pqcheck 0.16.3 → 0.16.4

package/bin/cipherwake-statusline.js

@@ -73,7 +73,11 @@ try {
   process.exit(0);
 }
 
-const { domain, score, grade, ship_decision, written_at, max_severity, unreachable } = state;
+const {
+  domain, score, grade, ship_decision, written_at, max_severity, unreachable,
+  // v0.16.4 — preview-diff-specific fields for the 4-line render
+  kind, delta_count, diff_no_change, sector_ranking, verified_signal_categories, last_changed,
+} = state;
 const age = ageHours(written_at);
 
 if (age > STALE_THRESHOLD_HOURS) {
@@ -87,6 +91,70 @@ if (age > STALE_THRESHOLD_HOURS) {
   process.exit(0);
 }
 
+// v0.16.4 — preview-diff 4-line state.
+// User direction: when the last scan was `preview-diff` (two URLs compared),
+// render the high-yield block in the statusline. Other scan kinds keep the
+// 1-line compact format below — the bigger block would be too noisy when
+// it's just a routine domain scan with no diff context.
+if (kind === "preview-diff" && !unreachable) {
+  // Line 1: brand header (hostname only).
+  const head = c(C.bold, "◆ Cipherwake") + c(C.dim, " — ") + c(C.bold, domain || "—");
+  // Line 3: decision pulse, diff-flavored copy.
+  let pulse;
+  if (ship_decision === "pass") {
+    pulse = c(C.green, "✓ PASS") + c(C.dim, " · no risky deploy-surface drift detected");
+  } else if (ship_decision === "review") {
+    pulse = c(C.yellow, "⚠ REVIEW") + c(C.dim, ` · ${delta_count || 0} public-surface change${delta_count === 1 ? "" : "s"}`);
+  } else if (ship_decision === "block") {
+    pulse = c(C.red, "⛔ BLOCK") + c(C.dim, ` · ${delta_count || 0} critical change${delta_count === 1 ? "" : "s"}`);
+  } else {
+    pulse = c(C.dim, "· no decision");
+  }
+  // Line 4: trust posture (DBR + percentile copy + stability).
+  function formatPercentile(percentile, sector) {
+    if (typeof percentile !== "number") return null;
+    const s = sector || "industry";
+    if (percentile <= 10) return `top 10% in ${s}`;
+    if (percentile <= 25) return `top 25% in ${s}`;
+    if (percentile <= 50) return `above median in ${s}`;
+    if (percentile <= 75) return `below median in ${s}`;
+    if (percentile <= 90) return `bottom 25% in ${s}`;
+    return `bottom 10% in ${s}`;
+  }
+  function formatStability(iso) {
+    if (!iso) return null;
+    const days = Math.floor((Date.now() - new Date(iso).getTime()) / 86400000);
+    if (days <= 0) return "drifted today";
+    if (days < 7) return `drifted ${days}d ago`;
+    return `stable ${days}d`;
+  }
+  const trustParts = [];
+  if (typeof score === "number") {
+    trustParts.push(`DBR ${score.toFixed(1)}${grade ? " " + grade : ""}`);
+  }
+  const pct = formatPercentile(sector_ranking?.percentile, sector_ranking?.sectorLabel || sector_ranking?.sectorName || sector_ranking?.sector);
+  if (pct) trustParts.push(pct);
+  const stab = formatStability(last_changed);
+  if (stab) trustParts.push(stab);
+  const trustLine = trustParts.length > 0
+    ? c(C.green, "✓ ") + c(C.bold, "Trust posture: ") + trustParts.join(c(C.dim, " · "))
+    : null;
+  // Line 5: verified signals (or finding line when there IS drift).
+  let verifiedLine = null;
+  if (Array.isArray(verified_signal_categories) && verified_signal_categories.length > 0) {
+    const head = diff_no_change === true
+      ? "Security-relevant surface unchanged"
+      : `Verified ${verified_signal_categories.length} signal${verified_signal_categories.length === 1 ? "" : "s"}`;
+    verifiedLine = c(C.green, "✓ ") + c(C.bold, head) + c(C.dim, " · " + verified_signal_categories.join(", "));
+  }
+  // Compose
+  const lines = [head, "", pulse];
+  if (trustLine) lines.push(trustLine);
+  if (verifiedLine) lines.push(verifiedLine);
+  process.stdout.write(lines.join("\n"));
+  process.exit(0);
+}
+
 // Brand-anchored layout — "Cipherwake" is always the first word after the
 // diamond, so the customer (and their AI agent) can identify the status
 // line's source at a glance. Trailing segments depend on what we have:

package/bin/pqcheck.js

@@ -24,7 +24,7 @@
 })();
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://cipherwake.io";
-const VERSION = "0.16.3";
+const VERSION = "0.16.4";
 
 // API-key support — paid tiers (Starter $29 / Growth $79 / Scale $199) get
 // per-account monthly quotas instead of the per-IP rate limit. Set via:
@@ -3390,15 +3390,30 @@ async function runPreviewDiffCommand(args) {
     }));
     console.log("");
 
+    // v0.16.4 — write the data the statusline needs to render its
+    // 4-line preview-diff state (brand header + decision pulse + trust
+    // posture + verified signals). For non-preview-diff kinds we keep
+    // the 1-line statusline; only preview-diff gets the bigger format.
+    const verifiedSignalCats = (() => {
+      try { return countVerifiedSignals(reportLike).categories; } catch { return null; }
+    })();
     await writeLastScanFile({
-      domain: result?.production?.domain || productionUrl,
+      domain: result?.production?.hostname || result?.production?.domain || productionUrl,
       kind: "preview-diff",
       preview_url: previewUrl,
       production_url: productionUrl,
-      score: typeof prevScore === "number" ? prevScore : null,
+      // v0.16.4 — score/grade come from the PRODUCTION side so the trust
+      // posture line reflects the live customer site, not the in-flight
+      // preview. (Was prevScore before — wrong reference.)
+      score: typeof prodSig?.score === "number" ? prodSig.score : (typeof prevScore === "number" ? prevScore : null),
+      grade: prodSig?.grade || null,
       max_severity: maxSev,
       ship_decision: shipDecision,
       delta_count: summaryLines.filter((l) => !/no meaningful/i.test(l)).length,
+      diff_no_change: diffNoChange,
+      sector_ranking: prodSig?.sectorRanking || null,
+      verified_signal_categories: verifiedSignalCats,
+      last_changed: prodSig?.lastChanged || null,
     });
 
     process.exit(shipDecisionExitCode(shipDecision));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Deploy gate for AI-coded web apps. `pqcheck deploy-check --ai` returns ship_decision=pass|review|block for Claude Code / Cursor / Copilot / Aider to gate deploys before they ship. Anonymous, no signup, free for first use.",
   "keywords": [
     "ai-coder",