securevibe 0.1.0

package/dist/ui/fix.js

@@ -0,0 +1,188 @@
+/**
+ * `fix` view (doc 05). Shows the before→after score, a colored unified diff for
+ * every accepted rewrite, and an honest breakdown of what was auto-fixed vs.
+ * what needs human review. The copy is deliberately precise: we never claim the
+ * app is "secure" — only that our detector no longer flags the issue.
+ */
+import pc from "picocolors";
+import { structuredPatch } from "diff";
+import { renderBanner } from "./banner.js";
+const SEV_TAG = {
+    critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
+    high: (s) => pc.red(pc.bold(s)),
+    medium: (s) => pc.yellow(s),
+    low: (s) => pc.blue(s),
+    info: (s) => pc.dim(s),
+};
+function gradeColor(grade) {
+    if (grade === "A" || grade === "B")
+        return pc.green;
+    if (grade === "C")
+        return pc.yellow;
+    return pc.red;
+}
+function readinessLabel(r) {
+    if (r === "ship")
+        return pc.green(pc.bold("SHIP"));
+    if (r === "warn")
+        return pc.yellow(pc.bold("WARN"));
+    return pc.red(pc.bold("BLOCK"));
+}
+function scoreBadge(s) {
+    return `${gradeColor(s.grade)(pc.bold(` ${s.grade} `))} ${s.composite}/100 ${readinessLabel(s.readiness)}`;
+}
+export function renderFixSession(result) {
+    const L = [];
+    L.push(renderBanner({ subtitle: result.apply ? "fix · applying" : "fix · dry run (no files changed)" }));
+    L.push("");
+    // Score transition.
+    L.push("  " + scoreBadge(result.scoreBefore) + pc.dim("  →  ") + scoreBadge(result.scoreAfter));
+    L.push("");
+    const fixed = result.outcomes.filter((o) => o.status === "fixed");
+    const manual = result.outcomes.filter((o) => o.status === "manual");
+    const skipped = result.outcomes.filter((o) => o.status === "skipped");
+    if (result.outcomes.length === 0) {
+        L.push(pc.green("  ✓ Nothing to fix — no findings."));
+        L.push("");
+        return L.join("\n");
+    }
+    const counts = [pc.green(`${fixed.length} auto-fixed`)];
+    if (skipped.length > 0)
+        counts.push(pc.dim(`${skipped.length} skipped`));
+    counts.push(pc.yellow(`${manual.length} need manual review`));
+    L.push("  " + counts.join("  ·  ") +
+        (result.llmAvailable ? pc.dim("  ·  Claude fixer: on") : pc.dim("  ·  Claude fixer: off")));
+    L.push("");
+    // Diffs for accepted patches.
+    for (const p of result.patches) {
+        L.push("  " + pc.cyan(pc.bold(p.relPath)) + pc.dim(`  (${p.targeted.length} fix${p.targeted.length === 1 ? "" : "es"})`));
+        L.push(renderDiff(p.relPath, p.before, p.after));
+        L.push("");
+    }
+    // Auto-fixed list — what actually landed (or would land, on a dry run).
+    if (fixed.length > 0) {
+        L.push(pc.bold(pc.green(result.apply ? "  Fixed" : "  Will fix")));
+        for (const o of fixed)
+            L.push("    " + outcomeLine(o));
+        L.push("");
+    }
+    // Declined list — changes you skipped at the prompt, so nothing silently vanishes.
+    if (skipped.length > 0) {
+        L.push(pc.bold(pc.dim("  Skipped — you declined these (still unfixed)")));
+        for (const o of skipped)
+            L.push("    " + outcomeLine(o));
+        L.push("");
+    }
+    // Manual list.
+    if (manual.length > 0) {
+        L.push(pc.bold(pc.yellow("  Needs manual review")));
+        for (const o of manual) {
+            L.push("    " + outcomeLine(o));
+            L.push("      " + pc.dim(o.note));
+        }
+        L.push("");
+    }
+    // Side effects.
+    if (result.sideEffects.length > 0) {
+        L.push(pc.bold("  Hardening side effects"));
+        for (const fx of result.sideEffects) {
+            const verb = fx.kind === "ensure-line" ? `ensure \`${fx.content}\` in` : "create";
+            L.push(`    ${pc.dim(result.apply ? "•" : "○")} ${verb} ${pc.cyan(fx.relPath)} ${pc.dim(`— ${fx.reason}`)}`);
+        }
+        L.push("");
+    }
+    // Footer: backup + the integrity disclaimer + next step.
+    L.push(pc.dim("  ─────────────────────────────────────────────────"));
+    if (result.apply) {
+        if (result.backupDir) {
+            L.push(`  ${pc.green("✓ Applied.")} Originals backed up to ${pc.cyan(rel(result.root, result.backupDir))}`);
+        }
+        else {
+            L.push(`  ${pc.green("✓ Applied.")}`);
+        }
+    }
+    else {
+        L.push(`  ${pc.dim("Dry run — no files were changed.")} Re-run with ${pc.bold("--apply")} to write these fixes.`);
+    }
+    L.push(pc.dim("  These fixes mean the detector no longer flags the issue — not that the app is proven secure. " +
+        "Review every diff and run your tests before deploying."));
+    if (!result.llmAvailable && result.outcomes.some((o) => o.status === "manual")) {
+        L.push(pc.dim("  Set ANTHROPIC_API_KEY to auto-fix logic-level issues (RCE, AI tool hijack, IDOR)."));
+    }
+    L.push("");
+    return L.join("\n");
+}
+/** Render one approval request (a patch diff + verification note, or the side-effects list). */
+export function renderApprovalRequest(req) {
+    const L = [];
+    if (req.kind === "patch") {
+        const p = req.patch;
+        const titles = p.targeted.map((f) => f.title).join(", ");
+        L.push("");
+        L.push(`  ${pc.bold(`Fix ${req.index + 1} of ${req.total}`)} — ${pc.cyan(p.relPath)}  ` +
+            pc.dim(`[${p.targeted.length} finding${p.targeted.length === 1 ? "" : "s"}: ${titles}]`));
+        L.push(renderDiff(p.relPath, p.before, p.after));
+        L.push("  " + pc.dim("verified: finding clears · no new issue · file still parses"));
+    }
+    else {
+        L.push("");
+        L.push("  " + pc.bold("Supporting changes") + pc.dim(" (additive, no break risk)"));
+        for (const fx of req.effects) {
+            const verb = fx.kind === "ensure-line" ? `ensure \`${fx.content}\` in` : "create";
+            L.push(`    ${pc.dim("○")} ${verb} ${pc.cyan(fx.relPath)} ${pc.dim(`— ${fx.reason}`)}`);
+        }
+    }
+    return L.join("\n");
+}
+function outcomeLine(o) {
+    const sev = SEV_TAG[o.finding.severity](` ${o.finding.severity.toUpperCase()} `);
+    const strat = o.strategy ? pc.dim(`[${o.strategy === "llm" ? "claude" : "rule"}]`) : "";
+    return `${sev} ${o.finding.title} ${pc.dim(`(${o.finding.file}:${o.finding.line})`)} ${strat}`.trimEnd();
+}
+/** Compact colored unified diff (2 lines of context). */
+function renderDiff(relPath, before, after) {
+    const patch = structuredPatch(relPath, relPath, before, after, "", "", { context: 2 });
+    const out = [];
+    for (const h of patch.hunks) {
+        out.push("    " + pc.dim(`@@ -${h.oldStart},${h.oldLines} +${h.newStart},${h.newLines} @@`));
+        for (const line of h.lines) {
+            if (line.startsWith("+"))
+                out.push("    " + pc.green(line));
+            else if (line.startsWith("-"))
+                out.push("    " + pc.red(line));
+            else
+                out.push("    " + pc.dim(line));
+        }
+    }
+    return out.join("\n");
+}
+function rel(root, abs) {
+    return abs.startsWith(root) ? abs.slice(root.length).replace(/^[\\/]/, "") : abs;
+}
+/** Machine-readable summary for `fix --json`. */
+export function fixToJson(result) {
+    return JSON.stringify({
+        root: result.root,
+        applied: result.apply,
+        llmAvailable: result.llmAvailable,
+        scoreBefore: result.scoreBefore,
+        scoreAfter: result.scoreAfter,
+        backupDir: result.backupDir,
+        summary: {
+            fixed: result.outcomes.filter((o) => o.status === "fixed").length,
+            manual: result.outcomes.filter((o) => o.status === "manual").length,
+        },
+        outcomes: result.outcomes.map((o) => ({
+            id: o.finding.id,
+            detector: o.finding.detector,
+            severity: o.finding.severity,
+            file: o.finding.file,
+            line: o.finding.line,
+            status: o.status,
+            strategy: o.strategy ?? null,
+            note: o.note,
+        })),
+        patches: result.patches.map((p) => ({ file: p.relPath, fixes: p.targeted.length })),
+        sideEffects: result.sideEffects,
+    }, null, 2);
+}

package/dist/ui/init.js

@@ -0,0 +1,34 @@
+/** `init` view (doc 12): what was wired in, and what to do next. */
+import pc from "picocolors";
+const MARK = {
+    created: pc.green("＋"),
+    updated: pc.cyan("↻"),
+    skipped: pc.dim("•"),
+};
+export function renderInit(result) {
+    const L = [];
+    L.push("");
+    L.push(pc.bold(pc.cyan("  ◇ SecureVibe init")) + pc.dim("  · always-on security for this project"));
+    L.push("");
+    for (const a of result.actions) {
+        const label = a.status === "skipped" ? pc.dim(a.target) : pc.bold(a.target);
+        L.push(`  ${MARK[a.status]} ${label} ${pc.dim("— " + a.note)}`);
+    }
+    L.push("");
+    L.push(pc.dim("  ─────────────────────────────────────────────────"));
+    if (result.isGitRepo) {
+        L.push(`  ${pc.green("✓")} Commits are now guarded — a commit that introduces a blocking issue (or leaks a secret) is rejected.`);
+    }
+    else {
+        L.push(`  ${pc.yellow("!")} Not a git repo yet. Run ${pc.bold("git init")} then ${pc.bold("securevibe init")} to install the commit guard.`);
+    }
+    L.push("");
+    L.push(pc.bold("  Next steps"));
+    L.push(`    1. ${pc.bold("securevibe scan")}            — see where you stand`);
+    L.push(`    2. ${pc.bold("securevibe fix --apply")}     — auto-harden the blocking issues`);
+    L.push(`    3. commit — the guard runs ${pc.bold("scan --staged --ci")} automatically`);
+    L.push("");
+    L.push(pc.dim("  Everything runs locally. SecureVibe never stores or transmits your secrets or API keys."));
+    L.push("");
+    return L.join("\n");
+}

package/dist/ui/prompt.js

@@ -0,0 +1,62 @@
+// packages/cli/src/ui/prompt.ts
+/**
+ * Interactive approval prompt for `fix --apply`. Pure decision logic
+ * (decideApply, mapAnswer) is separated from IO (makeFixConfirm) so it is
+ * unit-tested without a real TTY. Prompts render to stderr so --json on stdout
+ * stays clean; the readline input is the user's terminal.
+ */
+import readline from "node:readline";
+/** True only when both stdin and stdout are real terminals. */
+export function isInteractive() {
+    return !!process.stdout.isTTY && !!process.stdin.isTTY;
+}
+/**
+ * Decide how a `fix` invocation should behave. Truth table:
+ *  - not --apply              → preview only.
+ *  - --apply --yes            → write everything, no prompt.
+ *  - --apply, --json or non-TTY, no --yes → refuse to write, show notice.
+ *  - --apply, interactive, no --yes       → write with per-change prompt.
+ */
+export function decideApply(opts, interactive) {
+    if (!opts.apply)
+        return { apply: false, prompt: false, notice: false };
+    if (opts.yes)
+        return { apply: true, prompt: false, notice: false };
+    if (opts.json || !interactive)
+        return { apply: false, prompt: false, notice: true };
+    return { apply: true, prompt: true, notice: false };
+}
+/** Map a raw keypress/line to an answer. Empty / unknown → the safe default "no". */
+export function mapAnswer(raw, kind) {
+    const c = raw.trim().toLowerCase().charAt(0);
+    if (kind === "side-effects")
+        return c === "y" ? "yes" : "no";
+    if (c === "y")
+        return "yes";
+    if (c === "a")
+        return "all";
+    if (c === "q")
+        return "quit";
+    return "no";
+}
+/** Read one line. Streams are injectable so the readline round-trip is testable. */
+export function askLine(prompt, input = process.stdin, output = process.stderr) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input, output });
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/** Build a confirm callback that renders each request and reads one line of input. */
+export function makeFixConfirm(render, input = process.stdin, output = process.stderr) {
+    return async (req) => {
+        output.write(render(req) + "\n");
+        const prompt = req.kind === "patch"
+            ? "  Apply this change? [y]es / [n]o / [a]ll / [q]uit: "
+            : "  Apply these supporting changes? [y]es / [n]o: ";
+        const raw = await askLine(prompt, input, output);
+        return mapAnswer(raw, req.kind);
+    };
+}

package/dist/ui/protect.js

@@ -0,0 +1,67 @@
+/**
+ * `protect` and `score` views. `protect` is the remediation-first lens (doc 05):
+ * it leads with the fix for every finding. `score` is the one-glance verdict.
+ */
+import pc from "picocolors";
+import { renderBanner } from "./banner.js";
+const SEV_COLOR = {
+    critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
+    high: (s) => pc.red(pc.bold(s)),
+    medium: (s) => pc.yellow(s),
+    low: (s) => pc.blue(s),
+    info: (s) => pc.dim(s),
+};
+function readinessLine(r) {
+    switch (r) {
+        case "ship":
+            return pc.green(pc.bold("✓ SHIP — no blocking issues"));
+        case "warn":
+            return pc.yellow(pc.bold("⚠ SHIP WITH WARNINGS"));
+        case "block":
+            return pc.red(pc.bold("✗ BLOCK DEPLOY — fix blocking issues first"));
+    }
+}
+export function renderRemediations(result) {
+    const lines = [];
+    lines.push(renderBanner({ subtitle: "remediation plan" }));
+    lines.push("");
+    if (result.findings.length === 0) {
+        lines.push(pc.green("  ✓ Nothing to remediate."));
+        lines.push("");
+        return lines.join("\n");
+    }
+    // Group remediations by file (how a developer would apply them).
+    const byFile = new Map();
+    for (const f of result.findings) {
+        const arr = byFile.get(f.file) ?? [];
+        arr.push(f);
+        byFile.set(f.file, arr);
+    }
+    for (const [file, fileFindings] of byFile) {
+        lines.push("  " + pc.cyan(pc.bold(file)));
+        for (const f of fileFindings) {
+            const sev = SEV_COLOR[f.severity](` ${f.severity.toUpperCase()} `);
+            lines.push(`    ${sev} ${pc.bold(f.title)} ${pc.dim(`(L${f.line})`)}`);
+            lines.push(`       ${pc.green("→ fix:")} ${f.fix.replace(/\s+/g, " ").trim()}`);
+        }
+        lines.push("");
+    }
+    lines.push(pc.dim("  ─────────────────────────────────────────────────"));
+    lines.push(`  ${readinessLine(result.score.readiness)}`);
+    lines.push(pc.dim("  Run `securevibe fix` to apply these remediations automatically (dry run by default) " +
+        "and re-scan to verify. `protect` is the read-only plan."));
+    lines.push("");
+    return lines.join("\n");
+}
+export function renderScoreOnly(result) {
+    const s = result.score;
+    const gc = s.grade === "A" || s.grade === "B" ? pc.green : s.grade === "C" ? pc.yellow : pc.red;
+    const lines = [];
+    lines.push(renderBanner({ subtitle: "security score" }));
+    lines.push("");
+    lines.push(`  ${gc(pc.bold(`  ${s.grade}  `))}  ${pc.bold(`${s.composite}/100`)}   ${readinessLine(s.readiness)}`);
+    lines.push("");
+    lines.push(`  app ${s.subScores.appSecurity}  ·  ${pc.magenta(`ai ${s.subScores.aiSecurity}`)}  ·  secrets ${s.subScores.dependencies}  ·  deploy ${s.subScores.deployment}`);
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/ui/readiness.js

@@ -0,0 +1,62 @@
+// packages/cli/src/ui/readiness.ts
+/**
+ * Launch-readiness scorecard view + the one-line summary embedded in `scan`.
+ * Honest framing: passing the gates means these checks are satisfied, not that
+ * the app is proven secure.
+ */
+import pc from "picocolors";
+import { renderBanner } from "./banner.js";
+function verdictBadge(lr) {
+    if (lr.verdict === "ready")
+        return pc.bgGreen(pc.black(pc.bold(" LAUNCH READY ")));
+    if (lr.verdict === "warnings") {
+        return pc.yellow(pc.bold(`LAUNCH READINESS  ! ready with ${lr.warnings} warning${lr.warnings === 1 ? "" : "s"}`));
+    }
+    return pc.bgRed(pc.white(pc.bold(` NOT READY — ${lr.blockers} blocker${lr.blockers === 1 ? "" : "s"} `)));
+}
+function gateLine(g) {
+    const sym = g.status === "pass" ? pc.green("✓")
+        : g.status === "blocker" ? pc.red("✕")
+            : g.status === "warning" ? pc.yellow("!")
+                : pc.dim("○");
+    const label = g.label.padEnd(30);
+    const detail = g.status === "pass" ? pc.dim("ok")
+        : g.status === "not-assessed" ? pc.dim(g.detail)
+            : g.status === "blocker" ? pc.red(g.detail)
+                : pc.yellow(g.detail);
+    return `${sym} ${label} ${detail}`;
+}
+export function renderScorecard(result) {
+    const lr = result.launchReadiness;
+    const L = [];
+    L.push(renderBanner({ subtitle: "launch readiness" }));
+    L.push(pc.dim(`  ${result.root}`));
+    L.push("");
+    if (!lr) {
+        L.push("  Launch readiness is only evaluated on a full scan.");
+        L.push("");
+        return L.join("\n");
+    }
+    L.push("  " + verdictBadge(lr));
+    L.push("");
+    for (const g of lr.gates)
+        L.push("  " + gateLine(g));
+    L.push("");
+    L.push(pc.dim("  ─────────────────────────────────────────────────"));
+    L.push("  " + pc.bold("Next:") + pc.dim(" run ") + pc.cyan("securevibe fix") + pc.dim(" to auto-harden what's mechanical; the rest carry exact instructions."));
+    L.push(pc.dim("  Passing these gates means these checks are satisfied — not that the app is proven secure. Review the diffs and run your tests."));
+    L.push("");
+    return L.join("\n");
+}
+/** One line embedded in the scan report (empty when readiness was not evaluated). */
+export function readinessSummaryLine(result) {
+    const lr = result.launchReadiness;
+    if (!lr)
+        return "";
+    if (lr.verdict === "ready")
+        return pc.green("Launch readiness  ✓ ready");
+    if (lr.verdict === "warnings") {
+        return pc.yellow(`Launch readiness  ! ready with ${lr.warnings} warning${lr.warnings === 1 ? "" : "s"}`) + pc.dim("  → securevibe ready");
+    }
+    return pc.red(`Launch readiness  ✕ not ready (${lr.blockers} blocker${lr.blockers === 1 ? "" : "s"})`) + pc.dim("  → run `securevibe ready`");
+}

package/dist/ui/report.js

@@ -0,0 +1,169 @@
+/**
+ * Terminal report — the "score reveal" signature moment (doc 17). Calm,
+ * prioritized, remediation-first. Colour via picocolors; degrades cleanly
+ * when colour is disabled.
+ */
+import pc from "picocolors";
+import { dependencyLine } from "./deps.js";
+import { renderBanner } from "./banner.js";
+import { readinessSummaryLine } from "./readiness.js";
+const SEV_LABEL = {
+    critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
+    high: (s) => pc.red(pc.bold(s)),
+    medium: (s) => pc.yellow(pc.bold(s)),
+    low: (s) => pc.blue(s),
+    info: (s) => pc.dim(s),
+};
+function sevBadge(sev) {
+    const text = sev.toUpperCase().padEnd(8);
+    return SEV_LABEL[sev](text);
+}
+function gradeColor(grade) {
+    if (grade === "A" || grade === "B")
+        return pc.green;
+    if (grade === "C")
+        return pc.yellow;
+    return pc.red;
+}
+function readinessBadge(r) {
+    switch (r) {
+        case "ship":
+            return pc.green(pc.bold(" ✓ SHIP "));
+        case "warn":
+            return pc.yellow(pc.bold(" ⚠ SHIP WITH WARNINGS "));
+        case "block":
+            return pc.bgRed(pc.white(pc.bold(" ✗ BLOCK DEPLOY ")));
+    }
+}
+function bar(value, width = 24) {
+    const filled = Math.round((value / 100) * width);
+    const color = value >= 80 ? pc.green : value >= 60 ? pc.yellow : pc.red;
+    return color("█".repeat(filled)) + pc.dim("░".repeat(width - filled));
+}
+function gradeFor(n) {
+    if (n >= 90)
+        return "A";
+    if (n >= 80)
+        return "B";
+    if (n >= 70)
+        return "C";
+    if (n >= 55)
+        return "D";
+    if (n >= 40)
+        return "E";
+    return "F";
+}
+export function renderReport(result, opts = {}) {
+    const lines = [];
+    const { score, inventory, findings } = result;
+    // Dependency findings are surfaced on the Dependencies line, not in the code
+    // findings list / histogram — so the code finding count stays the code count.
+    const codeFindings = findings.filter((f) => f.category !== "dependency" && f.category !== "readiness");
+    // In AI-focus mode the composite is meaningless (other categories weren't
+    // scanned), so headline the AI sub-score instead.
+    const headlineValue = opts.aiFocus ? score.subScores.aiSecurity : score.composite;
+    const headlineGrade = opts.aiFocus ? gradeFor(headlineValue) : score.grade;
+    const scoreLabel = opts.aiFocus ? "AI Security Score" : "Security Score";
+    lines.push(renderBanner({ subtitle: opts.aiFocus ? "AI application security audit" : "security scan" }));
+    lines.push(pc.dim(`  ${result.root}`));
+    lines.push("");
+    // Inventory
+    const inv = [
+        inventory.languages.length ? `langs: ${inventory.languages.join(", ")}` : "",
+        inventory.frameworks.length ? `frameworks: ${inventory.frameworks.join(", ")}` : "",
+        inventory.aiIntegrations.length ? pc.magenta(`AI: ${inventory.aiIntegrations.join(", ")}`) : "",
+        inventory.deployTargets.length ? `deploy: ${inventory.deployTargets.join(", ")}` : "",
+    ].filter(Boolean);
+    for (const l of inv)
+        lines.push("  " + pc.dim("•") + " " + l);
+    lines.push(pc.dim(`  ${result.filesScanned} files analyzed in ${result.durationMs}ms`));
+    lines.push("");
+    // Score block
+    const gc = gradeColor(headlineGrade);
+    lines.push(pc.dim(`  ╭─ ${scoreLabel} ${"─".repeat(Math.max(0, 32 - scoreLabel.length))}`));
+    lines.push("  │  " +
+        gc(pc.bold(`  ${headlineGrade}  `)) +
+        "  " +
+        pc.bold(`${headlineValue}/100`) +
+        "      " +
+        readinessBadge(score.readiness));
+    lines.push("  │");
+    if (opts.aiFocus) {
+        lines.push(`  │  ${pc.magenta("AI Security")}    ${bar(score.subScores.aiSecurity)} ${score.subScores.aiSecurity}`);
+    }
+    else {
+        lines.push(`  │  App Security   ${bar(score.subScores.appSecurity)} ${score.subScores.appSecurity}`);
+        lines.push(`  │  ${pc.magenta("AI Security")}    ${bar(score.subScores.aiSecurity)} ${score.subScores.aiSecurity}`);
+        lines.push(`  │  Secrets        ${bar(score.subScores.dependencies)} ${score.subScores.dependencies}`);
+        lines.push(`  │  Deployment     ${bar(score.subScores.deployment)} ${score.subScores.deployment}`);
+    }
+    const depLine = dependencyLine(result);
+    if (depLine) {
+        lines.push("  │");
+        lines.push(`  │  Dependencies   ${depLine}`);
+    }
+    lines.push(pc.dim("  ╰────────────────────────────────────────────────"));
+    lines.push("");
+    const readyLine = readinessSummaryLine(result);
+    if (readyLine) {
+        lines.push("  " + readyLine);
+        lines.push("");
+    }
+    // Summary counts
+    const counts = countBySeverity(codeFindings);
+    const summary = ["critical", "high", "medium", "low"]
+        .map((s) => `${sevBadge(s).trimEnd()} ${counts[s]}`)
+        .join("   ");
+    lines.push("  " + summary);
+    lines.push("");
+    if (codeFindings.length === 0) {
+        lines.push(pc.green("  ✓ No findings. Looking good."));
+        lines.push("");
+        return lines.join("\n");
+    }
+    // Findings (top N)
+    const TOP = 15;
+    lines.push(pc.bold(`  Findings`) + pc.dim(`  (showing top ${Math.min(TOP, codeFindings.length)} of ${codeFindings.length}, highest risk first)`));
+    lines.push("");
+    for (const f of codeFindings.slice(0, TOP)) {
+        lines.push(...renderFinding(f));
+    }
+    if (codeFindings.length > TOP) {
+        lines.push(pc.dim(`  …and ${codeFindings.length - TOP} more. Use --json for the full list.`));
+        lines.push("");
+    }
+    // Footer / next steps
+    lines.push(pc.dim("  ─────────────────────────────────────────────────"));
+    lines.push("  " + pc.bold("Next:") + pc.dim(" every finding above carries a fix. ") + "Run " + pc.cyan("securevibe protect") + pc.dim(" to review remediations,"));
+    lines.push("  " + pc.dim("or ") + pc.cyan("securevibe ai-audit") + pc.dim(" to focus on the AI-agent attack surface."));
+    lines.push("");
+    return lines.join("\n");
+}
+function renderFinding(f) {
+    const out = [];
+    const tag = f.category === "ai" ? pc.magenta(" [AI]") : "";
+    out.push(`  ${sevBadge(f.severity)} ${pc.bold(f.title)}${tag}`);
+    out.push(`     ${pc.dim("↳")} ${pc.cyan(`${f.file}:${f.line}`)}  ${pc.dim(metaLine(f))}`);
+    if (f.evidence)
+        out.push(`     ${pc.dim("│")} ${pc.dim(truncate(f.evidence, 90))}`);
+    out.push(`     ${pc.dim("why:")} ${truncate(f.why, 140)}`);
+    if (f.taint && f.taint.length)
+        out.push(`     ${pc.dim("flow:")} ${pc.dim(f.taint.join(" "))}`);
+    out.push(`     ${pc.green("fix:")} ${truncate(f.fix, 160)}`);
+    out.push("");
+    return out;
+}
+function metaLine(f) {
+    const parts = [f.cwe, f.owasp, f.mitre, `conf ${(f.confidence * 100) | 0}%`].filter(Boolean);
+    return parts.join(" · ");
+}
+function countBySeverity(findings) {
+    const c = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        c[f.severity]++;
+    return c;
+}
+function truncate(s, n) {
+    const clean = s.replace(/\s+/g, " ").trim();
+    return clean.length > n ? clean.slice(0, n - 1) + "…" : clean;
+}

package/dist/usage.js

@@ -0,0 +1,68 @@
+/**
+ * Free beta daily usage metering. A local counter in ~/.securevibe/usage.json:
+ * one use per analysis command, reset at local midnight. Soft enforcement by
+ * design — there is no account system yet — so this establishes the metering
+ * UX honestly without pretending to be tamper-proof. The --staged commit guard
+ * is never metered: a quota must not block someone's commit.
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+export const DAILY_LIMIT = 50;
+export function usageFilePath() {
+    return path.join(os.homedir(), ".securevibe", "usage.json");
+}
+/** Local calendar day (not UTC) so the reset matches the user's midnight. */
+export function localDay(now = new Date()) {
+    const y = now.getFullYear();
+    const m = String(now.getMonth() + 1).padStart(2, "0");
+    const d = String(now.getDate()).padStart(2, "0");
+    return `${y}-${m}-${d}`;
+}
+/** Pure state transition: same day increments, a new day resets, limit blocks. */
+export function nextUsage(state, today, limit = DAILY_LIMIT) {
+    const base = state && state.date === today ? state : { date: today, count: 0 };
+    if (base.count >= limit) {
+        return { state: base, result: { allowed: false, used: base.count, limit } };
+    }
+    const next = { date: today, count: base.count + 1 };
+    return { state: next, result: { allowed: true, used: next.count, limit } };
+}
+async function readState(file) {
+    try {
+        const raw = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof raw?.date === "string" && typeof raw?.count === "number" && raw.count >= 0) {
+            return { date: raw.date, count: Math.floor(raw.count) };
+        }
+    }
+    catch {
+        /* missing or corrupt → treated as a fresh day */
+    }
+    return null;
+}
+/**
+ * Record one use against today's quota. Returns whether the command may run.
+ * Metering failures (unwritable home, etc.) never break the tool: on any IO
+ * error the use is allowed.
+ */
+export async function recordUse(file = usageFilePath(), now = new Date()) {
+    try {
+        const { state, result } = nextUsage(await readState(file), localDay(now));
+        if (result.allowed) {
+            await fs.mkdir(path.dirname(file), { recursive: true });
+            await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");
+        }
+        return result;
+    }
+    catch {
+        return { allowed: true, used: 0, limit: DAILY_LIMIT };
+    }
+}
+/** The message shown when the daily quota is exhausted. */
+export function limitMessage(limit = DAILY_LIMIT) {
+    return [
+        `  Daily free beta limit reached (${limit} analyses today).`,
+        "  It resets at midnight. The commit guard (--staged) is never limited.",
+        "  Paid plans with higher limits are coming during the beta.",
+    ].join("\n");
+}