securevibe 0.1.13 → 0.1.14

package/README.md

@@ -31,6 +31,7 @@ midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE
 | `securevibe pr-comment [path]` | Post/update a PR findings summary (used by the GitHub Actions workflow) |
 | `securevibe deps [path]` | Audit dependencies for known CVEs against the local OSV database (SCA) |
 | `securevibe db <update\|status>` | Manage the local OSV database — `update` is networked |
+| `securevibe update` | Update securevibe itself to the latest published version (also networked) |
 | `securevibe ready [path]` | Launch readiness scorecard: pass/fail gates + go/no-go verdict |
 | `securevibe ai-audit [path]` | Focus on the AI-agent attack surface (doc 04) |
 | `securevibe protect [path]` | Remediation-first view: the fix for every finding (doc 05) |
@@ -71,7 +72,8 @@ is sent to your provider. Needs the same key as `fix` and `explain`
 - a **GitHub Actions workflow** (`.github/workflows/securevibe.yml`) that scans every PR and uploads
   SARIF to GitHub code scanning, gates the build on deployment-readiness, and posts a PR comment
   summarizing findings in the *changed* files only (updated in place on new commits, not reposted —
-  and the only other command besides `db update` that talks to the network, and only to post a
+  and one of the few other commands (besides `db update` and `update`) that talks to the network,
+  and only to post a
   findings summary already computed locally, never your source code);
 - gitignores `.env` / backups and drops a minimal `securevibe.config.json`.
 
@@ -142,9 +144,10 @@ against a local copy of the [OSV](https://osv.dev) advisory database, and report
   CVE still blocks deployment, and `securevibe fix` bumps the package to the lowest non vulnerable
   version while preserving your range prefix (`^`, `~`, `==`, ...).
 - **Offline first.** A bundled seed (`data/osv-seed.json`) ships with the CLI, so `deps` works with
-  no network. `db update` is the only command that **downloads** anything (the public OSV npm and
-  PyPI dumps, into `~/.securevibe/db`). `pr-comment` is the only command that **uploads** anything,
-  and only a findings summary already computed locally — never your code or package list.
+  no network. `db update` and `update` are the only commands that **download** anything (OSV
+  advisory dumps, or the CLI's own next version, respectively). `pr-comment` is the only command
+  that **uploads** anything, and only a findings summary already computed locally — never your
+  code or package list.
 - **Honest framing.** A clean result reads "no known advisories as of `<db date>`", not "secure" —
   it means nothing matched the local database on that date, which is not a proof of safety.
 

package/dist/index.js

@@ -353,6 +353,18 @@ program
     process.stderr.write(`  unknown db action: ${action} (use: update | status)\n`);
     process.exit(64);
 });
+program
+    .command("update")
+    .description("Update securevibe to the latest published version (npm global installs only)")
+    .option("--no-color", "disable coloured output")
+    .action(async (opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    const { runUpdateCommand } = await import("./update-command.js");
+    const code = await runUpdateCommand();
+    if (code !== 0)
+        process.exit(code);
+});
 program
     .command("config")
     .description("Manage local AI-fixer provider keys (Groq/Anthropic), stored in ~/.securevibe/config.json")

package/dist/update-check.js

@@ -28,6 +28,16 @@ export function isNewer(current, latest) {
     }
     return false;
 }
+/**
+ * True when the running script is npm's npx cache copy rather than a
+ * persistent global install — npx always resolves to the latest published
+ * version on every invocation, so there is nothing for `securevibe update`
+ * to do in that case. The npx cache directory is named `_npx` on both Unix
+ * (~/.npm/_npx/...) and Windows (%LocalAppData%\npm-cache\_npx\...).
+ */
+export function isRunningViaNpx(scriptPath = process.argv[1] ?? "") {
+    return scriptPath.split(/[\\/]/).includes("_npx");
+}
 async function readCache(file) {
     try {
         const raw = JSON.parse(await fs.readFile(file, "utf8"));
@@ -48,7 +58,7 @@ async function writeCache(file, state) {
         /* best effort — a failed write must never break the command */
     }
 }
-async function fetchLatest(fetchImpl) {
+export async function fetchLatest(fetchImpl) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
@@ -96,6 +106,6 @@ export async function checkForUpdate(currentVersion, opts = {}) {
 export function updateNotice(currentVersion, latestVersion) {
     return [
         `  A new version of securevibe is available: ${latestVersion} (you have ${currentVersion}).`,
-        "  Update: npm install -g securevibe",
+        "  Update: securevibe update  (or: npm install -g securevibe)",
     ].join("\n");
 }

package/dist/update-command.js

@@ -0,0 +1,79 @@
+/**
+ * `securevibe update` — an explicit, user-triggered self-update for npm
+ * global installs. Reuses the same registry check as the passive daily
+ * notice (update-check.ts) but always fetches fresh: "check right now" is
+ * the whole point of running this command instead of waiting for tomorrow's
+ * cached check.
+ */
+import { isNewer, isRunningViaNpx, fetchLatest as defaultFetchLatest } from "./update-check.js";
+import { VERSION } from "./version.js";
+async function defaultSpawnNpmInstall(write) {
+    const { spawn } = await import("node:child_process");
+    return new Promise((resolve) => {
+        const child = spawn("npm", ["install", "-g", "securevibe@latest"], {
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: process.platform === "win32",
+        });
+        let output = "";
+        const onChunk = (chunk) => {
+            const text = chunk.toString("utf8");
+            output += text;
+            write(text);
+        };
+        child.stdout?.on("data", onChunk);
+        child.stderr?.on("data", onChunk);
+        child.on("error", (err) => resolve({ code: 1, output: output + String(err?.message ?? err) }));
+        child.on("close", (code) => resolve({ code, output }));
+    });
+}
+export function defaultUpdateCommandDeps() {
+    return {
+        currentVersion: VERSION,
+        platform: process.platform,
+        isNpx: () => isRunningViaNpx(),
+        fetchLatest: defaultFetchLatest,
+        fetchImpl: fetch,
+        spawnNpmInstall: defaultSpawnNpmInstall,
+        write: (text) => process.stderr.write(text),
+    };
+}
+/**
+ * True when npm's own output looks like a permission error and a sudo
+ * re-run would plausibly help. Never true on Windows, where elevation isn't
+ * a one-line fix.
+ */
+export function shouldShowSudoHint(output, platform = process.platform) {
+    return platform !== "win32" && /eacces|permission denied/i.test(output);
+}
+/**
+ * Runs the `securevibe update` flow. Returns the process exit code (0
+ * success, 1 failure) rather than calling process.exit itself, so callers
+ * (and tests) control process lifecycle. Never throws.
+ */
+export async function runUpdateCommand(deps = {}) {
+    const d = { ...defaultUpdateCommandDeps(), ...deps };
+    if (d.isNpx()) {
+        d.write("  You're running securevibe via npx, which always uses the latest published version — nothing to update.\n");
+        return 0;
+    }
+    const latest = await d.fetchLatest(d.fetchImpl);
+    if (latest === null) {
+        d.write("  Could not reach the npm registry to check for updates. Check your network and try again.\n");
+        return 1;
+    }
+    if (!isNewer(d.currentVersion, latest)) {
+        d.write(`  Already on the latest version (${d.currentVersion}).\n`);
+        return 0;
+    }
+    d.write(`  Updating securevibe ${d.currentVersion} -> ${latest}...\n`);
+    const result = await d.spawnNpmInstall(d.write);
+    if (result.code === 0) {
+        d.write(`  Updated to ${latest}.\n`);
+        return 0;
+    }
+    d.write("  Update failed.\n");
+    if (shouldShowSudoHint(result.output, d.platform)) {
+        d.write("  Try: sudo npm install -g securevibe@latest\n");
+    }
+    return 1;
+}

package/dist/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the CLI's own version, so it can't drift from
 // what commander reports and what the update-check compares against.
 // Kept in sync with the "version" field in package.json by hand at release time.
-export const VERSION = "0.1.13";
+export const VERSION = "0.1.14";

package/package.json

@@ -1,71 +1,71 @@
-{
-  "name": "securevibe",
-  "version": "0.1.13",
-  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
-  "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
-  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
-  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
-    "directory": "packages/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
-  },
-  "keywords": [
-    "security",
-    "scanner",
-    "sast",
-    "ai security",
-    "prompt injection",
-    "vulnerability",
-    "secrets",
-    "sca",
-    "cve",
-    "launch readiness",
-    "vibe coding",
-    "cli"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "securevibe": "./dist/index.js"
-  },
-  "files": [
-    "dist",
-    "data",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "node run-tests.mjs"
-  },
-  "dependencies": {
-    "commander": "^12.1.0",
-    "diff": "^5.2.0",
-    "ink": "^6.8.0",
-    "ink-text-input": "^6.0.0",
-    "picocolors": "^1.1.1",
-    "react": "^19.2.7",
-    "tree-sitter-wasms": "^0.1.12",
-    "web-tree-sitter": "^0.25.10",
-    "yauzl": "^3.2.0"
-  },
-  "optionalDependencies": {
-    "@anthropic-ai/sdk": "^0.39.0"
-  },
-  "devDependencies": {
-    "@types/diff": "^5.2.0",
-    "@types/node": "^20.14.0",
-    "@types/react": "^19.2.17",
-    "@types/yauzl": "^2.10.3",
-    "ink-testing-library": "^4.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "securevibe",
+  "version": "0.1.14",
+  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
+  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "sast",
+    "ai security",
+    "prompt injection",
+    "vulnerability",
+    "secrets",
+    "sca",
+    "cve",
+    "launch readiness",
+    "vibe coding",
+    "cli"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "securevibe": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "data",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "node run-tests.mjs"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "diff": "^5.2.0",
+    "ink": "^6.8.0",
+    "ink-text-input": "^6.0.0",
+    "picocolors": "^1.1.1",
+    "react": "^19.2.7",
+    "tree-sitter-wasms": "^0.1.12",
+    "web-tree-sitter": "^0.25.10",
+    "yauzl": "^3.2.0"
+  },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": "^0.39.0"
+  },
+  "devDependencies": {
+    "@types/diff": "^5.2.0",
+    "@types/node": "^20.14.0",
+    "@types/react": "^19.2.17",
+    "@types/yauzl": "^2.10.3",
+    "ink-testing-library": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}