proof-of-commitment 1.22.1 → 1.24.0

package/README.md

@@ -6,7 +6,7 @@
 
 An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on **behavioral commitment** — signals that are harder to fake than stars, READMEs, or download counts.
 
-## The supply chain problem
+## The supply chain security problem
 
 26 of the 91 npm packages with >10M weekly downloads have a **single npm publisher**. Together they account for over 3 billion downloads per week. `npm audit` doesn't surface this. Stars don't either.
 
@@ -93,7 +93,7 @@ Add to Claude Desktop, Cursor, Windsurf, or any MCP-compatible AI tool. Then ask
 
 ## GitHub Action
 
-Add supply chain auditing to any CI pipeline in 30 seconds — auto-detects packages from `package.json` or `requirements.txt`, **posts results as a PR comment**, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.
+Add supply chain security auditing to any CI pipeline in 30 seconds — auto-detects packages from `package.json` or `requirements.txt`, **posts results as a PR comment**, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.
 
 Use the dedicated action at [piiiico/commit-action](https://github.com/piiiico/commit-action):
 

package/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * proof-of-commitment CLI v1.22.1
+ * proof-of-commitment CLI v1.24.0
  * Scores npm/PyPI/Cargo/Go packages on behavioral commitment signals.
  * Usage: npx proof-of-commitment [packages...] [options]
  */
@@ -101,6 +101,14 @@ async function handle429(res) {
   const retryAfter = Number.isFinite(data.retry_after_seconds)
     ? data.retry_after_seconds
     : null;
+  // Backend signals "you've blown past the free wall, Developer $15/mo is the
+  // right fix" via overshoot=true / tier_suggestion="developer" (added
+  // backend-side 2026-06-04). When set, backend routes instantKeyUrl to
+  // /pricing — so the CLI must NOT promise "Free API key in 30 seconds" or
+  // prompt for email (a 200/day key won't help someone scanning 260+/day).
+  // Mismatched CTA text + destination kills trust and conversion. This branch
+  // aligns label + URL + skips the inline email prompt. (Dogfood, 2026-06-06.)
+  const overshoot = data.overshoot === true || data.tier_suggestion === 'developer';
 
   // Forward-compat: if backend ever returns partial scoring on 429,
   // print what we have BEFORE the rescue message. Falls back to JSON
@@ -130,6 +138,28 @@ async function handle429(res) {
   }
   console.error('');
 
+  // Overshoot path: free key is the wrong tool. Surface a URL aligned with
+  // the backend's Developer recommendation, skip the email prompt, exit.
+  // Without this branch, the CLI would say "Free API key in 30 seconds (no
+  // card)" while the URL goes to /pricing — bait-and-switch that erodes
+  // trust at the highest-intent moment we get with a user.
+  if (overshoot) {
+    console.error(
+      clr(
+        c.cyan + c.bold,
+        `   → Compare plans (Developer $15/mo · 1,000/day · batch API): ${instantKeyUrl}`
+      )
+    );
+    if (retryAfter && retryAfter > 0) {
+      const hours = Math.floor(retryAfter / 3600);
+      const mins = Math.floor((retryAfter % 3600) / 60);
+      const resetIn = hours > 0 ? `${hours}h ${mins}m` : `${mins}m`;
+      console.error(clr(c.dim, `     or wait — free-tier resets in ${resetIn} (00:00 UTC).`));
+    }
+    console.error('');
+    process.exit(1);
+  }
+
   // TTY: inline signup collapses the 6-step browser flow (visit URL → enter
   // email → copy key → switch back to terminal → export key → re-run) to a
   // single terminal prompt. Non-TTY (CI/piped) falls through to the URL.
@@ -420,14 +450,20 @@ async function inlineSignup(results) {
   if (hasKey) return;
   const critPkgs = results.filter(r => hasCritical(r.riskFlags));
   const lowScorePkgs = results.filter(r => typeof r.score === 'number' && r.score < 60);
-  // Gate: ≥3 packages scanned (real audit, not a one-off `npx poc somepkg` check)
-  if (results.length < 3) return;
-
   const hasFindings = critPkgs.length >= 1 || lowScorePkgs.length >= 2;
+  // Gate: show prompt when there's something worth monitoring.
+  // Old gate (results.length < 3) blocked the most common entry point:
+  // `npx proof-of-commitment axios` after reading about an attack.
+  // A single CRITICAL result IS the high-intent moment — don't skip it.
+  // For healthy single-package checks with no findings, still skip.
+  if (results.length < 3 && !hasFindings) return;
+
   // Copy adapts to context. Findings → degradation framing.
   // Healthy → baseline-lock framing (still real value: alert me if any score drops).
   const heading = hasFindings
-    ? '  🔔 Lock in this audit. Get alerted if these packages get worse.'
+    ? (results.length === 1
+      ? '  🔔 Monitor this package. Get alerted if it gets worse.'
+      : '  🔔 Lock in this audit. Get alerted if these packages get worse.')
     : '  🔔 Lock in this baseline. Get alerted if any of these packages degrade.';
 
   console.log(clr(c.dim, '  ─────────────────────────────────────────────'));
@@ -492,7 +528,7 @@ async function inlineSignup(results) {
 
 function printHelp() {
   console.log(`
-${clr(c.bold, 'proof-of-commitment')} v1.21.1 — supply chain risk scorer
+${clr(c.bold, 'proof-of-commitment')} v1.24.0 — supply chain risk scorer
 
 ${clr(c.bold, 'Usage:')}
   npx proof-of-commitment                            Auto-detect manifest in current dir

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "proof-of-commitment",
-  "version": "1.22.1",
+  "version": "1.24.0",
   "mcpName": "io.github.piiiico/proof-of-commitment",
-  "description": "Supply chain risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
+  "description": "Supply chain security risk scorer for npm, PyPI, Cargo, and Go packages — behavioral signals that can't be faked",
   "type": "module",
   "bin": {
     "proof-of-commitment": "./index.js",
@@ -16,7 +16,9 @@
   ],
   "keywords": [
     "supply-chain",
+    "supply-chain-security",
     "security",
+    "scanner",
     "npm",
     "pypi",
     "cargo",