pqcheck 0.16.0 → 0.16.2

package/bin/cipherwake-statusline.js

@@ -121,6 +121,18 @@ const sevSegment = (!isUnreachable && max_severity && max_severity !== "none")
   ? ` · ${String(max_severity).toUpperCase()}`
   : "";
 
+// v0.16.2 — drift narrative suffix. "stable 14d" / "drifted 2d ago" / "now".
+// Sourced from state.lastChanged (smartCache populates) so the customer
+// sees time-series anchor at a glance, not just a single-point snapshot.
+let stabilitySegment = "";
+if (!isUnreachable && state.lastChanged) {
+  const dms = Date.now() - new Date(state.lastChanged).getTime();
+  const days = Math.floor(dms / 86400000);
+  if (days <= 0) stabilitySegment = " · drifted today";
+  else if (days < 7) stabilitySegment = ` · drifted ${days}d ago`;
+  else stabilitySegment = ` · stable ${days}d`;
+}
+
 process.stdout.write(
   c(cdec, "◆") +
     " " +

package/bin/pqcheck.js

@@ -24,7 +24,7 @@
 })();
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
-const VERSION = "0.16.0";
+const VERSION = "0.16.2";
 
 // API-key support — paid tiers (Starter $29 / Growth $79 / Scale $199) get
 // per-account monthly quotas instead of the per-IP rate limit. Set via:
@@ -831,11 +831,13 @@ function countVerifiedSignals(report) {
   if (report?.sourceMaps?.reachable) cats.push("source maps");
   // 6. TLS posture
   if (report?.publicSurface?.tlsVersion || report?.tlsVersion) cats.push("TLS");
-  // 7. Mixed content — not yet a separate probe but counted when we have
-  //    publicDeps (which exposes any loadedOverHttps:false items).
-  if (report?.publicDeps?.fetched) cats.push("mixed-content");
+  // 7. Mixed content — v0.16.2 promoted to dedicated probe; falls back to
+  //    publicDeps inference when explicit field missing.
+  if (report?.mixedContent?.probed || report?.publicDeps?.fetched) cats.push("mixed-content");
   // 8. Subdomain scale (from CT log scan)
   if (typeof report?.publicSurface?.subdomainCount === "number") cats.push("subdomain scale");
+  // 9. Protected paths (v0.16.2 — the headline feature)
+  if (report?.protectedPaths?.probed) cats.push("protected paths");
   return { count: cats.length, categories: cats };
 }
 
@@ -2762,19 +2764,39 @@ async function runScanBasedDeployCheck(domain, args) {
         ];
   }
 
+  // v0.16.0 high-yield rendering — same shape as runOneScan but with the
+  // "first-deploy" context line above the brand header (since this path
+  // fires only when there's no baseline to diff against).
+  const verbose = isVerboseMode(args);
+  const highSevFindings = findings.filter((f) => severityRank(f.severity) >= 3);
+  const alertCount = highSevFindings.length;
+
   console.log("");
   console.log(color("dim", `  ℹ first deploy-check for ${domain} — using current scan state (no baseline yet to diff against)`));
   console.log("");
-  console.log(formatAiBanner({
-    domain,
-    kind: "scan",
-    dbr: report.score,
-    grade: report.grade,
-    maxSeverity: maxSev,
-    shipDecision,
-    unreachable,
-  }));
-  console.log(formatAiBody({ topIssue, whyMatters, nextActions }));
+  console.log(formatBrandHeader(domain));
+  console.log("");
+  console.log(formatDecisionPulse({ shipDecision, alertCount, unreachable, diffContext: true }));
+
+  if (unreachable) {
+    console.log(formatAiBody({ topIssue, whyMatters, nextActions }));
+  } else {
+    if (alertCount > 0) {
+      const alerts = formatAlertsLine(highSevFindings);
+      if (alerts) console.log(alerts);
+    }
+    const tpl = formatTrustPostureLine(report);
+    if (tpl) console.log(tpl);
+    const vsl = formatVerifiedSignalsLine(report);
+    if (vsl) console.log(vsl);
+    if (verbose) {
+      console.log("");
+      console.log(formatHighYieldVerbose(report));
+    } else {
+      console.log(color("dim", "  Run with --verbose to see all verified signals."));
+    }
+  }
+
   console.log(formatAiFooterBlock({
     status: shipDecision,
     domain,
@@ -2910,16 +2932,41 @@ async function runTrustDiffCommand(args) {
           `If not intentional: revert the deploy or investigate the drift source.`,
         ];
 
-    console.log("");
-    console.log(formatAiBanner({
+    // v0.16.0 high-yield rendering for trust-diff.
+    const verbose = isVerboseMode(args);
+    const diffNoChange = deltas.length === 0;
+    const fakeReport = {
       domain,
-      kind: "trust-diff",
-      dbr: result.current_score,
+      score: result.current_score,
       grade: result.current_grade,
-      maxSeverity: maxSev,
-      shipDecision,
-    }));
-    console.log(formatAiBody({ topIssue, whyMatters, nextActions }));
+      _meta: { lastChanged: result.last_changed },
+      sectorRanking: result.sectorRanking,
+    };
+
+    console.log("");
+    console.log(formatBrandHeader(domain));
+    console.log("");
+    console.log(formatDecisionPulse({ shipDecision, alertCount: deltas.length, unreachable: false, diffContext: true }));
+
+    if (deltas.length > 0) {
+      // Surface top deltas as alerts
+      const alertFindings = deltas.slice(0, 3).map((d) => ({
+        severity: d.severity || "medium",
+        title: d.title || d.what_changed || d.type || "drift",
+        id: d.id,
+      }));
+      const alerts = formatAlertsLine(alertFindings);
+      if (alerts) console.log(alerts);
+      if (deltas.length > 3) console.log(color("dim", `  +${deltas.length - 3} more (run with --verbose)`));
+    }
+    const tpl = formatTrustPostureLine(fakeReport);
+    if (tpl) console.log(tpl);
+    const vsl = formatVerifiedSignalsLine(fakeReport, { diffNoChange });
+    if (vsl) console.log(vsl);
+    if (!verbose) {
+      console.log(color("dim", "  Run with --verbose to see all verified signals."));
+    }
+
     console.log(formatAiFooterBlock({
       status: shipDecision,
       domain,
@@ -3123,16 +3170,46 @@ async function runPreviewDiffCommand(args) {
           `Each "- CSP weakened" or "~ HSTS weakened" reduces production safety.`,
         ];
 
-    console.log("");
-    console.log(formatAiBanner({
-      domain: result?.production?.domain || productionUrl,
-      kind: "preview-diff",
-      dbr: prevScore,
+    // v0.16.2 high-yield rendering for preview-diff.
+    const verbose = isVerboseMode(args);
+    const diffNoChange = !hasUnexpectedDiff;
+    const headerDomain = result?.production?.domain || productionUrl;
+    const fakeReport = {
+      domain: headerDomain,
+      score: prevScore,
       grade: result?.preview?.grade,
-      maxSeverity: maxSev,
-      shipDecision,
-    }));
-    console.log(formatAiBody({ topIssue, whyMatters, nextActions }));
+      _meta: { lastChanged: result?.production?.lastChanged },
+      sectorRanking: result?.production?.sectorRanking,
+    };
+    // Render top deltas as alert lines (1 per finding, max 3)
+    const deltaLines = summaryLines.filter((l) => !/no meaningful/i.test(l));
+
+    console.log("");
+    console.log(formatBrandHeader(headerDomain));
+    console.log("");
+    console.log(formatDecisionPulse({ shipDecision, alertCount: deltaLines.length, unreachable: false, diffContext: true }));
+
+    if (deltaLines.length > 0) {
+      for (const dl of deltaLines.slice(0, 3)) {
+        const sym = dl.startsWith("⛔") || dl.startsWith("-") ? "red" : dl.startsWith("⚠") || dl.startsWith("~") ? "yellow" : "dim";
+        console.log(color(sym, dl));
+      }
+      if (deltaLines.length > 3) console.log(color("dim", `  +${deltaLines.length - 3} more (run with --verbose)`));
+    }
+    const tpl = formatTrustPostureLine(fakeReport);
+    if (tpl) console.log(tpl);
+    const vsl = formatVerifiedSignalsLine(fakeReport, { diffNoChange });
+    if (vsl) console.log(vsl);
+    if (!verbose) {
+      console.log(color("dim", "  Run with --verbose to see all verified signals."));
+    }
+
+    // (Old banner + body removed in v0.16.2; new high-yield layout above
+    // replaces them. AI footer still lands below for downstream agents.)
+    if (verbose) {
+      console.log("");
+      console.log(formatAiBody({ topIssue, whyMatters, nextActions }));
+    }
     console.log(formatAiFooterBlock({
       status: shipDecision,
       domain: result?.production?.domain || productionUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Deploy gate for AI-coded web apps. `pqcheck deploy-check --ai` returns ship_decision=pass|review|block for Claude Code / Cursor / Copilot / Aider to gate deploys before they ship. Anonymous, no signup, free for first use.",
   "keywords": [
     "ai-coder",