penthera 1.7.0 → 1.8.0

package/src/ui/static/js/menubar.js

@@ -0,0 +1,170 @@
+// The menu bar: every action in one place, each with its shortcut written
+// next to it, and the status on the right (offline or online, the live run,
+// a diff waiting for you). The logo is the first menu, like the Apple menu:
+// the horizontal wordmark when there is room, the P mark when there is not.
+//
+// Keyboard (WAI-ARIA menubar): Left / Right move between menus, Down or Enter
+// opens one, Up / Down move inside it, Esc closes and returns to the title.
+import { h, clear, announce } from "./dom.js";
+import { api } from "./api.js";
+import { state, set, TABS, currentProject, liveRun, simple } from "./state.js";
+import { shortProject } from "./format.js";
+
+let openIdx = -1;
+
+export function renderMenubar(el, ctx) {
+  const project = currentProject() || state.overview?.projects?.[0]?.key || "";
+  const scanned = state.overview?.projects?.some((p) => p.key === project);
+  const run = liveRun();
+  const inDoc = state.sel.kind === "all" || state.sel.kind === "project";
+  const report = (a) => ({
+    label: `Download ${a} report`, disabled: !scanned,
+    run: () => api.download(`/api/report?${new URLSearchParams({ project, audience: a })}`).catch((e) => announce(e.message)),
+  });
+
+  const easy = simple();
+  const all = [
+    { id: "app", label: "Penthera", logo: true, items: [
+      { label: "About Penthera…", run: () => ctx.about() },
+      { label: "Set up…", run: () => ctx.setup() },
+      { label: "Settings…", run: () => set({ right: "settings" }) },
+      "-",
+      { label: "Simple mode", check: easy, run: () => ctx.setUx("simple") },
+      { label: "Advanced mode", check: !easy, run: () => ctx.setUx("advanced") },
+      "-",
+      { label: "Light theme", check: ctx.theme.get() === "light", run: () => ctx.setTheme("light") },
+      { label: "Dark theme", check: ctx.theme.get() === "dark", run: () => ctx.setTheme("dark") },
+    ] },
+    { id: "check", label: "Check", simple: true, items: [
+      { label: "Check my app…", key: "n", run: () => ctx.newScan("scan") },
+      { label: "Fix problems for me…", run: () => ctx.newScan("loop") },
+      "-",
+      { label: "Show the running check", disabled: !run, run: () => set({ sel: { kind: "run", key: run.id, run } }) },
+      { label: "Stop it", disabled: !run, run: () => api.post(`/api/runs/${run.id}/stop`).then(() => announce("Stopping after the current step")) },
+    ] },
+    { id: "file", label: "File", items: [
+      { label: "New scan…", key: "n", run: () => ctx.newScan() },
+      "-",
+      { label: "All projects", run: () => set({ sel: { kind: "all", key: null } }) },
+      { label: "Close the detail", key: "Esc", disabled: state.right === "none", run: () => set({ right: "none", finding: null }) },
+    ] },
+    { id: "scan", label: "Scan", items: [
+      { label: "Scan a site or folder…", run: () => ctx.newScan("scan") },
+      { label: "Check dependencies…", run: () => ctx.newScan("deps") },
+      { label: "Audit AI tooling…", run: () => ctx.newScan("agents") },
+    ] },
+    { id: "fix", label: "Fix", items: [
+      { label: "Run the fix loop…", run: () => ctx.newScan("loop") },
+      { label: "Show the running run", disabled: !run, run: () => set({ sel: { kind: "run", key: run.id, run } }) },
+      { label: "Stop the run", disabled: !run, run: () => api.post(`/api/runs/${run.id}/stop`).then(() => announce("Stopping after the current step")) },
+    ] },
+    { id: "evidence", label: "Evidence", items: [
+      { label: `Proof for ${shortProject(project)}`, disabled: !project, key: "5", run: () => ctx.openTab("proof", project) },
+      "-",
+      report("auditor"), report("owner"), report("developer"),
+    ] },
+    { id: "view", label: "View", simple: true, items: [
+      { label: "Projects window", key: "[", check: ctx.panels.left, run: ctx.toggleLeft },
+      { label: "Inspector window", key: "]", check: ctx.panels.right, run: ctx.toggleRight },
+      { label: "Search findings", key: "/", disabled: !inDoc, run: () => { ctx.openTab("findings"); queueMicrotask(() => document.getElementById("q")?.focus()); } },
+      "-",
+      ...(easy ? [] : TABS.map((t) => ({ label: t.label, key: t.key, check: inDoc && state.tab === t.id, disabled: !inDoc, run: () => ctx.openTab(t.id) }))),
+    ] },
+  ];
+  // Simple mode keeps three menus: Penthera, Check, View. Advanced has everything but Check.
+  const menus = all.filter((m) => m.logo || (easy ? m.simple : m.id !== "check"));
+
+  const titles = [];
+  const bar = h("ul", { class: "menus", role: "menubar", "aria-label": "Menu bar" });
+  menus.forEach((m, i) => {
+    const pop = h("ul", { class: "menu", role: "menu", "aria-label": m.label, hidden: i !== openIdx });
+    const title = h("button", {
+      type: "button", class: ["menu-title", m.logo ? "logo" : null], role: "menuitem", "aria-haspopup": "menu", "aria-expanded": String(i === openIdx),
+      tabindex: i === 0 ? "0" : "-1", "aria-label": m.logo ? "Penthera menu" : null,
+    }, m.logo ? [h("span", { class: "logotype", "aria-hidden": "true" }), h("span", { class: "mark", "aria-hidden": "true" })] : m.label);
+    titles.push(title);
+    for (const it of m.items) {
+      if (it === "-") { pop.append(h("li", { role: "separator", class: "sep" })); continue; }
+      const kids = [h("span", { class: "check", "aria-hidden": "true" }, it.check ? "✓" : ""), h("span", { class: "grow" }, it.label), it.key ? h("kbd", {}, it.key) : null];
+      const role = it.check != null ? "menuitemcheckbox" : "menuitem";
+      const item = h("button", { type: "button", class: "menu-item", role, tabindex: "-1", disabled: it.disabled || null, "aria-checked": it.check != null ? String(it.check) : null }, kids);
+      if (it.disabled) item.setAttribute("aria-disabled", "true");
+      item.addEventListener("click", () => { close(); it.run?.(); });
+      pop.append(h("li", { role: "none" }, item));
+    }
+    title.addEventListener("click", () => (openIdx === i ? close() : open(i)));
+    title.addEventListener("pointerenter", () => { if (openIdx !== -1 && openIdx !== i) open(i, false); });
+    title.addEventListener("keydown", (e) => {
+      if (e.key === "ArrowRight" || e.key === "ArrowLeft") {
+        e.preventDefault();
+        const n = (i + (e.key === "ArrowRight" ? 1 : -1) + menus.length) % menus.length;
+        if (openIdx !== -1) open(n); else { titles[n].focus(); roving(n); }
+      } else if (e.key === "ArrowDown" || e.key === "Enter" || e.key === " ") {
+        e.preventDefault();
+        open(i);
+      }
+    });
+    pop.addEventListener("keydown", (e) => {
+      const items = [...pop.querySelectorAll(".menu-item:not([disabled])")];
+      const at = items.indexOf(document.activeElement);
+      if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+        e.preventDefault();
+        items[(at + (e.key === "ArrowDown" ? 1 : -1) + items.length) % items.length]?.focus();
+      } else if (e.key === "ArrowRight" || e.key === "ArrowLeft") {
+        e.preventDefault();
+        open((i + (e.key === "ArrowRight" ? 1 : -1) + menus.length) % menus.length);
+      } else if (e.key === "Escape" || e.key === "Tab") {
+        if (e.key === "Escape") e.preventDefault();
+        close();
+        titles[i].focus();
+      }
+    });
+    bar.append(h("li", { role: "none", class: "menu-wrap" }, title, pop));
+  });
+
+  function roving(n) { titles.forEach((t, j) => t.setAttribute("tabindex", j === n ? "0" : "-1")); }
+  function open(i, focusFirst = true) {
+    openIdx = i;
+    bar.querySelectorAll(".menu").forEach((p, j) => { p.hidden = j !== i; });
+    titles.forEach((t, j) => t.setAttribute("aria-expanded", String(j === i)));
+    roving(i);
+    titles[i].focus();
+    if (focusFirst) bar.querySelectorAll(".menu")[i].querySelector(".menu-item:not([disabled])")?.focus();
+  }
+  function close() {
+    openIdx = -1;
+    bar.querySelectorAll(".menu").forEach((p) => { p.hidden = true; });
+    titles.forEach((t) => t.setAttribute("aria-expanded", "false"));
+  }
+  menubarClose = close;
+
+  // Status, right-aligned: the live run, then egress.
+  const offline = state.meta?.settings?.offline !== false;
+  const egress = h("button", { type: "button", class: "status", role: "switch", "aria-checked": String(offline), title: offline ? "Scans started here contact only their target. Click to go online." : "Scans may also contact recon sources. Click to go offline." },
+    h("span", { class: ["lamp", offline ? null : "on"], "aria-hidden": "true" }), offline ? "Offline" : "Online");
+  egress.addEventListener("click", async () => {
+    const s = await api.post("/api/settings", { offline: !offline }).catch(() => null);
+    if (!s) return;
+    state.meta.settings = s;
+    set({ meta: state.meta });
+    announce(`Offline ${s.offline ? "on" : "off"}`);
+  });
+  const waiting = state.pending;
+  const runStatus = run
+    ? h("button", { type: "button", class: ["status", waiting ? "waiting" : null], onclick: () => set({ sel: { kind: "run", key: run.id, run } }) },
+      h("span", { class: "lamp live", "aria-hidden": "true" }),
+      waiting ? `Fix ${waiting.index} of ${waiting.total} waiting for you` : `${({ scan: "Scan", deps: "Dependencies", agents: "AI tooling", loop: "Fix loop" })[run.kind] || run.kind} running`)
+    : null;
+
+  clear(el).append(bar, h("span", { class: "grow" }),
+    h("div", { class: "statuses", role: "status", "aria-live": "polite" }, runStatus, egress,
+      state.meta?.demo ? h("span", { class: "status dim" }, "demo") : null));
+}
+
+let menubarClose = () => {};
+/** Close any open menu (a click elsewhere, or Esc from the page). Returns true if one was open. */
+export function closeMenus() {
+  if (openIdx === -1) return false;
+  menubarClose();
+  return true;
+}

package/src/ui/static/js/onboarding.js

@@ -0,0 +1,104 @@
+// First-run setup: three screens in one window. Welcome, choose Simple or
+// Advanced, then the project and a first check. Back is always there, the
+// fraction says where you are, and closing it early keeps Simple mode.
+import { h, announce } from "./dom.js";
+import { api } from "./api.js";
+import { state, set, folderFor } from "./state.js";
+import { shortProject } from "./format.js";
+import { SETUP } from "./copy.js";
+import { openWindow } from "./dialog.js";
+
+const LOCAL = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|[a-z0-9-]+\.localhost)$/i;
+
+export function setup(ctx) {
+  const answers = { ux: state.ux || "simple", folder: folderFor(state.sel.kind === "project" ? state.sel.key : null), url: "" };
+  const body = h("div", { class: "setup" });
+  const progress = h("span", { class: "progress" });
+  const win = openWindow({ title: "Set up Penthera", body, wide: true });
+  win.el.querySelector(".win-bar").append(h("span", { class: "grow" }), progress);
+  win.el.addEventListener("close", () => ctx.finishSetup(answers.ux), { once: true });
+  let step = 0;
+
+  const nav = (...right) => h("div", { class: "actions" },
+    step > 0 ? h("button", { type: "button", class: "btn", onclick: () => go(step - 1) }, "◂ Back") : null,
+    h("span", { class: "grow" }), ...right);
+
+  function go(n) {
+    step = n;
+    progress.textContent = `${n + 1} / ${SETUP.steps}`;
+    body.replaceChildren(...[welcome, mode, project][n]());
+    body.querySelector("[data-first]")?.focus();
+  }
+
+  function welcome() {
+    const w = SETUP.welcome;
+    return [
+      h("span", { class: "logotype xl", role: "img", "aria-label": "Penthera" }),
+      h("h2", {}, w.title),
+      ...w.body.map((p) => h("p", { class: "prose" }, p)),
+      h("p", { class: "gate prose" }, w.gate),
+      nav(h("button", { type: "button", class: "btn primary", "data-first": "", onclick: () => go(1) }, "Start ▸")),
+    ];
+  }
+
+  function mode() {
+    const m = SETUP.mode;
+    const opt = (id, o) => {
+      const input = h("input", { type: "radio", name: "ux", value: id, checked: answers.ux === id, "data-first": answers.ux === id ? "" : null });
+      input.addEventListener("change", () => { answers.ux = id; });
+      return h("label", { class: "choice big" }, input, h("span", {}, h("span", { class: "t1" }, o.title), h("span", { class: "note prose" }, o.body)));
+    };
+    return [
+      h("h2", {}, m.title),
+      h("fieldset", {}, h("legend", { class: "sr" }, m.title), h("div", { class: "choices" }, opt("simple", m.simple), opt("advanced", m.advanced))),
+      h("p", { class: "muted prose" }, m.note),
+      nav(h("button", { type: "button", class: "btn primary", onclick: () => { ctx.setUx(answers.ux); go(2); } }, "Next ▸")),
+    ];
+  }
+
+  function project() {
+    const p = SETUP.project;
+    const folders = state.meta?.projects || [];
+    const folder = h("select", { id: "su-folder", "data-first": "" }, folders.map((f) => h("option", { value: f, selected: f === answers.folder }, shortProject(f))));
+    folder.addEventListener("change", () => { answers.folder = folder.value; });
+    const url = h("input", { type: "text", id: "su-url", autocomplete: "off", spellcheck: "false", placeholder: "http://localhost:3000", value: answers.url });
+    const confirm = h("input", { type: "text", id: "su-confirm", autocomplete: "off", spellcheck: "false" });
+    const confirmQ = h("label", { for: "su-confirm", class: "prose" });
+    const confirmRow = h("div", { class: "field confirm", hidden: true }, confirmQ, confirm);
+    const err = h("p", { class: "err", role: "alert", hidden: true });
+    url.addEventListener("input", () => {
+      answers.url = url.value;
+      let host = null;
+      try { host = url.value.trim() ? new URL(/^[a-z]+:\/\//i.test(url.value) ? url.value : `http://${url.value}`).hostname : null; } catch { /* not a URL yet */ }
+      const remote = Boolean(host && !LOCAL.test(host));
+      confirmRow.hidden = !remote;
+      if (remote) confirmQ.textContent = `${host} is not on this computer. Type its name to confirm it is yours or you may test it:`;
+    });
+    const check = h("button", { type: "button", class: "btn primary" }, `${p.check} ▸`);
+    check.addEventListener("click", async () => {
+      err.hidden = true;
+      check.disabled = true;
+      try {
+        const r = await api.post("/api/runs", { kind: "scan", repo: folder.value, url: url.value, confirm: confirm.value, maxIterations: 5 });
+        win.close();
+        await ctx.refresh();
+        set({ sel: { kind: "run", key: r.id, run: r } });
+        announce("First check started");
+      } catch (e) {
+        err.textContent = e.message;
+        err.hidden = false;
+        check.disabled = false;
+      }
+    });
+    return [
+      h("h2", {}, p.title),
+      h("div", { class: "form" },
+        h("div", { class: "field" }, h("label", { for: "su-folder" }, p.folder), folders.length ? folder : h("p", { class: "muted" }, "No folder given."), h("p", { class: "muted prose" }, p.folderNote)),
+        h("div", { class: "field" }, h("label", { for: "su-url" }, p.url), url, h("p", { class: "muted prose" }, p.urlNote)),
+        confirmRow, err),
+      nav(h("button", { type: "button", class: "btn", onclick: win.close }, p.skip), check),
+    ];
+  }
+
+  go(0);
+}

package/src/ui/static/js/panels.js

@@ -0,0 +1,186 @@
+// The project's tabs besides Findings: Dependencies, AI tooling, History and
+// Proof. These were the right-hand cards; they now live with the project they
+// describe, so the inspector on the right only ever shows one thing.
+import { h, empty, sevBadge, announce } from "./dom.js";
+import { api } from "./api.js";
+import { state, set } from "./state.js";
+import { bars, SHADE, trendChart } from "./charts.js";
+import { ago, stamp, shortProject, plural, pct } from "./format.js";
+import { EMPTY } from "./copy.js";
+
+const section = (title, aside, ...body) => h("section", { class: "section" },
+  h("h2", {}, h("span", {}, title), aside ? h("span", {}, aside) : null), ...body);
+const label = (text) => h("p", { class: "label" }, text);
+const failed = (e) => h("p", { class: "bad", role: "alert" }, e.message);
+
+// ── Dependencies ────────────────────────────────────────────────────────
+
+const CAP_SEV = { "install-scripts": "high", obfuscated: "high", "ai-config-write": "critical", "ai-cli-invoke": "critical", "token-harvest": "critical" };
+
+export async function depsTab(el) {
+  let d;
+  try { d = await api.get("/api/deps"); } catch (e) { el.append(failed(e)); return; }
+  const l = d.latest;
+  if (!l) { el.append(section("Dependencies", "", empty(EMPTY.deps))); return; }
+  const diff = l.diff;
+  const gained = diff ? diff.upgraded.reduce((n, u) => n + u.gained.length, 0) + diff.added.reduce((n, a) => n + a.capabilities.length, 0) : 0;
+  const chip = (id, plus) => h("span", { class: `chip ${CAP_SEV[id] ? "inv" : ""}` }, `${plus ? "+" : ""}${id}`);
+  el.append(
+    section("Dependencies", `${l.ecosystem} · ${l.total} packages · ${ago(l.ts)}`,
+      h("dl", { class: "kv" },
+        h("dt", {}, "packages"), h("dd", {}, `${l.total} (${l.direct} direct) · ${l.lockfile}`),
+        h("dt", {}, "diff"), h("dd", {}, diff ? `+${diff.added.length} added · ~${diff.upgraded.length} upgraded · -${diff.removed.length} removed vs ${diff.base}` : "no base compared"),
+        h("dt", {}, "gained"), h("dd", {}, `${gained} capabilities`),
+        h("dt", {}, "typosquats"), h("dd", { class: l.typosquats.length ? "bad" : null }, l.typosquats.length ? l.typosquats.map((t) => `${t.name} ~ ${t.similarTo}`).join(", ") : "none"))),
+    diff ? section("What changed", `vs ${diff.base}`,
+      h("ul", { class: "mini" },
+        diff.added.map((a) => h("li", { class: "stacked" }, h("span", {}, `+ ${a.name}@${a.version}`), h("span", { class: "chips" }, a.capabilities.map((c) => chip(c, true))))),
+        diff.upgraded.filter((u) => u.gained.length).map((u) => h("li", { class: "stacked" }, h("span", {}, `${u.name} ${u.from} → ${u.to}`), h("span", { class: "chips" }, u.gained.map((c) => chip(c, true))))))) : null,
+    section("Capabilities in the tree", "",
+      bars(Object.entries(l.capabilityCounts).filter(([, n]) => n > 0).sort((a, b) => b[1] - a[1]).map(([id, n]) => ({ label: id, value: n, ch: SHADE[CAP_SEV[id] || "low"] })), { width: 28 })),
+    d.installs.length ? section("Install firewall", plural(d.installs.length, "decision"),
+      h("ul", { class: "mini" }, d.installs.map((i) => {
+        const deny = i.changes.some((c) => c.deny.length) || i.action === "refused";
+        return h("li", {}, h("span", { class: "chip" }, deny ? "Refused" : i.clean ? "Clean" : "Approved"), h("span", { class: "grow" }, i.specs.join(" ")), h("span", { class: "muted" }, ago(i.ts)));
+      }))) : null,
+  );
+}
+
+// ── AI tooling ──────────────────────────────────────────────────────────
+
+export async function aiTab(el) {
+  let d;
+  try { d = await api.get("/api/ai"); } catch (e) { el.append(failed(e)); return; }
+  const l = d.latest;
+  if (!l) { el.append(section("AI tooling", "", empty(EMPTY.ai))); return; }
+  const lock = l.lock || {};
+  const drift = (lock.changed || 0) + (lock.added || 0) + (lock.removed || 0);
+  el.append(
+    section("AI tooling", ago(l.ts),
+      h("div", { class: "head" },
+        h("span", { class: `grade lg grade-${l.grade}` }, l.grade),
+        h("div", {}, h("div", { class: "t1" }, `score ${l.score}/100`), h("div", { class: "muted" }, `grade history ${d.history.map((x) => x.grade).join(" → ")}`))),
+      h("dl", { class: "kv" },
+        h("dt", {}, "penthera.lock"), h("dd", { class: drift ? "bad" : null }, lock.status === "missing" ? "not pinned" : drift ? `${lock.changed || 0} changed · ${lock.added || 0} new · ${lock.removed || 0} removed` : "no drift"),
+        h("dt", {}, "inventory"), h("dd", {}, `${l.inventory.skills || 0} skills · ${l.inventory.mcpServers || 0} MCP servers · ${l.inventory.hooks || 0} hooks`),
+        h("dt", {}, "hidden content"), h("dd", { class: l.hidden.length ? "bad" : null }, l.hidden.length ? plural(l.hidden.length, "hit") : "none"))),
+    l.hidden.length ? section("Hidden content", plural(l.hidden.length, "hit"),
+      h("ul", { class: "rows" }, l.hidden.map((x) => h("li", {}, h("div", { class: "row static" }, sevBadge(x.severity), h("span", { class: "t" }, x.title), h("span", { class: "tag" }, ""), x.location ? h("span", { class: "where" }, x.location) : null))))) : null,
+  );
+}
+
+// ── History: trend, runs, commits, memory ───────────────────────────────
+
+export async function historyTab(el, project) {
+  const p = project ? state.overview?.projects?.find((x) => x.key === project) : null;
+  const points = p ? p.trend.map((t) => ({ ts: t.ts, total: t.total, severe: (t.critical || 0) + (t.high || 0) })) : [];
+  if (points.length) el.append(section("Open findings per scan", plural(points.length, "scan"), trendChart(points, { width: 640, height: 160 })));
+
+  const runs = [
+    ...state.runs.live.filter((r) => !project || r.repo === project || r.url === project).map((r) => ({ live: true, kind: r.kind, at: r.startedAt, status: r.status, run: r })),
+    ...state.runs.past.filter((l) => !project || l.target.repo === project || l.target.url === project).map((l) => ({ live: false, kind: "loop", at: l.startedAt, past: l })),
+  ];
+  el.append(section("Runs", plural(runs.length, "run"),
+    runs.length ? h("ul", { class: "rows" }, runs.map((r) => h("li", {}, h("button", {
+      type: "button", class: "row",
+      onclick: () => set(r.live ? { sel: { kind: "run", key: r.run.id, run: r.run } } : { sel: { kind: "past", key: r.at, past: r.past } }),
+    },
+    h("span", { class: "tag" }, r.live ? r.status : stamp(r.at).slice(5)),
+    h("span", { class: "t" }, `${({ scan: "Scan", deps: "Dependency check", agents: "AI tooling audit", loop: "Fix loop" })[r.kind] || r.kind}${project ? "" : ` · ${shortProject(r.run?.repo || r.past?.target?.repo)}`}`),
+    h("span", { class: "tag" }, ago(r.at)),
+    r.past ? h("span", { class: "where" }, `${r.past.totals.verified} verified · ${r.past.totals.failed} failed · findings ${r.past.findings.initial ?? "?"} → ${r.past.findings.final ?? "?"} · ${r.past.branch}`) : null)))) : empty(EMPTY.history)));
+
+  const past = state.runs.past.filter((l) => !project || l.target.repo === project || l.target.url === project);
+  const fixes = past.flatMap((l) => l.iterations.flatMap((it) => it.fixes.filter((f) => f.commit).map((f) => ({ ...f, branch: l.branch }))));
+  let env = { fixBranches: [] };
+  try { env = await api.get(`/api/env?project=${encodeURIComponent(project || "")}`); } catch { /* shown as none */ }
+  el.append(section("Commits the fix loop made", plural(fixes.length, "fix", "fixes"),
+    fixes.length ? h("ul", { class: "mini" }, fixes.map((f) => h("li", {},
+      h("span", {}, "✓"), h("span", { class: "grow" }, f.title, h("span", { class: "muted" }, ` · ${f.branch}`)),
+      h("code", { class: "muted", title: `git show ${f.commit}` }, f.commit.slice(0, 7))))) : empty(EMPTY.changes),
+    env.fixBranches.length ? h("div", {}, label("Local fix branches"), h("ul", { class: "mini" }, env.fixBranches.map((b) => h("li", {}, h("code", { class: "grow" }, b))))) : null,
+    h("p", { class: "muted prose" }, "Nothing is pushed. Review with git log --stat main..<branch>, then merge or push it yourself.")));
+
+  let mem = { projects: [] };
+  try { mem = await api.get("/api/memory"); } catch { /* shown as empty */ }
+  const mine = mem.projects.filter((m) => project && (m.label === project || m.label.startsWith(`${project} `)));
+  const list = mine.length ? mine : mem.projects;
+  if (!list.length) { el.append(section("Memory", "", empty(EMPTY.memory))); return; }
+  const recipes = new Map();
+  for (const m of list) for (const r of m.recipes) {
+    const c = recipes.get(r.recipe) || { verified: 0, failed: 0 };
+    c.verified += r.verified;
+    c.failed += r.failed;
+    recipes.set(r.recipe, c);
+  }
+  const broken = list.filter((m) => m.chain !== "ok");
+  const ttf = list.map((m) => m.medianTimeToFixDays).filter((x) => x != null);
+  el.append(section("Memory", broken.length ? `${broken.length} broken` : "chain ok",
+    h("dl", { class: "kv" },
+      h("dt", {}, "chain"), h("dd", { class: broken.length ? "bad" : null }, broken.length ? `[!] broken in ${plural(broken.length, "project")} :: ignored there` : "✓ sha-256 hash chain"),
+      h("dt", {}, "events"), h("dd", {}, String(list.reduce((n, m) => n + m.events, 0))),
+      h("dt", {}, "fixes"), h("dd", {}, `${list.reduce((n, m) => n + m.verifiedFixes, 0)} verified · ${list.reduce((n, m) => n + m.failedFixes, 0)} failed`),
+      h("dt", {}, "time to fix"), h("dd", {}, ttf.length ? `median ${Math.min(...ttf)}-${Math.max(...ttf)} days` : "-")),
+    label("Recipe success"),
+    bars([...recipes].map(([recipe, r]) => ({ label: `${recipe} ${pct(r.verified / Math.max(1, r.verified + r.failed))}`, value: r.verified })), { width: 24 })));
+}
+
+// ── Proof: what was touched, and evidence an auditor can check ──────────
+
+export async function proofTab(el, project) {
+  const target = project || state.overview?.projects?.[0]?.key || "";
+  let env; let ev;
+  try {
+    [env, ev] = await Promise.all([api.get(`/api/env?project=${encodeURIComponent(target)}`), api.get("/api/evidence")]);
+  } catch (e) { el.append(failed(e)); return; }
+  const scanned = state.overview?.projects?.some((p) => p.key === target);
+
+  el.append(section("What the last scan touched", shortProject(target),
+    h("dl", { class: "kv" },
+      h("dt", {}, "folder"), h("dd", {}, env.folder || (target.startsWith("/") ? target : "a URL target")),
+      h("dt", {}, "branch"), h("dd", {}, env.branch ? `${env.branch}${env.head ? ` @ ${env.head}` : ""}` : "-"),
+      h("dt", {}, "dashboard"), h("dd", {}, `${location.host}, no network`)),
+    env.hosts.length ? h("ul", { class: "mini" },
+      env.hosts.map((x) => h("li", {}, h("span", { class: "chip" }, x.thirdParty ? "3rd party" : "target"), h("span", { class: "grow" }, x.host), h("span", { class: "muted" }, plural(x.requests, "request")))),
+      env.blocked.map((x) => h("li", {}, h("span", { class: "chip inv" }, "blocked"), h("span", { class: "grow" }, x.host), h("span", { class: "muted" }, "offline mode")))) : empty("No hosts recorded for the last scan."),
+  ));
+
+  const msg = h("p", { class: "muted prose", "aria-live": "polite" });
+  const out = h("div");
+  const create = h("button", { type: "button", class: "btn primary", disabled: !scanned }, "Create bundle");
+  create.addEventListener("click", async () => {
+    create.disabled = true;
+    msg.textContent = "Writing the bundle and hashing every file…";
+    try {
+      const r = await api.post("/api/evidence/create", { project: target });
+      const v = await api.post("/api/evidence/verify", { id: r.id });
+      msg.textContent = `${r.path} :: ${v.ok ? "verified" : "verification failed"}`;
+      announce(msg.textContent);
+      set({ tab: "proof" });
+    } catch (e) { msg.textContent = e.message; create.disabled = false; }
+  });
+  el.append(section("Evidence bundle", plural(ev.bundles.length, "bundle"),
+    h("p", { class: "prose" }, "A bundle holds the latest scan, its inputs and a hash of every file, so an auditor can check nothing changed after the fact."),
+    h("div", { class: "actions start" }, create,
+      // A download through the API carries the session header; a plain link could not.
+      ...["auditor", "owner", "developer"].map((a) => h("button", {
+        type: "button", class: "btn", disabled: !scanned,
+        onclick: () => api.download(`/api/report?${new URLSearchParams({ project: target, audience: a })}`).catch((e) => { msg.textContent = e.message; }),
+      }, `${a} report`))),
+    msg,
+    ev.bundles.length ? h("ul", { class: "mini" }, ev.bundles.map((b) => {
+      const res = h("span", { class: "muted" }, b.signed ? "signed" : "unsigned");
+      const btn = h("button", { type: "button", class: "btn small" }, "Verify");
+      btn.addEventListener("click", async () => {
+        btn.disabled = true;
+        res.textContent = "hashing…";
+        const r = await api.post("/api/evidence/verify", { id: b.id }).catch((e) => ({ ok: false, problems: [e.message], files: [] }));
+        res.textContent = r.ok ? "✓ intact" : `[!] ${plural(r.problems.length, "problem")}`;
+        res.className = r.ok ? "t1" : "bad";
+        out.replaceChildren(...(r.ok ? [] : [h("pre", { class: "block" }, r.problems.map((p) => `- ${p}`).join("\n"))]));
+        btn.disabled = false;
+      });
+      return h("li", {}, h("span", { class: "grow", title: b.target || "" }, `${b.path} · ${ago(b.generatedAt)}`), res, btn);
+    })) : empty(EMPTY.evidence),
+    out));
+}