proof-of-commitment 1.20.0 → 1.20.1

package/README.md

@@ -51,26 +51,23 @@ npx proof-of-commitment --file go.sum    # full transitive set
 
 **Web demo (no install):** [getcommit.dev/audit](https://getcommit.dev/audit) — paste your packages, see risk scores in seconds.
 
-**Account + monitoring (v1.10.0):**
+## Get notified before the next attack
+
+The CLI tells you what's risky today. A free API key unlocks **monitoring** — daily score recomputation across the packages you depend on, with alerts when one degrades (publisher drops, release stalls, score falls ≥10 points).
+
+[**Get a free API key →**](https://getcommit.dev/get-started?ref=npm-readme-monitoring&utm_source=cli) — no card, 30 seconds · 200 audits/day free · Developer $15/mo unlocks alerts + watchlist.
+
 ```bash
 # Install once, then use the `poc` alias:
 npm install -g proof-of-commitment
 
-# Get a free API key at https://getcommit.dev/get-started?utm_source=cli, then:
-poc login sk_commit_your_key_here
-# ✓ Authenticated — Tier: Free — Usage: 0/200 requests (daily)
-
-poc status                          # check tier + usage anytime
-poc logout                          # remove saved key
-
-# Monitoring (Developer $15/mo+ — daily scans + alerts):
-poc watch chalk
+# After getting your free key:
+poc login sk_commit_your_key_here   # save and validate
+poc status                          # check tier + usage
+poc watch chalk                     # start monitoring (Developer $15/mo)
 poc watch requests --ecosystem pypi
-poc watch serde --ecosystem cargo
-poc watchlist                       # view scores + risk levels
-poc unwatch chalk
-
-# Enable monitoring: https://getcommit.dev/pricing
+poc watchlist                       # view all watched packages
+poc init                            # add CI gate to this project
 ```
 
 Alerts fire on: score drop ≥10 points · package crosses CRITICAL threshold · recovery to HEALTHY.

package/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * proof-of-commitment CLI v1.20.0
+ * proof-of-commitment CLI v1.20.1
  * Scores npm/PyPI/Cargo/Go packages on behavioral commitment signals.
  * Usage: npx proof-of-commitment [packages...] [options]
  */
@@ -22,6 +22,22 @@ const JSON_API_HEADERS = {
   'Accept': 'application/json',
 };
 
+/**
+ * Build /api/audit request headers, adding Authorization: Bearer <key>
+ * when a key is present in COMMIT_API_KEY or ~/.commit/config.
+ *
+ * Without this, signed-up users hitting 429 stayed stuck: the inline-signup
+ * (v1.20.0) and URL signup flows both save the key locally, but the audit
+ * call site never read it — so "Re-run your command" still 429'd. Fixed
+ * in v1.20.1 after live dogfood confirmed the dead-end (see commit log).
+ */
+async function auditHeaders() {
+  const key = await readApiKey();
+  return key
+    ? { ...JSON_API_HEADERS, Authorization: `Bearer ${key}` }
+    : JSON_API_HEADERS;
+}
+
 // ANSI color helpers
 const c = {
   reset: '\x1b[0m',
@@ -462,7 +478,7 @@ async function inlineSignup(results) {
 
 function printHelp() {
   console.log(`
-${clr(c.bold, 'proof-of-commitment')} v1.20.0 — supply chain risk scorer
+${clr(c.bold, 'proof-of-commitment')} v1.20.1 — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
   npx proof-of-commitment                            Auto-detect manifest in current dir
@@ -876,11 +892,13 @@ async function auditBatched(packages, ecosystem, { onProgress } = {}) {
 
   let completed = 0;
   let batchedCta = null;
+  // Resolve auth once so all parallel batches share the same key lookup.
+  const headers = await auditHeaders();
   const results = await Promise.all(
     batches.map(async (batch) => {
       const res = await fetch(API, {
         method: 'POST',
-        headers: JSON_API_HEADERS,
+        headers,
         body: JSON.stringify({ packages: batch, ecosystem }),
       });
       if (!res.ok) {
@@ -1479,7 +1497,7 @@ async function cmdReport(packages, ecosystem, { filePath, isLockfile, totalScann
     if (packages.length <= 20) {
       const res = await fetch(API, {
         method: 'POST',
-        headers: JSON_API_HEADERS,
+        headers: await auditHeaders(),
         body: JSON.stringify({ packages, ecosystem }),
       });
       if (!res.ok) {
@@ -1881,7 +1899,7 @@ async function main() {
     try {
       const res = await fetch(API, {
         method: 'POST',
-        headers: JSON_API_HEADERS,
+        headers: await auditHeaders(),
         body: JSON.stringify({ packages, ecosystem }),
       });
       if (!res.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "mcpName": "io.github.piiiico/proof-of-commitment",
   "description": "Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",