pqcheck 0.7.5 → 0.7.7

package/README.md

@@ -12,6 +12,12 @@ The same scanner that powers [quantapact.com](https://quantapact.com), the brows
 
 ---
 
+## What's new in 0.7.6
+
+User-Agent now consistently tags the subcommand on every request (`pqcheck-cli/0.7.6 (scan)`, `(lock)`, `(deps)`, `(history)`, `(watch)`). Lets the server aggregate adoption by subcommand. No new data collected — the subcommand token rides inside the User-Agent header that has always been logged anonymously. See [privacy](https://quantapact.com/privacy) and [CHANGELOG.md](./CHANGELOG.md).
+
+---
+
 ## What it does
 
 `pqcheck` scans any HTTPS domain and computes its **Decryption Blast Radius score** — the first continuous metric for harvest-now-decrypt-later (HNDL) risk. Every other TLS scanner answers "is post-quantum cryptography enabled?" with yes/no. `pqcheck` answers the question that actually matters: *if an adversary harvests this traffic today and decrypts it in 2035, how much past + future data unlocks?*
@@ -179,7 +185,7 @@ curl -s "https://www.quantapact.com/api/scan?domain=stripe.com" | jq '.grade, .s
 
 Full API reference at [quantapact.com/api](https://quantapact.com/api).
 
-**Rate limit:** ~60 requests/minute per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry.
+**Rate limits:** 300 scans per hour per IP, 20 `--fresh` (force-refresh) scans per hour per IP. No API key required. Returns HTTP 429 if exceeded — back off and retry, or [let us know via the feedback form](https://quantapact.com/feedback) if you need higher limits (we're prioritizing the API tier based on real demand).
 
 ## Methodology
 
@@ -233,6 +239,8 @@ MIT. © 2026 Quantapact.
 
 ---
 
-**Source:** [github.com/quantapact/pqcheck](https://github.com/quantapact/pqcheck) *(public, pending org transfer to `quantapact/pqcheck`)*
+**Source:** [github.com/quantapact/pqcheck](https://github.com/quantapact/pqcheck)
+
+**Changelog:** [CHANGELOG.md](./CHANGELOG.md) for version-by-version release notes.
 
 **Issues / feedback:** [quantapact.com/feedback](https://quantapact.com/feedback) or open an issue on the repo.

package/bin/pqcheck.js

@@ -7,7 +7,7 @@
 // =============================================================================
 
 const API_BASE = process.env.PQCHECK_API_BASE || "https://quantapact.com";
-const VERSION = "0.7.5";
+const VERSION = "0.7.7";
 
 const ANSI = {
   reset:   "\x1b[0m",
@@ -107,28 +107,45 @@ async function main() {
     return; // runWatch handles its own exit; in practice it runs until killed.
   }
 
+  // --fresh: bypass server cache, force a fresh scan. Useful when verifying
+  // a cert/key change you just deployed. Subject to a 20/hr per-IP cap on
+  // the server side.
+  const fresh = args.includes("--fresh") || args.includes("--force");
+
   // One-shot scan(s)
   let worstExit = 0;
   for (const domain of domains) {
-    const exit = await runOneScan({ domain, format, quiet, threshold, webhookUrl, multi: domains.length > 1 });
+    const exit = await runOneScan({ domain, format, quiet, threshold, webhookUrl, multi: domains.length > 1, fresh });
     if (exit > worstExit) worstExit = exit;
   }
   process.exit(worstExit);
 }
 
-async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi }) {
-  if (!quiet && format === "text") process.stderr.write(color("dim", `Scanning ${domain} ...`));
+async function runOneScan({ domain, format, quiet, threshold, webhookUrl, multi, fresh }) {
+  if (!quiet && format === "text") process.stderr.write(color("dim", `Scanning ${domain}${fresh ? " (forcing fresh)" : ""} ...`));
   let report;
   try {
-    const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
+    // --fresh appends ?force=1 to bypass the smart-cache. Use when verifying
+    // a cert/key change you just deployed — otherwise scans hit the 1h SWR
+    // cache and return up-to-1h-old data. Subject to a 20/hr per-IP cap on
+    // the server side; if exceeded, the server silently downgrades to a
+    // cached scan and returns that instead of erroring.
+    const qs = fresh ? `?domain=${encodeURIComponent(domain)}&force=1` : `?domain=${encodeURIComponent(domain)}`;
+    const resp = await fetch(`${API_BASE}/api/scan${qs}`, {
       method: "GET",
-      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+      headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (scan)` },
     });
     if (!quiet && format === "text") process.stderr.write("\r\x1b[K");
     if (!resp.ok) {
       const errBody = await safeJSON(resp);
       console.error(color("red", `error scanning ${domain}: ${resp.status} ${errBody?.error || resp.statusText}`));
       if (errBody?.detail) console.error(color("dim", errBody.detail));
+      // Surface the 429 upsell hint if present — tells users how to ask for
+      // higher limits via the feedback form. Same demand signal we capture
+      // on the homepage.
+      if (resp.status === 429 && errBody?.need_more?.feedback_url) {
+        console.error(color("dim", `${errBody.need_more.message} → ${errBody.need_more.feedback_url}`));
+      }
       return 1;
     }
     report = await resp.json();
@@ -215,7 +232,7 @@ async function runWatch({ domains, format, quiet, threshold, webhookUrl, interva
       try {
         const resp = await fetch(`${API_BASE}/api/scan?domain=${encodeURIComponent(domain)}`, {
           method: "GET",
-          headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION}` },
+          headers: { accept: "application/json", "user-agent": `pqcheck-cli/${VERSION} (watch)` },
         });
         if (!resp.ok) continue;
         const report = await resp.json();
@@ -547,6 +564,7 @@ ${color("bold", "Common flags:")}
   -q, --quiet                      Print only the numeric score
   --watch [seconds]                Poll every N seconds (default 300) and report changes
   --webhook <url>                  POST scan results to a URL (one-shot or each watch tick)
+  --fresh                          Bypass server cache, force a fresh scan (subject to 20/hr per-IP cap)
 
 ${color("bold", "Subcommand-specific:")}
   pqcheck deps:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pqcheck",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Decryption Blast Radius scanner — find out how much of your data unlocks when quantum decryption arrives.",
   "keywords": [
     "post-quantum",