pqcheck 0.16.14 → 0.16.15

package/bin/pqcheck.js

@@ -24,7 +24,25 @@
 })();
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
-const VERSION = "0.16.14";
+const VERSION = "0.16.15";
+
+// v0.16.15 — attribution suffix. When the CLI runs inside GitHub Actions
+// (GH sets GITHUB_ACTIONS=true automatically in every step) we append
+// "(pqcheck-action)" to the User-Agent so the server-side classifier
+// (lib/events.ts) buckets the call as `action` rather than `cli`. Lets
+// the analytics dashboard split humans/CI invocations cleanly.
+//
+// No new data is collected — the User-Agent string was already being
+// sent on every call; this is a labeling change.
+//
+// Opt out via PQCHECK_DISABLE_ACTION_ATTRIBUTION=1 (UA stays plain
+// `pqcheck-cli/X.Y.Z` even under GitHub Actions). The env var is only
+// honored when GITHUB_ACTIONS=true — it does nothing in other contexts.
+const CI_ACTION_SUFFIX =
+  process.env.GITHUB_ACTIONS === "true" &&
+  process.env.PQCHECK_DISABLE_ACTION_ATTRIBUTION !== "1"
+    ? " (pqcheck-action)"
+    : "";
 
 // API-key support — paid tier (Founder Pro $19.99/mo launch pricing, locked while sub active) gets
 // per-account monthly quotas instead of the per-IP rate limit. Set via:
@@ -38,7 +56,7 @@ const QP_API_KEY = (process.env.CIPHERWAKE_API_KEY || "").trim();
 // Builds headers with optional Authorization. Use for every CLI → API call
 // so a single env-var toggle authenticates every endpoint at once.
 function apiHeaders(extra = {}) {
-  const h = { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}`, ...extra };
+  const h = { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`, ...extra };
   if (QP_API_KEY) h.authorization = `Bearer ${QP_API_KEY}`;
   return h;
 }
@@ -274,7 +292,7 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi,
     const qs = fresh ? `?domain=${encodeURIComponent(domain)}&force=1` : `?domain=${encodeURIComponent(domain)}`;
     const resp = await fetch(`${API_BASE}/api/scan${qs}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (scan)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (scan)` }),
     });
     if (!quiet && format === "text") process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -321,7 +339,7 @@ async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi,
   if (webhookUrl) {
     fetch(webhookUrl, {
       method: "POST",
-      headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+      headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
       body: JSON.stringify({ domain, report, source: "pqcheck-cli", at: new Date().toISOString() }),
     }).catch(() => { /* best-effort — never fail the scan on webhook delivery */ });
   }
@@ -543,7 +561,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
       try {
         const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
           method: "GET",
-          headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (watch)` }),
+          headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (watch)` }),
         });
         if (!resp.ok) continue;
         const report = await resp.json();
@@ -554,7 +572,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
         if (changed && webhookUrl) {
           fetch(webhookUrl, {
             method: "POST",
-            headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+            headers: { "content-type": "application/json", "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
             body: JSON.stringify({
               type: "score_changed",
               domain,
@@ -899,7 +917,7 @@ async function refreshVersionCacheInBackground(cachePath) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 2500);
     const resp = await fetch(VERSION_REGISTRY_URL, {
-      headers: { "Accept": "application/json", "User-Agent": `pqcheck-cli/${VERSION}` },
+      headers: { "Accept": "application/json", "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}` },
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -1829,7 +1847,7 @@ async function runLockCommand(args) {
   try {
     const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (lock)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (lock)` }),
     });
     if (!stdout) process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
@@ -1909,7 +1927,7 @@ function buildQxmManifest(report, crypto) {
   return {
     schema: "https://cipherwake.io/schemas/qxm/v1",
     schemaVersion: 1,
-    generator: `pqcheck-cli/${VERSION}`,
+    generator: `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
     generatedAt: report.generatedAt || new Date().toISOString(),
     domain: report.domain,
     reachable: !!report.reachable,
@@ -2152,7 +2170,7 @@ async function runDepsCommand(args) {
       batch.map(async (h) => {
         try {
           const r = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(h.host)}&source=cli-deps`, {
-            headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (deps)` }),
+            headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (deps)` }),
           });
           if (!r.ok) return { ...h, types: Array.from(h.types), scan: null, error: `${r.status}` };
           const body = await r.json();
@@ -2391,7 +2409,7 @@ async function fetchPageHTML(domain) {
       method: "GET",
       redirect: "follow",
       signal: ctrl.signal,
-      headers: { "User-Agent": `pqcheck-cli/${VERSION} (deps; +https://cipherwake.io)` },
+      headers: { "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (deps; +https://cipherwake.io)` },
     });
     clearTimeout(t);
     if (!resp.ok) return null;
@@ -2848,7 +2866,7 @@ async function runHistoryCommand(args) {
   let h;
   try {
     const r = await fetch(`${API_BASE}/api/history?domain=${encodeURIComponent(domain)}&days=${days}`, {
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (history)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (history)` }),
     });
     if (!r.ok) {
       console.error(color("red", `error: ${r.status} ${r.statusText}`));
@@ -2931,7 +2949,7 @@ async function runChangesCommand(args) {
   let summary;
   try {
     const r = await fetch(`${API_BASE}/api/changes-summary?domain=${encodeURIComponent(domain)}`, {
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (changes)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (changes)` }),
     });
     if (!r.ok) {
       console.error(color("red", `error: ${r.status} ${r.statusText}`));
@@ -3025,7 +3043,7 @@ async function runChangesCommand(args) {
 async function runScanBasedDeployCheck(domain, args) {
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) headers["Authorization"] = `Bearer ${QP_API_KEY}`;
 
@@ -3198,7 +3216,7 @@ async function runTrustDiffCommand(args) {
   // anonymous per-IP rate limit path (just like /api/scan).
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) {
     headers["Authorization"] = `Bearer ${QP_API_KEY}`;
@@ -3696,7 +3714,7 @@ async function runPreviewDiffCommand(args) {
 
   const headers = {
     "Content-Type": "application/json",
-    "User-Agent": `pqcheck-cli/${VERSION}`,
+    "User-Agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
   };
   if (QP_API_KEY) {
     headers["Authorization"] = `Bearer ${QP_API_KEY}`;
@@ -4766,7 +4784,7 @@ async function fetchVendorOrigins(domain) {
   try {
     resp = await fetch(`${API_BASE}/api/deps?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
-      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (vendors)` }),
+      headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (vendors)` }),
       signal: ac.signal,
     });
   } catch (err) {
@@ -4814,7 +4832,7 @@ function normalizeObservedOrigin(value) {
 function buildVendorLockfile(domain, origins) {
   return {
     schema_version: 1,
-    generator: `pqcheck-cli/${VERSION}`,
+    generator: `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX}`,
     domain,
     generated_at: new Date().toISOString(),
     approved_script_origins: origins,
@@ -4930,7 +4948,7 @@ async function runVendorsSync(domain, outPath) {
     resp = await fetch(`${API_BASE}/api/vendor-allowlist?domain=${encodeURIComponent(domain)}`, {
       method: "GET",
       headers: {
-        "user-agent": `pqcheck-cli/${VERSION} (vendors-sync)`,
+        "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (vendors-sync)`,
         "authorization": "Bearer " + QP_API_KEY,
       },
     });
@@ -5084,7 +5102,7 @@ async function runOnboardCommand(args) {
     try {
       const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}&source=onboard`, {
         method: "GET",
-        headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION} (onboard)` }),
+        headers: apiHeaders({ "user-agent": `pqcheck-cli/${VERSION}${CI_ACTION_SUFFIX} (onboard)` }),
       });
       if (resp.ok) {
         const report = await resp.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.16.14",
+  "version": "0.16.15",
   "description": "Deploy gate for AI-coded web apps. `pqcheck deploy-check --ai` returns ship_decision=pass|review|block for Claude Code / Cursor / Copilot / Aider to gate deploys before they ship. Anonymous, no signup, free for first use.",
   "keywords": [
     "ai-coder",