pqcheck 0.14.1 → 0.14.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +63 -26
- package/bin/pqcheck.js +6 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,6 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
> **Decryption Blast Radius scanner** — find out how much of your data unlocks when quantum decryption arrives.
|
|
4
4
|
|
|
5
|
+
[](https://www.npmjs.com/package/pqcheck)
|
|
6
|
+
[](https://www.npmjs.com/package/pqcheck)
|
|
7
|
+
[](./LICENSE)
|
|
8
|
+
|
|
5
9
|
```bash
|
|
6
10
|
npx pqcheck stripe.com
|
|
7
11
|
```
|
|
@@ -12,6 +16,20 @@ The same scanner that powers [cipherwake.io](https://cipherwake.io), the browser
|
|
|
12
16
|
|
|
13
17
|
---
|
|
14
18
|
|
|
19
|
+
## What it does
|
|
20
|
+
|
|
21
|
+
| Command | What it gives you |
|
|
22
|
+
|---|---|
|
|
23
|
+
| `npx pqcheck <domain>` | One-shot DBR scan + grade. The original surface. |
|
|
24
|
+
| `npx pqcheck trust-diff <domain>` | Compare today's public trust posture vs a baseline (last-week, last-month, or a saved CI baseline). For CI gates + release checklists. |
|
|
25
|
+
| `npx pqcheck preview-diff --preview <URL> --production <URL>` | Compare a Vercel/Netlify preview deployment URL to production. Surfaces new third-party scripts, header regressions, and DBR score drops *inside the PR*, before merge. |
|
|
26
|
+
| `npx pqcheck vendors export/check/sync <domain>` | Vendor lockfile (`cipherwake.vendors.json`) + CI gate that exits non-zero when a new third-party origin appears. Like `package-lock.json` for vendor scripts. |
|
|
27
|
+
| `npx pqcheck onboard <domain>` | One command: scan → scaffold the GitHub Action → capture a vendor lockfile → set a baseline → commit + push. Zero copy-paste from docs. |
|
|
28
|
+
|
|
29
|
+
Free tier covers all of the above within 100 Trust Diff calls/month per repo (paid lifts to 1K / 10K / 50K). Single-domain scans (`npx pqcheck <domain>`) are unmetered.
|
|
30
|
+
|
|
31
|
+
---
|
|
32
|
+
|
|
15
33
|
## Get started in 60 seconds
|
|
16
34
|
|
|
17
35
|
Wire Cipherwake into your CI so every PR gets a Trust Diff comment when your domain's public trust posture changes.
|
|
@@ -47,9 +65,21 @@ That's it. The scaffolded workflow includes `permissions: id-token: write`, so t
|
|
|
47
65
|
|
|
48
66
|
---
|
|
49
67
|
|
|
50
|
-
##
|
|
68
|
+
## Features
|
|
69
|
+
|
|
70
|
+
For the per-release version history see [CHANGELOG.md](./CHANGELOG.md).
|
|
51
71
|
|
|
52
|
-
|
|
72
|
+
### Trust Diff — CI gate for posture regressions
|
|
73
|
+
|
|
74
|
+
```bash
|
|
75
|
+
npx pqcheck trust-diff mycompany.com --baseline last-week --fail-on high
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
Compares today's public trust posture against a configured baseline (`last-week`, `last-month`, or a saved per-branch baseline). Surfaces cert / SPKI / HSTS / CSP / DMARC / vendor-script drift since the baseline and gates the PR by severity. SARIF output uploads to GitHub Code Scanning. Pair with the [GitHub Action](https://github.com/cipherwakelabs/pqcheck/tree/main/action) `mode: trust-diff` for one-line CI integration.
|
|
79
|
+
|
|
80
|
+
Exit codes: `0` pass · `1` warn · `2` fail · `3` error. Free tier (100 calls/repo/mo via GitHub Actions OIDC, no API key required) silently downgrades fail → report; Starter+ honors `--fail-on` for real CI gating.
|
|
81
|
+
|
|
82
|
+
### Preview Trust Diff — PR-time URL-vs-URL comparison
|
|
53
83
|
|
|
54
84
|
```bash
|
|
55
85
|
npx pqcheck preview-diff \
|
|
@@ -57,6 +87,8 @@ npx pqcheck preview-diff \
|
|
|
57
87
|
--production https://example.com
|
|
58
88
|
```
|
|
59
89
|
|
|
90
|
+
Compares a preview-deployment URL to a production URL and surfaces application-surface changes (new third-party scripts, header regressions, DBR score drops) *inside the PR review, before merge*. SSRF-pinned scan path keeps preview-URL hostnames out of Cipherwake's moat tables — feature-branch names stay private.
|
|
91
|
+
|
|
60
92
|
Sample output:
|
|
61
93
|
|
|
62
94
|
```
|
|
@@ -75,42 +107,48 @@ Sample output:
|
|
|
75
107
|
Tier: free · policy: report
|
|
76
108
|
```
|
|
77
109
|
|
|
78
|
-
Flags: `--preview <URL>` · `--production <URL>` · `--compare-transport`
|
|
110
|
+
Flags: `--preview <URL>` · `--production <URL>` · `--compare-transport` · `--fail-on <severity>` (default `high`; `none` for report-only) · `--format pretty|json`. CSP weakening detection diffs `script-src` / `default-src` / `object-src` / `frame-ancestors` / `base-uri` / `style-src` for newly-permissive tokens (`*`, `'unsafe-inline'`, `'unsafe-eval'`, `data:`, `blob:`).
|
|
79
111
|
|
|
80
|
-
|
|
112
|
+
**Diffing a local dev build against prod?** Cipherwake runs the comparison server-side, so `--preview http://localhost:3000` is rejected (we'd be reaching for *our* loopback, not yours). Expose your dev build via a public tunnel:
|
|
81
113
|
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
## What's new in 0.12.0
|
|
114
|
+
```bash
|
|
115
|
+
# Vercel/Netlify preview deploys — automatic per PR, free, the design target
|
|
116
|
+
--preview https://feature-x-abc123.vercel.app
|
|
87
117
|
|
|
88
|
-
|
|
118
|
+
# ngrok — ad-hoc, one command
|
|
119
|
+
ngrok http 3000
|
|
120
|
+
--preview https://9b1f-203-0-113-7.ngrok-free.app
|
|
89
121
|
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
- `pqcheck vendors check <domain>` — CI gate; exits **4** when new origins appear that aren't in the lockfile.
|
|
95
|
-
- `pqcheck vendors sync <domain>` — Starter+ only; pulls your dashboard-managed approved-vendor allowlist into the lockfile.
|
|
122
|
+
# Cloudflare Tunnel — zero-auth quick tunnel
|
|
123
|
+
cloudflared tunnel --url http://localhost:3000
|
|
124
|
+
--preview https://random-words-1234.trycloudflare.com
|
|
125
|
+
```
|
|
96
126
|
|
|
97
|
-
|
|
127
|
+
### Vendor lockfile — `cipherwake.vendors.json`
|
|
98
128
|
|
|
99
|
-
|
|
129
|
+
Like `package-lock.json`, but for the third-party scripts that load on your domain. Capture currently observed vendor origins, commit the lockfile, and CI fails when a PR introduces a new vendor.
|
|
100
130
|
|
|
101
|
-
|
|
131
|
+
```bash
|
|
132
|
+
npx pqcheck vendors export mycompany.com # write cipherwake.vendors.json
|
|
133
|
+
npx pqcheck vendors check mycompany.com # CI gate; exit 4 on new origins
|
|
134
|
+
npx pqcheck vendors sync mycompany.com # Starter+ — pull dashboard allowlist
|
|
135
|
+
```
|
|
102
136
|
|
|
103
|
-
|
|
137
|
+
`pqcheck deps` also surfaces a one-line site-wide **CSP verdict** above the supply-chain table (`✗ No CSP enforcement` / `⚠ CSP is permissive` / `✓ Strict CSP enforced`) and friendly vendor labels (`New Relic · errors` / `Cloudflare · cdn` / `Adobe Fonts · fonts`) instead of raw hostnames. Same data shape ships on `/r/<domain>` and in the browser extension.
|
|
104
138
|
|
|
105
|
-
|
|
139
|
+
### Developer habit-loop subcommands
|
|
106
140
|
|
|
107
|
-
|
|
141
|
+
```bash
|
|
142
|
+
npx pqcheck init # interactive scaffold for .github/workflows/cipherwake.yml
|
|
143
|
+
npx pqcheck deploy-check # pre-deploy gate (Trust Diff alias, last-scan baseline)
|
|
144
|
+
npx pqcheck release-checklist # markdown trust checklist for release notes (offline)
|
|
145
|
+
```
|
|
108
146
|
|
|
109
|
-
|
|
147
|
+
The GitHub Action posts a **sticky PR comment** with results when `comment-on-pr: true` is set on `pull_request` events. Comment auto-edits on subsequent pushes — no spam.
|
|
110
148
|
|
|
111
149
|
---
|
|
112
150
|
|
|
113
|
-
##
|
|
151
|
+
## How DBR scoring works
|
|
114
152
|
|
|
115
153
|
`pqcheck` scans any HTTPS domain and computes its **Decryption Blast Radius score** — the first continuous metric for harvest-now-decrypt-later (HNDL) risk. Every other TLS scanner answers "is post-quantum cryptography enabled?" with yes/no. `pqcheck` answers the question that actually matters: *if an adversary harvests this traffic today and decrypts it in 2035, how much past + future data unlocks?*
|
|
116
154
|
|
|
@@ -285,9 +323,8 @@ This CLI is one of four ways to consume the [Decryption Blast Radius API](https:
|
|
|
285
323
|
| Surface | Where |
|
|
286
324
|
|---|---|
|
|
287
325
|
| **CLI** (this package) | `npx pqcheck` |
|
|
288
|
-
| **Browser extension** | Chrome Web Store
|
|
326
|
+
| **Browser extension** | [Chrome Web Store](https://chromewebstore.google.com/) — toolbar badge per tab + dependency analysis. Runs on any Chromium-based browser (Edge, Brave, Arc) via sideload. |
|
|
289
327
|
| **GitHub Action** | [`cipherwakelabs/pqcheck/action@main`](https://github.com/cipherwakelabs/pqcheck/tree/main/action) — PR comments, SARIF upload, lockfile generation |
|
|
290
|
-
| **Slack `/pqcheck`** | [Install on workspace](https://cipherwake.io/install-slack) |
|
|
291
328
|
| **Web** | [cipherwake.io](https://cipherwake.io) — share-friendly URLs at `/r/<domain>` |
|
|
292
329
|
|
|
293
330
|
## Public API
|
package/bin/pqcheck.js
CHANGED
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
// =============================================================================
|
|
8
8
|
|
|
9
9
|
const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
|
|
10
|
-
const VERSION = "0.
|
|
10
|
+
const VERSION = "0.14.2";
|
|
11
11
|
|
|
12
12
|
// API-key support — paid tiers (Starter $29 / Growth $79 / Scale $199) get
|
|
13
13
|
// per-account monthly quotas instead of the per-IP rate limit. Set via:
|
|
@@ -2076,6 +2076,7 @@ async function runTrustDiffCommand(args) {
|
|
|
2076
2076
|
const body = await safeJSON(resp);
|
|
2077
2077
|
console.error(color("red", `error: /api/trust-diff returned ${resp.status}`));
|
|
2078
2078
|
if (body?.message) console.error(color("dim", body.message));
|
|
2079
|
+
if (body?.hint) console.error(color("dim", body.hint));
|
|
2079
2080
|
process.exit(3);
|
|
2080
2081
|
}
|
|
2081
2082
|
|
|
@@ -2213,6 +2214,10 @@ async function runPreviewDiffCommand(args) {
|
|
|
2213
2214
|
const body = await safeJSON(resp);
|
|
2214
2215
|
console.error(color("red", `error: /api/preview-diff returned ${resp.status}`));
|
|
2215
2216
|
if (body?.message) console.error(color("dim", body.message));
|
|
2217
|
+
// Server-side may return a `hint` field on rejected inputs (e.g. localhost
|
|
2218
|
+
// / private-IP URLs surface the tunnel-options hint). Print it so the
|
|
2219
|
+
// user knows what to do next instead of just seeing the rejection.
|
|
2220
|
+
if (body?.hint) console.error(color("dim", body.hint));
|
|
2216
2221
|
process.exit(3);
|
|
2217
2222
|
}
|
|
2218
2223
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pqcheck",
|
|
3
|
-
"version": "0.14.
|
|
3
|
+
"version": "0.14.2",
|
|
4
4
|
"description": "HTTPS posture scanner with Preview Deploy Trust Diff for PRs, Trust Diff for CI, vendor lockfile + drift alerts, cross-tenant key map, and HNDL/quantum-decryption risk scoring. Free, no signup.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|