seaworthycode 1.1.1 → 1.1.4

package/dist/index.js

@@ -9,8 +9,10 @@ import { cac } from "cac";
 import { createRequire as createRequire2 } from "module";
 
 // src/cli-action.ts
-import { stat } from "fs/promises";
+import { stat, access as access2 } from "fs/promises";
 import { resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join15 } from "path";
 
 // ../core/dist/index.js
 import { readFileSync } from "fs";
@@ -296,8 +298,8 @@ async function peekFileHead(filePath) {
         break;
       }
     }
-    const text2 = buf.toString("utf-8", 0, bytesRead).toLowerCase();
-    const isGenerated = GENERATED_MARKERS.some((marker) => text2.includes(marker));
+    const text22 = buf.toString("utf-8", 0, bytesRead).toLowerCase();
+    const isGenerated = GENERATED_MARKERS.some((marker) => text22.includes(marker));
     return { isBinary, isGenerated };
   } finally {
     await handle.close();
@@ -513,7 +515,9 @@ function sortFindings(findings) {
     const fileA = a.file ?? "";
     const fileB = b.file ?? "";
     if (fileA !== fileB) return fileA.localeCompare(fileB);
-    return (a.line ?? 0) - (b.line ?? 0);
+    const lineDiff = (a.line ?? 0) - (b.line ?? 0);
+    if (lineDiff !== 0) return lineDiff;
+    return a.checkId.localeCompare(b.checkId);
   });
 }
 function dedupeDegradedFindings(findings) {
@@ -769,9 +773,13 @@ var copy = {
   "report.scannedFiles": (count) => `Scanned ${count} files.`,
   "report.summary": "Summary",
   "report.bySeverity": "By severity",
-  "report.tierWatermark": (tier, licensedTo) => `Tier: ${tier} \u2014 Licensed to ${licensedTo}`,
-  "report.preScanNotice": (count) => `${count} additional check(s) available on Pro. See ${SITE_URL} to upgrade.`,
-  "report.postScanCta": (url) => `Learn more: ${url}`,
+  "report.tierWatermark": (licensedTo) => `\u2693 Pro \xB7 ${licensedTo}`,
+  "report.scanProgress.starting": (targetDir) => `\u2693 Scanning ${targetDir}...`,
+  "report.scanProgress.category": (label, count) => count > 0 ? `  \u2693 ${label} \u2014 ${count} issue(s)` : `  \u2693 ${label} \u2713`,
+  "report.cta.clean": `\u2713 All clear \u2014 your project is shipshape!`,
+  "report.cta.hasFindings": `Fix these before you ship. ${SITE_URL}/docs`,
+  "report.cta.critical": `\u26A0 Critical issues found \u2014 patch before you deploy. ${SITE_URL}/docs`,
+  "report.proUpsellNamed": (names, count) => `\u2693 Pro unlocks ${count} more check${count === 1 ? "" : "s"} (${names}). ${SITE_URL}`,
   "report.llmPrivacyWarning": "Pro checks will send code context to your LLM provider via your API key. No data is sent to Seaworthy servers.",
   "report.confidenceHigh": "high confidence",
   "report.confidenceMedium": "medium confidence",
@@ -1540,9 +1548,6 @@ var ScanRunner = class {
     const { files, meta } = await crawl({ targetDir: options.targetDir, maxFileSize: options.maxFileSize, debug: options.debug });
     const checks = registry.getForTier(options.tier);
     const skippedChecks = registry.getSkippedChecks(options.tier);
-    if (skippedChecks.length > 0) {
-      console.error(getCopy("report.preScanNotice", skippedChecks.length));
-    }
     if (options.llm) {
       console.error(getCopy("report.llmPrivacyWarning"));
     }
@@ -1556,20 +1561,36 @@ var ScanRunner = class {
       astCache: /* @__PURE__ */ new Map()
     };
     const results = [];
-    const mutex = [];
+    const checkResults = /* @__PURE__ */ new Map();
     await runWithConcurrency(
       checks,
       async (check2) => {
         try {
           const findings2 = await check2.run(ctx);
-          mutex.push(...findings2);
+          checkResults.set(check2.id, findings2);
         } catch (err) {
           console.error(`Check "${check2.id}" failed: ${String(err)}`);
         }
       },
       concurrency
     );
-    results.push(...mutex);
+    for (const check2 of checks) {
+      results.push(...checkResults.get(check2.id) ?? []);
+    }
+    if (options.onCategoryComplete) {
+      const findingsPerCategory = /* @__PURE__ */ new Map();
+      for (const check2 of checks) {
+        const count = (checkResults.get(check2.id) ?? []).length;
+        findingsPerCategory.set(check2.category, (findingsPerCategory.get(check2.category) ?? 0) + count);
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const check2 of checks) {
+        if (!seen.has(check2.category)) {
+          seen.add(check2.category);
+          options.onCategoryComplete(check2.category, findingsPerCategory.get(check2.category) ?? 0);
+        }
+      }
+    }
     if (ctx.astCache) {
       for (const promise of ctx.astCache.values()) {
         try {
@@ -1601,7 +1622,7 @@ var ScanRunner = class {
     return {
       findings,
       scannedFileCount: files.length,
-      skippedCheckCount: skippedChecks.length
+      skippedChecks
     };
   }
 };
@@ -2351,15 +2372,31 @@ var text = {
   success: (s) => source_default.hex(tokens.success)(s)
 };
 var SEVERITY_ORDER2 = ["critical", "high", "medium", "low", "info"];
+function checkNameOf(checkId) {
+  const short = checkId.replace(/^[^.]+\./, "");
+  try {
+    return getCopy(`checks.${short}.name`);
+  } catch {
+    return short;
+  }
+}
 var TerminalReporter = class {
   generate(input) {
-    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount } = input;
+    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], showIds = false } = input;
     const findings = dedupeDegradedFindings(rawFindings);
     if (findings.length === 0) {
-      return `${text.success(getCopy("report.noIssues"))}
-${text.meta(getCopy("report.scannedFiles", scannedFileCount))}
-
-${text.link(getCopy("report.postScanCta", SITE_URL))}`;
+      const lines2 = [];
+      lines2.push(text.success(getCopy("report.cta.clean")));
+      lines2.push(text.meta(getCopy("report.scannedFiles", scannedFileCount)));
+      if (tier === "pro") {
+        lines2.push("");
+        lines2.push(text.meta(getCopy("report.tierWatermark", licensedTo)));
+      }
+      if (skippedChecks.length > 0) {
+        lines2.push("");
+        lines2.push(text.link(buildProUpsell(skippedChecks)));
+      }
+      return lines2.join("\n");
     }
     const lines = [];
     lines.push(text.heading(getCopy("report.header", targetDir, findings.length)));
@@ -2372,7 +2409,9 @@ ${text.link(getCopy("report.postScanCta", SITE_URL))}`;
       const rawAnalysisType = f.properties?.analysisType;
       const analysisTypeValue = rawAnalysisType === "pattern" || rawAnalysisType === "semantic" ? rawAnalysisType : void 0;
       const analysisType = analysisTypeValue ? text.meta(` [${getCopy(`reporting.analysisType.${analysisTypeValue}`)}]`) : "";
-      lines.push(`${severityLabel}${baselineLabel} ${f.checkId}${analysisType} \u2014 ${f.message}${loc}${confidenceLabel}`);
+      const name = checkNameOf(f.checkId);
+      const idSuffix = showIds ? text.meta(` \xB7 ${f.checkId}`) : "";
+      lines.push(`${severityLabel}${baselineLabel} ${name}${idSuffix}${analysisType} \u2014 ${f.message}${loc}${confidenceLabel}`);
       if (f.remediation) {
         lines.push(`  ${text.meta(`\u2192 ${f.remediation}`)}`);
       }
@@ -2390,11 +2429,23 @@ ${text.link(getCopy("report.postScanCta", SITE_URL))}`;
       }
     }
     lines.push("");
-    lines.push(text.meta(getCopy("report.tierWatermark", tier, licensedTo)));
-    lines.push(text.link(getCopy("report.postScanCta", SITE_URL)));
+    const hasCriticalOrHigh = findings.some((f) => f.severity === "critical" || f.severity === "high");
+    lines.push(text.link(hasCriticalOrHigh ? getCopy("report.cta.critical") : getCopy("report.cta.hasFindings")));
+    if (tier === "pro") {
+      lines.push(text.meta(getCopy("report.tierWatermark", licensedTo)));
+    }
+    if (skippedChecks.length > 0) {
+      lines.push(text.link(buildProUpsell(skippedChecks)));
+    }
     return lines.join("\n");
   }
 };
+function buildProUpsell(skippedChecks) {
+  const count = skippedChecks.length;
+  const names = skippedChecks.slice(0, 2).map((c) => c.name.toLowerCase()).join(", ");
+  const suffix = count > 2 ? ", \u2026" : "";
+  return getCopy("report.proUpsellNamed", names + suffix, count);
+}
 function textForSeverity(severity) {
   switch (severity) {
     case "critical":
@@ -5640,8 +5691,8 @@ function downgradeSeverity(severity) {
   if (idx < 0 || idx >= SEVERITY_ORDER3.length - 1) return severity;
   return SEVERITY_ORDER3[idx + 1];
 }
-function estimateTokens(text2) {
-  return Math.ceil(text2.length / 4);
+function estimateTokens(text22) {
+  return Math.ceil(text22.length / 4);
 }
 async function filterFilesByBudget(files, budget) {
   if (budget === void 0 || budget === Infinity) {
@@ -7087,8 +7138,8 @@ function unquoteString(value) {
   }
   return trimmed;
 }
-function isDefaultCredential(password) {
-  const normalized = unquoteString(password).toLowerCase();
+function isDefaultCredential(password2) {
+  const normalized = unquoteString(password2).toLowerCase();
   const defaults = /* @__PURE__ */ new Set([
     "admin",
     "password",
@@ -7190,8 +7241,8 @@ async function scanSqlDefaultCredentials(ctx) {
     let roleMatch = createRoleRegex.exec(content);
     while (roleMatch) {
       const roleName = roleMatch[1].replace(/["`[\]]/g, "");
-      const password = roleMatch[2];
-      if (!looksLikeHash(password) && isDefaultCredential(password)) {
+      const password2 = roleMatch[2];
+      if (!looksLikeHash(password2) && isDefaultCredential(password2)) {
         const beforeMatch = content.slice(0, roleMatch.index);
         const lineNum = beforeMatch.split("\n").length;
         findings.push({
@@ -7757,8 +7808,8 @@ registry.register(
   })
 );
 var CHECK_ID11 = "security.os-command-injection";
-function isStaticShellLikeLiteral(text2) {
-  const t = text2.trim();
+function isStaticShellLikeLiteral(text22) {
+  const t = text22.trim();
   if (t.length < 2) return false;
   if (t.startsWith('"') && t.endsWith('"') || t.startsWith("'") && t.endsWith("'")) return true;
   if (t.startsWith("`") && t.endsWith("`") && !/(?<!\\)\${/.test(t)) return true;
@@ -9176,10 +9227,10 @@ var CSS_COMMENT = /\/\*([\s\S]*?)\*\//g;
 var JSON_SCRIPT = /<script\b[^>]*type\s*=\s*["']application\/json["'][^>]*>([\s\S]*?)<\/script>/gi;
 function scanPattern(content, filePath, checkPrefix, pattern, messageText, findings) {
   for (const match of content.matchAll(pattern)) {
-    const text2 = match[1] ?? match[0] ?? "";
-    if (!SECRET_MARKER.test(text2)) continue;
-    const valueMatch = text2.match(SECRET_VALUE);
-    const value = valueMatch?.[1] ?? text2;
+    const text22 = match[1] ?? match[0] ?? "";
+    if (!SECRET_MARKER.test(text22)) continue;
+    const valueMatch = text22.match(SECRET_VALUE);
+    const value = valueMatch?.[1] ?? text22;
     const { line, column } = lineAndColumn5(content, match.index ?? 0);
     findings.push({
       id: `${CHECK_ID23}:${filePath}:${line}:${column}:${checkPrefix}`,
@@ -9830,11 +9881,11 @@ function pushFinding6(findings, filePath, content, index, matchText) {
 }
 function scanCss(findings, filePath, scanContent, originalContent, offset = 0) {
   for (const match of scanContent.matchAll(BRACE_RULE_PATTERN)) {
-    const text2 = match[0] ?? "";
-    if (!ATTR_SELECTOR_PATTERN.test(text2)) continue;
-    if (!EXTERNAL_HTTP_URL_PATTERN.test(text2)) continue;
-    const leadingWhitespace = text2.match(/^\s*/)?.[0] ?? "";
-    pushFinding6(findings, filePath, originalContent, (match.index ?? 0) + offset + leadingWhitespace.length, text2);
+    const text22 = match[0] ?? "";
+    if (!ATTR_SELECTOR_PATTERN.test(text22)) continue;
+    if (!EXTERNAL_HTTP_URL_PATTERN.test(text22)) continue;
+    const leadingWhitespace = text22.match(/^\s*/)?.[0] ?? "";
+    pushFinding6(findings, filePath, originalContent, (match.index ?? 0) + offset + leadingWhitespace.length, text22);
   }
 }
 registry.register({
@@ -10185,7 +10236,7 @@ registry.register({
 });
 var CHECK_ID40 = "security.weak-email-validation";
 var REMEDIATION34 = getCopy("remediation.security.weak-email-validation");
-var WEAK_EMAIL_REGEX_LINE = /\/\^[^\/]*@[^\/]*\\\.[^\/]{0,4}\$\/[gimsuy]*/g;
+var WEAK_EMAIL_REGEX_LINE = /\/\^[^/]*@[^/]*\\\.[^/]{0,4}\$\/[gimsuy]*/g;
 var LOOSE_REGEX_CLASS = /\[\^?\\?s@\]\+@\[\^?\\?s@\]\+\\\.\[\^?\\?s@\]\+/g;
 var EMAIL_CONTEXT = /email|e-?mail|validateEmail|isEmail|checkEmail|verifyEmail|deliverable/is;
 function lineAndColumn15(content, index) {
@@ -10241,7 +10292,7 @@ registry.register({
 var CHECK_ID41 = "security.idempotency-key-leak";
 var REMEDIATION35 = getCopy("remediation.security.idempotency-key-leak");
 var IDEMPOTENCY_CONTEXT = /idempotency[_-]?key|idempotency[_-]?token/i;
-var TEMPLATE_LITERAL_INTERPOLATION = /\`[^`]*\$\{[^}]+\}[^`]*\`/g;
+var TEMPLATE_LITERAL_INTERPOLATION = new RegExp("`[^`]*\\$\\{[^}]+\\}[^`]*`", "g");
 var STRUCTURED_ID_PATTERN = /(?:lic(?:ense|ence)|sub(?:scription)?|order|cust(?:omer)?|user|tx|pay(?:ment)?|inv(?:oice)?)[-/]/i;
 function lineAndColumn16(content, index) {
   const prefix = content.slice(0, index);
@@ -10491,11 +10542,11 @@ function applyTaintToBashReadTarget(command, scopeRoot, s, cleanseFromId) {
   for (let i = 0; i < command.namedChildCount; i++) {
     const child = command.namedChild(i);
     if (child.type !== "word") continue;
-    const text2 = child.text;
-    if (text2 === "read" || text2.startsWith("-")) continue;
+    const text22 = child.text;
+    if (text22 === "read" || text22.startsWith("-")) continue;
     markTaint(s, child.id);
     if (cleanseFromId !== void 0) mergeCleanse(s, cleanseFromId, child.id);
-    taintVarUses(text2, scopeRoot, s);
+    taintVarUses(text22, scopeRoot, s);
   }
 }
 function collectEntries(table) {
@@ -15092,7 +15143,23 @@ var copy3 = {
   "cli.help.usage": "Usage: seaworthy [path] [options]",
   "cli.help.options": "Options",
   "cli.help.learnMore": `Documentation: ${SITE_URL}/docs`,
-  "cli.scanning": "Scanning...",
+  "cli.setup.intro": "Welcome to Seaworthy! Let's get you set up.",
+  "cli.setup.licensePrompt": "License key (press Enter to skip and scan free)",
+  "cli.setup.licenseHint": "Buy a key at seaworthycode.com \xB7 Enter skips to free tier",
+  "cli.setup.providerPrompt": "LLM provider for Pro checks",
+  "cli.setup.providerSkip": "Skip \u2014 no LLM checks",
+  "cli.setup.apiKeyPrompt": "API key for",
+  "cli.setup.modelPrompt": "Model (press Enter for default)",
+  "cli.setup.baseUrlPrompt": "Custom API base URL (press Enter to use default)",
+  "cli.setup.done": "Config saved. Run `seaworthy .` to scan your project.",
+  "cli.setup.skipped": "Setup skipped. Running free-tier scan.",
+  "cli.firstRun": "First time? Let's get you set up.",
+  "cli.category.security": "Security",
+  "cli.category.resilience": "Resilience",
+  "cli.category.ops": "Ops Basics",
+  "cli.category.dependencies": "Dependencies",
+  "cli.category.configuration": "Configuration",
+  "cli.category.data-exposure": "Data Exposure",
   "cli.reportWritten": (path) => `Report written to ${path}`,
   "cli.error.notADirectory": (path) => `Path is not a directory: ${path}`,
   "cli.error.notFound": (path) => `Path not found: ${path}`,
@@ -15104,6 +15171,7 @@ var copy3 = {
   "cli.sarif.stdout_conflict": "Flags --sarif-stdout and --json cannot be used together. Use --output to send JSON to a file.",
   "cli.error.llmRequired": "LLM API key required for Pro checks. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable.",
   "cli.warn.llmSkipped": "Pro checks skipped: no LLM API key configured. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable to enable semantic analysis.",
+  "cli.warn.licenseInvalid": "Your license key is invalid or has been revoked. Running in free tier.\nTo re-enter your key, run: npx seaworthycode setup",
   "cli.error.config.missingKey": "Missing config key. Usage: seaworthy config <set|get> <key>",
   "cli.error.config.missingValue": "Missing config value. Usage: seaworthy config set <key> <value>",
   "cli.error.config.unknownKey": "Unknown config key. Valid keys: licenseKey, llmProvider, llmApiKey, llmModel, llmApiUrl",
@@ -15154,6 +15222,14 @@ function resolveScanTimeoutMs(tier) {
   }
   return tier === "free" ? FREE_SCAN_TIMEOUT_MS : PRO_SCAN_TIMEOUT_MS;
 }
+var CATEGORY_LABELS = {
+  security: getCopy2("cli.category.security"),
+  resilience: getCopy2("cli.category.resilience"),
+  ops: getCopy2("cli.category.ops"),
+  dependencies: getCopy2("cli.category.dependencies"),
+  configuration: getCopy2("cli.category.configuration"),
+  "data-exposure": getCopy2("cli.category.data-exposure")
+};
 function withTimeout(promise, ms, message) {
   return new Promise((resolve5, reject) => {
     const timer = setTimeout(() => reject(new Error(message)), ms);
@@ -15186,6 +15262,10 @@ async function executeScan(args, ctx) {
   if (args.llmApiKey && args.llmProvider && !process.env.SEAWORTHY_SKIP_LLM_CHECK) {
     llm = createProvider({ provider: args.llmProvider, apiKey: args.llmApiKey, model: args.llmModel, baseUrl: args.llmApiUrl });
   }
+  const showProgress = args.format === "terminal" && !args.sarifStdout;
+  if (showProgress) {
+    process.stderr.write(getCopy("report.scanProgress.starting", args.targetDir) + "\n");
+  }
   const runner = new ScanRunner();
   const scanTimeoutMs = resolveScanTimeoutMs(ctx.tier);
   const result = await withTimeout(
@@ -15196,7 +15276,11 @@ async function executeScan(args, ctx) {
       maxFileSize: args.maxFileSize,
       debug: args.debug,
       baseline: args.baseline,
-      minConfidence: args.minConfidence
+      minConfidence: args.minConfidence,
+      onCategoryComplete: showProgress ? (category, count) => {
+        const label = CATEGORY_LABELS[category] ?? category;
+        process.stderr.write(getCopy("report.scanProgress.category", label, count) + "\n");
+      } : void 0
     }),
     scanTimeoutMs,
     getCopy("errors.scan.timed_out", Math.round(scanTimeoutMs / 1e3))
@@ -15206,7 +15290,9 @@ async function executeScan(args, ctx) {
     targetDir: args.targetDir,
     tier: ctx.tier,
     licensedTo: ctx.licensedTo ?? "free tier",
-    scannedFileCount: result.scannedFileCount
+    scannedFileCount: result.scannedFileCount,
+    skippedChecks: result.skippedChecks,
+    showIds: args.showIds ?? args.debug
   };
   let primaryOutput;
   switch (args.format) {
@@ -15257,6 +15343,9 @@ var scanCommand = createCommand({
   handler: executeScan
 });
 
+// src/commands/setup.ts
+import { intro, outro, text as text2, password, select, isCancel } from "@clack/prompts";
+
 // src/config/store.ts
 import { promises as fs9 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -15283,6 +15372,91 @@ async function writeConfig(config) {
   await fs9.chmod(getConfigFile(), 384);
 }
 
+// src/commands/setup.ts
+var PROVIDERS_WITH_CUSTOM_URL = /* @__PURE__ */ new Set(["ollama", "openrouter"]);
+async function executeSetup() {
+  intro(getCopy2("cli.setup.intro"));
+  const config = await readConfig();
+  const licenseKeyResult = await text2({
+    message: getCopy2("cli.setup.licensePrompt"),
+    placeholder: "SW-XXXXXX",
+    defaultValue: config.licenseKey ?? "",
+    validate: () => void 0
+  });
+  if (isCancel(licenseKeyResult)) {
+    outro(getCopy2("cli.setup.skipped"));
+    return { ok: true };
+  }
+  const licenseKey = String(licenseKeyResult).trim() || void 0;
+  const providers = listPresetProviders();
+  const providerOptions = [
+    { value: "", label: getCopy2("cli.setup.providerSkip") },
+    ...providers.map((p) => ({ value: p, label: p }))
+  ];
+  const providerResult = await select({
+    message: getCopy2("cli.setup.providerPrompt"),
+    options: providerOptions,
+    initialValue: config.llmProvider ?? ""
+  });
+  if (isCancel(providerResult)) {
+    outro(getCopy2("cli.setup.skipped"));
+    return { ok: true };
+  }
+  const llmProvider = String(providerResult) || void 0;
+  let llmApiKey = config.llmApiKey;
+  let llmModel = config.llmModel;
+  let llmApiUrl = config.llmApiUrl;
+  if (llmProvider) {
+    const apiKeyResult = await password({
+      message: `${getCopy2("cli.setup.apiKeyPrompt")} ${llmProvider}`,
+      validate: () => void 0
+    });
+    if (isCancel(apiKeyResult)) {
+      outro(getCopy2("cli.setup.skipped"));
+      return { ok: true };
+    }
+    llmApiKey = String(apiKeyResult).trim() || void 0;
+    const preset = resolvePreset(llmProvider);
+    const modelResult = await text2({
+      message: getCopy2("cli.setup.modelPrompt"),
+      placeholder: preset?.defaultModel ?? "",
+      defaultValue: config.llmModel ?? "",
+      validate: () => void 0
+    });
+    if (isCancel(modelResult)) {
+      outro(getCopy2("cli.setup.skipped"));
+      return { ok: true };
+    }
+    llmModel = String(modelResult).trim() || void 0;
+    if (PROVIDERS_WITH_CUSTOM_URL.has(llmProvider)) {
+      const urlResult = await text2({
+        message: getCopy2("cli.setup.baseUrlPrompt"),
+        placeholder: preset?.baseUrl ?? "",
+        defaultValue: config.llmApiUrl ?? "",
+        validate: () => void 0
+      });
+      if (isCancel(urlResult)) {
+        outro(getCopy2("cli.setup.skipped"));
+        return { ok: true };
+      }
+      llmApiUrl = String(urlResult).trim() || void 0;
+    } else {
+      llmApiUrl = void 0;
+    }
+  }
+  await writeConfig({ licenseKey, llmProvider, llmApiKey, llmModel, llmApiUrl });
+  outro(getCopy2("cli.setup.done"));
+  return { ok: true };
+}
+var setupCommand = createCommand(
+  {
+    name: "setup",
+    description: "Interactive first-run setup for license key and LLM provider",
+    handler: async () => executeSetup()
+  },
+  { requireLicense: false }
+);
+
 // src/auth/fs-credential-provider.ts
 var FsCredentialProvider = class {
   async getCredentials() {
@@ -15344,6 +15518,20 @@ async function checkUpdate() {
 }
 
 // src/cli-action.ts
+function getConfigFile2() {
+  return join15(process.env.SEAWORTHY_CONFIG_DIR ?? join15(homedir3(), ".seaworthy"), "config");
+}
+async function isFirstRun(options) {
+  if (options.json || options.output || options.sarif || options.sarifStdout || process.env.CI || process.env.SEAWORTHY_LICENSE_KEY || process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY || !process.stdin.isTTY || !process.stdout.isTTY) {
+    return false;
+  }
+  try {
+    await access2(getConfigFile2());
+    return false;
+  } catch {
+    return true;
+  }
+}
 function resolveExitCode(code) {
   const normalized = code.replace(/^errors\./, "");
   if (["license.invalid", "license.expired"].includes(normalized)) return 1;
@@ -15401,14 +15589,23 @@ async function runCli(options) {
       error: getCopy2("cli.error.notFound", dir)
     };
   }
+  if (await isFirstRun(options)) {
+    console.error(getCopy2("cli.firstRun"));
+    await setupCommand.handler({ action: "run" }, { tier: "free", licensedTo: "free tier" });
+  }
   const provider = new FsCredentialProvider();
   const license = new LicenseClient({ baseUrl: LICENSE_SERVER_URL });
   const authResult = await resolveAuth(provider, license);
   if (!authResult.ok) {
-    const message = resolveErrorMessage(authResult.code);
-    return { code: resolveExitCode(authResult.code), error: message };
+    const normalized = authResult.code.replace(/^errors\./, "");
+    const softCodes = ["license.invalid", "license.expired"];
+    if (!softCodes.includes(normalized)) {
+      const message = resolveErrorMessage(authResult.code);
+      return { code: resolveExitCode(authResult.code), error: message };
+    }
+    console.error(getCopy2("cli.warn.licenseInvalid"));
   }
-  const auth = authResult.value;
+  const auth = authResult.ok ? authResult.value : { tier: "free", token: "", licensedTo: "free tier" };
   const allowedTiers = {
     free: ["free"],
     pro: ["free", "pro"]
@@ -15437,7 +15634,8 @@ async function runCli(options) {
     maxFileSize: options.maxFileSize,
     debug: options.debug,
     baseline: options.baseline,
-    minConfidence: options.minConfidence
+    minConfidence: options.minConfidence,
+    showIds: options.showIds
   };
   const updateStart = Date.now();
   const updatePromise = checkUpdate().catch(() => void 0);
@@ -15524,12 +15722,12 @@ var require5 = createRequire2(import.meta.url);
 var { version } = require5("../package.json");
 var cli = cac("seaworthy");
 cli.version(version);
-cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").action(async (targetDir, options) => {
+cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").action(async (targetDir, options) => {
   const maxFileSize = options.maxFileSize ? Number(options.maxFileSize) : void 0;
   const tier = options.tier;
   const baseline = options.baseline === "save" ? "save" : options.baseline;
   const minConfidence = options.minConfidence;
-  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, debug: options.debug, baseline, minConfidence });
+  const result = await runCli({ targetDir, json: options.json, output: options.output, sarif: options.sarif, sarifStdout: options.sarifStdout, failOnFindings: options.failOnFindings, tier, provider: options.provider, maxFileSize, showIds: options.showIds, debug: options.debug, baseline, minConfidence });
   if (result.updateMessage) {
     console.error(result.updateMessage);
   }
@@ -15553,15 +15751,26 @@ cli.command("config <action> [key] [value]", "Manage configuration").action(asyn
     console.log(result.output);
   }
 });
+cli.command("setup", "Interactive setup for license key and LLM provider").action(async () => {
+  const result = await setupCommand.handler({ action: "run" }, { tier: "free", licensedTo: "free tier" });
+  if (!result.ok) {
+    console.error(resolveErrorMessage(result.code));
+    process.exit(2);
+  }
+});
 cli.help(() => {
   return [
     {
       title: "Examples",
-      body: `  $ npx seaworthy ./my-project
-  $ npx seaworthy ./my-project --json
-  $ npx seaworthy ./my-project --output report.html
-  $ npx seaworthy ./my-project --sarif report.sarif
-  $ npx seaworthy --provider kimi ./my-project`
+      body: `  $ npx seaworthycode ./my-project
+  $ npx seaworthycode ./my-project --json
+  $ npx seaworthycode ./my-project --output report.html
+  $ npx seaworthycode ./my-project --sarif report.sarif
+  $ npx seaworthycode --provider kimi ./my-project`
+    },
+    {
+      title: "Commands",
+      body: `  npx seaworthycode setup    Interactive setup for license key and LLM provider`
     },
     {
       title: "Options",
@@ -15571,10 +15780,11 @@ cli.help(() => {
   --sarif-stdout         ${getCopy2("cli.help.flag.sarifStdout")}
   --fail-on-findings     Exit with code 5 when findings are found
   --tier <tier>          Override tier (free, pro)
-  --provider <name>      LLM provider (anthropic, openai, kimi, deepseek, gemini, minimax, ollama, openrouter)
+  --provider <name>      LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)
   --max-file-size <n>    Skip files larger than n bytes (default: 1 MB)
   --baseline [ref]       Compare against baseline file or save (--baseline save)
   --min-confidence <level>  Hide findings below confidence (high, medium, low)
+  --show-ids             Show check IDs alongside names
   --debug                Enable debug logging`
     },
     {