securevibe 0.1.1 → 0.1.2

package/dist/index.js

@@ -10,11 +10,12 @@
 import { Command } from "commander";
 import { scan } from "./engine/scan.js";
 import { toJson, toSarif } from "./ui/emit.js";
+import { VERSION } from "./version.js";
 const program = new Command();
 program
     .name("securevibe")
     .description("Autonomous AI security engineer for AI-generated applications")
-    .version("0.1.1");
+    .version(VERSION);
 function addCommon(cmd) {
     return cmd
         .option("--json", "output machine-readable JSON")
@@ -79,6 +80,18 @@ function emitMachine(result, opts) {
     }
     return false;
 }
+/**
+ * Best-effort "a newer version exists" nudge on human-readable output only.
+ * Cached for a day, never blocks, never throws — see update-check.ts.
+ */
+async function maybeNotifyUpdate(opts) {
+    if (opts.json || opts.sarif || opts.staged)
+        return;
+    const { checkForUpdate, updateNotice } = await import("./update-check.js");
+    const latest = await checkForUpdate(VERSION);
+    if (latest)
+        process.stderr.write("\n" + updateNotice(VERSION, latest) + "\n");
+}
 /** Exit code policy for CI gating (doc 08/12). */
 function ciExit(result, opts) {
     if (!opts.ci)
@@ -99,6 +112,7 @@ addCommon(program
         const { renderReport } = await import("./ui/report.js");
         process.stdout.write(renderReport(result, { usage }) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 program
@@ -145,6 +159,7 @@ program
     if (decision.notice) {
         process.stderr.write("  Not applied: no interactive terminal. Re-run with --yes to apply non-interactively.\n");
     }
+    await maybeNotifyUpdate({ json: opts.json });
 });
 addCommon(program
     .command("ai-audit")
@@ -155,50 +170,55 @@ addCommon(program
         const { renderReport } = await import("./ui/report.js");
         process.stdout.write(renderReport(result, { aiFocus: true, usage }) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("protect")
     .description("Remediation-first view: the fixes for every finding")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const { result } = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderRemediations } = await import("./ui/protect.js");
-        process.stdout.write(renderRemediations(result) + "\n");
+        process.stdout.write(renderRemediations(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("attack-map")
     .description("Show exploit paths from reachable findings (doc 06)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const { result } = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderAttackMap } = await import("./ui/attackmap.js");
-        process.stdout.write(renderAttackMap(result) + "\n");
+        process.stdout.write(renderAttackMap(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("score")
     .description("Print the security score and deployment-readiness verdict")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const { result } = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderScoreOnly } = await import("./ui/protect.js");
-        process.stdout.write(renderScoreOnly(result) + "\n");
+        process.stdout.write(renderScoreOnly(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
     .command("deps")
     .description("Audit dependencies for known CVEs (SCA, offline against the local OSV db)")
     .argument("[path]", "path to the repository", ".")).action(async (pathArg, opts) => {
-    const { result } = await runScan(pathArg, opts);
+    const { result, usage } = await runScan(pathArg, opts);
     if (!emitMachine(result, opts)) {
         const { renderDeps } = await import("./ui/deps.js");
-        process.stdout.write(renderDeps(result) + "\n");
+        process.stdout.write(renderDeps(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 addCommon(program
@@ -210,6 +230,7 @@ addCommon(program
         const { renderScorecard } = await import("./ui/readiness.js");
         process.stdout.write(renderScorecard(result, usage) + "\n");
     }
+    await maybeNotifyUpdate(opts);
     ciExit(result, opts);
 });
 program

package/dist/ui/attackmap.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 function impactOf(f) {
     switch (f.detector) {
         case "sql-injection":
@@ -26,10 +27,14 @@ function impactOf(f) {
             return "compromise of " + f.file;
     }
 }
-export function renderAttackMap(result) {
+export function renderAttackMap(result, usage) {
     const lines = [];
     lines.push(renderBanner({ subtitle: "attack map · exploit paths" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     const chains = result.findings.filter((f) => f.reachable && (f.severity === "critical" || f.severity === "high"));
     if (chains.length === 0) {
         lines.push(pc.green("  ✓ No reachable critical/high exploit paths found."));

package/dist/ui/deps.js

@@ -6,6 +6,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_COLOR = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(` ${s} `))),
     high: (s) => pc.red(pc.bold(s)),
@@ -25,12 +26,16 @@ export function dependencyLine(result) {
         .map((s) => `${d.bySeverity[s]} ${s}`);
     return `${d.total} known ${d.total === 1 ? "CVE" : "CVEs"} (${parts.join(", ")}) · ${date}`;
 }
-export function renderDeps(result) {
+export function renderDeps(result, usage) {
     const lines = [];
     const deps = result.findings.filter((f) => f.detector === "vulnerable-dependency");
     lines.push(renderBanner({ subtitle: "dependency audit (SCA)" }));
     lines.push(pc.dim(`  ${result.root}`));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     lines.push("  " + (deps.length === 0 ? pc.green("✓ ") : "") + dependencyLine(result));
     lines.push("");
     for (const f of deps)

package/dist/ui/protect.js

@@ -4,6 +4,7 @@
  */
 import pc from "picocolors";
 import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
 const SEV_COLOR = {
     critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
     high: (s) => pc.red(pc.bold(s)),
@@ -21,10 +22,14 @@ function readinessLine(r) {
             return pc.red(pc.bold("✗ BLOCK DEPLOY — fix blocking issues first"));
     }
 }
-export function renderRemediations(result) {
+export function renderRemediations(result, usage) {
     const lines = [];
     lines.push(renderBanner({ subtitle: "remediation plan" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     if (result.findings.length === 0) {
         lines.push(pc.green("  ✓ Nothing to remediate."));
         lines.push("");
@@ -53,12 +58,16 @@ export function renderRemediations(result) {
     lines.push("");
     return lines.join("\n");
 }
-export function renderScoreOnly(result) {
+export function renderScoreOnly(result, usage) {
     const s = result.score;
     const gc = s.grade === "A" || s.grade === "B" ? pc.green : s.grade === "C" ? pc.yellow : pc.red;
     const lines = [];
     lines.push(renderBanner({ subtitle: "security score" }));
     lines.push("");
+    if (usage) {
+        lines.push(renderUsageLine(usage));
+        lines.push("");
+    }
     lines.push(`  ${gc(pc.bold(`  ${s.grade}  `))}  ${pc.bold(`${s.composite}/100`)}   ${readinessLine(s.readiness)}`);
     lines.push("");
     lines.push(`  app ${s.subScores.appSecurity}  ·  ${pc.magenta(`ai ${s.subScores.aiSecurity}`)}  ·  secrets ${s.subScores.dependencies}  ·  deploy ${s.subScores.deployment}`);

package/dist/update-check.js

@@ -0,0 +1,101 @@
+/**
+ * Best-effort "a newer version is published" notice. There is no auto-update —
+ * users install a CLI globally and nothing tells them it went stale. This
+ * checks the npm registry at most once a day (cached in ~/.securevibe), never
+ * throws, and never slows a command down on a broken network (short timeout,
+ * fire-and-forget failure).
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const REGISTRY_URL = "https://registry.npmjs.org/securevibe/latest";
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1500;
+export function cacheFilePath() {
+    return path.join(os.homedir(), ".securevibe", "update-check.json");
+}
+/** Simple major.minor.patch compare; true if `latest` is strictly newer than `current`. */
+export function isNewer(current, latest) {
+    const a = current.split(".").map((n) => parseInt(n, 10) || 0);
+    const b = latest.split(".").map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        const ai = a[i] ?? 0;
+        const bi = b[i] ?? 0;
+        if (bi > ai)
+            return true;
+        if (bi < ai)
+            return false;
+    }
+    return false;
+}
+async function readCache(file) {
+    try {
+        const raw = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof raw?.checkedAt === "number" && typeof raw?.latest === "string")
+            return raw;
+    }
+    catch {
+        /* missing or corrupt → treated as no cache */
+    }
+    return null;
+}
+async function writeCache(file, state) {
+    try {
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");
+    }
+    catch {
+        /* best effort — a failed write must never break the command */
+    }
+}
+async function fetchLatest(fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetchImpl(REGISTRY_URL, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        return typeof json?.version === "string" ? json.version : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Returns the newer published version if one exists, else null. Never
+ * throws — offline, a down registry, or a corrupt cache all resolve to null
+ * rather than interrupting the command.
+ */
+export async function checkForUpdate(currentVersion, opts = {}) {
+    const file = opts.file ?? cacheFilePath();
+    const now = opts.now ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    try {
+        const cached = await readCache(file);
+        let latest = null;
+        if (cached && now - cached.checkedAt < CACHE_TTL_MS) {
+            latest = cached.latest;
+        }
+        else {
+            latest = await fetchLatest(fetchImpl);
+            if (latest)
+                await writeCache(file, { checkedAt: now, latest });
+            else if (cached)
+                latest = cached.latest;
+        }
+        return latest && isNewer(currentVersion, latest) ? latest : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function updateNotice(currentVersion, latestVersion) {
+    return [
+        `  A new version of securevibe is available: ${latestVersion} (you have ${currentVersion}).`,
+        "  Update: npm install -g securevibe",
+    ].join("\n");
+}

package/dist/version.js

@@ -0,0 +1,5 @@
+// packages/cli/src/version.ts
+// Single source of truth for the CLI's own version, so it can't drift from
+// what commander reports and what the update-check compares against.
+// Kept in sync with the "version" field in package.json by hand at release time.
+export const VERSION = "0.1.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securevibe",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",