penthera 1.6.1 → 1.7.0

package/docs/commands/init.md

@@ -0,0 +1,114 @@
+# Set up in one command: `penthera init`
+
+## Start here
+
+New to Penthera? Run it with no arguments in your project folder:
+
+```bash
+npx penthera          # in a terminal, with no arguments: the setup wizard
+penthera init         # the same wizard, by name (also works with piped answers)
+penthera init --yes   # accept every safe default, ask nothing
+penthera init --dry-run   # show what would run and be written, change nothing
+```
+
+The wizard finds what your project has, asks one question about what to check,
+runs those checks offline, shows one summary, and then offers to set up the
+hook, the CI workflow and the rest, one yes/no at a time. Press Enter to accept
+a default.
+
+## What it does
+
+**1. Detect.** Offline, read-only:
+
+- whether this is a git repository (and which branch);
+- the web framework, from `package.json`, `requirements.txt` or `pyproject.toml`;
+- lockfiles: `package-lock.json`, `npm-shrinkwrap.json`, `uv.lock`,
+  `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt`;
+- agent config: `.mcp.json`, `.claude/`, `.cursor/`, `CLAUDE.md`, `AGENTS.md`, `skills/`;
+- a dev server on localhost ports 3000, 5173, 8000 or 8080 (a TCP connect to
+  127.0.0.1 and ::1, nothing else);
+- whether the Penthera pre-commit hook or a Penthera GitHub workflow is already there.
+
+**2. Ask what to check.** One checklist, with defaults from what was found.
+Type numbers to toggle items (`2,4`), or press Enter:
+
+```
+  What should Penthera check?
+    1. [x] Code: secrets and risky API routes in ./                 penthera --repo .
+    2. [x] Dependencies: what your npm and Python packages can do   penthera deps
+    3. [x] AI tooling: skills, MCP servers, hooks, agent instructions  penthera agents
+    4. [ ] The running app at http://localhost:3000                 only if it is yours
+    5. [x] Offline mode: nothing leaves this machine                recommended
+```
+
+- AI tooling then asks whether to include `~/.claude` and `~/.cursor` too (default no).
+- The running app is only listed when a dev server answered, is never
+  preselected, and is only scanned after you confirm it is yours (default no).
+  It runs the standard safe checks: no attack payloads.
+- With offline mode off, `deps` also reads npm registry metadata and the URL
+  scan may download the Retire.js database. Nothing else changes.
+
+**3. Run and summarize.** One line per check, then the grade per area (A to F,
+the same scale as `penthera agents`), the three things to fix first in plain
+language, and the report folder:
+
+```
+  Running 3 checks  (offline)
+    ✓ Code          B  1 high  0.1s
+    ✓ Dependencies  A  no issues  0.0s
+    ✓ AI tooling    A  1 medium  0.0s
+```
+
+Every report lands in `reports/penthera-<date>/`: `code`, `deps`, `agents` and
+`app` as JSON and Markdown, plus `summary.md` and `summary.json`.
+
+**4. Set up.** Each step is a yes/no:
+
+| Step | Default | What it does |
+|---|---|---|
+| Pre-commit hook | yes | `penthera hook install`: blocks staged secrets, risky agent config and lockfile changes ([hook.md](hook.md)). Git repos only |
+| GitHub workflow | yes | Writes `.github/workflows/penthera.yml` from [the PR dependency review example](../examples/pr-dependency-review.yml), with the action pinned to the release commit SHA. Shown as a diff first. Needs a git repo and `package-lock.json` |
+| `.gitignore` | yes | Appends `reports/` so scan output is never committed |
+| Fix loop | no | `penthera agent --loop` on a local `penthera/fix-<date>` branch; every diff asks first ([fix.md](fix.md)) |
+| Dashboard | yes | `penthera ui --open` on this run's reports ([dashboard.md](../dashboard.md)). Runs until Ctrl-C |
+
+Steps that are already done (a hook or workflow that exists, `reports/` already
+ignored) are skipped and say so.
+
+**5. What next.** The commands to rerun each check, check staged changes, run
+the fix loop or open the dashboard.
+
+## `--yes` and `--dry-run`
+
+`--yes` answers every question with its safe default: the code, dependency and
+AI tooling checks that apply, offline, then the hook, the workflow and
+`.gitignore`. It never scans a URL, never runs the fix loop and never opens the
+dashboard, even when a dev server is running.
+
+`--dry-run` runs detection and asks the questions, then prints what it would
+run and write instead of doing it. Combine them for a plan with no prompts:
+
+```bash
+penthera init --yes --dry-run
+```
+
+`penthera --yes` and `penthera --dry-run` (no other arguments) are the same as
+`penthera init --yes` and `penthera init --dry-run`.
+
+## What it never does
+
+- Commit, push, open a pull request, or touch a remote. The workflow file is
+  written for you to review and commit yourself.
+- Write outside the project: reports, `.gitignore` and the workflow go under
+  the project root (the git top level when there is one), the hook into the
+  repository's hooks folder.
+- Contact anything but localhost, unless you turn offline mode off or confirm
+  the running app.
+
+Exit code: 0 when the wizard finishes (whatever the grades), 2 for a bad flag.
+For a gate in CI, use the commands themselves (`penthera --repo .`, `penthera deps`):
+they exit 1 on high or critical findings.
+
+The pinned SHA is the last release tagged before this version
+(`ACTION_PIN` in `src/cli/onboarding.js`); Dependabot's `github-actions`
+updates keep it current in your repo.

package/docs/commands/scan.md

@@ -72,7 +72,7 @@ next to it. Reports are gitignored by default.
 
 ```yaml
 # Scan a staging URL on a schedule and upload results to GitHub Security.
-- run: npx penthera@1.6.1 "$PENTEST_URL" --profile standard --sarif reports/scan.sarif
+- run: npx penthera@1.7.0 "$PENTEST_URL" --profile standard --sarif reports/scan.sarif
 - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
   with:
     sarif_file: reports/scan.sarif

package/docs/compare/github.md

@@ -48,7 +48,7 @@ Keep Dependabot and code scanning on. Add Penthera's action for the capability
 diff ([docs/commands/action.md](../commands/action.md)) and upload its SARIF:
 
 ```yaml
-- run: npx penthera@1.6.1 "$PREVIEW_URL" --sarif reports/scan.sarif
+- run: npx penthera@1.7.0 "$PREVIEW_URL" --sarif reports/scan.sarif
 - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
   with:
     sarif_file: reports/scan.sarif

package/docs/dashboard.md

@@ -1,15 +1,15 @@
 # The local dashboard: `penthera ui`
 
-`penthera ui` opens a dashboard in your browser for what Penthera knows about
-your projects: where each one stands, what each finding means, what changed
-since the last scan, your dependencies and AI tooling, and evidence for an
-auditor. It can also run scans and the fix loop for you, stopping at every
-diff. It runs on `127.0.0.1` only, reads only the folders you give it and
-`~/.penthera`, and never contacts the network.
+`penthera ui` opens one view in your browser for what Penthera knows about
+your projects, laid out like the Claude Code desktop app: projects and runs on
+the left, the selected project or run in the middle, and details on the right.
+It can also run scans and the fix loop for you, stopping at every diff. It runs
+on `127.0.0.1` only, reads only the folders you give it and `~/.penthera`, and
+never contacts the network.
 
 | Dark | Light |
 |---|---|
-| ![Overview, dark theme](../assets/dashboard/overview-dark.jpg) | ![Overview, light theme](../assets/dashboard/overview-light.jpg) |
+| ![Projects, findings, and a finding's detail in the dark theme](../assets/dashboard/ui-dark.jpg) | ![All projects and the side cards in the light theme](../assets/dashboard/ui-light.jpg) |
 
 ## Start it
 
@@ -32,123 +32,76 @@ a session cookie and stops working, so a second browser (or a link that leaked
 into history) gets a 403. Restart `penthera ui` for a new link. Ctrl-C stops
 the server.
 
+## The view
+
+**Left sidebar** (`[` to hide or show). "+ New scan" on top. Then every
+project with its A to F grade, open findings and last scan, with "All
+projects" first; project folders you passed with `--project` show up even
+before their first scan. Below them, recent runs grouped by project, like the
+session list in Claude Code: live runs from this session (a green dot while
+running) and past fix-loop runs from the reports folder. The gear in the
+footer opens settings; the half-moon switches the theme.
+
+**Centre.** One scrolling stream for what you selected:
+
+- a project (or all of them): a compact header with the grade, a severity bar
+  drawn in 1-bit shades, the trend sparkline and open vs fixed; what changed
+  since the last scan (new and fixed); then the findings, "Fix first"
+  (critical and high) before the rest. `/` searches, `j` and `k` move through
+  findings and open each one on the right.
+- a run: its output streams in as a transcript, typed out as it arrives. Each
+  diff of the fix loop appears inline as a small dialog: the recipe, the files,
+  what memory knows about the recipe, the diff, and Apply (`y`), Skip (`n`) or
+  Stop (`q`).
+- a past fix-loop run: rebuilt from its `loopRun` file, round by round, with
+  each fix's decision, result and commit.
+
+At the bottom, a prompt-style bar starts things: **Scan** (with an optional
+URL), **Deps**, **AI tooling** or **Fix loop**, always for the selected
+project's folder. These are plain controls, not a chat: there is no model
+behind them. There is one primary button on screen at a time; while a run is
+going, its dialog owns it and the bar waits.
+
+**Right panel** (`]` to hide or show). Stacked cards, each one collapsible:
+
+| Card | What it shows |
+|---|---|
+| Environment | Offline or online for scans started here (switch it here), the project folder, its git branch and HEAD, and the hosts the last scan contacted (and the ones offline mode blocked) |
+| Memory | Chain status, events, verified and failed fixes, median time to fix, recipe success rates |
+| Dependencies | Package count and ecosystem, the capability diff against your base, typosquats, capabilities in the tree, install firewall decisions |
+| AI tooling | The A to F grade and its history, `penthera.lock` drift, inventory, hidden-content hits |
+| Evidence | Create a bundle from the latest scan, download the auditor, owner or developer report, verify any bundle in one click |
+| Changes | Fixes the loop committed, with their local commits, and the `penthera/fix-*` branches in the folder |
+
+Picking a finding replaces the cards with its detail: "In plain words" (how
+serious, how sure and what that means, what to do, the OWASP mapping), what
+was seen, the evidence, sources, and the exact fix-recipe diff with a button
+that starts the fix loop on that project. `Esc` goes back to the cards.
+
+Below 1180px the right panel becomes a drawer; below 760px the sidebar does
+too. A tap outside closes them.
+
+| Narrow, dark | Narrow, light, a finding open |
+|---|---|
+| <img src="../assets/dashboard/narrow-dark.jpg" alt="The view at 390px, dark" width="280"> | <img src="../assets/dashboard/narrow-light.jpg" alt="A finding in the drawer at 390px, light" width="280"> |
+
 ## User stories
 
-Each story names who it is for, what they want and why. Each one has a
-feature in the dashboard and a screenshot from `penthera ui --demo`.
-
-**1. First run, nothing scanned yet.** *As a solo founder the week before
-launch, I want the dashboard to tell me what to do first when there is no
-data yet, so that I am not staring at empty charts.* The overview turns into
-a three-step start: scan your app, check your dependencies, audit your AI
-tooling. Each step opens Run with the right mode and your project folder
-filled in.
-
-![Story 1: the Welcome screen with three steps](../assets/dashboard/story-first-run.jpg)
-
-**2. Run a scan from the UI.** *As a developer who does not live in the
-terminal, I want to start a scan from the page and watch it work, so that I
-know it ran and where the report went.* Run has four modes: scan app, check
-dependencies, audit AI tooling, fix loop. A URL that is not on this machine
-needs its hostname typed back first. Output streams into a terminal window;
-when it finishes, "What next?" offers the obvious next steps.
-
-![Story 2: a scan streaming in the terminal window](../assets/dashboard/story-scan.jpg)
-
-**3. Let the agent fix things, one approved diff at a time.** *As a founder
-with no security engineer, I want Penthera to propose fixes and apply only the
-ones I approve, so that nothing changes in my code without me seeing it.* The
-fix loop stops at every diff with a dialog: the recipe, the files, what the
-fix closes, what memory knows about this recipe, and the diff itself. Apply
-(`y`), Skip (`n`) or Stop the loop (`q`). Verified fixes are committed on a
-local branch; failed ones are reverted. Nothing is pushed.
-
-![Story 3: the approval dialog for a fix](../assets/dashboard/story-loop.jpg)
-
-**4. Understand one finding.** *As a product owner who is not a security
-expert, I want one finding explained in plain words, so that I can decide
-whether it matters today.* The detail panel opens with "In plain words": how
-serious it is, how sure Penthera is (and what that confidence level means),
-what to do, and the OWASP mapping. Below it: what was seen, the evidence, the
-sources, and the exact fix diff.
-
-![Story 4: a finding explained in plain words](../assets/dashboard/story-finding.jpg)
-
-**5. Compare over time.** *As a tech lead after a release, I want to compare
-two scans of the same project, so that I can see what got fixed and what is
-new.* History picks the most interesting project by default, compares the
-previous scan with the latest (or any two you choose), and lists new, fixed
-and still-open findings in three columns. Below them, a timeline draws every
-finding as a bar across the scans (S1, S2, ...): hatched while it is still
-open, an outline once it was fixed.
-
-![Story 5: history comparing two scans](../assets/dashboard/story-history.jpg)
-
-**6. Export evidence for an auditor.** *As the person who answers the NIS2
-questionnaire, I want a package an auditor can check without trusting me, so
-that the evidence holds up.* Evidence creates a bundle from the latest scan
-of a project (JSON, Markdown, SARIF, the auditor, owner and developer reports,
-and a manifest with a SHA-256 per file), verifies it straight away, and lets
-you download the auditor report as Markdown.
-
-![Story 6: a new bundle, verified, with downloads](../assets/dashboard/story-evidence.jpg)
-
-**7. Check what a dependency change can do.** *As a developer reviewing a
-pull request that bumps the lockfile, I want to see which packages gained new
-capabilities, so that I catch a malicious update before it runs.* Dependencies
-shows the capabilities in the tree, the capability diff against your base,
-typosquats, and every install firewall decision.
-
-![Story 7: the capability diff](../assets/dashboard/story-deps.jpg)
-
-**8. Trust my AI tooling.** *As someone who installs skills and MCP servers
-into Claude Code and Cursor, I want to know whether any of them hide
-instructions or changed since I reviewed them, so that my agent is not working
-for someone else.* AI tooling shows the A to F grade, hidden content with the
-decoded text, and drift against `penthera.lock`.
-
-![Story 8: grade, hidden content and lock drift](../assets/dashboard/story-ai-tooling.jpg)
-
-**9. Know where to start this week.** *As a solo founder on a Monday morning,
-I want one place that says what to fix first and what changed since the last
-scan, so that I do not have to read every report.* The overview opens with a
-"This week" window: fix first (every critical and high), new since the last
-scan, and fixed since the last scan, across all projects. Each line opens the
-finding.
-
-![Story 9: the This week window](../assets/dashboard/story-week.jpg)
-
-**10. Work in daylight.** *As someone who reads reports on a bright screen, I
-want a light theme, so that the dashboard is comfortable outside a dark room.*
-The `◐` button in the menu bar (and Settings) switches between the black
-terminal and the white paper theme. The first visit follows your system
-setting; the choice is remembered in this browser.
-
-| Narrow, dark | Narrow, light |
+| Story | Where it lives |
 |---|---|
-| <img src="../assets/dashboard/narrow-dark.jpg" alt="Overview at 390px, dark" width="280"> | <img src="../assets/dashboard/narrow-light.jpg" alt="History at 390px, light" width="280"> |
-
-## Where the data comes from
-
-| Screen | Source |
-|--------|--------|
-| Overview | The latest scan report per target in the reports folder, plus trend and time to fix from local memory |
-| Findings | The same reports. The fix preview runs the fix recipes against the project folder, read-only |
-| Run | Live runs started from this page; past `loopRun` files; memory stats |
-| History | Every scan report of one project in the reports folder |
-| Dependencies | `penthera deps -o reports/deps.json` and `penthera install <pkg> --dry-run --json > reports/install.json` (or Run → Check dependencies) |
-| AI tooling | `penthera agents . -o reports/agents.json` (or Run → Audit AI tooling) |
-| Evidence | Bundles below the reports folder, written with `--evidence` or from this screen |
-| Settings | Theme, egress mode for scans started here, data locations, memory chain status |
-
-The reports folder is read one level deep for `*.json` (anything that is not
-a Penthera report is ignored) and two levels deep for evidence bundles.
-Symlinks are skipped. A memory chain that does not verify is shown as broken
-and its contents are not used, the same rule scans follow.
+| *As a solo founder before launch, I want to know what to do first when there is no data yet.* | With no reports, the centre shows the wordmark and three steps (scan, dependencies, AI tooling); each focuses the bar on that action. ![First run](../assets/dashboard/ui-start.jpg) |
+| *As a developer who does not live in the terminal, I want to start a scan from the page and watch it work.* | The bar at the bottom; the run streams into the centre and appears in the sidebar. |
+| *As a founder with no security engineer, I want fixes applied only when I approve them.* | The fix loop's inline dialog: Apply, Skip or Stop on every diff; verified fixes land as local commits, failed ones are reverted, nothing is pushed. ![A diff waiting for a decision](../assets/dashboard/ui-run.jpg) |
+| *As a product owner, I want one finding explained in plain words.* | Pick it: the right panel opens with "In plain words", the evidence, sources and the fix diff. |
+| *As a tech lead after a release, I want to see what changed.* | The project header's sparkline, "Since the last scan" (new, fixed), and the runs in the sidebar. |
+| *As the person answering the NIS2 questionnaire, I want evidence an auditor can check.* | The Evidence card: create a bundle, verify it, download the auditor report. |
+| *As a developer reviewing a lockfile bump, I want to see what packages gained.* | The Dependencies card: the capability diff and install firewall decisions. |
+| *As someone who installs skills and MCP servers, I want to know if any hide instructions or drifted.* | The AI tooling card: grade, hidden content, `penthera.lock` drift. |
+| *As someone on a bright screen, I want a light theme.* | The half-moon in the sidebar footer, or Settings; the first visit follows your system. |
 
 ## Running things from the page
 
-Run calls the same functions as the CLI (`executeScan`, `scanDeps`,
+The bar calls the same functions as the CLI (`executeScan`, `scanDeps`,
 `scanAgents`, `runLoop`) with the same rules. The fix loop needs a clean git
 tree on a branch, works on a local `penthera/fix-<yyyymmdd-hhmm>` branch, runs
 only allow-listed local git commands with hooks off, is always offline with
@@ -158,8 +111,8 @@ egress limited to the URL's host, and never pushes. On top of that:
 - A URL that is not on this machine (anything but `localhost`, `127.x.x.x`,
   `[::1]` and `*.localhost`) needs its hostname typed back before the run
   starts. Only scan what you own or have written permission to test.
-- One run at a time. Closing the tab does not stop a run; come back to Run and
-  it reattaches. Stop finishes the current step, and the fix branch holds only
+- One run at a time. Closing the tab does not stop a run; pick it in the
+  sidebar and its transcript replays and continues. Stop finishes the current step, and the fix branch holds only
   verified commits.
 - Reports land in the reports folder (`loop-<timestamp>.json`,
   `deps_<timestamp>.json`, and so on), so every screen picks them up.
@@ -210,35 +163,25 @@ path traversal.
 
 ## Design
 
-A 1-bit desktop with a terminal inside. The window chrome comes from the Mac
-of the early 90s, and the layout from a planning board the maintainer keeps in
-the same style (every section a pinstriped window with its date on the right,
-bold-ruled columns, a Gantt with dashed milestones): a menu bar, pinstriped title bars with close and zoom boxes,
-a dithered desktop, rounded push buttons where the default one wears a thick
-ring, and alert dialogs with a double frame. The voice, the `▸` progress
-lines, the numbered "What next?" and the `#0000ed` block-letter wordmark come
-straight from the CLI and its demo GIF, so the terminal, the README and the
-dashboard read as one product.
-
-- **Black, white and patterns do the work.** Severity is a word plus a
-  pattern swatch (solid, hatched, half-tone, dotted, empty), and bars are drawn
-  with shade characters `█ ▓ ▒ ░ ·`. Charts fill with hatching and dithering,
-  not colour.
-- **One accent.** `#0000ed` marks the active screen, the default button,
-  selection, links and chart lines. On black it measures 2.2:1, so there it is
-  only a fill (white text on it, 9.5:1), a frame or a glow; text in that hue
-  uses the tint `#7a7aff` (6.1:1). On white, `#0000ed` is text-safe (9.3:1).
-- **Green** is kept for the cursor, the prompt and "OK".
-- **Calm where it counts.** Pinstripes only on real windows and dialogs; data
-  sits in hairline group boxes, one stat strip, and tables with figure captions
-  that say where each number came from.
-- **Both themes pass WCAG AA** for every text node on every screen (measured in
-  the browser, composited). Light text uses a 0.6 ink step where the dark
-  theme uses 0.5, because 0.5 measures 3.6:1 on paper.
-- **Motion.** The output types itself out and the cursor blinks. With
-  `prefers-reduced-motion`, both stop and output appears whole. Screens switch
-  with `1`-`8` and have no transition.
-- **Keyboard.** `1`-`8` screens, `/` filter findings, `j`/`k` move through
-  findings, `y`/`n`/`q` answer a diff. Every control is a real button or link;
-  the approval dialog takes focus when a diff arrives; screen readers get each
-  log line whole, never letter by letter.
+Calm, terminal-native, and close to the Claude Code desktop app: hairlines
+instead of boxes, one stream in the middle, details on the side. The 1-bit
+register from earlier versions stays in the details: severity as a word plus a
+pattern swatch (solid, hatched, half-tone, dotted, empty), bars drawn with the
+shade characters `█ ▓ ▒ ░`, the pinstriped title bar on the approval dialog,
+and the CLI's `#0000ed` block-letter wordmark on the empty state.
+
+- **One accent.** `#0000ed` marks the primary button, the selected finding,
+  links and chart lines. On black it measures 2.2:1, so there it is only a fill
+  with white on it (9.5:1), a frame or a glow; text in that hue uses `#7a7aff`
+  (6.1:1). On white, `#0000ed` is text-safe (9.3:1). Green is kept for the
+  cursor, the prompt and "OK".
+- **Both themes pass WCAG AA** for every text node in every state (all
+  projects with every card open, a project with a finding open, settings, a
+  past run), measured in the browser, composited.
+- **Motion.** Run output types itself out and the cursor blinks; with
+  `prefers-reduced-motion` both stop and output appears whole. Nothing else
+  animates.
+- **Keyboard.** `/` search, `j`/`k` findings, `[`/`]` side panels, `y`/`n`/`q`
+  answer a diff, `Esc` closes the detail, clears the search or closes a
+  drawer. Every control is a real button or link; the approval dialog takes
+  focus when a diff arrives; screen readers get each log line whole.

package/docs/examples/github-actions-scan.yml

@@ -34,7 +34,7 @@ jobs:
         run: |
           mkdir -p reports
           set +e
-          npx --yes penthera@1.6.1 "$PENTEST_URL" \
+          npx --yes penthera@1.7.0 "$PENTEST_URL" \
             --profile standard \
             -o reports/scan.json \
             --sarif reports/scan.sarif

package/docs/internal-audit.md

@@ -25,7 +25,7 @@ so drift shows up between releases.
 | Packaging | `npm pack --dry-run` | A file outside the allow-list ships, anything that looks like tests, fixtures, reports or secrets ships, or the package exceeds its size budget |
 | Offline | A full `--all --adaptive --offline` scan of the mock server | The report's `egress` field shows any third-party host |
 | Supply chain | `npm audit --omit=dev`; sha512 integrity for every lockfile entry; install scripts in runtime dependencies (via `penthera deps --prod`); every `uses:` in `.github/workflows`, `action.yml` and `docs/examples` | Any vulnerability, missing integrity, runtime install script, typosquat, action not pinned by commit SHA, or workflow without top-level `permissions:` |
-| Versions and docs | The version in `package.json`, the lockfile, the plugin manifests, `SKILL.md` and `CITATION.cff`; a `CHANGELOG.md` section for it; every relative link in `README.md` and `docs/` | Any mismatch or broken link |
+| Versions and docs | The version in `package.json`, the lockfile, the plugin manifests, `SKILL.md`, `CITATION.cff` and the "How to cite" block in `docs/METHODOLOGY.md`; a `CHANGELOG.md` section for it; every relative link in `README.md` and `docs/` | Any mismatch or broken link |
 
 Everything runs on this machine against this repo or `127.0.0.1`. The only
 network use is `npm audit` (the npm registry) and, with `--with-docker`,

package/docs/plan.md

@@ -29,8 +29,9 @@ these three moments is out of scope.
 |---------|-------|-----------|
 | v1.5.0 | AI apps and compliance | Tagged with the pre-commit hook, license policy, CRA helper and AI-BOM; held back from npm and shipped inside 1.6.0 |
 | v1.6.0 | Hardening and the rest of AI apps | Released with the 360 security review fixes, Python `deps`, the internal audit gate and the dashboard. Signed rule packs follow once the maintainer's key is set up |
-| v1.7.0 | Before you deploy | `penthera ship` and preview-deployment scanning work on a real Vercel and Netlify project |
-| v1.8.0 | After you ship | `penthera watch` runs weekly on three real production apps for a month without a false alarm anyone complained about |
+| v1.7.0 | One view, one command | The single-view dashboard, the `npx penthera` setup wizard, and an APA-cited methodology. Released |
+| Next | Before you deploy | `penthera ship` and preview-deployment scanning work on a real Vercel and Netlify project |
+| After that | After you ship | `penthera watch` runs weekly on three real production apps for a month without a false alarm anyone complained about |
 | v2.0.0 | Stable | Public interfaces frozen (CLI flags, JSON report schema, policy file, rule-pack format), documented, and covered by compatibility tests |
 
 ## What "perfect" means, concretely