securevibe 0.1.0 → 0.1.2

package/dist/engine/detectors/classic.js

@@ -130,6 +130,87 @@ const codeExecution = (ctx) => {
     });
     return out;
 };
+/**
+ * Path traversal: untrusted input reaches a filesystem path sink. Taint-gated
+ * (a static path is never flagged) and skipped when the argument is visibly
+ * sanitized (path.basename / secure_filename).
+ */
+const FS_SINKS = new Set([
+    "readFile", "readFileSync", "writeFile", "writeFileSync", "appendFile",
+    "appendFileSync", "createReadStream", "createWriteStream", "unlink",
+    "unlinkSync", "rm", "rmSync", "readdir", "readdirSync", "sendFile",
+]);
+const PY_FS_CALLEES = /^(open|os\.remove|os\.unlink|os\.rmdir|send_file)$/;
+const PATH_SANITIZED = /\b(basename|secure_filename)\s*\(/;
+const pathTraversal = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        const last = calleeLastSegment(n) ?? "";
+        const isJsSink = ctx.file.lang !== "python" && FS_SINKS.has(last);
+        const isPySink = ctx.file.lang === "python" && PY_FS_CALLEES.test(callee);
+        if (!isJsSink && !isPySink)
+            return;
+        const argsNode = n.childForFieldName("arguments");
+        const firstArg = argsNode?.namedChild(0)?.text ?? "";
+        if (!firstArg || PATH_SANITIZED.test(firstArg))
+            return;
+        if (!isTainted(firstArg, ctx.taint) && !isUntrustedStringBuild(firstArg, ctx.taint))
+            return;
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "path-traversal",
+            title: "Path traversal: untrusted input reaches a filesystem path",
+            category: "classic",
+            severity: "high",
+            confidence: 0.85,
+            reachable: true,
+            cwe: "CWE-22",
+            owasp: "A01:2021 Broken Access Control",
+            why: "A request-controlled value is used as a filesystem path. With ../ sequences an attacker can read or write files outside the intended directory (source code, .env, credentials).",
+            fix: "Never pass user input into a path directly. Resolve against a fixed base directory and verify the result stays inside it, or map ids to filenames and use path.basename / secure_filename on any user-supplied segment.",
+            taint: ["request input", "→ file path", `→ ${callee}()`],
+        }));
+    });
+    return out;
+};
+/** Server-side request forgery: untrusted input becomes the URL of a server-side request. */
+const JS_HTTP_CALLEE = /^(fetch|axios(\.(get|post|put|patch|delete|head|request))?|got(\.(get|post|put|patch|delete|head))?|https?\.(get|request))$/;
+const PY_HTTP_CALLEE = /^(requests\.(get|post|put|patch|delete|head)|httpx\.(get|post|put|patch|delete|head)|urllib\.request\.urlopen|urlopen)$/;
+const ssrf = (ctx) => {
+    const out = [];
+    walk(ctx.root, (n) => {
+        if (!isCall(n))
+            return;
+        const callee = calleeText(n) ?? "";
+        const re = ctx.file.lang === "python" ? PY_HTTP_CALLEE : JS_HTTP_CALLEE;
+        if (!re.test(callee))
+            return;
+        const argsNode = n.childForFieldName("arguments");
+        const firstArg = argsNode?.namedChild(0)?.text ?? "";
+        if (!firstArg)
+            return;
+        if (!isTainted(firstArg, ctx.taint) && !isUntrustedStringBuild(firstArg, ctx.taint))
+            return;
+        out.push(mkFinding(ctx, {
+            node: n,
+            detector: "ssrf",
+            title: "SSRF: untrusted input controls a server-side request URL",
+            category: "classic",
+            severity: "high",
+            confidence: 0.75,
+            reachable: true,
+            cwe: "CWE-918",
+            owasp: "A10:2021 Server-Side Request Forgery",
+            why: "A request-controlled value is used as the URL of a server-side HTTP request. An attacker can make your server call internal services, cloud metadata endpoints, or arbitrary hosts.",
+            fix: "Validate the URL against an allowlist of hosts/schemes before requesting it. Never fetch a raw user-supplied URL; block private IP ranges and metadata endpoints.",
+            taint: ["request input", "→ URL", `→ ${callee}()`],
+        }));
+    });
+    return out;
+};
 /** Cross-site scripting (XSS). */
 const xss = (ctx) => {
     const out = [];
@@ -278,6 +359,8 @@ function lineNumberOf(code, re) {
 export const classicDetectors = [
     sqlInjection,
     codeExecution,
+    pathTraversal,
+    ssrf,
     xss,
     brokenAccessControl,
     insecureConfig,

package/dist/engine/readiness/scorecard.js

@@ -1,7 +1,7 @@
 const GATES = [
     { id: "secrets", label: "Secrets managed", detectors: ["hardcoded-secret"], crit: "blocker" },
     { id: "deps", label: "Dependencies current", detectors: ["vulnerable-dependency"], crit: "critical-only" },
-    { id: "injection", label: "Injection safe (SQLi/RCE)", detectors: ["sql-injection", "code-execution"], crit: "blocker" },
+    { id: "injection", label: "Injection safe (SQLi/RCE/SSRF)", detectors: ["sql-injection", "code-execution", "path-traversal", "ssrf"], crit: "blocker" },
     { id: "authz", label: "Access control", detectors: ["broken-access-control"], crit: "blocker" },
     { id: "ai", label: "AI agent safety", detectors: ["ai-tool-hijack", "ai-missing-firewall", "ai-prompt-injection", "ai-overprivileged-tool"], crit: "high-blocks" },
     { id: "transport", label: "Transport config (CORS/JWT)", detectors: ["cors-misconfig", "weak-jwt"], crit: "warning" },

package/dist/engine/scan.js

@@ -98,6 +98,7 @@ export async function scan(root, options = {}) {
     const readinessFindings = [];
     let headersSeen = false;
     let headerAnchor;
+    let firstFile;
     progress(`Analyzing ${files.length} files…`);
     for (const abs of files) {
         const rel = path.relative(absRoot, abs).split(path.sep).join("/");
@@ -115,6 +116,8 @@ export async function scan(root, options = {}) {
             parsedCount++;
         findings.push(...(await detectFile(rel, code, { aiOnly: options.aiOnly, depDb })));
         if (fullScan) {
+            if (!firstFile)
+                firstFile = rel;
             readinessFindings.push(...checkDebugExposure(rel, code));
             if (!headersSeen && fileHasSecurityHeader(code))
                 headersSeen = true;
@@ -124,7 +127,10 @@ export async function scan(root, options = {}) {
     }
     progress("Scoring…");
     if (fullScan && isWebApp(inventory) && !(headersSeen || inventory.dependencies.includes("helmet"))) {
-        readinessFindings.push(...checkSecurityHeaders(headerAnchor ?? "package.json"));
+        // Anchor to a real config file when we found one; otherwise to any file we
+        // actually scanned (so `fix` can read it) rather than a name that may not
+        // exist in this project (e.g. package.json in a Python-only repo).
+        readinessFindings.push(...checkSecurityHeaders(headerAnchor ?? firstFile ?? "package.json"));
     }
     findings.push(...readinessFindings);
     const deduped = dedupe(findings);

package/dist/index.js

@@ -10,11 +10,12 @@
 import { Command } from "commander";
 import { scan } from "./engine/scan.js";
 import { toJson, toSarif } from "./ui/emit.js";
+import { VERSION } from "./version.js";
 const program = new Command();
 program
     .name("securevibe")
     .description("Autonomous AI security engineer for AI-generated applications")
-    .version("0.1.0");
+    .version(VERSION);
 function addCommon(cmd) {
     return cmd
         .option("--json", "output machine-readable JSON")
@@ -26,22 +27,25 @@ function addCommon(cmd) {
 /**
  * Free beta metering: one use per analysis command against the daily quota.
  * The --staged commit guard is exempt — a quota must never block a commit.
+ * Returns the usage state so callers can show it, or undefined when this run
+ * wasn't metered (--staged).
  */
 async function meter(opts = {}) {
     if (opts.staged)
-        return;
+        return undefined;
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
         process.stderr.write(limitMessage() + "\n");
         process.exit(1);
     }
+    return r;
 }
 /** Run a scan with stderr progress; honour --json/--sarif/--no-color. */
 async function runScan(pathArg, opts, scanOpts = {}) {
     if (opts.color === false)
         process.env.NO_COLOR = "1";
-    await meter(opts);
+    const usage = await meter(opts);
     const target = pathArg ?? ".";
     const quiet = opts.json || opts.sarif;
     // --staged: analyze only what's about to be committed (the pre-commit guard).
@@ -62,7 +66,7 @@ async function runScan(pathArg, opts, scanOpts = {}) {
         ...scanOpts,
         onProgress: quiet ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
     });
-    return result;
+    return { result, usage };
 }
 /** Emit machine output if requested; returns true if it handled output. */
 function emitMachine(result, opts) {
@@ -76,6 +80,18 @@ function emitMachine(result, opts) {
     }
     return false;
 }
+/**
+ * Best-effort "a newer version exists" nudge on human-readable output only.
+ * Cached for a day, never blocks, never throws — see update-check.ts.
+ */
+async function maybeNotifyUpdate(opts) {
+    if (opts.json || opts.sarif || opts.staged)
+        return;
+    const { checkForUpdate, updateNotice } = await import("./update-check.js");
+    const latest = await checkForUpdate(VERSION);
+    if (latest)
+        process.stderr.write("\n" + updateNotice(VERSION, latest) + "\n");
+}
 /** Exit code policy for CI gating (doc 08/12). */
 function ciExit(result, opts) {
     if (!opts.ci)
@@ -87,24 +103,16 @@ function ciExit(result, opts) {
         process.exit(1);
     process.exit(0);
 }
-/** After a human-readable scan, nudge toward `fix` if anything is blocking. */
-function fixHint(result, opts) {
-    if (opts.json || opts.sarif)
-        return;
-    if (result.score.readiness === "ship")
-        return;
-    process.stdout.write(`  → run \`securevibe fix\` to auto-harden the blocking issues (dry run by default)\n\n`);
-}
 addCommon(program
     .command("scan", { isDefault: true })
     .description("Scan a repository for vulnerabilities and AI-agent risks")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderReport } = await import("./ui/report.js");
-        process.stdout.write(renderReport(result) + "\n");
-        fixHint(result, opts);
+        process.stdout.write(renderReport(result, { usage }) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 program
@@ -151,71 +159,78 @@ program
     if (decision.notice) {
         process.stderr.write("  Not applied: no interactive terminal. Re-run with --yes to apply non-interactively.\n");
     }
+    await maybeNotifyUpdate({ json: opts.json });
 });
 addCommon(program
     .command("ai-audit")
     .description("Focus on the AI-application / agent attack surface (doc 04)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts, { aiOnly: true });
+    const { result, usage } = await runScan(pathArg, opts, { aiOnly: true });
     if (!emitMachine(result, opts)) {
         const { renderReport } = await import("./ui/report.js");
-        process.stdout.write(renderReport(result, { aiFocus: true }) + "\n");
+        process.stdout.write(renderReport(result, { aiFocus: true, usage }) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("protect")
     .description("Remediation-first view: the fixes for every finding")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderRemediations } = await import("./ui/protect.js");
-        process.stdout.write(renderRemediations(result) + "\n");
+        process.stdout.write(renderRemediations(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("attack-map")
     .description("Show exploit paths from reachable findings (doc 06)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderAttackMap } = await import("./ui/attackmap.js");
-        process.stdout.write(renderAttackMap(result) + "\n");
+        process.stdout.write(renderAttackMap(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("score")
     .description("Print the security score and deployment-readiness verdict")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderScoreOnly } = await import("./ui/protect.js");
-        process.stdout.write(renderScoreOnly(result) + "\n");
+        process.stdout.write(renderScoreOnly(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("deps")
     .description("Audit dependencies for known CVEs (SCA, offline against the local OSV db)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderDeps } = await import("./ui/deps.js");
-        process.stdout.write(renderDeps(result) + "\n");
+        process.stdout.write(renderDeps(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("ready")
     .description("Launch-readiness scorecard: pass/fail gates + a go/no-go verdict")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const result = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderScorecard } = await import("./ui/readiness.js");
-        process.stdout.write(renderScorecard(result) + "\n");
+        process.stdout.write(renderScorecard(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 program

package/dist/ui/attackmap.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 function impactOf(f) {
     switch (f.detector) {
         case "sql-injection":
@@ -26,10 +27,14 @@ function impactOf(f) {
             return "compromise of " + f.file;
     }
 }
-export function renderAttackMap(result) {
+export function renderAttackMap(result, usage) {
     const lines = [];
     lines.push(renderBanner({ subtitle: "attack map · exploit paths" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     const chains = result.findings.filter((f) => f.reachable && (f.severity === "critical" || f.severity === "high"));
     if (chains.length === 0) {
         lines.push(pc.green("  ✓ No reachable critical/high exploit paths found."));

package/dist/ui/deps.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_COLOR = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
     high: (s) => pc.red(pc.bold(s)),
@@ -25,12 +26,16 @@ export function dependencyLine(result) {
         .map((s) => `${d.bySeverity[s]} ${s}`);
     return `${d.total} known ${d.total === 1 ? "CVE" : "CVEs"} (${parts.join(", ")}) · ${date}`;
 }
-export function renderDeps(result) {
+export function renderDeps(result, usage) {
     const lines = [];
     const deps = result.findings.filter((f) => f.detector === "vulnerable-dependency");
     lines.push(renderBanner({ subtitle: "dependency audit (SCA)" }));
     lines.push(pc.dim(`  ${result.root}`));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     lines.push("  " + (deps.length === 0 ? pc.green("✓ ") : "") + dependencyLine(result));
     lines.push("");
     for (const f of deps)

package/dist/ui/protect.js

@@ -4,6 +4,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_COLOR = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
     high: (s) => pc.red(pc.bold(s)),
@@ -21,10 +22,14 @@ function readinessLine(r) {
             return pc.red(pc.bold("✗ BLOCK DEPLOY — fix blocking issues first"));
     }
 }
-export function renderRemediations(result) {
+export function renderRemediations(result, usage) {
     const lines = [];
     lines.push(renderBanner({ subtitle: "remediation plan" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     if (result.findings.length === 0) {
         lines.push(pc.green("  ✓ Nothing to remediate."));
         lines.push("");
@@ -53,12 +58,16 @@ export function renderRemediations(result) {
     lines.push("");
     return lines.join("\n");
 }
-export function renderScoreOnly(result) {
+export function renderScoreOnly(result, usage) {
     const s = result.score;
     const gc = s.grade === "A" || s.grade === "B" ? pc.green : s.grade === "C" ? pc.yellow : pc.red;
     const lines = [];
     lines.push(renderBanner({ subtitle: "security score" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     lines.push(`  ${gc(pc.bold(`  ${s.grade}  `))}  ${pc.bold(`${s.composite}/100`)}   ${readinessLine(s.readiness)}`);
     lines.push("");
     lines.push(`  app ${s.subScores.appSecurity}  ·  ${pc.magenta(`ai ${s.subScores.aiSecurity}`)}  ·  secrets ${s.subScores.dependencies}  ·  deploy ${s.subScores.deployment}`);

package/dist/ui/readiness.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 function verdictBadge(lr) {
     if (lr.verdict === "ready")
         return pc.bgGreen(pc.black(pc.bold(" LAUNCH READY ")));
@@ -26,12 +27,16 @@ function gateLine(g) {
                 : pc.yellow(g.detail);
     return `${sym} ${label} ${detail}`;
 }
-export function renderScorecard(result) {
+export function renderScorecard(result, usage) {
     const lr = result.launchReadiness;
     const L = [];
     L.push(renderBanner({ subtitle: "launch readiness" }));
     L.push(pc.dim(`  ${result.root}`));
     L.push("");
+    if (usage) {
+        L.push(renderUsageLine(usage));
+        L.push("");
+    }
     if (!lr) {
         L.push("  Launch readiness is only evaluated on a full scan.");
         L.push("");

package/dist/ui/report.js

@@ -7,6 +7,7 @@ import pc from "picocolors";
 import { dependencyLine } from "./deps.js";
 import { renderBanner } from "./banner.js";
 import { readinessSummaryLine } from "./readiness.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_LABEL = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
     high: (s) => pc.red(pc.bold(s)),
@@ -67,6 +68,10 @@ export function renderReport(result, opts = {}) {
     lines.push(renderBanner({ subtitle: opts.aiFocus ? "AI application security audit" : "security scan" }));
     lines.push(pc.dim(`  ${result.root}`));
     lines.push("");
+    if (opts.usage) {
+        lines.push(renderUsageLine(opts.usage));
+        lines.push("");
+    }
     // Inventory
     const inv = [
         inventory.languages.length ? `langs: ${inventory.languages.join(", ")}` : "",
@@ -134,8 +139,10 @@ export function renderReport(result, opts = {}) {
     }
     // Footer / next steps
     lines.push(pc.dim("  ─────────────────────────────────────────────────"));
-    lines.push("  " + pc.bold("Next:") + pc.dim(" every finding above carries a fix. ") + "Run " + pc.cyan("securevibe protect") + pc.dim(" to review remediations,"));
-    lines.push("  " + pc.dim("or ") + pc.cyan("securevibe ai-audit") + pc.dim(" to focus on the AI-agent attack surface."));
+    lines.push("  " + pc.bold("Next steps"));
+    lines.push("  " + pc.dim("1.") + " " + pc.cyan("securevibe fix --apply") + pc.dim(" — fix what's mechanical (asks before each change)"));
+    lines.push("  " + pc.dim("2.") + " " + pc.cyan("securevibe ready") + pc.dim("     — see what still blocks launch"));
+    lines.push("  " + pc.dim("3.") + " " + pc.cyan("securevibe init") + pc.dim("      — install the commit/CI gate so this doesn't regress"));
     lines.push("");
     return lines.join("\n");
 }

package/dist/ui/usage.js

@@ -0,0 +1,12 @@
+// packages/cli/src/ui/usage.ts
+/** One-line free-beta daily usage bar, shown at the top of scan-style reports. */
+import pc from "picocolors";
+function bar(fraction, width = 20) {
+    const filled = Math.round(Math.min(1, Math.max(0, fraction)) * width);
+    const color = fraction >= 0.9 ? pc.red : fraction >= 0.7 ? pc.yellow : pc.cyan;
+    return color("█".repeat(filled)) + pc.dim("░".repeat(width - filled));
+}
+export function renderUsageLine(usage) {
+    const fraction = usage.limit > 0 ? usage.used / usage.limit : 0;
+    return pc.dim("  Free beta usage today  ") + bar(fraction) + pc.dim(`  ${usage.used}/${usage.limit}`);
+}

package/dist/update-check.js

@@ -0,0 +1,101 @@
+/**
+ * Best-effort "a newer version is published" notice. There is no auto-update —
+ * users install a CLI globally and nothing tells them it went stale. This
+ * checks the npm registry at most once a day (cached in ~/.securevibe), never
+ * throws, and never slows a command down on a broken network (short timeout,
+ * fire-and-forget failure).
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const REGISTRY_URL = "https://registry.npmjs.org/securevibe/latest";
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1500;
+export function cacheFilePath() {
+    return path.join(os.homedir(), ".securevibe", "update-check.json");
+}
+/** Simple major.minor.patch compare; true if `latest` is strictly newer than `current`. */
+export function isNewer(current, latest) {
+    const a = current.split(".").map((n) => parseInt(n, 10) || 0);
+    const b = latest.split(".").map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        const ai = a[i] ?? 0;
+        const bi = b[i] ?? 0;
+        if (bi > ai)
+            return true;
+        if (bi < ai)
+            return false;
+    }
+    return false;
+}
+async function readCache(file) {
+    try {
+        const raw = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof raw?.checkedAt === "number" && typeof raw?.latest === "string")
+            return raw;
+    }
+    catch {
+        /* missing or corrupt → treated as no cache */
+    }
+    return null;
+}
+async function writeCache(file, state) {
+    try {
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");
+    }
+    catch {
+        /* best effort — a failed write must never break the command */
+    }
+}
+async function fetchLatest(fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetchImpl(REGISTRY_URL, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        return typeof json?.version === "string" ? json.version : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Returns the newer published version if one exists, else null. Never
+ * throws — offline, a down registry, or a corrupt cache all resolve to null
+ * rather than interrupting the command.
+ */
+export async function checkForUpdate(currentVersion, opts = {}) {
+    const file = opts.file ?? cacheFilePath();
+    const now = opts.now ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    try {
+        const cached = await readCache(file);
+        let latest = null;
+        if (cached && now - cached.checkedAt < CACHE_TTL_MS) {
+            latest = cached.latest;
+        }
+        else {
+            latest = await fetchLatest(fetchImpl);
+            if (latest)
+                await writeCache(file, { checkedAt: now, latest });
+            else if (cached)
+                latest = cached.latest;
+        }
+        return latest && isNewer(currentVersion, latest) ? latest : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function updateNotice(currentVersion, latestVersion) {
+    return [
+        `  A new version of securevibe is available: ${latestVersion} (you have ${currentVersion}).`,
+        "  Update: npm install -g securevibe",
+    ].join("\n");
+}

package/dist/version.js

@@ -0,0 +1,5 @@
+// packages/cli/src/version.ts
+// Single source of truth for the CLI's own version, so it can't drift from
+// what commander reports and what the update-check compares against.
+// Kept in sync with the "version" field in package.json by hand at release time.
+export const VERSION = "0.1.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securevibe",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",