penthera 1.6.1 → 1.7.0

package/src/ui/static/js/right.js

@@ -0,0 +1,270 @@
+// The right panel: stacked cards (environment, memory, dependencies, AI
+// tooling, evidence, changes), or one finding's detail, or settings.
+import { h, clear, empty, sevBadge, diffBlock, announce } from "./dom.js";
+import { api } from "./api.js";
+import { state, set } from "./state.js";
+import { bars, SHADE } from "./charts.js";
+import { ago, shortProject, plural, pct } from "./format.js";
+import { EMPTY, KEYS } from "./copy.js";
+
+let seq = 0;
+
+export async function renderRight(el, ctx) {
+  const my = ++seq;
+  if (state.right === "finding" && state.finding) return findingView(el, ctx, my);
+  if (state.right === "settings") return settingsView(el, ctx, my);
+  return cardsView(el, ctx, my);
+}
+
+function card(title, aside, open, ...body) {
+  return h("details", { class: "card", open: open || null },
+    h("summary", {}, h("span", {}, title), aside ? h("span", { class: "aside" }, aside) : null),
+    h("div", { class: "card-body" }, ...body));
+}
+
+function head(title, ctx, extra) {
+  return h("div", { class: "detail-head" },
+    h("span", { class: "t1" }, title),
+    h("span", { class: "grow" }),
+    extra || null,
+    h("button", { type: "button", class: "icon", "aria-label": "Close (Esc)", title: "Close  Esc", onclick: () => set({ right: "cards", finding: null }) }, "×"));
+}
+
+// ── Cards ───────────────────────────────────────────────────────────────
+
+async function cardsView(el, ctx, my) {
+  const project = state.sel.kind === "project" ? state.sel.key : state.sel.kind === "past" ? state.sel.past?.target?.repo : state.sel.run?.repo || null;
+  const [env, mem, deps, ai, ev, settings] = await Promise.all([
+    api.get(`/api/env?project=${encodeURIComponent(project || "")}`),
+    api.get("/api/memory"), api.get("/api/deps"), api.get("/api/ai"), api.get("/api/evidence"), api.get("/api/settings"),
+  ]).catch((e) => { clear(el).append(h("p", { class: "pad error" }, e.message)); return []; });
+  if (my !== seq || !env) return;
+
+  clear(el).append(h("div", { class: "cards" },
+    envCard(env, settings, project, ctx),
+    memoryCard(mem.projects),
+    depsCard(deps),
+    aiCard(ai),
+    evidenceCard(ev.bundles, project, ctx),
+    changesCard(env, project),
+  ));
+}
+
+function envCard(env, settings, project, ctx) {
+  const sw = h("button", { type: "button", class: "switch", role: "switch", "aria-checked": String(settings.offline) }, h("span", {}, "Offline"), h("span", { class: "state" }, settings.offline ? "on" : "off"));
+  sw.addEventListener("click", async () => {
+    const s = await api.post("/api/settings", { offline: sw.getAttribute("aria-checked") !== "true" });
+    sw.setAttribute("aria-checked", String(s.offline));
+    sw.lastChild.textContent = s.offline ? "on" : "off";
+    announce(`Offline ${s.offline ? "on" : "off"}`);
+    ctx.refreshMeta?.();
+  });
+  return card("Environment", settings.offline ? "offline" : "online", true,
+    h("dl", { class: "kv" },
+      h("dt", {}, "folder"), h("dd", {}, env.folder || (project ? "a URL target" : state.meta?.projects?.[0] || "-")),
+      h("dt", {}, "branch"), h("dd", {}, env.branch ? `${env.branch}${env.head ? ` @ ${env.head}` : ""}` : "-"),
+      h("dt", {}, "bound to"), h("dd", {}, `${location.host}, no network`),
+    ),
+    sw,
+    h("p", { class: "muted" }, settings.offline ? "Scans started here contact only their target." : "Scans may also contact recon sources and fetch the Retire.js database."),
+    env.hosts.length ? h("div", {},
+      h("p", { class: "label" }, "Hosts the last scan contacted"),
+      h("ul", { class: "mini" }, env.hosts.map((x) => h("li", {}, h("span", { class: x.thirdParty ? "t1" : "ok" }, x.thirdParty ? "3P" : "OK"), h("span", { class: "grow" }, x.host), h("span", { class: "muted" }, String(x.requests))))),
+      env.blocked.length ? h("ul", { class: "mini" }, env.blocked.map((x) => h("li", {}, h("span", { class: "muted" }, "--"), h("span", { class: "grow muted" }, `${x.host} (blocked)`)))) : null,
+    ) : null,
+  );
+}
+
+function memoryCard(projects) {
+  if (!projects.length) return card("Memory", "", false, empty(EMPTY.memory));
+  const recipes = new Map();
+  for (const p of projects) for (const r of p.recipes) {
+    const c = recipes.get(r.recipe) || { verified: 0, failed: 0 };
+    c.verified += r.verified;
+    c.failed += r.failed;
+    recipes.set(r.recipe, c);
+  }
+  const broken = projects.filter((p) => p.chain !== "ok");
+  const ttf = projects.map((p) => p.medianTimeToFixDays).filter((x) => x != null);
+  return card("Memory", broken.length ? `${broken.length} broken` : "chain ok", false,
+    h("dl", { class: "kv" },
+      h("dt", {}, "chain"), h("dd", { class: broken.length ? "bad" : "ok" }, broken.length ? `[!] broken in ${plural(broken.length, "project")} :: ignored there` : "[OK] sha-256 hash chain"),
+      h("dt", {}, "events"), h("dd", {}, String(projects.reduce((n, p) => n + p.events, 0))),
+      h("dt", {}, "fixes"), h("dd", {}, `${projects.reduce((n, p) => n + p.verifiedFixes, 0)} verified · ${projects.reduce((n, p) => n + p.failedFixes, 0)} failed`),
+      h("dt", {}, "time to fix"), h("dd", {}, ttf.length ? `median ${Math.min(...ttf)}-${Math.max(...ttf)} days` : "-"),
+    ),
+    h("p", { class: "label" }, "Recipe success"),
+    bars([...recipes].map(([recipe, r]) => ({ label: recipe, value: r.verified })), { width: 10 }),
+    h("p", { class: "muted" }, [...recipes].map(([recipe, r]) => `${recipe} ${pct(r.verified / Math.max(1, r.verified + r.failed))}`).join(" · ")),
+  );
+}
+
+const CAP_SEV = { "install-scripts": "high", obfuscated: "high", "ai-config-write": "critical", "ai-cli-invoke": "critical", "token-harvest": "critical" };
+
+function depsCard(d) {
+  const l = d.latest;
+  if (!l) return card("Dependencies", "", false, empty(EMPTY.deps));
+  const diff = l.diff;
+  const gained = diff ? diff.upgraded.reduce((n, u) => n + u.gained.length, 0) + diff.added.reduce((n, a) => n + a.capabilities.length, 0) : 0;
+  const chip = (id, plus) => h("span", { class: `chip ${CAP_SEV[id] ? "inv" : ""}` }, `${plus ? "+" : ""}${id}`);
+  return card("Dependencies", `${l.ecosystem} · ${l.total} packages`, false,
+    h("dl", { class: "kv" },
+      h("dt", {}, "packages"), h("dd", {}, `${l.total} (${l.direct} direct) · ${l.lockfile}`),
+      h("dt", {}, "diff"), h("dd", {}, diff ? `+${diff.added.length} added · ~${diff.upgraded.length} upgraded · -${diff.removed.length} removed vs ${diff.base}` : "no base compared"),
+      h("dt", {}, "gained"), h("dd", {}, `${gained} capabilities`),
+      h("dt", {}, "typosquats"), h("dd", { class: l.typosquats.length ? "bad" : null }, l.typosquats.length ? l.typosquats.map((t) => `${t.name} ~ ${t.similarTo}`).join(", ") : "none"),
+    ),
+    diff ? h("ul", { class: "mini" },
+      diff.added.map((a) => h("li", { class: "stacked" }, h("span", {}, `+ ${a.name}@${a.version}`), h("span", { class: "chips" }, a.capabilities.slice(0, 4).map((c) => chip(c, true))))),
+      diff.upgraded.filter((u) => u.gained.length).map((u) => h("li", { class: "stacked" }, h("span", {}, `${u.name} ${u.from} → ${u.to}`), h("span", { class: "chips" }, u.gained.slice(0, 4).map((c) => chip(c, true)))))) : null,
+    h("p", { class: "label" }, "Capabilities in the tree"),
+    bars(Object.entries(l.capabilityCounts).filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1]).slice(0, 6).map(([id, n]) => ({ label: id, value: n, ch: SHADE[CAP_SEV[id] || "low"] })), { width: 10 }),
+    d.installs.length ? h("div", {},
+      h("p", { class: "label" }, "Install firewall"),
+      h("ul", { class: "mini" }, d.installs.slice(0, 5).map((i) => {
+        const deny = i.changes.some((c) => c.deny.length) || i.action === "refused";
+        return h("li", {}, h("span", { class: deny ? "bad" : i.clean ? "ok" : "t1" }, deny ? "REFUSED" : i.clean ? "CLEAN" : "APPROVED"), h("span", { class: "grow" }, i.specs.join(" ")), h("span", { class: "muted" }, ago(i.ts)));
+      }))) : null,
+  );
+}
+
+function aiCard(d) {
+  const l = d.latest;
+  if (!l) return card("AI tooling", "", false, empty(EMPTY.ai));
+  const lock = l.lock || {};
+  const drift = (lock.changed || 0) + (lock.added || 0) + (lock.removed || 0);
+  return card("AI tooling", `grade ${l.grade}`, false,
+    h("div", { class: "head" }, h("span", { class: `grade lg grade-${l.grade}` }, l.grade), h("div", {}, h("div", { class: "t1" }, `score ${l.score}/100`), h("div", { class: "muted" }, `${d.history.map((x) => x.grade).join(" → ")} · ${ago(l.ts)}`))),
+    h("dl", { class: "kv" },
+      h("dt", {}, "penthera.lock"), h("dd", { class: drift ? "bad" : null }, lock.status === "missing" ? "not pinned" : drift ? `${lock.changed || 0} changed · ${lock.added || 0} new · ${lock.removed || 0} removed` : "no drift"),
+      h("dt", {}, "inventory"), h("dd", {}, `${l.inventory.skills || 0} skills · ${l.inventory.mcpServers || 0} MCP · ${l.inventory.hooks || 0} hooks`),
+      h("dt", {}, "hidden content"), h("dd", { class: l.hidden.length ? "bad" : "ok" }, l.hidden.length ? `${l.hidden.length} hits` : "none"),
+    ),
+    l.hidden.length ? h("ul", { class: "mini" }, l.hidden.slice(0, 4).map((x) => h("li", {}, sevBadge(x.severity), h("span", { class: "grow" }, `${x.title} · ${x.location || ""}`)))) : null,
+  );
+}
+
+function evidenceCard(bundles, project, ctx) {
+  const target = project || state.overview?.projects?.[0]?.key || "";
+  const msg = h("p", { class: "muted", "aria-live": "polite" });
+  const out = h("div");
+  const create = h("button", { type: "button", class: "btn", disabled: !target || !state.overview?.projects?.some((p) => p.key === target) }, "Create bundle");
+  create.addEventListener("click", async () => {
+    create.disabled = true;
+    msg.textContent = "Writing the bundle and hashing every file…";
+    try {
+      const r = await api.post("/api/evidence/create", { project: target });
+      const v = await api.post("/api/evidence/verify", { id: r.id });
+      msg.textContent = `${r.path} :: ${v.ok ? "verified" : "verification failed"}`;
+      ctx.redrawRight();
+    } catch (e) { msg.textContent = e.message; create.disabled = false; }
+  });
+  const list = h("ul", { class: "mini" }, bundles.map((b) => {
+    const res = h("span", { class: "muted" }, b.signed ? "signed" : "unsigned");
+    const btn = h("button", { type: "button", class: "btn small" }, "Verify");
+    btn.addEventListener("click", async () => {
+      btn.disabled = true;
+      res.textContent = "hashing…";
+      const r = await api.post("/api/evidence/verify", { id: b.id }).catch((e) => ({ ok: false, problems: [e.message], files: [] }));
+      res.textContent = r.ok ? "[OK]" : `[!] ${plural(r.problems.length, "problem")}`;
+      res.className = r.ok ? "ok" : "bad";
+      clear(out).append(r.ok ? null : h("pre", { class: "block" }, r.problems.map((p) => `- ${p}`).join("\n")));
+      btn.disabled = false;
+    });
+    return h("li", {}, h("span", { class: "grow", title: b.target || "" }, `${b.path} · ${ago(b.generatedAt)}`), res, btn);
+  }));
+  return card("Evidence", plural(bundles.length, "bundle"), false,
+    target ? h("div", { class: "actions" },
+      h("span", { class: "muted grow" }, shortProject(target)),
+      create,
+      ...["auditor", "owner", "developer"].map((a) => h("a", { class: "btn small", href: `/api/report?${new URLSearchParams({ project: target, audience: a })}`, download: "" }, `${a}.md`)),
+    ) : null,
+    msg,
+    bundles.length ? list : empty(EMPTY.evidence),
+    out,
+  );
+}
+
+function changesCard(env, project) {
+  const past = state.runs.past.filter((l) => !project || l.target.repo === project || l.target.url === project);
+  const fixes = past.flatMap((l) => l.iterations.flatMap((it) => it.fixes.filter((f) => f.commit).map((f) => ({ ...f, branch: l.branch, at: l.startedAt }))));
+  return card("Changes", plural(fixes.length, "fix", "fixes"), false,
+    fixes.length ? h("ul", { class: "mini" }, fixes.slice(0, 12).map((f) => h("li", {},
+      h("span", { class: "ok" }, "OK"),
+      h("span", { class: "grow" }, f.title, h("span", { class: "muted" }, ` · ${f.branch}`)),
+      h("code", { class: "muted", title: `git show ${f.commit}` }, f.commit.slice(0, 7))))) : empty(EMPTY.changes),
+    env.fixBranches.length ? h("div", {}, h("p", { class: "label" }, "Local fix branches"), h("ul", { class: "mini" }, env.fixBranches.map((b) => h("li", {}, h("code", { class: "grow" }, b))))) : null,
+    h("p", { class: "muted" }, "Nothing is pushed. Review with git log --stat main..<branch>, then merge or push it yourself."),
+  );
+}
+
+// ── One finding ─────────────────────────────────────────────────────────
+
+async function findingView(el, ctx, my) {
+  const f = state.finding;
+  clear(el).append(head("Finding", ctx), h("p", { class: "pad muted" }, "Reading evidence…"));
+  let d;
+  try { d = await api.get(`/api/findings/${f.id}?project=${encodeURIComponent(f.project)}`); } catch (e) {
+    if (my === seq) clear(el).append(head("Finding", ctx), h("p", { class: "pad bad" }, e.message));
+    return;
+  }
+  if (my !== seq) return;
+  const x = d.explain || {};
+  const section = (label, ...body) => h("section", {}, h("p", { class: "label" }, label), ...body);
+  clear(el).append(
+    head("Finding", ctx),
+    h("div", { class: "detail" },
+      h("div", {}, sevBadge(d.severity), " ", h("span", { class: "chip" }, d.confidence || "unrated"), " ", d.category ? h("span", { class: "chip" }, d.category) : null),
+      h("h2", { tabindex: "-1" }, d.title),
+      h("dl", { class: "kv" },
+        h("dt", {}, "where"), h("dd", {}, d.location || "-"),
+        h("dt", {}, "project"), h("dd", {}, f.project),
+        h("dt", {}, "id"), h("dd", { class: "muted" }, d.id)),
+      h("div", { class: "plain", "aria-label": "In plain words" },
+        h("p", {}, h("b", {}, "In plain words :: "), (x.plainSeverity || d.severity) === "note" ? "a note, not a problem." : `a ${x.plainSeverity || d.severity} problem${d.category ? ` with ${d.category.replace(/-/g, " ")}` : ""}.`),
+        x.confidenceMeaning ? h("p", {}, h("b", {}, `How sure (${x.confidence}) :: `), x.confidenceMeaning) : null,
+        x.fixText ? h("p", {}, h("b", {}, "What to do :: "), x.fixText) : null,
+        x.owasp?.length ? h("p", { class: "muted" }, `Maps to ${x.owasp.join(" · ")}`) : null),
+      d.description ? section("What we saw", h("p", {}, d.description)) : null,
+      d.evidence ? section("Evidence", h("pre", { class: "block" }, d.evidence)) : null,
+      d.remediation ? section("How to fix", h("p", {}, d.remediation)) : null,
+      d.sources?.length ? section("Sources", h("ul", { class: "mini" }, d.sources.map((s) => h("li", {}, h("a", { href: s.url, target: "_blank", rel: "noopener noreferrer" }, s.cite))))) : null,
+      d.fix ? section("Fix recipe",
+        h("p", {}, h("span", { class: "ok" }, d.fix.recipe), ` :: ${d.fix.title}`),
+        diffBlock(d.fix.diff),
+        f.project.startsWith("/") ? h("div", { class: "actions" }, h("button", { type: "button", class: "btn primary", onclick: () => { set({ mode: "loop", sel: { kind: "project", key: f.project } }); ctx.focusBar("loop"); } }, "Fix it with the loop ▸")) : null)
+        : section("Fix recipe", h("p", { class: "muted" }, "No recipe matches. Fix it by hand, or run the loop with a local model (--fix-model) from the CLI.")),
+    ),
+  );
+}
+
+// ── Settings (behind the gear) ──────────────────────────────────────────
+
+async function settingsView(el, ctx, my) {
+  const [settings, mem] = await Promise.all([api.get("/api/settings"), api.get("/api/memory")]);
+  if (my !== seq) return;
+  const radios = ["dark", "light"].map((t) => {
+    const r = h("input", { type: "radio", name: "theme", value: t, checked: ctx.theme.get() === t });
+    r.addEventListener("change", () => ctx.theme.set(t));
+    return h("label", {}, r, h("span", {}, t === "dark" ? "Dark" : "Light"));
+  });
+  clear(el).append(
+    head("Settings", ctx),
+    h("div", { class: "detail" },
+      h("section", {}, h("p", { class: "label" }, "Theme"), h("div", { class: "seg", role: "radiogroup", "aria-label": "Theme" }, radios),
+        h("p", { class: "muted" }, "Remembered in this browser. The first visit follows your system.")),
+      h("section", {}, h("p", { class: "label" }, "Where data comes from"),
+        h("dl", { class: "kv" },
+          h("dt", {}, "reports"), h("dd", {}, state.meta.reportsDir),
+          h("dt", {}, "memory"), h("dd", {}, state.meta.memoryRoot),
+          h("dt", {}, "projects"), h("dd", {}, state.meta.projects.map((p) => h("div", {}, p)))),
+        h("p", { class: "muted" }, "Only these folders and ~/.penthera are read. Add folders with penthera ui --project <dir>.")),
+      h("section", {}, h("p", { class: "label" }, "Egress for scans started here"), h("p", {}, settings.offline ? "Offline: only the target." : "Online: target plus recon sources.")),
+      h("section", {}, h("p", { class: "label" }, "Memory chains"),
+        mem.projects.length ? h("ul", { class: "mini" }, mem.projects.map((p) => h("li", {}, h("span", { class: p.chain === "ok" ? "ok" : "bad" }, p.chain === "ok" ? "[OK]" : "[!]"), h("span", { class: "grow" }, p.label), h("span", { class: "muted" }, `${p.events} events`)))) : empty(EMPTY.memory)),
+      h("section", {}, h("p", { class: "label" }, "Keys"), h("dl", { class: "kv" }, KEYS.flatMap(([k, v]) => [h("dt", {}, h("kbd", {}, k)), h("dd", {}, v)]))),
+      h("section", {}, h("p", { class: "label" }, "Session"),
+        h("p", { class: "muted" }, `127.0.0.1 only · one-time link swapped for an HttpOnly, SameSite=Strict cookie · Host and Origin checked · strict CSP · ${state.meta.demo ? "demo data" : "local reports"}`)),
+    ),
+  );
+}

package/src/ui/static/js/state.js

@@ -0,0 +1,35 @@
+// One store for the single view. Renderers subscribe and redraw their column.
+export const state = {
+  meta: null,
+  overview: null,
+  findings: [],
+  runs: { live: [], past: [] },
+  sel: { kind: "all", key: null },   // all | project | run | past
+  finding: null,                     // { id, project } open in the right panel
+  right: "cards",                    // cards | finding | settings
+  query: "",
+  mode: "scan",
+  activeRun: null,                   // the live run object being streamed
+};
+
+const subs = new Set();
+export function on(fn) { subs.add(fn); return () => subs.delete(fn); }
+export function set(patch) {
+  Object.assign(state, patch);
+  for (const fn of subs) fn(patch);
+}
+
+/** Every project key: scanned targets first, then project folders with no scans yet. */
+export function projectKeys() {
+  const scanned = (state.overview?.projects || []).map((p) => p.key);
+  const folders = (state.meta?.projects || []).filter((f) => !scanned.includes(f));
+  return [...scanned, ...folders];
+}
+
+export const projectOf = (key) => (state.overview?.projects || []).find((p) => p.key === key) || null;
+
+/** The folder a run should use: the selected project if it is a folder, else the first project folder. */
+export function folderFor(key) {
+  if (key && key.startsWith("/")) return key;
+  return state.meta?.projects?.[0] || "";
+}

package/src/ui/static/js/views/ai.js

@@ -1,68 +0,0 @@
-import { h, put, panel, empty, sevBadge } from "../dom.js";
-import { bigGrade, sparkline, severityBars } from "../charts.js";
-import { ago } from "../format.js";
-import { SCREENS, EMPTY } from "../copy.js";
-
-const GRADE_SCORE = { A: 95, B: 80, C: 65, D: 50, F: 20 };
-
-export async function render(root, { api }) {
-  const d = await api.get("/api/ai");
-  put(root, 
-    h("h1", {}, SCREENS.ai.title),
-    h("p", { class: "lede" }, SCREENS.ai.lede),
-  );
-  const l = d.latest;
-  if (!l) {
-    put(root, h("div", { class: "notice" }, empty(EMPTY.ai)));
-    return;
-  }
-  const grid = h("div", { class: "grid" });
-  put(root, grid);
-
-  const lock = l.lock || {};
-  const drift = (lock.changed || 0) + (lock.added || 0) + (lock.removed || 0);
-  put(grid, panel("Agent config grade", { class: "span-4" },
-    h("div", { class: "filters" },
-      bigGrade(l.grade),
-      h("div", {},
-        h("div", { class: "big" }, h("span", { class: `grade-${l.grade}` }, `Grade ${l.grade}`)),
-        h("div", { class: "muted" }, `score ${l.score}/100`),
-        h("div", { class: "faint" }, `${l.home ? "repo + home config" : "repo config"} :: ${ago(l.ts)}`),
-      ),
-    ),
-    h("p", { class: "label" }, "Grade over time"),
-    sparkline(d.history.map((x) => x.score ?? GRADE_SCORE[x.grade]), { width: 260, height: 32, label: "agent config score", zero: false }),
-    h("p", { class: "panel-note" }, d.history.map((x) => x.grade).join(" → ")),
-  ));
-
-  const inv = l.inventory || {};
-  put(grid, panel("Inventory", { class: "span-4" },
-    h("dl", { class: "kv" }, ...[["skills", inv.skills], ["MCP servers", inv.mcpServers], ["hooks", inv.hooks], ["permissions", inv.permissions], ["plugins", inv.plugins], ["marketplaces", inv.marketplaces], ["instruction files", inv.instructionFiles]]
-      .flatMap(([k, v]) => [h("dt", {}, k), h("dd", {}, String(v ?? 0))])),
-  ));
-
-  put(grid, panel("penthera.lock drift", { class: "span-4" },
-    h("div", { class: "big" }, h("span", { class: drift ? "t1" : "ok" }, drift ? `${drift} drifted` : lock.status === "missing" ? "not pinned" : "no drift")),
-    h("dl", { class: "kv" },
-      h("dt", {}, "status"), h("dd", {}, lock.status || "-"),
-      h("dt", {}, "changed"), h("dd", { class: lock.changed ? "bad" : null }, String(lock.changed || 0)),
-      h("dt", {}, "new"), h("dd", { class: lock.added ? "bad" : null }, String(lock.added || 0)),
-      h("dt", {}, "removed"), h("dd", {}, String(lock.removed || 0)),
-      h("dt", {}, "pinned"), h("dd", {}, String(lock.entries || 0)),
-    ),
-    h("p", { class: "panel-note" }, "A pinned skill or server that changes after review is how a rug pull works. Diff it, then re-pin with penthera agents --pin."),
-  ));
-
-  put(grid, panel(`Hidden content (${l.hidden.length})`, { class: "span-7" },
-    l.hidden.length ? h("ul", { class: "list" }, l.hidden.map((x) => h("li", {},
-      sevBadge(x.severity),
-      h("div", { class: "grow" }, h("div", {}, x.title), h("div", { class: "faint" }, `${x.location || ""}${x.rule ? `  [${x.rule}]` : ""}`), x.description ? h("pre", { class: "block" }, x.description) : null),
-    ))) : empty("No hidden instructions, invisible characters or smuggled binaries found."),
-  ));
-
-  put(grid, panel("Other findings", { class: "span-5" },
-    severityBars(l.counts, { width: 14 }),
-    h("p", { class: "label" }, "Config findings"),
-    h("ul", { class: "list" }, l.findings.slice(0, 12).map((x) => h("li", {}, sevBadge(x.severity), h("span", { class: "grow" }, x.title)))),
-  ));
-}

package/src/ui/static/js/views/deps.js

@@ -1,96 +0,0 @@
-import { h, put, panel, empty, sevBadge } from "../dom.js";
-import { bars, sparkline, severityBars } from "../charts.js";
-import { ago, plural } from "../format.js";
-import { SCREENS, EMPTY } from "../copy.js";
-import { SHADE } from "../charts.js";
-
-const CAP_SEV = {
-  "install-scripts": "high", shell: "medium", network: "medium", "fs-write": "medium", env: "low", "env-bulk": "medium",
-  eval: "medium", "dynamic-require": "low", native: "low", obfuscated: "high", "ai-config-write": "critical", "ai-cli-invoke": "critical", "token-harvest": "critical",
-};
-
-const capChip = (id, gained = false) => h("span", { class: `chip ${CAP_SEV[id] === "critical" || CAP_SEV[id] === "high" ? "inv" : ""}` }, `${gained ? "+" : ""}${id}`);
-
-export async function render(root, { api }) {
-  const d = await api.get("/api/deps");
-  put(root, 
-    h("h1", {}, SCREENS.deps.title),
-    h("p", { class: "lede" }, SCREENS.deps.lede),
-  );
-  const grid = h("div", { class: "grid" });
-  put(root, grid);
-  const l = d.latest;
-
-  if (!l) {
-    put(grid, panel("Latest deps scan", { class: "span-12" }, empty(EMPTY.deps)));
-  } else {
-    const caps = Object.entries(l.capabilityCounts).filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1]);
-    const diff = l.diff;
-    root.querySelector(".lede").after(h("div", { class: "strip" },
-      tile("Packages", String(l.total), `${l.scanned} scanned, ${l.direct} direct`),
-      tile("Added", diff ? String(diff.added.length) : "-", diff ? `vs ${diff.base}` : "no base to compare"),
-      tile("Gained capabilities", diff ? String(diff.upgraded.reduce((n, u) => n + u.gained.length, 0) + diff.added.reduce((n, a) => n + a.capabilities.length, 0)) : "-", "new things code can do"),
-      tile("Typosquats", String(l.typosquats.length), l.typosquats.length ? "names one edit from a popular package" : "none found"),
-    ));
-
-    put(grid, panel("Capabilities in the tree", { class: "span-5" },
-      bars(caps.map(([id, n]) => ({ label: id, value: n, cls: "t1", ch: SHADE[CAP_SEV[id] || "info"] })), { width: 18 }),
-      h("p", { class: "panel-note" }, `${l.ecosystem} :: ${l.lockfile} :: ${l.network} :: ${ago(l.ts)}`),
-    ));
-
-    put(grid, panel("Capability diff", { class: "span-7" },
-      diff ? h("div", {},
-        h("div", { class: "filters" },
-          h("span", { class: "chip" }, `+${diff.added.length} added`),
-          h("span", { class: "chip" }, `~${diff.upgraded.length} upgraded`),
-          h("span", { class: "chip" }, `-${diff.removed.length} removed`),
-          h("span", { class: "faint" }, `base ${diff.base}`),
-        ),
-        h("div", { class: "table-wrap" }, h("table", {},
-          h("thead", {}, h("tr", {}, h("th", {}, "Package"), h("th", {}, "Change"), h("th", {}, "Can now"))),
-          h("tbody", {},
-            diff.added.map((a) => h("tr", {}, h("td", {}, a.name), h("td", { class: "t1" }, `+ ${a.version}`), h("td", {}, a.capabilities.length ? a.capabilities.map((c) => capChip(c, true)) : h("span", { class: "faint" }, "nothing flagged")))),
-            diff.upgraded.filter((u) => u.gained.length || u.lost.length).map((u) => h("tr", {}, h("td", {}, u.name), h("td", { class: "t1" }, `${u.from} → ${u.to}`), h("td", {}, u.gained.map((c) => capChip(c, true)), u.lost.map((c) => h("span", { class: "chip" }, `-${c}`))))),
-            diff.removed.map((r) => h("tr", {}, h("td", { class: "faint" }, r.name), h("td", { class: "faint" }, `- ${r.version}`), h("td", {}))),
-          ),
-        )),
-        h("p", { class: "panel-note" }, `${plural(diff.upgraded.filter((u) => !u.gained.length && !u.lost.length).length, "upgrade")} with no capability change not shown.`),
-      ) : empty("No diff in the latest report. Run penthera deps --base <ref> to compare."),
-    ));
-
-    put(grid, panel("Deps findings", { class: "span-7" },
-      l.findings.length ? h("ul", { class: "list" }, l.findings.map((f) => h("li", {}, sevBadge(f.severity), h("span", { class: "grow" }, f.title), h("span", { class: "faint trunc hide-narrow" }, f.location || "")))) : empty("No findings."),
-      l.typosquats.length ? h("p", { class: "panel-note" }, l.typosquats.map((t) => `${t.name} looks like ${t.similarTo}`).join(" :: ")) : null,
-    ));
-
-    put(grid, panel("Severity and history", { class: "span-5" },
-      severityBars(l.counts, { width: 16 }),
-      h("p", { class: "label" }, "Package count over time"),
-      sparkline(d.history.map((x) => x.total), { width: 300, height: 36, label: "package count", zero: false }),
-    ));
-  }
-
-  put(grid, panel("Install firewall decisions", { class: "span-12" },
-    d.installs.length ? h("div", { class: "table-wrap" }, h("table", {},
-      h("thead", {}, h("tr", {}, ...["When", "Install", "Decision", "Flags", "Denied by policy", "Needed approval"].map((t) => h("th", {}, t)))),
-      h("tbody", {}, d.installs.map((i) => {
-        const flags = [...new Set(i.changes.flatMap((c) => c.flags))];
-        const deny = [...new Set(i.changes.flatMap((c) => c.deny))];
-        const appr = [...new Set(i.changes.flatMap((c) => c.approval))];
-        const verdict = i.action === "refused" || deny.length ? ["REFUSED", "bad"] : i.clean ? ["CLEAN", "ok"] : ["APPROVED", "t1"];
-        return h("tr", {},
-          h("td", { class: "muted" }, ago(i.ts)),
-          h("td", {}, i.specs.join(" "), h("span", { class: "faint" }, ` (${plural(i.changes.length, "package")})`)),
-          h("td", { class: verdict[1] }, `[${verdict[0]}]`),
-          h("td", {}, flags.length ? flags.map((f) => capChip(f)) : h("span", { class: "faint" }, "-")),
-          h("td", { class: "bad" }, deny.join(", ") || h("span", { class: "faint" }, "-")),
-          h("td", { class: "t1" }, appr.join(", ") || h("span", { class: "faint" }, "-")),
-        );
-      })),
-    )) : empty("No penthera install --json reports yet."),
-  ));
-}
-
-function tile(label, value, sub) {
-  return h("div", { class: "cell" }, h("span", { class: "label" }, label), h("div", { class: "big" }, value), h("div", { class: "sub" }, sub));
-}

package/src/ui/static/js/views/evidence.js

@@ -1,115 +0,0 @@
-import { h, put, panel, empty, clear, announce, fig } from "../dom.js";
-import { ago, stamp, shortProject } from "../format.js";
-import { SCREENS, EMPTY } from "../copy.js";
-
-export async function render(root, { api, params }) {
-  const [{ bundles }, o] = await Promise.all([api.get("/api/evidence"), api.get("/api/overview")]);
-  put(root, h("h1", {}, SCREENS.evidence.title), h("p", { class: "lede" }, SCREENS.evidence.lede));
-
-  const out = h("div");
-  const keys = o.projects.map((p) => p.key);
-  const projSel = h("select", { id: "ev-project", "aria-label": "Project" }, keys.map((k) => h("option", { value: k, selected: k === params.get("project") }, shortProject(k))));
-  const create = h("button", { type: "button", class: "btn primary", disabled: !keys.length }, "Create evidence bundle ▸");
-  const downloads = h("p", { class: "filters" });
-  const createMsg = h("p", { class: "muted", "aria-live": "polite" });
-
-  const paintDownloads = () => {
-    const p = projSel.value;
-    clear(downloads).append(
-      h("span", { class: "muted" }, "Download the latest report as Markdown ::"),
-      ...["auditor", "owner", "developer"].map((a) => h("a", { class: "btn", href: `/api/report?${new URLSearchParams({ project: p, audience: a })}`, download: "" }, `${a}.md`)),
-    );
-  };
-  projSel.addEventListener("change", paintDownloads);
-  if (keys.length) paintDownloads();
-
-  create.addEventListener("click", async () => {
-    create.disabled = true;
-    createMsg.textContent = "Writing the bundle and hashing every file…";
-    try {
-      const r = await api.post("/api/evidence/create", { project: projSel.value });
-      const v = await api.post("/api/evidence/verify", { id: r.id });
-      createMsg.textContent = `Written to ${r.path} :: ${v.ok ? "verified" : "verification failed"}.`;
-      announce(createMsg.textContent);
-      await refresh();
-      clear(out).append(report({ path: r.path }, v));
-    } catch (e) {
-      createMsg.textContent = e.message;
-    } finally {
-      create.disabled = false;
-    }
-  });
-
-  const tableSlot = h("div");
-  async function refresh() {
-    const { bundles: list } = await api.get("/api/evidence");
-    clear(tableSlot).append(bundleTable(list));
-  }
-
-  function bundleTable(list) {
-    if (!list.length) return empty(EMPTY.evidence);
-    const rows = list.map((b) => {
-      const result = h("td", { class: "muted", "aria-live": "polite" }, "not checked");
-      const btn = h("button", { type: "button", class: "btn" }, "Verify");
-      btn.addEventListener("click", async () => {
-        btn.disabled = true;
-        result.textContent = "hashing…";
-        result.className = "muted";
-        try {
-          const r = await api.post("/api/evidence/verify", { id: b.id });
-          result.textContent = r.ok ? "[VERIFIED]" : `[FAILED] ${r.problems.length} problem${r.problems.length === 1 ? "" : "s"}`;
-          result.className = r.ok ? "ok" : "bad";
-          clear(out).append(report(b, r));
-          announce(`${b.path}: ${r.ok ? "verified" : "verification failed"}`);
-        } catch (e) {
-          result.textContent = e.message;
-          result.className = "bad";
-        } finally {
-          btn.disabled = false;
-        }
-      });
-      return h("tr", {},
-        h("td", { class: "t1" }, b.path),
-        h("td", { class: "trunc hide-narrow", title: b.target || "" }, shortProject(b.target)),
-        h("td", { class: "muted hide-narrow" }, ago(b.generatedAt)),
-        h("td", { class: "num" }, String(b.artifacts)),
-        h("td", {}, b.signed ? h("span", { class: "chip on" }, "signed") : h("span", { class: "chip" }, "unsigned")),
-        h("td", {}, btn),
-        result,
-      );
-    });
-    return h("div", { class: "table-wrap" }, h("table", {},
-      h("thead", {}, h("tr", {}, ...["Bundle", "Target", "Written", "Files", "Signature", "", "Result"].map((t, i) => h("th", { class: [i === 3 ? "num" : null, i === 1 || i === 2 ? "hide-narrow" : null] }, t)))),
-      h("tbody", {}, rows),
-    ));
-  }
-  put(tableSlot, bundleTable(bundles));
-
-  put(root, h("div", { class: "grid" },
-    panel("For your auditor", { class: "span-12" },
-      keys.length ? h("div", {},
-        h("p", { class: "t1" }, "One folder they can check without trusting you: the JSON, Markdown and SARIF reports, the auditor, owner and developer reports, and manifest.json with a SHA-256 for each file."),
-        h("div", { class: "filters" }, h("label", { class: "field" }, h("span", {}, "Project"), projSel), create),
-        createMsg,
-        downloads,
-        h("p", { class: "muted" }, "To sign it, write the bundle from the CLI with --evidence <dir> --sign-key ~/.ssh/id_ed25519. They verify with penthera evidence verify <dir>."),
-      ) : empty("Scan a project first: a bundle is made from its latest report."),
-    ),
-    panel("Bundles in the reports folder", { class: "span-12" }, tableSlot, fig("fig 1 :: verify recomputes every hash and checks the SSH signature", `${bundles.length} bundles`)),
-    h("div", { class: "span-12" }, out),
-  ));
-}
-
-function report(b, r) {
-  return panel(`Verification :: ${b.path}`, {},
-    h("p", { class: r.ok ? "ok" : "bad" }, r.ok ? "[OK] Every file matches the manifest." : "[!] NOT VERIFIED"),
-    h("ul", { class: "list" }, r.files.map((f) => h("li", {},
-      h("span", { class: f.ok ? "ok" : "bad" }, f.ok ? "ok  " : "FAIL"),
-      h("span", { class: "grow t1" }, f.path),
-      f.ok ? null : h("span", { class: "bad" }, f.reason),
-    ))),
-    r.signature ? h("p", {}, h("span", { class: r.signature.ok ? (r.signature.status === "valid" ? "ok" : "t1") : "bad" }, `signature ${r.signature.status} :: `), r.signature.detail) : null,
-    r.problems.length ? h("pre", { class: "block" }, r.problems.map((p) => `- ${p}`).join("\n")) : null,
-    fig(`checked ${stamp(new Date().toISOString())}`, "sha-256"),
-  );
-}