penthera 1.6.0 → 1.7.0

package/src/cli.js

@@ -51,10 +51,11 @@ function shouldRunOnboarding(positionals, opts) {
 }
 
 const HELP = `
-  ${bold("penthera")} v${pkg.version} \u2014 lightweight security scanner
+  ${bold("penthera")} v${pkg.version}: Cyber Security Agent. Open-source security for the apps and AI systems you ship
 
   ${dim("Usage")}
-    $ penthera                        Interactive setup (TTY, no args needed)
+    $ penthera                        Setup wizard: detect, check, set up (TTY, no args)
+    $ penthera init [--yes] [--dry-run]  The same wizard, also non-interactive
     $ penthera <url>                 Scan a live URL (black-box)
     $ penthera --repo <path>         Scan a local repo (white-box)
     $ penthera <url> --repo <path>   Full scan (both)
@@ -168,7 +169,20 @@ const HELP = `
 function bold(s) { return `\x1b[1m${s}\x1b[0m`; }
 function dim(s) { return `\x1b[2m${s}\x1b[0m`; }
 
+/** `penthera init ...`, or bare `penthera --yes` / `--dry-run`: the setup wizard. */
+function initArgs(argv) {
+  if (argv[0] === "init") return argv.slice(1);
+  if (argv.length && argv.every((a) => ["--yes", "-y", "--dry-run"].includes(a))) return argv;
+  return null;
+}
+
 export async function run() {
+  const init = initArgs(process.argv.slice(2));
+  if (init) {
+    const { runInit } = await import("./cli/onboarding.js");
+    process.exit(await runInit(init, { version: pkg.version }));
+  }
+
   if (process.argv[2] === "memory") {
     const { runMemoryCommand } = await import("./cli/memory.js");
     process.exit(await runMemoryCommand(process.argv.slice(3)));
@@ -389,9 +403,8 @@ export async function run() {
   }
 
   if (shouldRunOnboarding(positionals, opts)) {
-    const { runOnboarding } = await import("./cli/onboarding.js");
-    await runOnboarding();
-    return;
+    const { runInit } = await import("./cli/onboarding.js");
+    process.exit(await runInit([], { version: pkg.version }));
   }
 
   // `penthera agents [path]`: offline audit of skills, MCP servers, hooks, plugins.

package/src/ui/api/data.js

@@ -15,6 +15,7 @@ import { referencesFor } from "../../../lib/references.js";
 import { planFixes, redactPlan } from "../../../lib/fix/index.js";
 import { verifyEvidence, MANIFEST, SIGNATURE, SCHEMA as EVIDENCE_SCHEMA } from "../../report/evidence.js";
 import { writeEvidence } from "../../cli/report-outputs.js";
+import { createGit } from "../../agent/git.js";
 import { formatAudienceReport, AUDIENCES } from "../../report/audience.js";
 import {
   classify, buildOverview, buildFindings, locateFinding, findingDetail, buildDeps, buildAi, memoryStats, loopSummary,
@@ -216,6 +217,35 @@ export function createDataSource({ projects, reportsDir, home, memoryRoot, setti
       return { ...detail, id, project, sources, fix, file: hit.report.name, explain: explainFinding(hit.finding, hit.report.data) };
     },
 
+    /**
+     * The Environment card: which folder a project maps to, its git branch and
+     * HEAD, local penthera/fix-* branches, and the hosts its latest scan
+     * contacted. Git is read through the agent's hardened runner
+     * (src/agent/git.js: allow-listed subcommands, hooks and fsmonitor off).
+     */
+    env(project) {
+      let folder = null;
+      if (typeof project === "string" && project.startsWith("/")) {
+        try { folder = confineDir(project, projectRoots); } catch { folder = null; }
+      }
+      const out = { folder, branch: null, head: null, fixBranches: [], hosts: [], blocked: [] };
+      if (folder) {
+        const git = createGit(folder);
+        out.branch = git.tryRun("symbolic-ref", "--quiet", "--short", "HEAD")?.trim() || null;
+        out.head = git.tryRun("rev-parse", "--short", "HEAD")?.trim() || null;
+        const refs = git.tryRun("show-ref", "--heads") || "";
+        out.fixBranches = refs.split("\n").map((l) => l.split(" ")[1] || "").filter((r) => r.startsWith("refs/heads/penthera/fix-"))
+          .map((r) => r.replace("refs/heads/", "")).slice(-10).reverse();
+      }
+      const latest = latestScan(scan().scans, project);
+      const e = latest?.data?.egress;
+      if (e) {
+        out.hosts = (e.hosts || []).slice(0, 12).map((h) => ({ host: String(h.host).slice(0, 255), requests: h.requests || 0, thirdParty: (e.thirdPartyHosts || []).some((t) => t.host === h.host) }));
+        out.blocked = (e.blocked || []).slice(0, 8).map((h) => ({ host: String(h.host).slice(0, 255), requests: h.requests || 0 }));
+      }
+      return out;
+    },
+
     history(project, a, b) {
       return buildScanHistory(scan().scans, project, a, b);
     },

package/src/ui/api/demo.js

@@ -307,6 +307,19 @@ export function createDemoSource({ settings, version = "dev" }) {
       };
     },
     history: (project, a, b) => buildScanHistory(scans, project, a, b),
+    env(project) {
+      const latest = latestScan(scans, project);
+      const e = latest?.data?.egress;
+      const isRepo = String(project).startsWith("/");
+      return {
+        folder: isRepo ? project : null,
+        branch: isRepo ? "main" : null,
+        head: isRepo ? "4be9c1f" : null,
+        fixBranches: isRepo ? loops.map((l) => l.loopRun.branch.fix) : [],
+        hosts: (e?.hosts || []).map((h) => ({ ...h, thirdParty: (e.thirdPartyHosts || []).some((t) => t.host === h.host) })),
+        blocked: e?.blocked || [],
+      };
+    },
     createEvidence(project) {
       const latest = latestScan(scans, project);
       if (!latest) return null;

package/src/ui/api/routes.js

@@ -75,6 +75,7 @@ export function createApi({ source, runs, version, settings }) {
       if (!r) throw new RunError("No scan report for that project yet. Run a scan first.", 404);
       return r;
     }],
+    ["GET", /^\/api\/env$/, (_m, q) => source.env(String(q.get("project") || ""))],
     ["GET", /^\/api\/deps$/, () => source.deps()],
     ["GET", /^\/api\/ai$/, () => source.ai()],
     ["GET", /^\/api\/memory$/, () => ({ projects: source.memory() })],