secure-repo 1.0.8 → 1.1.0

package/bin/cli.js

@@ -10,7 +10,8 @@ const FREE_DIR = path.join(TEMPLATES_DIR, "free");
 
 const POLAR_ORGANIZATION_ID = "d55baa70-3a94-4549-901a-2b4c920ff122";
 
-const PRO_ZIP_URL = "https://github.com/sebiomoa/shipsecure/releases/latest/download/shipsecure-pro.zip";
+// Pro download endpoint (server-side proxy — token never ships in client code)
+const PRO_DOWNLOAD_URL = "https://shipsecure.app/api/download-pro";
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -173,37 +174,40 @@ function verifyLicense(licenseKey) {
 }
 
 // ============================================================
-// Download file from URL
+// Download pro zip via server-side proxy
 // ============================================================
-function downloadFile(url, destPath) {
+function downloadProZip(destPath, licenseKey) {
   return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(destPath);
-
-    function follow(url) {
-      https.get(url, (res) => {
-        // Follow redirects
-        if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-          follow(res.headers.location);
-          return;
-        }
-
-        if (res.statusCode !== 200) {
-          reject(new Error(`Download failed (HTTP ${res.statusCode})`));
-          return;
-        }
+    const parsed = new URL(PRO_DOWNLOAD_URL);
+    const postData = JSON.stringify({ license_key: licenseKey });
+    const opts = {
+      hostname: parsed.hostname,
+      path: parsed.pathname,
+      method: "POST",
+      headers: {
+        "User-Agent": "secure-repo-cli",
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(postData),
+      },
+    };
 
-        res.pipe(file);
-        file.on("finish", () => {
-          file.close();
-          resolve();
+    const req = https.request(opts, (res) => {
+      if (res.statusCode !== 200) {
+        let body = "";
+        res.on("data", (chunk) => (body += chunk));
+        res.on("end", () => {
+          reject(new Error(`Download failed (HTTP ${res.statusCode}): ${body}`));
         });
-      }).on("error", (err) => {
-        fs.unlink(destPath, () => {});
-        reject(new Error(`Download error: ${err.message}`));
-      });
-    }
+        return;
+      }
+      const file = fs.createWriteStream(destPath);
+      res.pipe(file);
+      file.on("finish", () => { file.close(); resolve(); });
+    });
 
-    follow(url);
+    req.on("error", (err) => reject(new Error(`Network error: ${err.message}`)));
+    req.write(postData);
+    req.end();
   });
 }
 
@@ -269,6 +273,87 @@ function installFromZip(zipPath, outputDir, force) {
   }
 }
 
+// ============================================================
+// Agent instruction files — tell AI agents to read policy files
+// ============================================================
+const AGENT_INSTRUCTION = `# Security Policies — MUST READ
+
+This project uses ShipSecure security policies. Before writing or modifying code, you MUST read and follow every policy file that exists in this repository.
+
+## Policy Files
+
+Read each of these files if they exist before making changes:
+
+### Core
+- SECURITY.md — Secrets management, attack surface, enforced architecture
+- AUTH.md — Token handling, session rules, password policy, roles
+- API.md — Input validation, rate limiting, error handling
+
+### Extended
+- DATABASE.md — Query safety, access control, migrations
+- ENV_VARIABLES.md — Environment variable handling, secret rotation
+- DEPLOYMENT.md — Deploy pipeline, environment isolation
+- INCIDENT_RESPONSE.md — Breach response, escalation procedures
+- ACCESS_CONTROL.md — Role-based access, permission boundaries
+- DATA_PRIVACY.md — PII handling, data retention, GDPR compliance
+- PAYMENTS.md — Payment processing, PCI compliance
+- FILE_UPLOADS.md — Upload validation, storage security
+- RATE_LIMITING.md — Throttling, abuse prevention
+- THIRD_PARTY.md — Dependency security, vendor risk
+- LOGGING_PII.md — Log sanitization, PII redaction
+- TESTING.md — Security test requirements
+- OBSERVABILITY.md — Monitoring, alerting, audit trails
+- THREAT_MODEL.md — Known threats and mitigations
+- PR_CHECKLIST.md — Pre-merge security checklist
+- CONTRIBUTING_SECURITY.md — Security contribution guidelines
+- VULNERABILITY_REPORTING.md — Responsible disclosure process
+- POLICY_INDEX.md — Index of all policies
+- FULL_AUDIT_CHECKLIST.md — 100+ point security audit checklist
+
+### Stack Presets
+- supabase-preset/ — Supabase-specific security rules (if present)
+- firebase-preset/ — Firebase-specific security rules (if present)
+
+## Rules
+
+1. Always check policy files before writing code — if your task touches auth, APIs, database, payments, file uploads, or any area with a policy file, read that file first.
+2. Never violate a policy — if a policy says "never do X", do not do X. Flag it if unsure.
+3. Secrets are never hardcoded — no API keys, tokens, passwords, or credentials in source code.
+4. Validate all input — every endpoint, every form, every external data source.
+5. Follow the principle of least privilege — only request the permissions you need.
+`;
+
+function writeAgentFiles(outputDir, force) {
+  const agentFiles = [
+    { path: "CLAUDE.md", name: "Claude" },
+    { path: ".cursorrules", name: "Cursor" },
+    { path: ".github/copilot-instructions.md", name: "GitHub Copilot" },
+    { path: ".windsurfrules", name: "Windsurf" },
+    { path: ".clinerules", name: "Cline" },
+  ];
+
+  let written = 0;
+  let skipped = 0;
+
+  console.log("\n  Agent instructions:");
+  agentFiles.forEach(({ path: filePath, name }) => {
+    const fullPath = path.join(outputDir, filePath);
+    const dir = path.dirname(fullPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+    if (fs.existsSync(fullPath) && !force) {
+      console.log(`    [skip] ${filePath} (${name}) — use --force to overwrite`);
+      skipped++;
+    } else {
+      fs.writeFileSync(fullPath, AGENT_INSTRUCTION);
+      console.log(`    [done] ${filePath} (${name})`);
+      written++;
+    }
+  });
+
+  return { written, skipped };
+}
+
 // ============================================================
 // INIT — install templates (free, or free + pro with --key)
 // ============================================================
@@ -300,11 +385,14 @@ async function init() {
     console.log("\n  Downloading pro templates...");
 
     try {
-      await downloadFile(PRO_ZIP_URL, zipPath);
+      await downloadProZip(zipPath, licenseKey);
       const proResult = installFromZip(zipPath, outputDir, force);
 
-      const totalCopied = freeResult.copied + proResult.copied;
-      const totalSkipped = freeResult.skipped + proResult.skipped;
+      // Write agent instruction files
+      const agentResult = writeAgentFiles(outputDir, force);
+
+      const totalCopied = freeResult.copied + proResult.copied + agentResult.written;
+      const totalSkipped = freeResult.skipped + proResult.skipped + agentResult.skipped;
 
       console.log(`\n  Done! ${totalCopied} files installed, ${totalSkipped} skipped.`);
       console.log("\n  Next steps:");
@@ -326,7 +414,13 @@ async function init() {
     console.log("  Free templates:");
     const result = copyFiles(FREE_DIR, outputDir, force);
 
-    console.log(`\n  Done! ${result.copied} files added, ${result.skipped} skipped.`);
+    // Write agent instruction files
+    const agentResult = writeAgentFiles(outputDir, force);
+
+    const totalCopied = result.copied + agentResult.written;
+    const totalSkipped = result.skipped + agentResult.skipped;
+
+    console.log(`\n  Done! ${totalCopied} files added, ${totalSkipped} skipped.`);
     console.log("\n  Next steps:");
     console.log("    1. Customize the templates for your project");
     console.log("    2. Run: npx secure-repo audit");
@@ -370,9 +464,10 @@ function importPack() {
 
   try {
     const proResult = installFromZip(resolvedPath, outputDir, force);
+    const agentResult = writeAgentFiles(outputDir, force);
 
-    const totalCopied = freeResult.copied + proResult.copied;
-    const totalSkipped = freeResult.skipped + proResult.skipped;
+    const totalCopied = freeResult.copied + proResult.copied + agentResult.written;
+    const totalSkipped = freeResult.skipped + proResult.skipped + agentResult.skipped;
 
     console.log(`\n  Done! ${totalCopied} files imported, ${totalSkipped} skipped.\n`);
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-repo",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "Drop production-grade security standards into any repo. Audit your repo for security issues. Templates for AI-assisted development.",
   "bin": {
     "secure-repo": "./bin/cli.js"