seaworthycode 1.1.4 → 1.2.3

package/dist/index.js

@@ -6,13 +6,14 @@ import { existsSync as existsSync6 } from "fs";
 import { dirname as dirname7, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { cac } from "cac";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 
 // src/cli-action.ts
 import { stat, access as access2 } from "fs/promises";
 import { resolve as resolve3 } from "path";
 import { homedir as homedir3 } from "os";
 import { join as join15 } from "path";
+import { createRequire as createRequire2 } from "module";
 
 // ../core/dist/index.js
 import { readFileSync } from "fs";
@@ -36,6 +37,8 @@ import { createHash } from "crypto";
 import { isAbsolute, relative as relative3 } from "path";
 import { pathToFileURL } from "url";
 import { z } from "zod";
+import { lookup } from "dns/promises";
+import { request as httpsRequest } from "https";
 import { jwtVerify, createLocalJWKSet } from "jose";
 import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
 import { join as join6, resolve as pathResolve2 } from "path";
@@ -1440,6 +1443,52 @@ var copy = {
   "checks.sql-missing-rls.message": (match) => `RLS is not enabled or lacks restriction on a private/tenant table: ${match}`,
   "checks.sql-missing-rls.degraded": (path, language) => `${language} analysis was incomplete for ${path} (no grammar available)`,
   "remediation.security.sql-missing-rls": "Define a policy with CREATE POLICY ... ON ... USING (...) to restrict data access to authorized users.",
+  // Security headers
+  "checks.missing-security-headers.name": "Missing HTTP security headers",
+  "checks.missing-security-headers.description": "Application does not set HTTP security response headers (HSTS, X-Content-Type-Options, X-Frame-Options, Permissions-Policy)",
+  "remediation.security.missing-security-headers": "Add helmet() (Node.js) or equivalent security-header middleware. At minimum set Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options, and Permissions-Policy.",
+  // GitHub Actions supply-chain
+  "checks.gh-actions-unpinned.name": "Unpinned GitHub Actions",
+  "checks.gh-actions-unpinned.description": "GitHub Actions workflow steps reference third-party actions by mutable tag rather than a full commit SHA",
+  "remediation.security.gh-actions-unpinned": "Pin every third-party action to a full 40-character commit SHA, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. Use a tool like Renovate or pin-github-action to automate this.",
+  "checks.gh-actions-excessive-permissions.name": "Excessive GitHub Actions permissions",
+  "checks.gh-actions-excessive-permissions.description": "GitHub Actions workflow grants overly broad or undeclared default permissions",
+  "remediation.security.gh-actions-excessive-permissions": 'Add a top-level "permissions: {}" block and grant only the minimum scopes needed per job, e.g. "permissions: { contents: read }".',
+  // GraphQL
+  "checks.graphql-introspection-prod.name": "GraphQL introspection in production",
+  "checks.graphql-introspection-prod.description": "GraphQL server exposes introspection without disabling it for production environments",
+  "remediation.security.graphql-introspection-prod": 'Disable GraphQL introspection in production: set introspection: process.env.NODE_ENV !== "production" in Apollo Server, or use a validationRules plugin that blocks introspection queries.',
+  "checks.graphql-no-depth-limit.name": "GraphQL missing depth limit",
+  "checks.graphql-no-depth-limit.description": "GraphQL server has no query depth or complexity limiting, enabling denial-of-service via deeply nested queries",
+  "remediation.security.graphql-no-depth-limit": "Add query depth limiting with graphql-depth-limit or complexity analysis with graphql-query-complexity. Wire the validation rule into ApolloServer validationRules or the equivalent for your framework.",
+  // JWT
+  "checks.jwt-alg-none.name": 'JWT allows algorithm "none"',
+  "checks.jwt-alg-none.description": 'JWT verification does not restrict algorithms, allowing forged unsigned tokens via the "none" algorithm',
+  "remediation.security.jwt-alg-none": 'Always pass an explicit algorithms allowlist to jwt.verify() (e.g. { algorithms: ["HS256"] }). Never accept "none" as a valid algorithm.',
+  "checks.jwt-no-expiry.name": "JWT issued without expiry",
+  "checks.jwt-no-expiry.description": "JWT tokens are signed without an expiry claim (exp / expiresIn), making them valid indefinitely",
+  "remediation.security.jwt-no-expiry": 'Set a short expiry on all issued JWTs using expiresIn (jsonwebtoken), .setExpirationTime() (jose), or an "exp" claim in the payload (PyJWT). Use refresh tokens to extend sessions.',
+  // Browser token storage
+  "checks.refresh-token-in-localstorage.name": "Refresh token in localStorage",
+  "checks.refresh-token-in-localstorage.description": "Refresh tokens or long-lived credentials stored in localStorage are vulnerable to theft via XSS",
+  "remediation.security.refresh-token-in-localstorage": "Store refresh tokens in httpOnly, Secure, SameSite=Strict cookies \u2014 not localStorage or sessionStorage. XSS cannot read httpOnly cookies.",
+  // Dockerfile hardening
+  "checks.dockerfile-runs-as-root.name": "Dockerfile runs as root",
+  "checks.dockerfile-runs-as-root.description": "Container image has no non-root USER directive \u2014 all processes run as root",
+  "remediation.ops.dockerfile-runs-as-root": "Create a non-root user and switch to it before CMD/ENTRYPOINT: RUN addgroup -S app && adduser -S app -G app followed by USER app.",
+  "checks.dockerfile-secrets-in-env.name": "Secrets in Dockerfile ENV",
+  "checks.dockerfile-secrets-in-env.description": "Dockerfile bakes secrets or credentials into image layers via ENV or ARG instructions",
+  "remediation.ops.dockerfile-secrets-in-env": "Never pass secrets via ENV or ARG \u2014 they persist in image history. Use Docker BuildKit secrets (RUN --mount=type=secret), environment variables injected at container start, or a secrets manager.",
+  "checks.dockerfile-no-healthcheck.name": "Dockerfile missing HEALTHCHECK",
+  "checks.dockerfile-no-healthcheck.description": "Dockerfile has no HEALTHCHECK instruction \u2014 container orchestrators cannot detect unhealthy state",
+  "remediation.ops.dockerfile-no-healthcheck": "Add a HEALTHCHECK instruction, e.g.: HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:8080/health || exit 1",
+  "checks.missing-dockerignore.name": "Missing .dockerignore",
+  "checks.missing-dockerignore.description": "Dockerfile is present without a .dockerignore \u2014 build context may include node_modules, .env files, or other sensitive data",
+  "remediation.ops.missing-dockerignore": "Add a .dockerignore file listing directories and files to exclude from the build context: node_modules, .env, .git, *.log, dist, coverage.",
+  // ORM N+1
+  "checks.orm-n-plus-one.name": "ORM N+1 query pattern",
+  "checks.orm-n-plus-one.description": "ORM results are iterated with a per-row database query instead of a single batch load",
+  "remediation.resilience.orm-n-plus-one": "Replace per-row queries inside loops with a single batch query using include/eager loading (Prisma include, Sequelize eager loading, SQLAlchemy joinedload, ActiveRecord includes).",
   // Reporting labels
   "reporting.analysisType.pattern": "pattern",
   "reporting.analysisType.semantic": "semantic"
@@ -3134,16 +3183,60 @@ var REFRESH_WINDOW_MS = 5 * 60 * 1e3;
 var LicenseClient = class {
   baseUrl;
   timeout;
+  userAgent;
   cache = null;
   jwksFetched = false;
   constructor(config = {}) {
     this.baseUrl = config.baseUrl ?? LICENSE_SERVER_URL;
     this.timeout = config.timeout ?? 1e4;
+    this.userAgent = config.userAgent ?? "seaworthycode/unknown";
+  }
+  async fetchWithRetry(url, init) {
+    try {
+      return await fetch(url, init);
+    } catch (err) {
+      if (!(err instanceof TypeError)) throw err;
+      return this.fetchIpv4(url, init);
+    }
+  }
+  async fetchIpv4(url, init) {
+    const parsed = new URL(url);
+    const { address } = await lookup(parsed.hostname, { family: 4 });
+    const initHeaders = init.headers ?? {};
+    const headers = { ...initHeaders, Host: parsed.hostname };
+    return new Promise((resolve22, reject) => {
+      const options = {
+        hostname: address,
+        port: parseInt(parsed.port || "443"),
+        path: parsed.pathname + (parsed.search || ""),
+        method: init.method ?? "GET",
+        headers,
+        servername: parsed.hostname,
+        signal: init.signal ?? void 0
+      };
+      const req = httpsRequest(options, (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => {
+          const resHeaders = new Headers();
+          for (const [k, v] of Object.entries(res.headers)) {
+            if (typeof v === "string") resHeaders.set(k, v);
+            else if (Array.isArray(v)) resHeaders.set(k, v.join(", "));
+          }
+          resolve22(new Response(Buffer.concat(chunks), { status: res.statusCode ?? 0, headers: resHeaders }));
+        });
+        res.on("error", reject);
+      });
+      req.on("error", reject);
+      if (init.body) req.write(init.body);
+      req.end();
+    });
   }
   async ensureJwks() {
     if (this.jwksFetched) return;
-    const response = await fetch(`${this.baseUrl}/.well-known/jwks.json`, {
-      signal: AbortSignal.timeout(this.timeout)
+    const response = await this.fetchWithRetry(`${this.baseUrl}/.well-known/jwks.json`, {
+      signal: AbortSignal.timeout(this.timeout),
+      headers: { "User-Agent": this.userAgent }
     });
     if (!response.ok) {
       throw new Error("jwks.fetch_failed");
@@ -3167,9 +3260,9 @@ var LicenseClient = class {
     }
     try {
       await this.ensureJwks();
-      const response = await fetch(`${this.baseUrl}/validate`, {
+      const response = await this.fetchWithRetry(`${this.baseUrl}/validate`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", "User-Agent": this.userAgent },
         body: JSON.stringify({ licenseKey: licenseKey ?? "free" }),
         signal: AbortSignal.timeout(this.timeout)
       });
@@ -3180,7 +3273,8 @@ var LicenseClient = class {
         return fail("license.rate_limited");
       }
       if (!response.ok) {
-        return fail("license.server_error");
+        const rayId = response.headers.get("cf-ray") ?? "";
+        return fail("license.server_error", `HTTP ${response.status}${rayId ? ` ray=${rayId}` : ""}`);
       }
       const data = await response.json();
       const parsed = licenseResponseSchema.safeParse(data);
@@ -3209,12 +3303,12 @@ var LicenseClient = class {
       });
     } catch (err) {
       if (err instanceof DOMException && err.name === "TimeoutError") {
-        return fail("license.server_unreachable");
+        return fail("license.server_unreachable", "timeout");
       }
       if (err instanceof TypeError) {
-        return fail("license.server_unreachable");
+        return fail("license.server_unreachable", err.message);
       }
-      return fail("license.server_unreachable");
+      return fail("license.server_unreachable", String(err));
     }
   }
   shouldRefresh() {
@@ -3756,6 +3850,22 @@ function mergeFindings(tsFindings, otherFindings) {
   }
   return Array.from(map.values());
 }
+var ENV_SUBSTITUTION_PATTERNS = [
+  /^env\(\s*[A-Za-z_][A-Za-z0-9_]*\s*\)$/,
+  /^\$\{[A-Za-z_][A-Za-z0-9_]*(?::[-=+?][^}]*)?\}$/,
+  /^\$[A-Za-z_][A-Za-z0-9_]*$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^<%=?\s*ENV\[['"][A-Za-z_][A-Za-z0-9_]*['"]\]\s*%>$/,
+  /^process\.env(?:\.[A-Za-z_][A-Za-z0-9_]*|\[['"][A-Za-z_][A-Za-z0-9_]*['"]\])$/,
+  /^os\.(?:environ\[['"][A-Za-z_][A-Za-z0-9_]*['"]\]|getenv\(['"][A-Za-z_][A-Za-z0-9_]*['"]\))$/
+];
+function isEnvSubstitution(value) {
+  const trimmed = value.trim();
+  for (const pattern of ENV_SUBSTITUTION_PATTERNS) {
+    if (pattern.test(trimmed)) return true;
+  }
+  return false;
+}
 var CHECK_ID = "security.hardcoded-secrets";
 var SECRET_PATTERNS = [
   { regex: /AWS_SECRET_ACCESS_KEY\s*=\s*['"]([A-Za-z0-9/+=]{40})['"]/gi, name: "AWS secret access key", minLength: 40, method: "known-format" },
@@ -3791,6 +3901,8 @@ var regexCheck = {
           const matches = Array.from(line.matchAll(pattern.regex));
           for (let matchIdx = 0; matchIdx < matches.length; matchIdx++) {
             const match = matches[matchIdx];
+            const captured = match[1] ?? match[0];
+            if (isEnvSubstitution(captured)) continue;
             findings.push({
               id: `${CHECK_ID}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
               checkId: CHECK_ID,
@@ -3947,6 +4059,7 @@ var tsCheck = createTreeSitterCheck({
     const trimmedValue = value.trim();
     if (!/^['"`].*['"`]$/.test(trimmedValue)) return false;
     const cleanValue = trimmedValue.replace(/^['"`]|['"`]$/g, "");
+    if (isEnvSubstitution(cleanValue)) return false;
     for (const rule of NAME_RULES) {
       if (rule.regex.test(name) && cleanValue.length >= rule.minLength) {
         return true;
@@ -5205,7 +5318,7 @@ var MIN_VALUE_LENGTH = 8;
 var SECRET_ASSIGNMENT_PATTERNS = [
   /(?:const|let|var)\s+(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*=\s*['"]([^'"]{8,})['"]/i,
   /(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*:\s*['"]([^'"]{8,})['"]/i,
-  /(?:<!--|\/\*)[^]*?(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*[:=]\s*['"]([^'"]{8,})['"]/i
+  /(?:<!--|\/\*)[^]{0,300}?(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*[:=]\s*['"]([^'"]{8,})['"]/i
 ];
 var REMEDIATION9 = getCopy("remediation.configuration.secrets-in-source");
 function stripQuotes(value) {
@@ -5235,7 +5348,9 @@ var regexCheck3 = {
         const name = match[1] ?? "";
         const value = match[2] ?? "";
         if (!isCompoundSecretName(name)) continue;
-        if (stripQuotes(value).length < MIN_VALUE_LENGTH) continue;
+        const cleanValue = stripQuotes(value);
+        if (cleanValue.length < MIN_VALUE_LENGTH) continue;
+        if (isEnvSubstitution(cleanValue)) continue;
         const before = content.slice(0, match.index ?? 0);
         const line = before.split("\n").length;
         const col = (before.split("\n").at(-1) ?? "").length + 1;
@@ -5264,7 +5379,9 @@ var regexCheck3 = {
             const name = match[1] ?? "";
             const value = match[2] ?? "";
             if (!isCompoundSecretName(name)) continue;
-            if (stripQuotes(value).length < MIN_VALUE_LENGTH) continue;
+            const cleanValue = stripQuotes(value);
+            if (cleanValue.length < MIN_VALUE_LENGTH) continue;
+            if (isEnvSubstitution(cleanValue)) continue;
             findings.push({
               id: `${CHECK_ID5}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
               checkId: CHECK_ID5,
@@ -5400,7 +5517,9 @@ var tsCheck3 = createTreeSitterCheck({
     const value = captures.value;
     if (!name || !value) return false;
     if (!isCompoundSecretName(name)) return false;
-    return stripQuotes(value).length >= MIN_VALUE_LENGTH;
+    const cleanValue = stripQuotes(value);
+    if (cleanValue.length < MIN_VALUE_LENGTH) return false;
+    return !isEnvSubstitution(cleanValue);
   },
   confidenceFactory: (captures) => mechanicalConfidence("ast", void 0, captures.value ?? "")
 });
@@ -5630,10 +5749,25 @@ var ENTRYPOINT_PATTERNS = [
   /(?:^|[\\/])bin[\\/]rails$/i,
   /(?:^|[\\/])application_controller\.rb$/i
 ];
+var DOCKERFILE_CHECK_IDS = /* @__PURE__ */ new Set([
+  "ops.dockerfile-runs-as-root",
+  "ops.dockerfile-secrets-in-env",
+  "ops.dockerfile-no-healthcheck"
+]);
+var GH_ACTIONS_CHECK_IDS = /* @__PURE__ */ new Set([
+  "security.gh-actions-unpinned",
+  "security.gh-actions-excessive-permissions"
+]);
 function isProCheckEligible(file, template) {
   if (template?.checkId === "security.sql-missing-rls") {
     return file.language === "sql" && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
   }
+  if (template?.checkId && DOCKERFILE_CHECK_IDS.has(template.checkId)) {
+    return file.language === "dockerfile" && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
+  }
+  if (template?.checkId && GH_ACTIONS_CHECK_IDS.has(template.checkId)) {
+    return file.language === "yaml" && /(?:^|[\\/])\.github[\\/]workflows[\\/]/i.test(file.relativePath) && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
+  }
   return PRO_CHECK_SOURCE_LANGUAGES.has(file.language) && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
 }
 function pickProjectAnchorFile(files) {
@@ -7521,6 +7655,10 @@ registry.register({
   }
 });
 var CHECK_ID10 = "security.xss-surface";
+var CGI_PATH_HINT = /(^|[\/_-])cgi([\/_.-]|$)/i;
+function isLikelyCgiBashScript(file) {
+  return CGI_PATH_HINT.test(file.relativePath);
+}
 var QUERIES = {
   javascript: `
 (call_expression
@@ -7804,7 +7942,10 @@ registry.register(
     queries: QUERIES,
     messageKey: "checks.xss-surface.message",
     degradedMessageKey: "checks.xss-surface.degraded",
-    remediationKey: "remediation.security.xss-surface"
+    remediationKey: "remediation.security.xss-surface",
+    // Bash echo $VAR writes to stdout, not a browser. Only treat bash
+    // scripts as XSS-relevant when they look like CGI handlers.
+    fileFilter: (file) => file.language !== "bash" || isLikelyCgiBashScript(file)
   })
 );
 var CHECK_ID11 = "security.os-command-injection";
@@ -14732,6 +14873,556 @@ registry.register({
     }
   }
 });
+var PROMPT_VERSION31 = "1.0.0";
+var fallbackPatterns31 = [
+  {
+    regex: /helmet\s*\(/i,
+    message: "No HTTP security headers middleware detected",
+    severity: "medium",
+    absenceBased: true
+  }
+];
+async function buildPrompt31(sourceFiles) {
+  const parts = [
+    "Check if the application configures HTTP security response headers.",
+    "In Node.js (Express, Fastify, Nest), look for helmet() middleware or explicit setHeader calls for: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options (or Content-Security-Policy with frame-ancestors), and Permissions-Policy.",
+    "In Python Django, check for SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, X_FRAME_OPTIONS in settings files.",
+    "In Python FastAPI/Flask, check for SecurityHeadersMiddleware or manual response.headers assignments covering these headers.",
+    "Flag apps that initialise a server without any of these security headers. Prefer one project-level finding rather than one per route file. Do NOT flag if helmet() or a known security-header middleware is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse31(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate31 = {
+  checkId: "security.missing-security-headers",
+  promptVersion: PROMPT_VERSION31,
+  projectScoped: true,
+  buildPrompt: buildPrompt31,
+  parseResponse: parseResponse31,
+  fallbackPatterns: fallbackPatterns31
+};
+registry.register({
+  id: "security.missing-security-headers",
+  name: "Missing security headers",
+  description: "Application does not set HTTP security response headers",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate31);
+  }
+});
+var PROMPT_VERSION32 = "1.0.0";
+var fallbackPatterns32 = [
+  {
+    regex: /uses:\s+(?!\.\/)\S+@(?![0-9a-f]{40}\b)\S+/,
+    message: "GitHub Actions step uses an unpinned action reference (not a 40-char commit SHA)",
+    severity: "medium"
+  }
+];
+async function buildPrompt32(sourceFiles) {
+  const parts = [
+    "Check GitHub Actions workflow files for third-party action steps not pinned to a full 40-character commit SHA.",
+    "Safe: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
+    "Unsafe (flag these): uses: actions/checkout@v4, uses: actions/checkout@main, uses: actions/checkout@latest, uses: actions/checkout@master",
+    "First-party actions (uses: ./ prefix) are always acceptable \u2014 do not flag them.",
+    'Flag every "uses:" line referencing a third-party action without a 40-hex-char commit SHA.'
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 4e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse32(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate32 = {
+  checkId: "security.gh-actions-unpinned",
+  promptVersion: PROMPT_VERSION32,
+  buildPrompt: buildPrompt32,
+  parseResponse: parseResponse32,
+  fallbackPatterns: fallbackPatterns32
+};
+registry.register({
+  id: "security.gh-actions-unpinned",
+  name: "Unpinned GitHub Actions",
+  description: "GitHub Actions steps reference third-party actions by mutable tag rather than commit SHA",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate32);
+  }
+});
+var PROMPT_VERSION33 = "1.0.0";
+var fallbackPatterns33 = [
+  {
+    regex: /permissions:\s*write-all/i,
+    message: "Workflow grants write-all permissions",
+    severity: "low"
+  }
+];
+async function buildPrompt33(sourceFiles) {
+  const parts = [
+    "Check GitHub Actions workflow files for excessive or undeclared permission grants.",
+    `Flag workflows that: (1) use "permissions: write-all" at the top level or in a job, (2) have no top-level "permissions:" key at all (GitHub's default grants broad write access when omitted), or (3) grant write-level permissions far broader than the job's purpose (e.g. contents: write on a check that only reads).`,
+    'A well-secured workflow adds "permissions: {}" at the top level and grants only the minimum needed per job, e.g. "permissions: { contents: read }".',
+    "Do NOT flag workflows that already have explicitly scoped, narrow permissions defined."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 4e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse33(response, checkId) {
+  return parseLLMResponse(response, checkId, "low");
+}
+var promptTemplate33 = {
+  checkId: "security.gh-actions-excessive-permissions",
+  promptVersion: PROMPT_VERSION33,
+  buildPrompt: buildPrompt33,
+  parseResponse: parseResponse33,
+  fallbackPatterns: fallbackPatterns33
+};
+registry.register({
+  id: "security.gh-actions-excessive-permissions",
+  name: "Excessive GitHub Actions permissions",
+  description: "GitHub Actions workflow grants overly broad or undeclared permissions",
+  category: "security",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate33);
+  }
+});
+var PROMPT_VERSION34 = "1.0.0";
+var fallbackPatterns34 = [
+  {
+    regex: /introspection:\s*true/i,
+    message: "GraphQL introspection is explicitly enabled \u2014 disable in production",
+    severity: "medium"
+  }
+];
+async function buildPrompt34(sourceFiles) {
+  const parts = [
+    "Check if a GraphQL server has introspection enabled for production traffic.",
+    'In Apollo Server (Node.js), flag ApolloServer instances with introspection: true where there is no production guard (e.g. process.env.NODE_ENV !== "production"), or where introspection is not explicitly set to false.',
+    "In GraphQL Yoga or Mercurius, check for equivalent introspection settings.",
+    "In Python (Strawberry, graphene), flag schema servers without a mechanism to disable introspection in non-development environments.",
+    "Only flag when no environment guard exists that would prevent introspection in production. Return [] if introspection is already disabled or gated on a non-production environment check."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse34(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate34 = {
+  checkId: "security.graphql-introspection-prod",
+  promptVersion: PROMPT_VERSION34,
+  buildPrompt: buildPrompt34,
+  parseResponse: parseResponse34,
+  fallbackPatterns: fallbackPatterns34
+};
+registry.register({
+  id: "security.graphql-introspection-prod",
+  name: "GraphQL introspection in production",
+  description: "GraphQL server exposes introspection without disabling it for production",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate34);
+  }
+});
+var PROMPT_VERSION35 = "1.0.0";
+var fallbackPatterns35 = [];
+async function buildPrompt35(sourceFiles) {
+  const parts = [
+    "Check if a GraphQL server enforces query depth or complexity limits.",
+    "Flag GraphQL server setups (Apollo Server, GraphQL Yoga, Mercurius, Strawberry, graphene) that configure no query depth or complexity protection \u2014 none of: graphql-depth-limit, depthLimit, graphql-cost-analysis, graphql-query-complexity, or custom validationRules that restrict query shape.",
+    "Without depth limiting, deeply nested queries cause exponential resolver work and can be used as a denial-of-service vector.",
+    "Emit one project-level finding pointing at the server setup file. Return [] if any depth, complexity, or cost validation plugin is wired into the server, or if no GraphQL server is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse35(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate35 = {
+  checkId: "security.graphql-no-depth-limit",
+  promptVersion: PROMPT_VERSION35,
+  projectScoped: true,
+  buildPrompt: buildPrompt35,
+  parseResponse: parseResponse35,
+  fallbackPatterns: fallbackPatterns35
+};
+registry.register({
+  id: "security.graphql-no-depth-limit",
+  name: "GraphQL no depth limit",
+  description: "GraphQL server has no query depth or complexity limiting",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate35);
+  }
+});
+var PROMPT_VERSION36 = "1.0.0";
+var fallbackPatterns36 = [
+  {
+    regex: /algorithm[s'"`]*\s*[=:]\s*['"`]none['"`]/i,
+    message: 'JWT algorithm set to "none" \u2014 token signatures are not verified',
+    severity: "high"
+  }
+];
+async function buildPrompt36(sourceFiles) {
+  const parts = [
+    "Check for insecure JWT algorithm configurations.",
+    'Flag any explicit use of algorithm "none" in JWT signing or verification (jsonwebtoken, jose, PyJWT, ruby-jwt, etc.).',
+    'Also flag jwt.verify() or jwt.decode() calls that do NOT pass an "algorithms" allowlist \u2014 without one, an attacker can forge tokens by switching to the "none" algorithm.',
+    "In Python PyJWT: flag jwt.decode() missing the algorithms=[...] parameter.",
+    'In Node.js jsonwebtoken: flag jwt.verify() without an algorithms option, or with algorithm/algorithms set to "none".',
+    "In jose: flag jwtVerify() without explicit algorithms.",
+    "Return [] if all verify/decode calls have an explicit non-empty algorithms allowlist."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse36(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate36 = {
+  checkId: "security.jwt-alg-none",
+  promptVersion: PROMPT_VERSION36,
+  buildPrompt: buildPrompt36,
+  parseResponse: parseResponse36,
+  fallbackPatterns: fallbackPatterns36
+};
+registry.register({
+  id: "security.jwt-alg-none",
+  name: "JWT algorithm none",
+  description: 'JWT verification allows the "none" algorithm or lacks an algorithms allowlist',
+  category: "security",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate36);
+  }
+});
+var PROMPT_VERSION37 = "1.0.1";
+var fallbackPatterns37 = [];
+async function buildPrompt37(sourceFiles) {
+  const parts = [
+    "Check for JWT tokens issued without an expiry claim.",
+    'Flag jwt.sign(payload, secret) calls (jsonwebtoken) that have no "expiresIn" in the options argument.',
+    "Flag new SignJWT(payload).sign(key) calls (jose) that do not chain .setExpirationTime(...).",
+    'Flag jwt.encode(payload, key) (PyJWT) where the payload dict has no "exp" key.',
+    "Tokens without expiry are valid indefinitely \u2014 a stolen token cannot be invalidated through expiry.",
+    'Do NOT flag if the payload object itself already contains an "exp" property set before the sign call.',
+    "Do NOT flag short-lived access tokens that have expiresIn set."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse37(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate37 = {
+  checkId: "security.jwt-no-expiry",
+  promptVersion: PROMPT_VERSION37,
+  buildPrompt: buildPrompt37,
+  parseResponse: parseResponse37,
+  fallbackPatterns: fallbackPatterns37
+};
+registry.register({
+  id: "security.jwt-no-expiry",
+  name: "JWT issued without expiry",
+  description: "JWT tokens are signed without an expiry claim, making them valid indefinitely",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate37);
+  }
+});
+var PROMPT_VERSION38 = "1.0.0";
+var fallbackPatterns38 = [
+  {
+    regex: /(?:localStorage|sessionStorage)\.setItem\s*\(\s*['"`][^'"`]*(?:refresh|refreshToken|refresh_token)[^'"`]*['"`]/i,
+    message: "Refresh token or long-lived credential stored in localStorage/sessionStorage",
+    severity: "high"
+  }
+];
+async function buildPrompt38(sourceFiles) {
+  const parts = [
+    "Check for refresh tokens or long-lived authentication credentials written to browser localStorage or sessionStorage.",
+    'Flag any code that calls localStorage.setItem() or sessionStorage.setItem() (or equivalent bracket notation assignments) with a key containing "refresh", "refreshToken", or "refresh_token".',
+    "Also flag storing full auth/session tokens intended for reuse across browser sessions in localStorage.",
+    "XSS attacks can read all localStorage values \u2014 refresh tokens should be in httpOnly cookies instead.",
+    "Short-lived access tokens held in JavaScript memory variables (not persisted to storage) are acceptable. Only flag explicit writes to localStorage/sessionStorage."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse38(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate38 = {
+  checkId: "security.refresh-token-in-localstorage",
+  promptVersion: PROMPT_VERSION38,
+  buildPrompt: buildPrompt38,
+  parseResponse: parseResponse38,
+  fallbackPatterns: fallbackPatterns38
+};
+registry.register({
+  id: "security.refresh-token-in-localstorage",
+  name: "Refresh token in localStorage",
+  description: "Refresh tokens or long-lived credentials stored in localStorage are vulnerable to XSS theft",
+  category: "security",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate38);
+  }
+});
+var PROMPT_VERSION39 = "1.0.0";
+var fallbackPatterns39 = [
+  {
+    regex: /^\s*USER\s+(?!root\b|0\b)/im,
+    message: "Dockerfile has no non-root USER directive \u2014 container runs as root",
+    severity: "medium",
+    absenceBased: true
+  }
+];
+async function buildPrompt39(sourceFiles) {
+  const parts = [
+    "Check Dockerfiles for containers running as root.",
+    "Flag Dockerfiles that have no USER instruction before the final CMD or ENTRYPOINT, or where the last USER directive sets root (USER root or USER 0).",
+    "A secure Dockerfile creates a non-privileged user and switches to it, e.g.: RUN adduser --disabled-password appuser followed by USER appuser.",
+    "Running containers as root means any process escape gains host root privileges.",
+    "Return [] if a non-root USER is set before CMD/ENTRYPOINT."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse39(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate39 = {
+  checkId: "ops.dockerfile-runs-as-root",
+  promptVersion: PROMPT_VERSION39,
+  buildPrompt: buildPrompt39,
+  parseResponse: parseResponse39,
+  fallbackPatterns: fallbackPatterns39
+};
+registry.register({
+  id: "ops.dockerfile-runs-as-root",
+  name: "Dockerfile runs as root",
+  description: "Container image has no non-root USER directive",
+  category: "ops",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate39);
+  }
+});
+var PROMPT_VERSION40 = "1.0.0";
+var fallbackPatterns40 = [
+  {
+    regex: /^\s*(?:ENV|ARG)\s+\S*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|CREDENTIAL|API_KEY|PRIVATE)\s*=\s*\S+/im,
+    message: "Dockerfile bakes a secret-shaped value into the image via ENV or ARG",
+    severity: "high"
+  }
+];
+async function buildPrompt40(sourceFiles) {
+  const parts = [
+    "Check Dockerfiles for secrets or credentials baked into image layers via ENV or ARG instructions.",
+    "Flag ENV or ARG directives where the variable name suggests a secret (*_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_PASS, *_CREDENTIAL, *_PRIVATE, DATABASE_URL, PRIVATE_KEY) and a literal non-placeholder value is assigned.",
+    'ENV values are baked into every image layer and visible via "docker inspect". ARG values are also stored in the build history.',
+    "Flag: ENV DATABASE_URL=postgres://user:password@host/db, ENV API_KEY=sk-abc123, ARG STRIPE_SECRET=sk_live_...",
+    "Do NOT flag: ENV PORT=3000, ENV NODE_ENV=production, ARG BUILD_DATE, or ENV DATABASE_URL= (empty assignment)."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse40(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate40 = {
+  checkId: "ops.dockerfile-secrets-in-env",
+  promptVersion: PROMPT_VERSION40,
+  buildPrompt: buildPrompt40,
+  parseResponse: parseResponse40,
+  fallbackPatterns: fallbackPatterns40
+};
+registry.register({
+  id: "ops.dockerfile-secrets-in-env",
+  name: "Secrets in Dockerfile ENV",
+  description: "Dockerfile bakes secrets into image layers via ENV or ARG instructions",
+  category: "ops",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate40);
+  }
+});
+var PROMPT_VERSION41 = "1.0.0";
+var fallbackPatterns41 = [
+  {
+    regex: /^\s*HEALTHCHECK\b/im,
+    message: "Dockerfile has no HEALTHCHECK instruction \u2014 container orchestrators cannot detect unhealthy state",
+    severity: "low",
+    absenceBased: true
+  }
+];
+async function buildPrompt41(sourceFiles) {
+  const parts = [
+    "Check if a Dockerfile includes a HEALTHCHECK instruction.",
+    "Without HEALTHCHECK, Docker and container orchestrators like Kubernetes cannot detect an unhealthy container and will continue routing traffic to it.",
+    "Flag Dockerfiles that have no HEALTHCHECK instruction at all.",
+    "A minimal HEALTHCHECK example: HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:8080/health || exit 1",
+    "Return [] if a HEALTHCHECK instruction is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse41(response, checkId) {
+  return parseLLMResponse(response, checkId, "low");
+}
+var promptTemplate41 = {
+  checkId: "ops.dockerfile-no-healthcheck",
+  promptVersion: PROMPT_VERSION41,
+  buildPrompt: buildPrompt41,
+  parseResponse: parseResponse41,
+  fallbackPatterns: fallbackPatterns41
+};
+registry.register({
+  id: "ops.dockerfile-no-healthcheck",
+  name: "Dockerfile missing HEALTHCHECK",
+  description: "Dockerfile has no HEALTHCHECK instruction \u2014 orchestrators cannot detect unhealthy containers",
+  category: "ops",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate41);
+  }
+});
+registry.register({
+  id: "ops.missing-dockerignore",
+  name: "Missing .dockerignore",
+  description: "Dockerfile present without a .dockerignore \u2014 build context may leak sensitive files",
+  category: "ops",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    const dockerfile = ctx.files.find((f) => f.language === "dockerfile");
+    if (!dockerfile) return [];
+    const hasDockerignore = ctx.files.some((f) => /(?:^|[\\/])\.dockerignore$/.test(f.relativePath));
+    if (hasDockerignore) return [];
+    let remediation;
+    try {
+      remediation = getCopy("remediation.ops.missing-dockerignore");
+    } catch {
+    }
+    return [
+      {
+        id: "ops.missing-dockerignore-1",
+        checkId: "ops.missing-dockerignore",
+        category: "ops",
+        severity: "low",
+        message: "Dockerfile exists but no .dockerignore found \u2014 sensitive files (node_modules, .env, secrets) may be included in the build context",
+        file: dockerfile.relativePath,
+        line: 1,
+        remediation
+      }
+    ];
+  }
+});
+var PROMPT_VERSION42 = "1.0.0";
+var fallbackPatterns42 = [];
+async function buildPrompt42(sourceFiles) {
+  const parts = [
+    "Check for N+1 query patterns where ORM results are iterated and a new database query is issued per row.",
+    "In Prisma (TypeScript): flag findMany() or findFirst() results iterated with for...of or forEach where a separate findUnique/findFirst/findMany is called inside the loop body.",
+    "In Sequelize (Node.js): flag findAll() results where model.find() or association.get() is called per element inside a loop.",
+    "In TypeORM: flag find()/findBy() results with repository calls inside the iteration.",
+    "In SQLAlchemy (Python): flag query.all() or session.scalars() results where session.get() or a new query is executed per row.",
+    "In Active Record (Ruby): flag .all or .where results iterated with .each where an association is accessed without eager loading (use .includes instead).",
+    "Flag only clear, direct N+1 patterns \u2014 a loop body that calls a query on each iteration. Do not flag loops that process already-loaded data."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse42(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate42 = {
+  checkId: "resilience.orm-n-plus-one",
+  promptVersion: PROMPT_VERSION42,
+  buildPrompt: buildPrompt42,
+  parseResponse: parseResponse42,
+  fallbackPatterns: fallbackPatterns42
+};
+registry.register({
+  id: "resilience.orm-n-plus-one",
+  name: "ORM N+1 query pattern",
+  description: "ORM results are iterated with a per-row database query instead of a batch load",
+  category: "resilience",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate42);
+  }
+});
 var LANGUAGE_CODES = [
   "javascript",
   "typescript",
@@ -15518,6 +16209,8 @@ async function checkUpdate() {
 }
 
 // src/cli-action.ts
+var _require = createRequire2(import.meta.url);
+var { version: CLI_VERSION } = _require("../package.json");
 function getConfigFile2() {
   return join15(process.env.SEAWORTHY_CONFIG_DIR ?? join15(homedir3(), ".seaworthy"), "config");
 }
@@ -15594,7 +16287,7 @@ async function runCli(options) {
     await setupCommand.handler({ action: "run" }, { tier: "free", licensedTo: "free tier" });
   }
   const provider = new FsCredentialProvider();
-  const license = new LicenseClient({ baseUrl: LICENSE_SERVER_URL });
+  const license = new LicenseClient({ baseUrl: LICENSE_SERVER_URL, userAgent: `seaworthycode/${CLI_VERSION}` });
   const authResult = await resolveAuth(provider, license);
   if (!authResult.ok) {
     const normalized = authResult.code.replace(/^errors\./, "");
@@ -15718,7 +16411,7 @@ var repoRootEnv = resolve4(dirname7(fileURLToPath3(import.meta.url)), "../../.."
 if (existsSync6(repoRootEnv)) {
   loadEnv({ path: repoRootEnv, override: false });
 }
-var require5 = createRequire2(import.meta.url);
+var require5 = createRequire3(import.meta.url);
 var { version } = require5("../package.json");
 var cli = cac("seaworthy");
 cli.version(version);