   install: install,
   uninstall: uninstall,

package/intro.js

@@ -28,15 +28,23 @@ const trouble = require('./trouble.js');
  * their users end up on the same page by a different door.
  */
 function whereToFindIt() {
+  // The session pooler, and said as such: the direct connection answers only
+  // over IPv6, which many home networks do not have, and the transaction
+  // pooler on 6543 cannot hold these attacks together. The kryptheon
+  // dashboard shows these same steps; kryptheon-night words hands them over.
   return [
     'Where to find it:',
     '',
-    '  Supabase   supabase.com/dashboard -> your project -> the gear icon',
-    '             (Project Settings) at the bottom left -> Database ->',
-    '             scroll to "Connection string" -> the URI tab -> Copy.',
+    '  Supabase   1. supabase.com/dashboard -> open your project.',
+    '             2. Press "Connect" at the top of the page.',
+    '             3. Choose "Session pooler" - the one on port 5432.',
+    '             4. Copy the URI. It starts postgresql://',
+    '             5. Replace [YOUR-PASSWORD] in it with your database password.',
+    '                Forgotten it? Project Settings -> Database -> Reset',
+    '                database password.',
     '',
-    '             Replace [YOUR-PASSWORD] in it with your database password.',
-    '             It is on that same page under "Database password".',
+    '             Not port 6543 (the transaction pooler), and not the direct',
+    '             db.<project>.supabase.co address - both are warned about.',
     '',
     '  Lovable    your app uses Supabase underneath. Open the Supabase',
     '  and Bolt   project it made for you and follow the lines above.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.14",
+  "version": "0.1.22",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -55,6 +55,8 @@
     "check:privileged": "node privileged.check.js",
     "check:recursion": "node recursion.check.js",
     "check:guarded": "node guarded.check.js",
+    "check:nightly": "node nightly.check.js",
+    "check:words": "node words.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/scan.js

@@ -385,28 +385,12 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    // Quiet: a yes/no about the caller, and a function that turns the caller
-    // away before it does anything (schema.guardedAtTheDoor).
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
-      kind: 'privileged',
-      fn: fn.name,
-      table: fn.name,
-      args: fn.args,
-      writes: fn.writes,
-      hasFixedSearchPath: fn.hasFixedSearchPath,
-      columns: [],
-    }));
+    const privileged = privilegedOf(plan);
 
-    // Whether each table is tied to Supabase's sign-in decides what its fix
-    // can be. Read from the original schema: the copy points auth.users keys
-    // at a stand-in, and would call every table untied.
-    const ties = finding.authTiesOf(plan);
-    // And whether a row says whose it is: with no such column, no rule can
-    // tie it to the person asking. Read from the copy, the way seeding did.
-    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
-    const tagged = (f) => Object.assign({}, f,
-      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
-      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+    // Ties read from the original schema: the copy points auth.users keys at
+    // a stand-in, and would call every table untied. Owners read from the
+    // copy, the way seeding did.
+    const tagged = taggerFor(plan, theirs);
 
     return {
       stopped: null,
@@ -438,6 +422,128 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/**
+ * Functions an anonymous visitor can call that run past the rules. Read from
+ * the shape, not attacked. Quiet: a yes/no about the caller, and a function
+ * that turns the caller away before it does anything (schema.guardedAtTheDoor).
+ */
+function privilegedOf(plan) {
+  return ((plan && plan.anonFunctions) || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
+    kind: 'privileged',
+    fn: fn.name,
+    table: fn.name,
+    args: fn.args,
+    writes: fn.writes,
+    hasFixedSearchPath: fn.hasFixedSearchPath,
+    columns: [],
+  }));
+}
+
+/**
+ * What each finding needs to know about its table for its fix to be right:
+ * whether the app signs people in through Supabase, whether a row says whose
+ * it is, and which column that is. Without these a prompt falls back to "the
+ * column that says who each row belongs to" - found on a nightly read-back,
+ * whose findings came from the database without them.
+ */
+function taggerFor(plan, tables) {
+  const ties = finding.authTiesOf(plan);
+  const owned = new Map((tables || []).map((table) => [table.name, attack.ownerColumn(table)]));
+  return (f) => Object.assign({}, f,
+    ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+    owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
+    owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
+}
+
+/**
+ * What the nightly engine wrote down as not tried, in the shape a scan uses.
+ * It names a column's check as table and column apart, with no attack named,
+ * so "export_jobs.access_token could not be raced" was counted as a whole
+ * table not checked - and listed without its column.
+ */
+function notCheckedFromNight(entries) {
+  return (entries || []).map((e) => {
+    if (!e || e.key || !e.column) return e;
+    const kind = /two requests at the same instant/.test(String(e.why)) ? 'duplicated' : 'orphaned';
+    return { table: e.table + '.' + e.column, key: kind + ':' + e.table + ':' + e.column, why: e.why };
+  });
+}
+
+/**
+ * A moment of the night, said in UTC - which is what the database runs on -
+ * and in this computer's own time, so 03:00 is not read as three at night
+ * here. Found on a real read-back: "the night of 2026-10-01 03:00" was 08:30
+ * in India, and nothing said so.
+ */
+function bothTimes(iso) {
+  const at = new Date(iso);
+  return at.toISOString().slice(0, 16).replace('T', ' ') + ' UTC (' +
+    at.toLocaleString('en-GB', { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
+/** "0 3 * * *" as a time of day in both, or the schedule as written. */
+function scheduleTimes(cron) {
+  const m = /^(\d{1,2})\s+(\d{1,2})\s+\*\s+\*\s+\*$/.exec(String(cron || '').trim());
+  if (!m) return String(cron || 'whenever it is scheduled');
+  const now = new Date();
+  const at = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), Number(m[2]), Number(m[1])));
+  return 'every night at ' + at.toISOString().slice(11, 16) + ' UTC (' +
+    at.toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
+/** Where the nightly run's last answer is kept for the dashboard. */
+function nightlyFile() {
+  return store.open(process.cwd()).nightNightly;
+}
+
+/**
+ * The nightly run's last answer, in the shape the dashboard reads: the same
+ * described findings a scan saves, and the three states that are not the same
+ * as "nothing found" - not installed, installed and never run, and stopped -
+ * said as themselves. `latest` is installer.latestRun's answer.
+ */
+function nightlyRecord(latest, readAt, plan) {
+  const at = (value) => (value ? new Date(value).toISOString() : null);
+  if (!latest || !latest.installed) return { readAt: readAt, installed: false };
+  const where = latest.where || {};
+  const record = {
+    readAt: readAt,
+    installed: true,
+    scheduled: where.job ? where.job.schedule : null,
+    active: Boolean(where.job && where.job.active),
+    source: where.source || null,
+    ranAt: null,
+  };
+  const run = latest.run;
+  if (!run) return record;
+  // The night's findings, told as the night's: tagged with what their table
+  // needs for a right fix when the schema could be read, and joined by the
+  // functions anyone can call - read now, when this is asked, because the
+  // engine inside the database does not look at them.
+  const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
+  const night = (run.findings || []).map((f) => tag(Object.assign({}, f, { fromNight: true })));
+  const now = plan ? privilegedOf(plan).map(tag) : [];
+  return Object.assign(record, {
+    ranAt: at(run.ran_at),
+    source: run.source,
+    stopped: run.stopped || null,
+    attacksRun: run.attacks_run || 0,
+    notChecked: notCheckedFromNight(run.not_checked),
+    findings: run.stopped ? [] : finding.describeAll(night.concat(now)),
+    functionsReadAt: plan ? readAt : null,
+  });
+}
+
+/** Kept for the dashboard. A failure here never touches the run itself. */
+function saveNightly(file, record) {
+  try {
+    fs.writeFileSync(file, JSON.stringify(record, null, 2));
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
 /** The last run, or null if there has not been one worth keeping. */
 function loadLastRun(file) {
   try {
@@ -506,6 +612,34 @@ function notTestedLines(result) {
   return lines;
 }
 
+/**
+ * The warning above the verdict: how much went untested, counted honestly.
+ *
+ * Every entry used to be counted as a table. Found on a benchmark: one
+ * column's duplicate test did not run, and the top line said "1 table was
+ * NOT checked" about a table every other attack had covered - and a table
+ * with two attacks stuck was counted as two tables. An entry with no attack
+ * named is a whole table nothing could be put into; one with an attack named
+ * is part of a table.
+ */
+function missedLines(notChecked) {
+  const tableOf = (entry) => String(entry.table).split('.')[0];
+  const whole = new Set(notChecked.filter((entry) => !entry.key).map(tableOf));
+  const parts = notChecked.filter((entry) => entry.key && !whole.has(tableOf(entry)));
+  const partly = new Set(parts.map(tableOf));
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  const said = [];
+  if (whole.size) said.push(tables(whole.size) + (whole.size === 1 ? ' was' : ' were') + ' NOT checked');
+  if (parts.length) {
+    said.push(parts.length + (parts.length === 1 ? ' check' : ' checks') + ' on ' +
+      (whole.size ? tables(partly.size).replace(/ table/, ' other table') : tables(partly.size)) +
+      (parts.length === 1 ? ' was' : ' were') + ' NOT run');
+  }
+  const it = notChecked.length === 1 ? 'it' : 'them';
+  return wrap(said.join(', and ') + '. Whatever this report says next is not about ' + it + '. Treat ' +
+    it + ' as unknown, not as clear - the list, and why, is at the end.', 68).map((l) => '  ' + l);
+}
+
 /** The report, as the person reads it in the morning. */
 function report(result) {
   if (result.stopped) {
@@ -530,11 +664,7 @@ function report(result) {
   const sayWhatWasMissed = () => {
     if (!notChecked.length) return;
     line('');
-    line('  ' + notChecked.length + (notChecked.length === 1 ? ' table was' : ' tables were') +
-      ' NOT checked. Whatever this report says next is not');
-    line('  about ' + (notChecked.length === 1 ? 'it' : 'them') + '. Treat ' +
-      (notChecked.length === 1 ? 'it' : 'them') + ' as unknown, not as clear - the list, and why, is');
-    line('  at the end.');
+    missedLines(notChecked).forEach(line);
   };
 
   if (!result.findings.length) {
@@ -702,9 +832,18 @@ if (require.main === module) {
 module.exports = {
   scan: scan,
   report: report,
+  missedLines: missedLines,
   wrap: wrap,
   loadLastRun: loadLastRun,
   saveRun: saveRun,
+  nightlyFile: nightlyFile,
+  nightlyRecord: nightlyRecord,
+  bothTimes: bothTimes,
+  scheduleTimes: scheduleTimes,
+  notCheckedFromNight: notCheckedFromNight,
+  privilegedOf: privilegedOf,
+  taggerFor: taggerFor,
+  saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
   lastRunFile: lastRunFile,

package/store.js

@@ -45,6 +45,7 @@ const FILES = {
   history: 'history.jsonl',
   testResults: 'test-results',
   nightLast: 'night-last.json',
+  nightNightly: 'night-nightly.json',
   codeFindings: 'code-findings.json',
   config: 'config.json',
   snapshot: 'snapshot.json',
@@ -132,6 +133,7 @@ function pathsIn(dir) {
     history: path.join(dir, FILES.history),
     testResults: path.join(dir, FILES.testResults),
     nightLast: path.join(dir, FILES.nightLast),
+    nightNightly: path.join(dir, FILES.nightNightly),
     codeFindings: path.join(dir, FILES.codeFindings),
     config: path.join(dir, FILES.config),
     snapshot: path.join(dir, FILES.snapshot),

package/trouble.js

@@ -189,8 +189,22 @@ function poolerWarning(raw) {
       'That is the transaction pooler (port 6543). It gives every statement a',
       'different connection, and these attacks have to stay on one.',
       '',
-      'Use the session pooler or the direct connection instead - same page in',
-      'Supabase, the one whose port is 5432.',
+      'Use the session pooler instead: Supabase -> Connect -> Session pooler,',
+      'the one whose port is 5432.',
+    ];
+  }
+
+  // The direct connection answers only over IPv6 now. On a network without
+  // it the name does not resolve, and the failure reads like a typo. It works
+  // where IPv6 does, so this warns rather than refuses.
+  if (/^db\.[a-z0-9]+\.supabase\.(co|com)$/i.test(url.hostname)) {
+    return [
+      'That is Supabase\'s direct connection (db.' + url.hostname.split('.')[1] + '.supabase.co). It',
+      'answers only over IPv6, and many home and office networks have none - it',
+      'then fails as if the address were wrong.',
+      '',
+      'If it does, use the session pooler: Supabase -> Connect -> Session pooler,',
+      'port 5432.',
     ];
   }
 
@@ -359,14 +373,19 @@ function explain(err, raw) {
   const ref = code === 'ENOTFOUND' ? supabaseDirectRef(raw) : null;
   if (ref) {
     return [
-      'I could not find that server - and I think I know why.',
+      'I could not find that server. There are two likely reasons.',
+      '',
+      'Most likely: that address is Supabase’s direct connection, and it now',
+      'answers only over IPv6. Plenty of home and office networks have no IPv6',
+      'at all, and on those the name does not resolve to anything.',
       '',
-      'That address is Supabase’s direct connection, and it now answers only',
-      'over IPv6. Plenty of home and office networks have no IPv6 at all, and on',
-      'those the name does not resolve to anything - which is what just',
-      'happened here.',
+      // A ref with one letter wrong fails exactly the same way, and blaming
+      // only IPv6 would send somebody to change networks over a typo.
+      'Or the address is mistyped. Check that "' + ref + '" matches the project',
+      'ref in Supabase -> Project Settings -> General; one wrong letter fails',
+      'exactly the same way.',
       '',
-      'There is nothing wrong with your project or your password. Use the',
+      'Your password has not been tried yet, so it is not the problem. Use the',
       'session pooler instead, which answers over the ordinary internet:',
       '',
       '  Supabase dashboard -> Project Settings -> Database ->',