seaworthycode 1.1.4 → 1.2.4

package/dist/index.js

@@ -6,13 +6,14 @@ import { existsSync as existsSync6 } from "fs";
 import { dirname as dirname7, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { cac } from "cac";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire4 } from "module";
 
 // src/cli-action.ts
-import { stat, access as access2 } from "fs/promises";
+import { stat, access as access2, appendFile, mkdir } from "fs/promises";
 import { resolve as resolve3 } from "path";
 import { homedir as homedir3 } from "os";
 import { join as join15 } from "path";
+import { createRequire as createRequire2 } from "module";
 
 // ../core/dist/index.js
 import { readFileSync } from "fs";
@@ -36,6 +37,8 @@ import { createHash } from "crypto";
 import { isAbsolute, relative as relative3 } from "path";
 import { pathToFileURL } from "url";
 import { z } from "zod";
+import { lookup } from "dns/promises";
+import { request as httpsRequest } from "https";
 import { jwtVerify, createLocalJWKSet } from "jose";
 import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
 import { join as join6, resolve as pathResolve2 } from "path";
@@ -90,6 +93,7 @@ var CACHE_DIR = join(CONFIG_DIR, "cache");
 var AST_CACHE_DIR = join(CACHE_DIR, "ast");
 var DEP_CACHE_DIR = join(CACHE_DIR, "deps");
 var LLM_CACHE_DIR = join(CACHE_DIR, "llm");
+var LOG_DIR = join(CONFIG_DIR, "logs");
 var VALID_CATEGORIES = /* @__PURE__ */ new Set([
   "security",
   "resilience",
@@ -397,11 +401,11 @@ async function crawl(options) {
         const ext2 = entry.name.includes(".") ? entry.name.slice(entry.name.lastIndexOf(".")) : "";
         if (SKIP_EXTENSIONS.has(ext2)) continue;
         try {
-          const stat22 = await fs.stat(fullPath);
-          if (!stat22.isFile()) continue;
-          if (stat22.size > maxFileSize) continue;
-          const { isBinary: isBinary2, isGenerated: isGenerated2 } = await peekFileHead(fullPath);
-          if (isBinary2 || isGenerated2) continue;
+          const stat2 = await fs.stat(fullPath);
+          if (!stat2.isFile()) continue;
+          if (stat2.size > maxFileSize) continue;
+          const { isBinary, isGenerated } = await peekFileHead(fullPath);
+          if (isBinary || isGenerated) continue;
           if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
           files.push({
             path: fullPath,
@@ -417,17 +421,20 @@ async function crawl(options) {
       if (ig.ignores(relPath)) continue;
       const ext = entry.name.includes(".") ? entry.name.slice(entry.name.lastIndexOf(".")) : "";
       if (SKIP_EXTENSIONS.has(ext)) continue;
-      const stat2 = await fs.stat(fullPath);
-      if (stat2.size > maxFileSize) continue;
-      const { isBinary, isGenerated } = await peekFileHead(fullPath);
-      if (isBinary || isGenerated) continue;
-      if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
-      files.push({
-        path: fullPath,
-        relativePath: relPath,
-        content: () => fs.readFile(fullPath, "utf-8"),
-        language: inferLanguage(entry.name)
-      });
+      try {
+        const stat2 = await fs.stat(fullPath);
+        if (stat2.size > maxFileSize) continue;
+        const { isBinary, isGenerated } = await peekFileHead(fullPath);
+        if (isBinary || isGenerated) continue;
+        if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
+        files.push({
+          path: fullPath,
+          relativePath: relPath,
+          content: () => fs.readFile(fullPath, "utf-8"),
+          language: inferLanguage(entry.name)
+        });
+      } catch {
+      }
     }
   }
   await walk(targetDir);
@@ -776,10 +783,12 @@ var copy = {
   "report.tierWatermark": (licensedTo) => `\u2693 Pro \xB7 ${licensedTo}`,
   "report.scanProgress.starting": (targetDir) => `\u2693 Scanning ${targetDir}...`,
   "report.scanProgress.category": (label, count) => count > 0 ? `  \u2693 ${label} \u2014 ${count} issue(s)` : `  \u2693 ${label} \u2713`,
+  "report.licenseNotice": (licensedTo) => `Licensed to ${licensedTo}`,
   "report.cta.clean": `\u2713 All clear \u2014 your project is shipshape!`,
   "report.cta.hasFindings": `Fix these before you ship. ${SITE_URL}/docs`,
   "report.cta.critical": `\u26A0 Critical issues found \u2014 patch before you deploy. ${SITE_URL}/docs`,
   "report.proUpsellNamed": (names, count) => `\u2693 Pro unlocks ${count} more check${count === 1 ? "" : "s"} (${names}). ${SITE_URL}`,
+  "report.preScanNotice": (count) => `\u2693 Pro unlocks ${count} additional checks. Upgrade at ${SITE_URL}`,
   "report.llmPrivacyWarning": "Pro checks will send code context to your LLM provider via your API key. No data is sent to Seaworthy servers.",
   "report.confidenceHigh": "high confidence",
   "report.confidenceMedium": "medium confidence",
@@ -1440,6 +1449,52 @@ var copy = {
   "checks.sql-missing-rls.message": (match) => `RLS is not enabled or lacks restriction on a private/tenant table: ${match}`,
   "checks.sql-missing-rls.degraded": (path, language) => `${language} analysis was incomplete for ${path} (no grammar available)`,
   "remediation.security.sql-missing-rls": "Define a policy with CREATE POLICY ... ON ... USING (...) to restrict data access to authorized users.",
+  // Security headers
+  "checks.missing-security-headers.name": "Missing HTTP security headers",
+  "checks.missing-security-headers.description": "Application does not set HTTP security response headers (HSTS, X-Content-Type-Options, X-Frame-Options, Permissions-Policy)",
+  "remediation.security.missing-security-headers": "Add helmet() (Node.js) or equivalent security-header middleware. At minimum set Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options, and Permissions-Policy.",
+  // GitHub Actions supply-chain
+  "checks.gh-actions-unpinned.name": "Unpinned GitHub Actions",
+  "checks.gh-actions-unpinned.description": "GitHub Actions workflow steps reference third-party actions by mutable tag rather than a full commit SHA",
+  "remediation.security.gh-actions-unpinned": "Pin every third-party action to a full 40-character commit SHA, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. Use a tool like Renovate or pin-github-action to automate this.",
+  "checks.gh-actions-excessive-permissions.name": "Excessive GitHub Actions permissions",
+  "checks.gh-actions-excessive-permissions.description": "GitHub Actions workflow grants overly broad or undeclared default permissions",
+  "remediation.security.gh-actions-excessive-permissions": 'Add a top-level "permissions: {}" block and grant only the minimum scopes needed per job, e.g. "permissions: { contents: read }".',
+  // GraphQL
+  "checks.graphql-introspection-prod.name": "GraphQL introspection in production",
+  "checks.graphql-introspection-prod.description": "GraphQL server exposes introspection without disabling it for production environments",
+  "remediation.security.graphql-introspection-prod": 'Disable GraphQL introspection in production: set introspection: process.env.NODE_ENV !== "production" in Apollo Server, or use a validationRules plugin that blocks introspection queries.',
+  "checks.graphql-no-depth-limit.name": "GraphQL missing depth limit",
+  "checks.graphql-no-depth-limit.description": "GraphQL server has no query depth or complexity limiting, enabling denial-of-service via deeply nested queries",
+  "remediation.security.graphql-no-depth-limit": "Add query depth limiting with graphql-depth-limit or complexity analysis with graphql-query-complexity. Wire the validation rule into ApolloServer validationRules or the equivalent for your framework.",
+  // JWT
+  "checks.jwt-alg-none.name": 'JWT allows algorithm "none"',
+  "checks.jwt-alg-none.description": 'JWT verification does not restrict algorithms, allowing forged unsigned tokens via the "none" algorithm',
+  "remediation.security.jwt-alg-none": 'Always pass an explicit algorithms allowlist to jwt.verify() (e.g. { algorithms: ["HS256"] }). Never accept "none" as a valid algorithm.',
+  "checks.jwt-no-expiry.name": "JWT issued without expiry",
+  "checks.jwt-no-expiry.description": "JWT tokens are signed without an expiry claim (exp / expiresIn), making them valid indefinitely",
+  "remediation.security.jwt-no-expiry": 'Set a short expiry on all issued JWTs using expiresIn (jsonwebtoken), .setExpirationTime() (jose), or an "exp" claim in the payload (PyJWT). Use refresh tokens to extend sessions.',
+  // Browser token storage
+  "checks.refresh-token-in-localstorage.name": "Refresh token in localStorage",
+  "checks.refresh-token-in-localstorage.description": "Refresh tokens or long-lived credentials stored in localStorage are vulnerable to theft via XSS",
+  "remediation.security.refresh-token-in-localstorage": "Store refresh tokens in httpOnly, Secure, SameSite=Strict cookies \u2014 not localStorage or sessionStorage. XSS cannot read httpOnly cookies.",
+  // Dockerfile hardening
+  "checks.dockerfile-runs-as-root.name": "Dockerfile runs as root",
+  "checks.dockerfile-runs-as-root.description": "Container image has no non-root USER directive \u2014 all processes run as root",
+  "remediation.ops.dockerfile-runs-as-root": "Create a non-root user and switch to it before CMD/ENTRYPOINT: RUN addgroup -S app && adduser -S app -G app followed by USER app.",
+  "checks.dockerfile-secrets-in-env.name": "Secrets in Dockerfile ENV",
+  "checks.dockerfile-secrets-in-env.description": "Dockerfile bakes secrets or credentials into image layers via ENV or ARG instructions",
+  "remediation.ops.dockerfile-secrets-in-env": "Never pass secrets via ENV or ARG \u2014 they persist in image history. Use Docker BuildKit secrets (RUN --mount=type=secret), environment variables injected at container start, or a secrets manager.",
+  "checks.dockerfile-no-healthcheck.name": "Dockerfile missing HEALTHCHECK",
+  "checks.dockerfile-no-healthcheck.description": "Dockerfile has no HEALTHCHECK instruction \u2014 container orchestrators cannot detect unhealthy state",
+  "remediation.ops.dockerfile-no-healthcheck": "Add a HEALTHCHECK instruction, e.g.: HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:8080/health || exit 1",
+  "checks.missing-dockerignore.name": "Missing .dockerignore",
+  "checks.missing-dockerignore.description": "Dockerfile is present without a .dockerignore \u2014 build context may include node_modules, .env files, or other sensitive data",
+  "remediation.ops.missing-dockerignore": "Add a .dockerignore file listing directories and files to exclude from the build context: node_modules, .env, .git, *.log, dist, coverage.",
+  // ORM N+1
+  "checks.orm-n-plus-one.name": "ORM N+1 query pattern",
+  "checks.orm-n-plus-one.description": "ORM results are iterated with a per-row database query instead of a single batch load",
+  "remediation.resilience.orm-n-plus-one": "Replace per-row queries inside loops with a single batch query using include/eager loading (Prisma include, Sequelize eager loading, SQLAlchemy joinedload, ActiveRecord includes).",
   // Reporting labels
   "reporting.analysisType.pattern": "pattern",
   "reporting.analysisType.semantic": "semantic"
@@ -3134,16 +3189,60 @@ var REFRESH_WINDOW_MS = 5 * 60 * 1e3;
 var LicenseClient = class {
   baseUrl;
   timeout;
+  userAgent;
   cache = null;
   jwksFetched = false;
   constructor(config = {}) {
     this.baseUrl = config.baseUrl ?? LICENSE_SERVER_URL;
     this.timeout = config.timeout ?? 1e4;
+    this.userAgent = config.userAgent ?? "seaworthycode/unknown";
+  }
+  async fetchWithRetry(url, init) {
+    try {
+      return await fetch(url, init);
+    } catch (err) {
+      if (!(err instanceof TypeError)) throw err;
+      return this.fetchIpv4(url, init);
+    }
+  }
+  async fetchIpv4(url, init) {
+    const parsed = new URL(url);
+    const { address } = await lookup(parsed.hostname, { family: 4 });
+    const initHeaders = init.headers ?? {};
+    const headers = { ...initHeaders, Host: parsed.hostname };
+    return new Promise((resolve22, reject) => {
+      const options = {
+        hostname: address,
+        port: parseInt(parsed.port || "443"),
+        path: parsed.pathname + (parsed.search || ""),
+        method: init.method ?? "GET",
+        headers,
+        servername: parsed.hostname,
+        signal: init.signal ?? void 0
+      };
+      const req = httpsRequest(options, (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => {
+          const resHeaders = new Headers();
+          for (const [k, v] of Object.entries(res.headers)) {
+            if (typeof v === "string") resHeaders.set(k, v);
+            else if (Array.isArray(v)) resHeaders.set(k, v.join(", "));
+          }
+          resolve22(new Response(Buffer.concat(chunks), { status: res.statusCode ?? 0, headers: resHeaders }));
+        });
+        res.on("error", reject);
+      });
+      req.on("error", reject);
+      if (init.body) req.write(init.body);
+      req.end();
+    });
   }
   async ensureJwks() {
     if (this.jwksFetched) return;
-    const response = await fetch(`${this.baseUrl}/.well-known/jwks.json`, {
-      signal: AbortSignal.timeout(this.timeout)
+    const response = await this.fetchWithRetry(`${this.baseUrl}/.well-known/jwks.json`, {
+      signal: AbortSignal.timeout(this.timeout),
+      headers: { "User-Agent": this.userAgent }
     });
     if (!response.ok) {
       throw new Error("jwks.fetch_failed");
@@ -3167,9 +3266,9 @@ var LicenseClient = class {
     }
     try {
       await this.ensureJwks();
-      const response = await fetch(`${this.baseUrl}/validate`, {
+      const response = await this.fetchWithRetry(`${this.baseUrl}/validate`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", "User-Agent": this.userAgent },
         body: JSON.stringify({ licenseKey: licenseKey ?? "free" }),
         signal: AbortSignal.timeout(this.timeout)
       });
@@ -3180,7 +3279,8 @@ var LicenseClient = class {
         return fail("license.rate_limited");
       }
       if (!response.ok) {
-        return fail("license.server_error");
+        const rayId = response.headers.get("cf-ray") ?? "";
+        return fail("license.server_error", `HTTP ${response.status}${rayId ? ` ray=${rayId}` : ""}`);
       }
       const data = await response.json();
       const parsed = licenseResponseSchema.safeParse(data);
@@ -3209,12 +3309,12 @@ var LicenseClient = class {
       });
     } catch (err) {
       if (err instanceof DOMException && err.name === "TimeoutError") {
-        return fail("license.server_unreachable");
+        return fail("license.server_unreachable", "timeout");
       }
       if (err instanceof TypeError) {
-        return fail("license.server_unreachable");
+        return fail("license.server_unreachable", err.message);
       }
-      return fail("license.server_unreachable");
+      return fail("license.server_unreachable", String(err));
     }
   }
   shouldRefresh() {
@@ -3756,6 +3856,22 @@ function mergeFindings(tsFindings, otherFindings) {
   }
   return Array.from(map.values());
 }
+var ENV_SUBSTITUTION_PATTERNS = [
+  /^env\(\s*[A-Za-z_][A-Za-z0-9_]*\s*\)$/,
+  /^\$\{[A-Za-z_][A-Za-z0-9_]*(?::[-=+?][^}]*)?\}$/,
+  /^\$[A-Za-z_][A-Za-z0-9_]*$/,
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/,
+  /^<%=?\s*ENV\[['"][A-Za-z_][A-Za-z0-9_]*['"]\]\s*%>$/,
+  /^process\.env(?:\.[A-Za-z_][A-Za-z0-9_]*|\[['"][A-Za-z_][A-Za-z0-9_]*['"]\])$/,
+  /^os\.(?:environ\[['"][A-Za-z_][A-Za-z0-9_]*['"]\]|getenv\(['"][A-Za-z_][A-Za-z0-9_]*['"]\))$/
+];
+function isEnvSubstitution(value) {
+  const trimmed = value.trim();
+  for (const pattern of ENV_SUBSTITUTION_PATTERNS) {
+    if (pattern.test(trimmed)) return true;
+  }
+  return false;
+}
 var CHECK_ID = "security.hardcoded-secrets";
 var SECRET_PATTERNS = [
   { regex: /AWS_SECRET_ACCESS_KEY\s*=\s*['"]([A-Za-z0-9/+=]{40})['"]/gi, name: "AWS secret access key", minLength: 40, method: "known-format" },
@@ -3791,6 +3907,8 @@ var regexCheck = {
           const matches = Array.from(line.matchAll(pattern.regex));
           for (let matchIdx = 0; matchIdx < matches.length; matchIdx++) {
             const match = matches[matchIdx];
+            const captured = match[1] ?? match[0];
+            if (isEnvSubstitution(captured)) continue;
             findings.push({
               id: `${CHECK_ID}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
               checkId: CHECK_ID,
@@ -3947,6 +4065,7 @@ var tsCheck = createTreeSitterCheck({
     const trimmedValue = value.trim();
     if (!/^['"`].*['"`]$/.test(trimmedValue)) return false;
     const cleanValue = trimmedValue.replace(/^['"`]|['"`]$/g, "");
+    if (isEnvSubstitution(cleanValue)) return false;
     for (const rule of NAME_RULES) {
       if (rule.regex.test(name) && cleanValue.length >= rule.minLength) {
         return true;
@@ -5205,7 +5324,7 @@ var MIN_VALUE_LENGTH = 8;
 var SECRET_ASSIGNMENT_PATTERNS = [
   /(?:const|let|var)\s+(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*=\s*['"]([^'"]{8,})['"]/i,
   /(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*:\s*['"]([^'"]{8,})['"]/i,
-  /(?:<!--|\/\*)[^]*?(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*[:=]\s*['"]([^'"]{8,})['"]/i
+  /(?:<!--|\/\*)[^]{0,300}?(\w*(?:secret|api[_-]?key|access[_-]?key|private[_-]?key|auth[_-]?token|bearer[_-]?token|refresh[_-]?token|apiKey|accessKey|privateKey|authToken|bearerToken|refreshToken)\w*)\s*[:=]\s*['"]([^'"]{8,})['"]/i
 ];
 var REMEDIATION9 = getCopy("remediation.configuration.secrets-in-source");
 function stripQuotes(value) {
@@ -5235,7 +5354,9 @@ var regexCheck3 = {
         const name = match[1] ?? "";
         const value = match[2] ?? "";
         if (!isCompoundSecretName(name)) continue;
-        if (stripQuotes(value).length < MIN_VALUE_LENGTH) continue;
+        const cleanValue = stripQuotes(value);
+        if (cleanValue.length < MIN_VALUE_LENGTH) continue;
+        if (isEnvSubstitution(cleanValue)) continue;
         const before = content.slice(0, match.index ?? 0);
         const line = before.split("\n").length;
         const col = (before.split("\n").at(-1) ?? "").length + 1;
@@ -5264,7 +5385,9 @@ var regexCheck3 = {
             const name = match[1] ?? "";
             const value = match[2] ?? "";
             if (!isCompoundSecretName(name)) continue;
-            if (stripQuotes(value).length < MIN_VALUE_LENGTH) continue;
+            const cleanValue = stripQuotes(value);
+            if (cleanValue.length < MIN_VALUE_LENGTH) continue;
+            if (isEnvSubstitution(cleanValue)) continue;
             findings.push({
               id: `${CHECK_ID5}:${file.relativePath}:${lineNum + 1}:${(match.index ?? 0) + 1}:${matchIdx}`,
               checkId: CHECK_ID5,
@@ -5400,7 +5523,9 @@ var tsCheck3 = createTreeSitterCheck({
     const value = captures.value;
     if (!name || !value) return false;
     if (!isCompoundSecretName(name)) return false;
-    return stripQuotes(value).length >= MIN_VALUE_LENGTH;
+    const cleanValue = stripQuotes(value);
+    if (cleanValue.length < MIN_VALUE_LENGTH) return false;
+    return !isEnvSubstitution(cleanValue);
   },
   confidenceFactory: (captures) => mechanicalConfidence("ast", void 0, captures.value ?? "")
 });
@@ -5630,10 +5755,25 @@ var ENTRYPOINT_PATTERNS = [
   /(?:^|[\\/])bin[\\/]rails$/i,
   /(?:^|[\\/])application_controller\.rb$/i
 ];
+var DOCKERFILE_CHECK_IDS = /* @__PURE__ */ new Set([
+  "ops.dockerfile-runs-as-root",
+  "ops.dockerfile-secrets-in-env",
+  "ops.dockerfile-no-healthcheck"
+]);
+var GH_ACTIONS_CHECK_IDS = /* @__PURE__ */ new Set([
+  "security.gh-actions-unpinned",
+  "security.gh-actions-excessive-permissions"
+]);
 function isProCheckEligible(file, template) {
   if (template?.checkId === "security.sql-missing-rls") {
     return file.language === "sql" && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
   }
+  if (template?.checkId && DOCKERFILE_CHECK_IDS.has(template.checkId)) {
+    return file.language === "dockerfile" && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
+  }
+  if (template?.checkId && GH_ACTIONS_CHECK_IDS.has(template.checkId)) {
+    return file.language === "yaml" && /(?:^|[\\/])\.github[\\/]workflows[\\/]/i.test(file.relativePath) && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
+  }
   return PRO_CHECK_SOURCE_LANGUAGES.has(file.language) && !isDocumentationPath(file.relativePath) && !isNonProductionPath(file.relativePath);
 }
 function pickProjectAnchorFile(files) {
@@ -7521,6 +7661,10 @@ registry.register({
   }
 });
 var CHECK_ID10 = "security.xss-surface";
+var CGI_PATH_HINT = new RegExp("(^|[/_-])cgi([/_.-]|$)", "i");
+function isLikelyCgiBashScript(file) {
+  return CGI_PATH_HINT.test(file.relativePath);
+}
 var QUERIES = {
   javascript: `
 (call_expression
@@ -7804,7 +7948,10 @@ registry.register(
     queries: QUERIES,
     messageKey: "checks.xss-surface.message",
     degradedMessageKey: "checks.xss-surface.degraded",
-    remediationKey: "remediation.security.xss-surface"
+    remediationKey: "remediation.security.xss-surface",
+    // Bash echo $VAR writes to stdout, not a browser. Only treat bash
+    // scripts as XSS-relevant when they look like CGI handlers.
+    fileFilter: (file) => file.language !== "bash" || isLikelyCgiBashScript(file)
   })
 );
 var CHECK_ID11 = "security.os-command-injection";
@@ -14732,6 +14879,556 @@ registry.register({
     }
   }
 });
+var PROMPT_VERSION31 = "1.0.0";
+var fallbackPatterns31 = [
+  {
+    regex: /helmet\s*\(/i,
+    message: "No HTTP security headers middleware detected",
+    severity: "medium",
+    absenceBased: true
+  }
+];
+async function buildPrompt31(sourceFiles) {
+  const parts = [
+    "Check if the application configures HTTP security response headers.",
+    "In Node.js (Express, Fastify, Nest), look for helmet() middleware or explicit setHeader calls for: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options (or Content-Security-Policy with frame-ancestors), and Permissions-Policy.",
+    "In Python Django, check for SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, X_FRAME_OPTIONS in settings files.",
+    "In Python FastAPI/Flask, check for SecurityHeadersMiddleware or manual response.headers assignments covering these headers.",
+    "Flag apps that initialise a server without any of these security headers. Prefer one project-level finding rather than one per route file. Do NOT flag if helmet() or a known security-header middleware is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse31(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate31 = {
+  checkId: "security.missing-security-headers",
+  promptVersion: PROMPT_VERSION31,
+  projectScoped: true,
+  buildPrompt: buildPrompt31,
+  parseResponse: parseResponse31,
+  fallbackPatterns: fallbackPatterns31
+};
+registry.register({
+  id: "security.missing-security-headers",
+  name: "Missing security headers",
+  description: "Application does not set HTTP security response headers",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate31);
+  }
+});
+var PROMPT_VERSION32 = "1.0.0";
+var fallbackPatterns32 = [
+  {
+    regex: /uses:\s+(?!\.\/)\S+@(?![0-9a-f]{40}\b)\S+/,
+    message: "GitHub Actions step uses an unpinned action reference (not a 40-char commit SHA)",
+    severity: "medium"
+  }
+];
+async function buildPrompt32(sourceFiles) {
+  const parts = [
+    "Check GitHub Actions workflow files for third-party action steps not pinned to a full 40-character commit SHA.",
+    "Safe: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683",
+    "Unsafe (flag these): uses: actions/checkout@v4, uses: actions/checkout@main, uses: actions/checkout@latest, uses: actions/checkout@master",
+    "First-party actions (uses: ./ prefix) are always acceptable \u2014 do not flag them.",
+    'Flag every "uses:" line referencing a third-party action without a 40-hex-char commit SHA.'
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 4e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse32(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate32 = {
+  checkId: "security.gh-actions-unpinned",
+  promptVersion: PROMPT_VERSION32,
+  buildPrompt: buildPrompt32,
+  parseResponse: parseResponse32,
+  fallbackPatterns: fallbackPatterns32
+};
+registry.register({
+  id: "security.gh-actions-unpinned",
+  name: "Unpinned GitHub Actions",
+  description: "GitHub Actions steps reference third-party actions by mutable tag rather than commit SHA",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate32);
+  }
+});
+var PROMPT_VERSION33 = "1.0.0";
+var fallbackPatterns33 = [
+  {
+    regex: /permissions:\s*write-all/i,
+    message: "Workflow grants write-all permissions",
+    severity: "low"
+  }
+];
+async function buildPrompt33(sourceFiles) {
+  const parts = [
+    "Check GitHub Actions workflow files for excessive or undeclared permission grants.",
+    `Flag workflows that: (1) use "permissions: write-all" at the top level or in a job, (2) have no top-level "permissions:" key at all (GitHub's default grants broad write access when omitted), or (3) grant write-level permissions far broader than the job's purpose (e.g. contents: write on a check that only reads).`,
+    'A well-secured workflow adds "permissions: {}" at the top level and grants only the minimum needed per job, e.g. "permissions: { contents: read }".',
+    "Do NOT flag workflows that already have explicitly scoped, narrow permissions defined."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 4e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse33(response, checkId) {
+  return parseLLMResponse(response, checkId, "low");
+}
+var promptTemplate33 = {
+  checkId: "security.gh-actions-excessive-permissions",
+  promptVersion: PROMPT_VERSION33,
+  buildPrompt: buildPrompt33,
+  parseResponse: parseResponse33,
+  fallbackPatterns: fallbackPatterns33
+};
+registry.register({
+  id: "security.gh-actions-excessive-permissions",
+  name: "Excessive GitHub Actions permissions",
+  description: "GitHub Actions workflow grants overly broad or undeclared permissions",
+  category: "security",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate33);
+  }
+});
+var PROMPT_VERSION34 = "1.0.0";
+var fallbackPatterns34 = [
+  {
+    regex: /introspection:\s*true/i,
+    message: "GraphQL introspection is explicitly enabled \u2014 disable in production",
+    severity: "medium"
+  }
+];
+async function buildPrompt34(sourceFiles) {
+  const parts = [
+    "Check if a GraphQL server has introspection enabled for production traffic.",
+    'In Apollo Server (Node.js), flag ApolloServer instances with introspection: true where there is no production guard (e.g. process.env.NODE_ENV !== "production"), or where introspection is not explicitly set to false.',
+    "In GraphQL Yoga or Mercurius, check for equivalent introspection settings.",
+    "In Python (Strawberry, graphene), flag schema servers without a mechanism to disable introspection in non-development environments.",
+    "Only flag when no environment guard exists that would prevent introspection in production. Return [] if introspection is already disabled or gated on a non-production environment check."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse34(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate34 = {
+  checkId: "security.graphql-introspection-prod",
+  promptVersion: PROMPT_VERSION34,
+  buildPrompt: buildPrompt34,
+  parseResponse: parseResponse34,
+  fallbackPatterns: fallbackPatterns34
+};
+registry.register({
+  id: "security.graphql-introspection-prod",
+  name: "GraphQL introspection in production",
+  description: "GraphQL server exposes introspection without disabling it for production",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate34);
+  }
+});
+var PROMPT_VERSION35 = "1.0.0";
+var fallbackPatterns35 = [];
+async function buildPrompt35(sourceFiles) {
+  const parts = [
+    "Check if a GraphQL server enforces query depth or complexity limits.",
+    "Flag GraphQL server setups (Apollo Server, GraphQL Yoga, Mercurius, Strawberry, graphene) that configure no query depth or complexity protection \u2014 none of: graphql-depth-limit, depthLimit, graphql-cost-analysis, graphql-query-complexity, or custom validationRules that restrict query shape.",
+    "Without depth limiting, deeply nested queries cause exponential resolver work and can be used as a denial-of-service vector.",
+    "Emit one project-level finding pointing at the server setup file. Return [] if any depth, complexity, or cost validation plugin is wired into the server, or if no GraphQL server is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse35(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate35 = {
+  checkId: "security.graphql-no-depth-limit",
+  promptVersion: PROMPT_VERSION35,
+  projectScoped: true,
+  buildPrompt: buildPrompt35,
+  parseResponse: parseResponse35,
+  fallbackPatterns: fallbackPatterns35
+};
+registry.register({
+  id: "security.graphql-no-depth-limit",
+  name: "GraphQL no depth limit",
+  description: "GraphQL server has no query depth or complexity limiting",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate35);
+  }
+});
+var PROMPT_VERSION36 = "1.0.0";
+var fallbackPatterns36 = [
+  {
+    regex: /algorithm[s'"`]*\s*[=:]\s*['"`]none['"`]/i,
+    message: 'JWT algorithm set to "none" \u2014 token signatures are not verified',
+    severity: "high"
+  }
+];
+async function buildPrompt36(sourceFiles) {
+  const parts = [
+    "Check for insecure JWT algorithm configurations.",
+    'Flag any explicit use of algorithm "none" in JWT signing or verification (jsonwebtoken, jose, PyJWT, ruby-jwt, etc.).',
+    'Also flag jwt.verify() or jwt.decode() calls that do NOT pass an "algorithms" allowlist \u2014 without one, an attacker can forge tokens by switching to the "none" algorithm.',
+    "In Python PyJWT: flag jwt.decode() missing the algorithms=[...] parameter.",
+    'In Node.js jsonwebtoken: flag jwt.verify() without an algorithms option, or with algorithm/algorithms set to "none".',
+    "In jose: flag jwtVerify() without explicit algorithms.",
+    "Return [] if all verify/decode calls have an explicit non-empty algorithms allowlist."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse36(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate36 = {
+  checkId: "security.jwt-alg-none",
+  promptVersion: PROMPT_VERSION36,
+  buildPrompt: buildPrompt36,
+  parseResponse: parseResponse36,
+  fallbackPatterns: fallbackPatterns36
+};
+registry.register({
+  id: "security.jwt-alg-none",
+  name: "JWT algorithm none",
+  description: 'JWT verification allows the "none" algorithm or lacks an algorithms allowlist',
+  category: "security",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate36);
+  }
+});
+var PROMPT_VERSION37 = "1.0.1";
+var fallbackPatterns37 = [];
+async function buildPrompt37(sourceFiles) {
+  const parts = [
+    "Check for JWT tokens issued without an expiry claim.",
+    'Flag jwt.sign(payload, secret) calls (jsonwebtoken) that have no "expiresIn" in the options argument.',
+    "Flag new SignJWT(payload).sign(key) calls (jose) that do not chain .setExpirationTime(...).",
+    'Flag jwt.encode(payload, key) (PyJWT) where the payload dict has no "exp" key.',
+    "Tokens without expiry are valid indefinitely \u2014 a stolen token cannot be invalidated through expiry.",
+    'Do NOT flag if the payload object itself already contains an "exp" property set before the sign call.',
+    "Do NOT flag short-lived access tokens that have expiresIn set."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse37(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate37 = {
+  checkId: "security.jwt-no-expiry",
+  promptVersion: PROMPT_VERSION37,
+  buildPrompt: buildPrompt37,
+  parseResponse: parseResponse37,
+  fallbackPatterns: fallbackPatterns37
+};
+registry.register({
+  id: "security.jwt-no-expiry",
+  name: "JWT issued without expiry",
+  description: "JWT tokens are signed without an expiry claim, making them valid indefinitely",
+  category: "security",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate37);
+  }
+});
+var PROMPT_VERSION38 = "1.0.0";
+var fallbackPatterns38 = [
+  {
+    regex: /(?:localStorage|sessionStorage)\.setItem\s*\(\s*['"`][^'"`]*(?:refresh|refreshToken|refresh_token)[^'"`]*['"`]/i,
+    message: "Refresh token or long-lived credential stored in localStorage/sessionStorage",
+    severity: "high"
+  }
+];
+async function buildPrompt38(sourceFiles) {
+  const parts = [
+    "Check for refresh tokens or long-lived authentication credentials written to browser localStorage or sessionStorage.",
+    'Flag any code that calls localStorage.setItem() or sessionStorage.setItem() (or equivalent bracket notation assignments) with a key containing "refresh", "refreshToken", or "refresh_token".',
+    "Also flag storing full auth/session tokens intended for reuse across browser sessions in localStorage.",
+    "XSS attacks can read all localStorage values \u2014 refresh tokens should be in httpOnly cookies instead.",
+    "Short-lived access tokens held in JavaScript memory variables (not persisted to storage) are acceptable. Only flag explicit writes to localStorage/sessionStorage."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse38(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate38 = {
+  checkId: "security.refresh-token-in-localstorage",
+  promptVersion: PROMPT_VERSION38,
+  buildPrompt: buildPrompt38,
+  parseResponse: parseResponse38,
+  fallbackPatterns: fallbackPatterns38
+};
+registry.register({
+  id: "security.refresh-token-in-localstorage",
+  name: "Refresh token in localStorage",
+  description: "Refresh tokens or long-lived credentials stored in localStorage are vulnerable to XSS theft",
+  category: "security",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate38);
+  }
+});
+var PROMPT_VERSION39 = "1.0.0";
+var fallbackPatterns39 = [
+  {
+    regex: /^\s*USER\s+(?!root\b|0\b)/im,
+    message: "Dockerfile has no non-root USER directive \u2014 container runs as root",
+    severity: "medium",
+    absenceBased: true
+  }
+];
+async function buildPrompt39(sourceFiles) {
+  const parts = [
+    "Check Dockerfiles for containers running as root.",
+    "Flag Dockerfiles that have no USER instruction before the final CMD or ENTRYPOINT, or where the last USER directive sets root (USER root or USER 0).",
+    "A secure Dockerfile creates a non-privileged user and switches to it, e.g.: RUN adduser --disabled-password appuser followed by USER appuser.",
+    "Running containers as root means any process escape gains host root privileges.",
+    "Return [] if a non-root USER is set before CMD/ENTRYPOINT."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse39(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate39 = {
+  checkId: "ops.dockerfile-runs-as-root",
+  promptVersion: PROMPT_VERSION39,
+  buildPrompt: buildPrompt39,
+  parseResponse: parseResponse39,
+  fallbackPatterns: fallbackPatterns39
+};
+registry.register({
+  id: "ops.dockerfile-runs-as-root",
+  name: "Dockerfile runs as root",
+  description: "Container image has no non-root USER directive",
+  category: "ops",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate39);
+  }
+});
+var PROMPT_VERSION40 = "1.0.0";
+var fallbackPatterns40 = [
+  {
+    regex: /^\s*(?:ENV|ARG)\s+\S*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|CREDENTIAL|API_KEY|PRIVATE)\s*=\s*\S+/im,
+    message: "Dockerfile bakes a secret-shaped value into the image via ENV or ARG",
+    severity: "high"
+  }
+];
+async function buildPrompt40(sourceFiles) {
+  const parts = [
+    "Check Dockerfiles for secrets or credentials baked into image layers via ENV or ARG instructions.",
+    "Flag ENV or ARG directives where the variable name suggests a secret (*_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_PASS, *_CREDENTIAL, *_PRIVATE, DATABASE_URL, PRIVATE_KEY) and a literal non-placeholder value is assigned.",
+    'ENV values are baked into every image layer and visible via "docker inspect". ARG values are also stored in the build history.',
+    "Flag: ENV DATABASE_URL=postgres://user:password@host/db, ENV API_KEY=sk-abc123, ARG STRIPE_SECRET=sk_live_...",
+    "Do NOT flag: ENV PORT=3000, ENV NODE_ENV=production, ARG BUILD_DATE, or ENV DATABASE_URL= (empty assignment)."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse40(response, checkId) {
+  return parseLLMResponse(response, checkId, "high");
+}
+var promptTemplate40 = {
+  checkId: "ops.dockerfile-secrets-in-env",
+  promptVersion: PROMPT_VERSION40,
+  buildPrompt: buildPrompt40,
+  parseResponse: parseResponse40,
+  fallbackPatterns: fallbackPatterns40
+};
+registry.register({
+  id: "ops.dockerfile-secrets-in-env",
+  name: "Secrets in Dockerfile ENV",
+  description: "Dockerfile bakes secrets into image layers via ENV or ARG instructions",
+  category: "ops",
+  severity: "high",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate40);
+  }
+});
+var PROMPT_VERSION41 = "1.0.0";
+var fallbackPatterns41 = [
+  {
+    regex: /^\s*HEALTHCHECK\b/im,
+    message: "Dockerfile has no HEALTHCHECK instruction \u2014 container orchestrators cannot detect unhealthy state",
+    severity: "low",
+    absenceBased: true
+  }
+];
+async function buildPrompt41(sourceFiles) {
+  const parts = [
+    "Check if a Dockerfile includes a HEALTHCHECK instruction.",
+    "Without HEALTHCHECK, Docker and container orchestrators like Kubernetes cannot detect an unhealthy container and will continue routing traffic to it.",
+    "Flag Dockerfiles that have no HEALTHCHECK instruction at all.",
+    "A minimal HEALTHCHECK example: HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:8080/health || exit 1",
+    "Return [] if a HEALTHCHECK instruction is present."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse41(response, checkId) {
+  return parseLLMResponse(response, checkId, "low");
+}
+var promptTemplate41 = {
+  checkId: "ops.dockerfile-no-healthcheck",
+  promptVersion: PROMPT_VERSION41,
+  buildPrompt: buildPrompt41,
+  parseResponse: parseResponse41,
+  fallbackPatterns: fallbackPatterns41
+};
+registry.register({
+  id: "ops.dockerfile-no-healthcheck",
+  name: "Dockerfile missing HEALTHCHECK",
+  description: "Dockerfile has no HEALTHCHECK instruction \u2014 orchestrators cannot detect unhealthy containers",
+  category: "ops",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate41);
+  }
+});
+registry.register({
+  id: "ops.missing-dockerignore",
+  name: "Missing .dockerignore",
+  description: "Dockerfile present without a .dockerignore \u2014 build context may leak sensitive files",
+  category: "ops",
+  severity: "low",
+  minTier: "pro",
+  async run(ctx) {
+    const dockerfile = ctx.files.find((f) => f.language === "dockerfile");
+    if (!dockerfile) return [];
+    const hasDockerignore = ctx.files.some((f) => /(?:^|[\\/])\.dockerignore$/.test(f.relativePath));
+    if (hasDockerignore) return [];
+    let remediation;
+    try {
+      remediation = getCopy("remediation.ops.missing-dockerignore");
+    } catch {
+    }
+    return [
+      {
+        id: "ops.missing-dockerignore-1",
+        checkId: "ops.missing-dockerignore",
+        category: "ops",
+        severity: "low",
+        message: "Dockerfile exists but no .dockerignore found \u2014 sensitive files (node_modules, .env, secrets) may be included in the build context",
+        file: dockerfile.relativePath,
+        line: 1,
+        remediation
+      }
+    ];
+  }
+});
+var PROMPT_VERSION42 = "1.0.0";
+var fallbackPatterns42 = [];
+async function buildPrompt42(sourceFiles) {
+  const parts = [
+    "Check for N+1 query patterns where ORM results are iterated and a new database query is issued per row.",
+    "In Prisma (TypeScript): flag findMany() or findFirst() results iterated with for...of or forEach where a separate findUnique/findFirst/findMany is called inside the loop body.",
+    "In Sequelize (Node.js): flag findAll() results where model.find() or association.get() is called per element inside a loop.",
+    "In TypeORM: flag find()/findBy() results with repository calls inside the iteration.",
+    "In SQLAlchemy (Python): flag query.all() or session.scalars() results where session.get() or a new query is executed per row.",
+    "In Active Record (Ruby): flag .all or .where results iterated with .each where an association is accessed without eager loading (use .includes instead).",
+    "Flag only clear, direct N+1 patterns \u2014 a loop body that calls a query on each iteration. Do not flag loops that process already-loaded data."
+  ];
+  for (const file of sourceFiles) {
+    const content = await file.content();
+    parts.push(`--- ${file.relativePath} ---
+${content.slice(0, 3e3)}`);
+  }
+  return parts.join("\n\n");
+}
+function parseResponse42(response, checkId) {
+  return parseLLMResponse(response, checkId, "medium");
+}
+var promptTemplate42 = {
+  checkId: "resilience.orm-n-plus-one",
+  promptVersion: PROMPT_VERSION42,
+  buildPrompt: buildPrompt42,
+  parseResponse: parseResponse42,
+  fallbackPatterns: fallbackPatterns42
+};
+registry.register({
+  id: "resilience.orm-n-plus-one",
+  name: "ORM N+1 query pattern",
+  description: "ORM results are iterated with a per-row database query instead of a batch load",
+  category: "resilience",
+  severity: "medium",
+  minTier: "pro",
+  async run(ctx) {
+    return runLLMCheck(ctx, promptTemplate42);
+  }
+});
 var LANGUAGE_CODES = [
   "javascript",
   "typescript",
@@ -15151,7 +15848,7 @@ var copy3 = {
   "cli.setup.apiKeyPrompt": "API key for",
   "cli.setup.modelPrompt": "Model (press Enter for default)",
   "cli.setup.baseUrlPrompt": "Custom API base URL (press Enter to use default)",
-  "cli.setup.done": "Config saved. Run `seaworthy .` to scan your project.",
+  "cli.setup.done": "Config saved. Run `npx seaworthycode .` to scan your project.",
   "cli.setup.skipped": "Setup skipped. Running free-tier scan.",
   "cli.firstRun": "First time? Let's get you set up.",
   "cli.category.security": "Security",
@@ -15177,7 +15874,19 @@ var copy3 = {
   "cli.error.config.unknownKey": "Unknown config key. Valid keys: licenseKey, llmProvider, llmApiKey, llmModel, llmApiUrl",
   "cli.error.config.invalidProvider": "Invalid provider. Valid providers: anthropic, openai, kimi, moonshot, deepseek, gemini, ollama, openrouter",
   "cli.error.config.invalidAction": "Invalid config action. Usage: seaworthy config <set|get|list>",
-  "cli.config.setSuccess": (key) => `${key} updated.`
+  "cli.config.setSuccess": (key) => `${key} updated.`,
+  "cli.licenseNotice": (licensedTo) => `Licensed to ${licensedTo}`,
+  "cli.error.debugHint": (logPath) => `Re-run with --debug to write a diagnostic log: ${logPath}
+Report persistent issues: npx seaworthycode bugreport`,
+  "cli.bugreport.intro": "Seaworthy Bug Report \u2014 send an anonymized diagnostic to the Seaworthy team.",
+  "cli.bugreport.noLog": (logFile) => `No diagnostic log found at ${logFile}.
+Re-run the failing command with --debug first, then run bugreport again.`,
+  "cli.bugreport.preview": "The following diagnostic data will be sent (home directory paths have been anonymized):",
+  "cli.bugreport.confirm": "Send this report to the Seaworthy team?",
+  "cli.bugreport.cancelled": "Cancelled \u2014 no data was sent.",
+  "cli.bugreport.sent": (eventId) => `Report sent. Reference ID: ${eventId}
+Mention this ID when contacting support at ${SITE_URL}/support`,
+  "cli.bugreport.failed": "Could not reach the error reporting service. Check your connection and try again."
 };
 function getCopy2(key, ...args) {
   const value = copy3[key];
@@ -15202,7 +15911,7 @@ function createCommand(definition, options) {
         return {
           ok: false,
           code: "errors.unexpected",
-          detail: err instanceof Error ? err.message : String(err)
+          detail: err instanceof Error ? err.stack ?? err.message : String(err)
         };
       }
     }
@@ -15264,6 +15973,11 @@ async function executeScan(args, ctx) {
   }
   const showProgress = args.format === "terminal" && !args.sarifStdout;
   if (showProgress) {
+    if (ctx.tier === "free") {
+      const skippedCount = registry.getSkippedChecks("free").length;
+      process.stderr.write(getCopy("report.preScanNotice", skippedCount) + "\n");
+      process.stderr.write(getCopy2("cli.licenseNotice", ctx.licensedTo ?? "free tier") + "\n");
+    }
     process.stderr.write(getCopy("report.scanProgress.starting", args.targetDir) + "\n");
   }
   const runner = new ScanRunner();
@@ -15518,6 +16232,8 @@ async function checkUpdate() {
 }
 
 // src/cli-action.ts
+var _require = createRequire2(import.meta.url);
+var { version: CLI_VERSION } = _require("../package.json");
 function getConfigFile2() {
   return join15(process.env.SEAWORTHY_CONFIG_DIR ?? join15(homedir3(), ".seaworthy"), "config");
 }
@@ -15594,7 +16310,7 @@ async function runCli(options) {
     await setupCommand.handler({ action: "run" }, { tier: "free", licensedTo: "free tier" });
   }
   const provider = new FsCredentialProvider();
-  const license = new LicenseClient({ baseUrl: LICENSE_SERVER_URL });
+  const license = new LicenseClient({ baseUrl: LICENSE_SERVER_URL, userAgent: `seaworthycode/${CLI_VERSION}` });
   const authResult = await resolveAuth(provider, license);
   if (!authResult.ok) {
     const normalized = authResult.code.replace(/^errors\./, "");
@@ -15647,7 +16363,21 @@ async function runCli(options) {
     return { code: resolveExitCode("scan.failed"), error: message };
   }
   if (!result.ok) {
-    const message = resolveErrorMessage(result.code);
+    let message = resolveErrorMessage(result.code);
+    if (result.code === "errors.unexpected") {
+      const logFile = join15(LOG_DIR, "seaworthy.log");
+      message += "\n" + getCopy2("cli.error.debugHint", logFile);
+      if (options.debug && result.detail) {
+        try {
+          await mkdir(LOG_DIR, { recursive: true });
+          await appendFile(logFile, `[${(/* @__PURE__ */ new Date()).toISOString()}] unexpected error
+${result.detail}
+
+`);
+        } catch {
+        }
+      }
+    }
     return { code: resolveExitCode(result.code), error: message };
   }
   const remaining = Math.max(0, 3e3 - (Date.now() - updateStart));
@@ -15712,13 +16442,89 @@ var configCommand = createCommand(
   { requireLicense: false }
 );
 
+// src/commands/bugreport.ts
+import { readFile as readFile2 } from "fs/promises";
+import { randomUUID } from "crypto";
+import { platform, arch, homedir as homedir4 } from "os";
+import { join as join16 } from "path";
+import { createRequire as createRequire3 } from "module";
+import { intro as intro2, outro as outro2, confirm, isCancel as isCancel2 } from "@clack/prompts";
+var _require2 = createRequire3(import.meta.url);
+var { version: CLI_VERSION2 } = _require2("../../package.json");
+var LOG_FILE = join16(LOG_DIR, "seaworthy.log");
+var SENTRY_PROJECT_ID = "4511394796666960";
+var SENTRY_INGEST = "https://o4508597942026240.ingest.de.sentry.io";
+var SENTRY_KEY = "3c8dc912769032c73a306cb571805658";
+function sanitize(text3) {
+  return text3.split(homedir4()).join("<home>");
+}
+async function sendReport(log) {
+  const eventId = randomUUID().replace(/-/g, "");
+  const payload = {
+    event_id: eventId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    platform: "node",
+    level: "error",
+    environment: "cli",
+    release: CLI_VERSION2,
+    message: log.split("\n")[0] ?? "Unexpected error",
+    extra: { log },
+    contexts: {
+      runtime: { name: "node", version: process.version },
+      os: { name: platform(), arch: arch() }
+    },
+    tags: { source: "cli-bugreport" }
+  };
+  try {
+    const res = await fetch(`${SENTRY_INGEST}/api/${SENTRY_PROJECT_ID}/store/`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Sentry-Auth": `Sentry sentry_version=7, sentry_key=${SENTRY_KEY}, sentry_client=seaworthycode/${CLI_VERSION2}`
+      },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(1e4)
+    });
+    return res.ok ? eventId : null;
+  } catch {
+    return null;
+  }
+}
+async function executeBugReport() {
+  intro2(getCopy2("cli.bugreport.intro"));
+  let log;
+  try {
+    const raw = await readFile2(LOG_FILE, "utf-8");
+    if (!raw.trim()) throw new Error("empty");
+    log = sanitize(raw.length > 8192 ? raw.slice(-8192) : raw);
+  } catch {
+    return { ok: true, output: getCopy2("cli.bugreport.noLog", LOG_FILE) };
+  }
+  process.stderr.write(getCopy2("cli.bugreport.preview") + "\n---\n" + log + "---\n\n");
+  const confirmed = await confirm({ message: getCopy2("cli.bugreport.confirm") });
+  if (isCancel2(confirmed) || !confirmed) {
+    outro2(getCopy2("cli.bugreport.cancelled"));
+    return { ok: true };
+  }
+  const eventId = await sendReport(log);
+  outro2(eventId ? getCopy2("cli.bugreport.sent", eventId) : getCopy2("cli.bugreport.failed"));
+  return { ok: true };
+}
+var bugReportCommand = createCommand(
+  {
+    name: "bugreport",
+    description: "Send an anonymized bug report to the Seaworthy team",
+    handler: async () => executeBugReport()
+  },
+  { requireLicense: false }
+);
+
 // src/index.ts
-loadEnv({ path: resolve4(process.cwd(), ".env") });
 var repoRootEnv = resolve4(dirname7(fileURLToPath3(import.meta.url)), "../../..", ".env");
 if (existsSync6(repoRootEnv)) {
   loadEnv({ path: repoRootEnv, override: false });
 }
-var require5 = createRequire2(import.meta.url);
+var require5 = createRequire4(import.meta.url);
 var { version } = require5("../package.json");
 var cli = cac("seaworthy");
 cli.version(version);
@@ -15758,6 +16564,16 @@ cli.command("setup", "Interactive setup for license key and LLM provider").actio
     process.exit(2);
   }
 });
+cli.command("bugreport", "Send an anonymized bug report to the Seaworthy team").action(async () => {
+  const result = await bugReportCommand.handler({ action: "run" }, { tier: "free", licensedTo: "free tier" });
+  if (!result.ok) {
+    console.error(resolveErrorMessage(result.code));
+    process.exit(2);
+  }
+  if (result.output) {
+    console.log(result.output);
+  }
+});
 cli.help(() => {
   return [
     {
@@ -15770,7 +16586,8 @@ cli.help(() => {
     },
     {
       title: "Commands",
-      body: `  npx seaworthycode setup    Interactive setup for license key and LLM provider`
+      body: `  npx seaworthycode setup        Interactive setup for license key and LLM provider
+  npx seaworthycode bugreport    Send an anonymized bug report to the Seaworthy team`
     },
     {
       title: "Options",