npmguard-cli 0.5.4 → 0.5.6

package/dist/commands/install.js

@@ -18,7 +18,7 @@ const ogGalileo = defineChain({
 });
 const IPFS_GATEWAY = "https://gateway.pinata.cloud/ipfs";
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
-const DEFAULT_AUDIT_API_URL = "http://209.38.42.28:8000/audit";
+const DEFAULT_ENGINE_URL = "http://209.38.42.28:8000";
 const WALLETCONNECT_PROJECT_ID = process.env.WALLETCONNECT_PROJECT_ID ?? "d5eb170c427570e15ac00ae53acc93ba";
 const OG_RPC = "https://evmrpc-testnet.0g.ai";
 const BLOCK_EXPLORER = "https://chainscan-galileo.0g.ai";
@@ -304,21 +304,44 @@ export async function installCommand(packageSpec, auditSource, force = false) {
                     return askInstallWithoutAudit(packageSpec);
                 }
             }
-            // Trigger audit engine
-            const auditApiUrl = process.env.NPMGUARD_AUDIT_API_URL ?? DEFAULT_AUDIT_API_URL;
-            console.log(chalk.gray(`  Live dashboard: http://209.38.42.28:3000`));
-            console.log();
+            // Trigger audit engine (streaming endpoint)
+            const rawApiUrl = process.env.NPMGUARD_AUDIT_API_URL ?? DEFAULT_ENGINE_URL;
+            const engineBaseUrl = rawApiUrl.replace(/\/audit\/?$/, "");
+            const frontendUrl = process.env.NPMGUARD_FRONTEND_URL ?? engineBaseUrl.replace(":8000", ":3000");
             const auditSpinner = ora("  Running security audit...").start();
             try {
-                const resp = await fetch(auditApiUrl, {
+                const streamResp = await fetch(`${engineBaseUrl}/audit/stream`, {
                     method: "POST",
                     headers: { "Content-Type": "application/json" },
                     body: JSON.stringify({ packageName, version: requestedVersion }),
                 });
-                if (!resp.ok)
-                    throw new Error(`Audit engine returned ${resp.status}`);
-                const result = await resp.json();
+                if (!streamResp.ok)
+                    throw new Error(`Audit engine returned ${streamResp.status}`);
+                const { auditId } = await streamResp.json();
+                auditSpinner.text = "  Running security audit...";
+                console.log();
+                console.log(chalk.cyan(`  Live audit: ${frontendUrl}/audit/${auditId}`));
+                console.log();
+                // Poll for completion
+                let result;
+                const POLL_INTERVAL = 2000;
+                const POLL_TIMEOUT = 5 * 60_000;
+                const start = Date.now();
+                while (Date.now() - start < POLL_TIMEOUT) {
+                    const reportResp = await fetch(`${engineBaseUrl}/audit/${auditId}/report`);
+                    if (reportResp.status === 202) {
+                        await new Promise((r) => setTimeout(r, POLL_INTERVAL));
+                        continue;
+                    }
+                    if (!reportResp.ok)
+                        throw new Error(`Audit engine returned ${reportResp.status}`);
+                    result = await reportResp.json();
+                    break;
+                }
                 auditSpinner.stop();
+                if (!result) {
+                    throw new Error("Audit timed out");
+                }
                 console.log();
                 const verdict = (result.verdict ?? "UNKNOWN").toUpperCase();
                 const capabilities = result.capabilities ?? [];

package/dist/ens-source.js

@@ -3,8 +3,8 @@ import { sepolia } from "viem/chains";
 const RPC_URLS = process.env.SEPOLIA_RPC_URL
     ? [process.env.SEPOLIA_RPC_URL]
     : [
+        "https://sepolia.infura.io/v3/c087278b0ced40f5bea26b7536ebe9a1",
         "https://ethereum-sepolia-rpc.publicnode.com",
-        "https://rpc.sepolia.org",
         "https://sepolia.drpc.org",
     ];
 function makeClient(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npmguard-cli",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "type": "module",
   "description": "Check npm packages against NpmGuard security audits on ENS before installing",
   "bin": "./dist/index.js",