kryptheon-night 0.1.6 → 0.1.8

package/README.md

@@ -37,6 +37,27 @@ If you paste the wrong thing — the project URL, an API key, the line with
 `[YOUR-PASSWORD]` still in it — it says so and tells you where the right one
 is. It does not just fail.
 
+## No connection string? Check your app from outside
+
+```
+npx kryptheon-night https://your-app.example.com
+```
+
+Give it your running app instead. It reads the app the way a stranger's
+browser does — the Supabase address and public key every visitor is already
+handed — and asks each table your app uses one question: can a stranger read
+this? It asks for a **count only**, so no customer's row is ever pulled out,
+and it writes nothing. About ten seconds, no password, no yes to give.
+
+It is a narrower check than the full scan, and it says so:
+
+- It only proves a leak when a stranger actually gets rows back. A table that
+  answers with none looks the same whether it is well protected or open and
+  empty, so it is reported as "could not tell", never as safe.
+- One customer reading another's rows, adding or deleting rows, and the same
+  thing saved twice at once all change data, so they are only ever tried on
+  a copy — the full scan above.
+
 ## What you get back
 
 Four questions, asked against the copy:

package/bin/kryptheon-night.js

@@ -26,12 +26,14 @@ const path = require('path');
 const { Client } = require('pg');
 
 const scanner = require('../scan.js');
+const store = require('../store.js');
 const recheck = require('../recheck.js');
 const intro = require('../intro.js');
 const trouble = require('../trouble.js');
 const { howToConnect } = require('../connect.js');
 const installer = require('../installer.js');
 const finding = require('../finding.js');
+const outside = require('../outside.js');
 
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
@@ -45,6 +47,12 @@ function usage() {
     '',
     '      npx kryptheon-night',
     '',
+    '  No connection string? Give it your running app instead. It reads the app',
+    '  the way a stranger does and tells you which tables anyone can read -',
+    '  counts only, nothing written:',
+    '',
+    '      npx kryptheon-night https://your-app.example.com',
+    '',
     '  Run it again after you fix something and it tells you what is actually',
     '  closed - you do not have to ask it to. It also offers to do the same',
     '  check every night from inside your database, and says so if it already',
@@ -85,11 +93,15 @@ const VERBS = ['install', 'uninstall', 'status', 'night'];
 /** What was asked for, and what was left to the default. */
 function readArgs(argv) {
   const asked = {
-    command: 'scan', schema: null, recheck: false, yes: false, help: false, unknown: [],
+    command: 'scan', schema: null, appUrl: null, recheck: false, yes: false, help: false, unknown: [],
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (arg === '--recheck') asked.recheck = true;
+    // An address is the outside attack: the running app, read the way a
+    // stranger's browser reads it. Never a schema name - no schema is called
+    // https://anything.
+    if (/^https?:\/\//i.test(arg) && !asked.appUrl) asked.appUrl = arg;
+    else if (arg === '--recheck') asked.recheck = true;
     else if (arg === '--yes' || arg === '-y') asked.yes = true;
     else if (arg === '--help' || arg === '-h') asked.help = true;
     else if (arg === '--schema') asked.schema = argv[++i] || null;
@@ -322,6 +334,45 @@ async function offerTheNight(client, target, canAsk) {
   }
 }
 
+/**
+ * The attack from outside, end to end: find the backend in the app, ask each
+ * table as a stranger, say what came back and what could not be tested.
+ *
+ * Exit codes are the same three as the scan: 1 when a stranger read rows, 0
+ * when nothing came back, 2 when it could not run at all.
+ */
+async function runOutside(appUrl) {
+  line('');
+  line('  Kryptheon Night Shift - from outside');
+  line('  I read your app the way a stranger\'s browser does, and ask your');
+  line('  database what it lets a stranger see. Counts only, nothing written.');
+  line('');
+  line('  Reading ' + appUrl + ' ...');
+
+  let found;
+  try {
+    found = await outside.discover(appUrl);
+  } catch (err) {
+    fail('');
+    fail('  ' + (err.code ? err.message : 'I could not read ' + appUrl + ': ' + err.message));
+    fail('');
+    return 2;
+  }
+
+  let result;
+  try {
+    result = await outside.prowl(found);
+  } catch (err) {
+    fail('');
+    fail('  I found your database but could not ask it anything: ' + err.message);
+    fail('');
+    return 2;
+  }
+
+  outside.reportLines(found, result).forEach(line);
+  return result.findings.length ? 1 : 0;
+}
+
 /** Prints a block of plain lines with the indent the rest of the report uses. */
 function block(lines, write) {
   (write || line)('');
@@ -343,6 +394,15 @@ async function main() {
     process.exit(2);
   }
 
+  // The outside attack. Needs no connection string, no copy and no yes: it
+  // only asks the live app what it already answers any visitor, and asks for
+  // counts, never rows. So nothing below - the string, the consent screen,
+  // the connection - applies to it.
+  if (asked.appUrl) {
+    process.exitCode = await runOutside(asked.appUrl);
+    return;
+  }
+
   line('');
   line('  Kryptheon Night Shift');
   line('  I attack a copy of your database and tell you what got in.');
@@ -426,7 +486,19 @@ async function main() {
   //
   // The flag still works, because anything scripted may be passing it, and
   // now it changes nothing: with an earlier run here, this always compares.
-  const file = path.resolve(scanner.LAST_RUN);
+  let file;
+  try {
+    file = scanner.lastRunFile(line);
+  } catch (err) {
+    // Nowhere to keep this run means nothing to compare the next one against,
+    // and a re-check with nothing to compare against is not an answer.
+    fail('');
+    fail('  Kryptheon keeps its last run for this project in ' + store.dirFor(process.cwd()));
+    fail('  and could not write there: ' + err.message);
+    fail('  Set KRYPTHEON_HOME to a folder you can write to, and run this again.');
+    fail('');
+    process.exit(2);
+  }
   const before = scanner.loadLastRun(file);
   if (asked.recheck && !before) {
     // Asked for explicitly and impossible, which is worth saying. Arriving

package/finding.js

@@ -312,6 +312,19 @@ function bodyFor(finding, contents) {
   }
 
   if (finding.kind === 'exposed') {
+    // Two different proofs, said as two different things. The copy-based scan
+    // signed in with the anon key and pulled the rows out; the outside check
+    // (outside.js) asked the live app for the count alone and never pulled a
+    // row, so it may not claim it did.
+    if (finding.countOnly) {
+      const many = finding.readable === 1 ? 'is 1 row' : 'are ' + finding.readable + ' rows';
+      return (
+        'Anyone on the internet, without logging in and without an account, can read ' +
+        'this table. I asked your live app as a stranger and it let me - there ' + many +
+        ' in it. I asked only for the count, so I never pulled a row out; a real ' +
+        'attacker would have taken them.'
+      );
+    }
     return (
       'Anyone on the internet, without logging in and without an account, can read ' +
       'this table. I did it myself just now and got back ' + finding.readable + ' ' + rowWord +
@@ -476,6 +489,9 @@ function describe(finding) {
     proof: finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
+      : finding.countOnly
+      ? 'I counted ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
+        ' in "' + finding.table + '" that a stranger can read, without pulling any of them out.'
       : 'I read ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
         ' from "' + finding.table + '" that should not have been readable.',
     fixPrompt: fixPromptFor(finding),

package/outside.js

@@ -0,0 +1,409 @@
+// The attack that needs nothing but what the app already hands every visitor.
+//
+// The deep scan (scan.js) needs the database connection string - the password
+// to the whole database - and copies the database so it can attack the copy.
+// Most people building on Lovable, Bolt, v0 or a bare Supabase project never
+// have that string: the platform keeps it. What they DO ship, to every browser
+// that opens the app, is the database's public address and its "publishable"
+// (anon) key. Those two are all a real attacker outside has, and they are all
+// this needs.
+//
+// So this becomes that attacker. With the anon key, for each table the app
+// talks to, it asks PostgREST one question: can a stranger read this table? It
+// asks for the COUNT only - never a row - so it learns "anyone can read your
+// bookings table, and there are 3,412 of them" without ever pulling a
+// customer's name or email out of the live database. Reading real rows to
+// prove a leak would be committing the leak.
+//
+// WHAT THIS DELIBERATELY DOES NOT DO
+//
+// It never writes. It never signs in as one customer to read another's rows,
+// never races two writes, never deletes a row to see if it can. Those all
+// change data, and this runs against the live app, not a copy. They are the
+// copy-based scan's job, and they need the connection string. What this cannot
+// reach, the report says out loud - so a quiet result is never mistaken for a
+// safe app.
+
+const finding = require('./finding.js');
+
+// Wraps one paragraph to a width that reads in a terminal and a chat box, the
+// same width the deep scan's report uses.
+function wrap(text, width) {
+  const words = String(text).split(/\s+/).filter(Boolean);
+  const out = [];
+  let current = '';
+  for (const word of words) {
+    if ((current + ' ' + word).trim().length > (width || 70)) {
+      out.push(current.trim());
+      current = word;
+    } else {
+      current = (current + ' ' + word).trim();
+    }
+  }
+  if (current) out.push(current.trim());
+  return out;
+}
+
+// PostgREST answers a count-only request with an empty body and the total in a
+// Content-Range header. `limit=0` is what makes the body empty: the query
+// returns no rows at all, so not one leaves the database, and count=exact
+// still fills in the total.
+
+/** The REST base for a Supabase project URL. */
+function restBase(supabaseUrl) {
+  return String(supabaseUrl || '').replace(/\/+$/, '') + '/rest/v1';
+}
+
+/**
+ * The Supabase address, the publishable key, and the tables the app talks to,
+ * read out of the app's own JavaScript - exactly what a browser is handed.
+ *
+ * Given `{ supabaseUrl, key, tables }` already, it trusts them and does no
+ * fetching. Otherwise it needs the running app's address and reads the rest
+ * from there.
+ */
+async function discover(input, options) {
+  const opts = options || {};
+  const doFetch = opts.fetch || fetch;
+
+  if (input && input.supabaseUrl && input.key) {
+    return {
+      supabaseUrl: input.supabaseUrl,
+      key: input.key,
+      tables: dedupe(input.tables || []),
+      from: 'given',
+    };
+  }
+
+  const appUrl = typeof input === 'string' ? input : input && input.appUrl;
+  if (!appUrl) throw problem('no-app', 'I need the address of your running app, e.g. https://your-app.example.com');
+
+  const html = await getText(doFetch, appUrl);
+  const scripts = scriptUrls(html, appUrl);
+  // The HTML itself sometimes carries the values (server-rendered apps do), so
+  // it is searched too, before the bundles.
+  let text = html;
+  for (const src of scripts) {
+    text += '\n' + await getText(doFetch, src).catch(() => '');
+  }
+
+  const supabaseUrl = firstMatch(text, /https?:\/\/[a-z0-9-]+\.supabase\.co/i);
+  const key = firstMatch(text, /sb_publishable_[A-Za-z0-9_-]{10,}/) || anonJwt(text);
+  if (!supabaseUrl || !key) {
+    throw problem(
+      'no-backend',
+      'I could not find a Supabase address and public key in ' + appUrl + '. ' +
+        'If this app has no database, there is nothing here to read; if it does, ' +
+        'point me at the page that actually loads it.',
+    );
+  }
+  return { supabaseUrl: supabaseUrl, key: key, tables: tableNames(text), from: 'app', appUrl: appUrl };
+}
+
+/**
+ * Can a stranger read this table? Asked for the count alone, so no row is ever
+ * pulled out of the live database.
+ *
+ * Readable, protected, absent, or unclear - never guessed. A 200 means the
+ * anon key was allowed to read it; a 401 or 403 means row level security
+ * turned it away; a 404 means the table is not exposed through the API at all.
+ */
+async function readable(restUrl, key, table, options) {
+  const opts = options || {};
+  const doFetch = opts.fetch || fetch;
+  const url = restUrl + '/' + encodeURIComponent(table) + '?select=*&limit=0';
+  let res;
+  try {
+    res = await doFetch(url, {
+      method: 'GET',
+      headers: { apikey: key, Authorization: 'Bearer ' + key, Prefer: 'count=exact' },
+    });
+  } catch (err) {
+    return { table: table, status: 0, verdict: 'unclear', why: 'the request could not be made: ' + err.message };
+  }
+  // The body is read and dropped without being kept, so even a server that
+  // ignores the count-only request never leaves a customer's row in memory
+  // here longer than it takes to throw it away.
+  await res.text().catch(() => '');
+
+  // The one distinction that matters, and the one it is easy to get wrong.
+  //
+  //   200 with a count above zero  ->  a stranger really did read real rows.
+  //                                    Proven. This is the finding.
+  //   200 with a count of zero     ->  a stranger was allowed to ask, and got
+  //                                    nothing. That is ALSO exactly what a
+  //                                    correctly protected table returns to a
+  //                                    stranger - row level security filters the
+  //                                    rows, it does not refuse the request. So
+  //                                    an empty answer proves nothing either way,
+  //                                    and must never be reported as a leak.
+  //   401 or 403                   ->  the table's own grants turned the key
+  //                                    away before any rule ran.
+  //   404                          ->  not exposed through the API at all.
+  if (res.status === 200 || res.status === 206) {
+    const count = rangeCount(res.headers);
+    if (count && count > 0) return { table: table, status: res.status, verdict: 'readable', count: count };
+    // Allowed to ask, nothing came back. Cannot be told from good security
+    // with no rows in the table. The deep scan, which seeds its own rows,
+    // settles it; from outside it stays open.
+    return { table: table, status: res.status, verdict: 'empty', count: count == null ? 0 : count };
+  }
+  if (res.status === 401 || res.status === 403) {
+    return { table: table, status: res.status, verdict: 'protected' };
+  }
+  if (res.status === 404) {
+    return { table: table, status: res.status, verdict: 'absent' };
+  }
+  return { table: table, status: res.status, verdict: 'unclear' };
+}
+
+/**
+ * Every table the app names, asked the one question, turned into the same kind
+ * of finding scan.js produces - so `finding.describeAll` reports both the same
+ * way. The count-only proof is carried through so the wording never claims a
+ * row was pulled that was not.
+ */
+async function prowl(target, options) {
+  const opts = options || {};
+  const tables = dedupe(target.tables || []);
+  if (!tables.length) {
+    return {
+      findings: [], attempted: [], protectedTables: [], emptyTables: [], absent: [], unclear: [],
+      note: 'the app did not name any tables I could find, so I had nothing to ask about',
+    };
+  }
+  const restUrl = restBase(target.supabaseUrl);
+  const findings = [];
+  const attempted = [];
+  const protectedTables = [];
+  const emptyTables = [];
+  const absent = [];
+  const unclear = [];
+
+  for (const table of tables) {
+    const seen = await readable(restUrl, target.key, table, opts);
+    attempted.push(table);
+    if (seen.verdict === 'readable') {
+      findings.push({
+        kind: 'exposed',
+        table: table,
+        readable: seen.count,
+        countOnly: true, // read over the network, count only - see finding.js
+        columns: [], //     no row was pulled, so nothing is claimed about contents
+        who: 'anyone',
+        rlsEnabled: null,
+      });
+    } else if (seen.verdict === 'protected') {
+      protectedTables.push(table);
+    } else if (seen.verdict === 'empty') {
+      // Allowed to ask, nothing came back. Not proof of a leak, and not proof
+      // of safety either - carried separately so the report can say plainly
+      // that this one could not be settled from outside.
+      emptyTables.push(table);
+    } else if (seen.verdict === 'absent') {
+      absent.push(table);
+    } else {
+      unclear.push({ table: table, why: seen.why || ('the server answered ' + seen.status) });
+    }
+  }
+  return {
+    findings: findings, attempted: attempted, protectedTables: protectedTables,
+    emptyTables: emptyTables, absent: absent, unclear: unclear,
+  };
+}
+
+/* -------------------------------------------------------------------------- */
+
+function problem(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+
+async function getText(doFetch, url) {
+  const res = await doFetch(url, { headers: { 'user-agent': 'kryptheon-night' } });
+  if (!res.ok) throw problem('unreachable', 'I could not read ' + url + ' (it answered ' + res.status + ')');
+  return res.text();
+}
+
+// <script src="/assets/index-xxxx.js"> and the module-preload links, made
+// absolute against the app's own address.
+function scriptUrls(html, appUrl) {
+  const out = [];
+  const re = /(?:src|href)\s*=\s*["']([^"']+\.js)["']/gi;
+  let m;
+  while ((m = re.exec(html))) {
+    try {
+      out.push(new URL(m[1], appUrl).href);
+    } catch (err) {
+      /* a src that is not a URL is not a script we can read */
+    }
+  }
+  return dedupe(out);
+}
+
+function firstMatch(text, re) {
+  const m = String(text).match(re);
+  return m ? m[0] : null;
+}
+
+// A Supabase anon key in the older JWT form: three base64url parts, the middle
+// one decoding to a payload whose role is "anon". Checked, not assumed, so a
+// service_role key that leaked into a bundle is never sent as if it were the
+// public one.
+function anonJwt(text) {
+  const re = /eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g;
+  let m;
+  while ((m = re.exec(text))) {
+    try {
+      const payload = JSON.parse(Buffer.from(m[0].split('.')[1], 'base64').toString('utf8'));
+      if (payload && payload.role === 'anon') return m[0];
+    } catch (err) {
+      /* not a JWT we can read */
+    }
+  }
+  return null;
+}
+
+// The tables the app talks to, from the Supabase client calls the bundle is
+// full of: .from("bookings"), .from('profiles').
+function tableNames(text) {
+  const out = [];
+  const re = /\.from\(\s*["'`]([a-zA-Z_][a-zA-Z0-9_]*)["'`]\s*\)/g;
+  let m;
+  while ((m = re.exec(text))) out.push(m[1]);
+  return dedupe(out);
+}
+
+function dedupe(list) {
+  return Array.from(new Set((list || []).filter(Boolean)));
+}
+
+// PostgREST returns the total in a Content-Range header shaped "0-0/1234", or
+// "*/0" when there is nothing. Null when the server did not send one.
+function rangeCount(headers) {
+  const range = headers && typeof headers.get === 'function' ? headers.get('content-range') : null;
+  if (!range) return null;
+  const m = String(range).match(/\/(\d+)\s*$/);
+  return m ? Number(m[1]) : null;
+}
+
+/**
+ * The report, as lines. Its own, not the deep scan's: that one says "I built a
+ * copy and attacked the copy", which is not what happened here, and a report
+ * that describes a different attack than the one that ran is lying about
+ * where its limits are.
+ *
+ * The part that matters most is at the end: what could not be tested from
+ * outside. A stranger's view settles one question - can anyone read this - and
+ * only for tables that have rows in them. Everything else needs a copy of the
+ * database, and a quiet result here must never be read as "the app is safe".
+ */
+function reportLines(found, result) {
+  const out = [];
+  const say = (text) => out.push(text === '' ? '' : '  ' + text);
+  const rule = () => say('-'.repeat(68));
+  const findings = finding.describeAll(result.findings || []);
+  const asked = (result.attempted || []).length;
+
+  say('');
+  say('App:       ' + (found.appUrl || '(given directly)'));
+  say('Database:  ' + found.supabaseUrl);
+  say('Tables I found in your app\'s code: ' + (asked ? (result.attempted || []).join(', ') : 'none'));
+
+  if (!asked) {
+    say('');
+    say('Your app\'s code does not name any table I could find, so there was');
+    say('nothing to ask about. This does NOT mean your data is safe - only that');
+    say('I could not see which tables to test from outside.');
+  } else if (findings.length) {
+    say('');
+    say(findings.length + (findings.length === 1 ? ' problem' : ' problems') + ' found.');
+    for (const item of findings) {
+      say('');
+      rule();
+      say(item.severity + '   ' + item.table);
+      say('');
+      say(item.headline);
+      say('');
+      for (const paragraph of [item.body, item.cause]) {
+        wrap(paragraph, 70).forEach((l) => say(l));
+        say('');
+      }
+      say('Paste this into Cursor, Claude, Windsurf or your AI tool:');
+      say('');
+      item.fixPrompt.split('\n').forEach((l) => out.push('    ' + l));
+    }
+  } else {
+    say('');
+    say('A stranger could not read rows from any table that had rows in it.');
+  }
+
+  const empty = result.emptyTables || [];
+  const shut = result.protectedTables || [];
+  const unclear = result.unclear || [];
+
+  say('');
+  rule();
+  say('How this was done');
+  say('');
+  wrap(
+    'Over the internet, as a stranger, with only the public key your app ' +
+    'already hands every visitor. I asked each table for a count and nothing ' +
+    'else, so no customer\'s row was pulled out, and nothing was written.',
+    70,
+  ).forEach((l) => say(l));
+
+  say('');
+  rule();
+  say('What I could NOT test from outside');
+  say('');
+  if (empty.length) {
+    wrap(
+      'Could not tell: ' + empty.join(', ') + '. A stranger was allowed to ask ' +
+      'and got no rows back - which is what a well protected table looks like, ' +
+      'and also what an open but empty one looks like. From outside there is ' +
+      'no way to tell them apart.',
+      70,
+    ).forEach((l) => say(l));
+    say('');
+  }
+  if (unclear.length) {
+    say('Got an answer I could not read: ' + unclear.map((u) => u.table).join(', ') + '.');
+    say('');
+  }
+  if (shut.length) {
+    say('Refused a stranger outright: ' + shut.join(', ') + '.');
+    say('');
+  }
+  wrap(
+    'Whether one signed-in customer can read another\'s rows, whether anyone ' +
+    'can add, change or delete rows, and whether the same thing can be saved ' +
+    'twice at once. Those change data, so they are only ever done on a copy of ' +
+    'your database. For that, and to settle the tables above:',
+    70,
+  ).forEach((l) => say(l));
+  say('');
+  say('    npx kryptheon-night');
+  say('');
+  wrap(
+    'It asks for your database connection string (Supabase: Project Settings, ' +
+    'Database). Lovable Cloud does not hand that string out.',
+    70,
+  ).forEach((l) => say(l));
+  say('');
+  return out;
+}
+
+module.exports = {
+  reportLines: reportLines,
+  restBase: restBase,
+  discover: discover,
+  readable: readable,
+  prowl: prowl,
+  // exported for the checks
+  scriptUrls: scriptUrls,
+  tableNames: tableNames,
+  anonJwt: anonJwt,
+  rangeCount: rangeCount,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -13,6 +13,7 @@
     "schema.js",
     "attack.js",
     "finding.js",
+    "outside.js",
     "collision.js",
     "tamper.js",
     "orphan.js",
@@ -23,18 +24,21 @@
     "README.md",
     "installer.js",
     "sqlengine.js",
-    "engine.sql"
+    "engine.sql",
+    "store.js"
   ],
   "engines": {
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node loop.check.js",
-    "check:dry": "node package.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node loop.check.js",
+    "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
+    "check:store": "node store.check.js",
     "check:trouble": "node trouble.check.js",
     "check:intro": "node intro.check.js",
     "check:report": "node finding.check.js",
+    "check:outside": "node outside.check.js",
     "check:recheck": "node recheck.check.js",
     "check:copy": "node schema.check.js",
     "check:collision": "node collision.check.js",

package/scan.js

@@ -21,11 +21,26 @@ const collision = require('./collision.js');
 const tamper = require('./tamper.js');
 const orphan = require('./orphan.js');
 const recheck = require('./recheck.js');
-
-// Where the last run is kept so the next one has something to compare against.
-// Beside the person's own project, not in a temp folder, because a re-check a
-// week later has to find it.
-const LAST_RUN = '.kryptheon-last.json';
+const store = require('./store.js');
+
+// Where the last run is kept so the next one has something to compare against:
+// the project's store under ~/.kryptheon, not a temp folder, because a
+// re-check a week later has to find it - and not the project, because a saved
+// run lists one app's tables and exactly where it is weak, which is the last
+// thing that should ever be committed. It used to be .kryptheon-last.json in
+// the project; the store moves one it finds there, once, and says so.
+//
+// Throws when the store cannot be made: a run that could not be saved would
+// leave the next re-check nothing to hold anyone to.
+function lastRunFile(say) {
+  const opened = store.open(process.cwd());
+  const lines = store.migrationLines(opened);
+  if (lines.length && say) {
+    say('');
+    lines.forEach(say);
+  }
+  return opened.nightLast;
+}
 
 const line = (text) => process.stdout.write(text + '\n');
 
@@ -530,7 +545,17 @@ async function main() {
     process.exit(2);
   }
 
-  const file = path.resolve(LAST_RUN);
+  let file;
+  try {
+    file = lastRunFile(line);
+  } catch (err) {
+    // 2, not 1: nothing was attacked, so nothing "got through".
+    console.error('');
+    console.error('  There is nowhere to keep this run (' + err.message + ').');
+    console.error('  Set KRYPTHEON_HOME to a folder you can write to, and run this again.');
+    console.error('');
+    process.exit(2);
+  }
   const before = again ? loadLastRun(file) : null;
   if (again && !before) {
     // Running a fresh scan and calling it a re-check would report every
@@ -595,6 +620,6 @@ module.exports = {
   saveRun: saveRun,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
-  LAST_RUN: LAST_RUN,
+  lastRunFile: lastRunFile,
   ABANDONED_AFTER: ABANDONED_AFTER,
 };

package/store.js

@@ -0,0 +1,317 @@
+// Where Kryptheon keeps what it remembers about a project.
+//
+// It used to be the project itself: kryptheon-baselines.json,
+// kryptheon-history.jsonl, test-results/ and .kryptheon-last.json all appeared
+// next to the person's own code. A plain landing page picked up six or seven
+// files that way, and an AI assistant that commits "everything that changed"
+// commits them too - the repo grows because Kryptheon is watching it.
+//
+// So every record now lives in one folder per project, outside it:
+//
+//   ~/.kryptheon/projects/<folder-name>-<hash>/     (KRYPTHEON_HOME moves ~/.kryptheon)
+//     project.json    which folder this store belongs to
+//     baselines.json  was kryptheon-baselines.json
+//     history.jsonl   was kryptheon-history.jsonl
+//     test-results/   was test-results/ (Playwright's screenshots of a failure)
+//     night-last.json was .kryptheon-last.json (kryptheon-night)
+//
+// Only tests/ - the recordings the person made - stays in the project.
+//
+// The hash is of the project's full path, so two folders that happen to share
+// a name are never mixed. kryptheon-night carries a copy of this file and must
+// land in the same folder for the same project; both packages check the ids
+// below against the same fixed examples, so the two copies cannot drift apart.
+//
+// Records an older version left in a project are moved here the first time a
+// project is opened, and only moved: nothing is thrown away, and when both
+// places already hold a file the project's copy is kept in parked/ rather than
+// overwriting what is here.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+
+const HOME_ENV = 'KRYPTHEON_HOME';
+
+const FILES = {
+  project: 'project.json',
+  baselines: 'baselines.json',
+  history: 'history.jsonl',
+  testResults: 'test-results',
+  nightLast: 'night-last.json',
+};
+
+// What older versions wrote into the project, and where each one goes now.
+//   append - history: lines the store does not have yet are added to it
+//   park   - both exist: the project's copy goes to parked/, the store's stays
+const LEGACY = [
+  { from: 'kryptheon-baselines.json', to: FILES.baselines, onBoth: 'park' },
+  { from: 'kryptheon-history.jsonl', to: FILES.history, onBoth: 'append' },
+  { from: '.kryptheon-last.json', to: FILES.nightLast, onBoth: 'park' },
+  { from: 'test-results', to: FILES.testResults, onBoth: 'park', dir: true },
+];
+
+// A project with a Playwright config of its own owns its test-results/ -
+// Playwright's default output folder. Moving that would take the person's own
+// screenshots away, so it is left exactly where it is.
+const OWN_PLAYWRIGHT = /^playwright\.config\.(js|cjs|mjs|ts|cts|mts)$/;
+
+/** ~/.kryptheon, or wherever KRYPTHEON_HOME points. */
+function home(env) {
+  const source = env || process.env;
+  const set = source[HOME_ENV];
+  if (set && String(set).trim()) return path.resolve(String(set).trim());
+  return path.join(os.homedir(), '.kryptheon');
+}
+
+/** The project folder as one exact path, whatever form it was given in. */
+function canonicalRoot(dir) {
+  const resolved = path.resolve(dir || process.cwd());
+  try {
+    return fs.realpathSync.native(resolved);
+  } catch (err) {
+    return resolved;
+  }
+}
+
+/**
+ * <folder-name>-<12 hex>. Pure: the same path always gives the same id.
+ *
+ * Windows paths are compared without regard to case, because C:\Users\a and
+ * c:\users\a are the same folder there and must be the same project.
+ */
+function projectId(root, platform) {
+  const plat = platform || process.platform;
+  const P = plat === 'win32' ? path.win32 : path.posix;
+  // resolve() also drops a trailing separator and turns / into \ on Windows.
+  let key = P.resolve(String(root));
+  if (plat === 'win32') key = key.toLowerCase();
+  const hash = crypto.createHash('sha256').update(key, 'utf8').digest('hex').slice(0, 12);
+  const base = P.basename(key) || 'project';
+  const name = base.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[-.]+|-+$/g, '').slice(0, 40) || 'project';
+  return name + '-' + hash;
+}
+
+/**
+ * The store folder for a project. Only reads: nothing is created or moved, so
+ * the fixture and the reporter can ask for it just by being loaded.
+ */
+function dirFor(dir, env) {
+  const root = canonicalRoot(dir);
+  const short = path.join(home(env), 'projects', projectId(root));
+  const owner = readProject(path.join(short, FILES.project));
+  if (!owner || !owner.root || sameRoot(owner.root, root)) return short;
+  // Two different folders with the same short hash. Astronomically rare, but
+  // the one thing a store must never do is hold two projects, so the second
+  // one gets the full hash instead.
+  const full = crypto.createHash('sha256').update(root, 'utf8').digest('hex');
+  return short.replace(/-[0-9a-f]{12}$/, '-' + full);
+}
+
+/** Every file in a project's store, by name. Only reads, like dirFor. */
+function pathsFor(dir, env) {
+  return pathsIn(dirFor(dir, env));
+}
+
+function pathsIn(dir) {
+  return {
+    dir: dir,
+    project: path.join(dir, FILES.project),
+    baselines: path.join(dir, FILES.baselines),
+    history: path.join(dir, FILES.history),
+    testResults: path.join(dir, FILES.testResults),
+    nightLast: path.join(dir, FILES.nightLast),
+  };
+}
+
+function exists(file) {
+  try {
+    fs.lstatSync(file);
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
+function hasOwnPlaywright(root) {
+  try {
+    return fs.readdirSync(root).some((name) => OWN_PLAYWRIGHT.test(name));
+  } catch (err) {
+    return false;
+  }
+}
+
+// rename is the whole move when both sides are on one drive. Across drives it
+// fails with EXDEV, and then it is copy, check the copy, and only then remove.
+function move(from, to, isDir) {
+  try {
+    fs.renameSync(from, to);
+    return;
+  } catch (err) {
+    // Anything else - a file held open by an editor, say - is reported and the
+    // record stays where it is, whole.
+    if (err.code !== 'EXDEV') throw err;
+  }
+  if (isDir) {
+    fs.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+    fs.rmSync(from, { recursive: true, force: true });
+    return;
+  }
+  const tmp = to + '.moving';
+  fs.copyFileSync(from, tmp);
+  if (fs.statSync(tmp).size !== fs.statSync(from).size) {
+    fs.rmSync(tmp, { force: true });
+    throw new Error('the copy of ' + from + ' came out a different size');
+  }
+  fs.renameSync(tmp, to);
+  fs.rmSync(from, { force: true });
+}
+
+// Lines of the project's history the store does not have yet, in their order.
+// Checked line by line so moving twice - say the project file could not be
+// removed the first time - never writes a run down twice.
+function appendHistory(from, to) {
+  const have = new Set(fs.readFileSync(to, 'utf8').split('\n').filter((l) => l.trim()));
+  const extra = fs.readFileSync(from, 'utf8').split('\n').filter((l) => l.trim() && !have.has(l));
+  if (extra.length) {
+    const current = fs.readFileSync(to, 'utf8');
+    const lead = current.length && !current.endsWith('\n') ? '\n' : '';
+    fs.appendFileSync(to, lead + extra.join('\n') + '\n', 'utf8');
+  }
+  fs.rmSync(from, { force: true });
+  return extra.length;
+}
+
+function stamp(now) {
+  return (now || new Date()).toISOString().replace(/[:.]/g, '-');
+}
+
+/**
+ * Moves what an older version left in the project into the store.
+ * Returns { moved: [names], parked: [{ name, to }], appended: [{ name, lines }],
+ * kept: [{ name, why }], failed: [{ name, why }] }.
+ */
+function migrate(root, dir, options) {
+  const out = { moved: [], parked: [], appended: [], kept: [], failed: [] };
+  const ownPlaywright = hasOwnPlaywright(root);
+  for (const item of LEGACY) {
+    const from = path.join(root, item.from);
+    if (!exists(from)) continue;
+    const label = item.from + (item.dir ? '/' : '');
+    if (item.dir && ownPlaywright) {
+      out.kept.push({ name: label, why: 'this project has its own Playwright config, so it is theirs' });
+      continue;
+    }
+    const to = path.join(dir, item.to);
+    try {
+      if (!exists(to)) {
+        move(from, to, item.dir);
+        out.moved.push(label);
+      } else if (item.onBoth === 'append') {
+        out.appended.push({ name: label, lines: appendHistory(from, to) });
+      } else {
+        const parkedDir = path.join(dir, 'parked');
+        fs.mkdirSync(parkedDir, { recursive: true });
+        const parked = path.join(parkedDir, stamp(options && options.now) + '-' + item.from.replace(/^\./, ''));
+        move(from, parked, item.dir);
+        out.parked.push({ name: label, to: parked });
+      }
+    } catch (err) {
+      out.failed.push({ name: label, why: err.message });
+    }
+  }
+  return out;
+}
+
+/**
+ * The store for the project in `dir` (default: the current folder), created if
+ * it is not there yet, with anything an older version left in the project moved
+ * into it. Safe to call again: once moved, there is nothing left to move.
+ *
+ * Throws when the store cannot be created. A record that silently cannot be
+ * written makes every run look like the first one - which reads as "nothing to
+ * compare against, all fine" - so that is never swallowed here.
+ */
+function open(dir, options) {
+  const env = (options && options.env) || process.env;
+  const root = canonicalRoot(dir);
+  const storeDir = dirFor(root, env);
+  fs.mkdirSync(storeDir, { recursive: true });
+  const paths = pathsIn(storeDir);
+  if (!exists(paths.project)) {
+    fs.writeFileSync(paths.project, JSON.stringify({
+      root: root,
+      name: path.basename(root),
+      id: path.basename(storeDir),
+      createdAt: new Date().toISOString(),
+    }, null, 2) + '\n', 'utf8');
+  }
+  return Object.assign({ root: root, id: path.basename(storeDir) }, paths, {
+    migration: migrate(root, storeDir, options),
+  });
+}
+
+function sameRoot(a, b, platform) {
+  const plat = platform || process.platform;
+  const norm = (p) => {
+    const r = path.resolve(String(p)).replace(/[\\/]+$/, '');
+    return plat === 'win32' ? r.split('/').join('\\').toLowerCase() : r;
+  };
+  return norm(a) === norm(b);
+}
+
+function readProject(file) {
+  try {
+    let raw = fs.readFileSync(file, 'utf8');
+    if (raw.charCodeAt(0) === 0xfeff) raw = raw.slice(1);
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch (err) {
+    return null;
+  }
+}
+
+/** What to tell the person about a migration, or nothing when nothing moved. */
+function migrationLines(store) {
+  const m = store && store.migration;
+  if (!m) return [];
+  const lines = [];
+  const movedNames = m.moved.concat(m.appended.map((a) => a.name)).concat(m.parked.map((p) => p.name));
+  if (movedNames.length) {
+    lines.push('  Kryptheon now keeps its records outside your project, so they can never');
+    lines.push('  end up in your repo. Moved out of this folder:');
+    for (const name of movedNames) lines.push('    ' + name);
+    lines.push('  They are now in:');
+    lines.push('    ' + store.dir);
+    for (const p of m.parked) {
+      lines.push('  ' + p.name + ' was already there too, so this folder\'s copy is kept aside in:');
+      lines.push('    ' + p.to);
+    }
+    lines.push('');
+  }
+  for (const k of m.kept) {
+    lines.push('  Left ' + k.name + ' where it is: ' + k.why + '.');
+    lines.push('');
+  }
+  for (const f of m.failed) {
+    lines.push('  Could not move ' + f.name + ' out of this folder: ' + f.why);
+    lines.push('  It is still here. Close anything that has it open and run this again.');
+    lines.push('');
+  }
+  return lines;
+}
+
+module.exports = {
+  HOME_ENV: HOME_ENV,
+  FILES: FILES,
+  LEGACY: LEGACY,
+  home: home,
+  canonicalRoot: canonicalRoot,
+  projectId: projectId,
+  dirFor: dirFor,
+  pathsFor: pathsFor,
+  open: open,
+  migrate: migrate,
+  migrationLines: migrationLines,
+};