securevibe 0.1.13 → 0.1.15

package/README.md

@@ -17,8 +17,9 @@ securevibe fix <path> --apply   # apply + back up originals (asks per change)
 From a clone of this repo instead: `pnpm install && pnpm build`, then
 `node packages/cli/dist/index.js scan <path>` (`pnpm demo` scans the bundled sample).
 
-The free beta includes a daily usage limit (50 analyses per day, reset at local
-midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE).
+The free beta includes a daily usage limit, reset at local midnight (the current count and
+limit are shown after each run; the limit itself is remotely adjustable and not a fixed
+number, see below). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE).
 
 ## Commands
 
@@ -31,6 +32,7 @@ midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE
 | `securevibe pr-comment [path]` | Post/update a PR findings summary (used by the GitHub Actions workflow) |
 | `securevibe deps [path]` | Audit dependencies for known CVEs against the local OSV database (SCA) |
 | `securevibe db <update\|status>` | Manage the local OSV database — `update` is networked |
+| `securevibe update` | Update securevibe itself to the latest published version (also networked) |
 | `securevibe ready [path]` | Launch readiness scorecard: pass/fail gates + go/no-go verdict |
 | `securevibe ai-audit [path]` | Focus on the AI-agent attack surface (doc 04) |
 | `securevibe protect [path]` | Remediation-first view: the fix for every finding (doc 05) |
@@ -71,7 +73,8 @@ is sent to your provider. Needs the same key as `fix` and `explain`
 - a **GitHub Actions workflow** (`.github/workflows/securevibe.yml`) that scans every PR and uploads
   SARIF to GitHub code scanning, gates the build on deployment-readiness, and posts a PR comment
   summarizing findings in the *changed* files only (updated in place on new commits, not reposted —
-  and the only other command besides `db update` that talks to the network, and only to post a
+  and one of the few other commands (besides `db update` and `update`) that talks to the network,
+  and only to post a
   findings summary already computed locally, never your source code);
 - gitignores `.env` / backups and drops a minimal `securevibe.config.json`.
 
@@ -142,9 +145,14 @@ against a local copy of the [OSV](https://osv.dev) advisory database, and report
   CVE still blocks deployment, and `securevibe fix` bumps the package to the lowest non vulnerable
   version while preserving your range prefix (`^`, `~`, `==`, ...).
 - **Offline first.** A bundled seed (`data/osv-seed.json`) ships with the CLI, so `deps` works with
-  no network. `db update` is the only command that **downloads** anything (the public OSV npm and
-  PyPI dumps, into `~/.securevibe/db`). `pr-comment` is the only command that **uploads** anything,
-  and only a findings summary already computed locally — never your code or package list.
+  no network. `db update` and `update` are the only commands that **download** anything (OSV
+  advisory dumps, or the CLI's own next version, respectively). `pr-comment` is the only command
+  that **uploads** anything, and only a findings summary already computed locally — never your
+  code or package list. Most other commands also make one small background check: a newer
+  version notice (the npm registry, cached a day, exempt under `--json`/`--sarif`/`--staged`)
+  and the current daily usage limit (a public read only endpoint, cached an hour, exempt under
+  `--staged`/`--diff`). Both are tiny GET requests for a version string or a number, and never
+  send your code, your findings, or anything else about your project.
 - **Honest framing.** A clean result reads "no known advisories as of `<db date>`", not "secure" —
   it means nothing matched the local database on that date, which is not a proof of safety.
 

package/dist/index.js

@@ -38,7 +38,7 @@ async function meter(opts = {}) {
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
-        process.stderr.write(limitMessage() + "\n");
+        process.stderr.write(limitMessage(r.limit) + "\n");
         process.exit(1);
     }
     return r;
@@ -353,6 +353,18 @@ program
     process.stderr.write(`  unknown db action: ${action} (use: update | status)\n`);
     process.exit(64);
 });
+program
+    .command("update")
+    .description("Update securevibe to the latest published version (npm global installs only)")
+    .option("--no-color", "disable coloured output")
+    .action(async (opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    const { runUpdateCommand } = await import("./update-command.js");
+    const code = await runUpdateCommand();
+    if (code !== 0)
+        process.exit(code);
+});
 program
     .command("config")
     .description("Manage local AI-fixer provider keys (Groq/Anthropic), stored in ~/.securevibe/config.json")

package/dist/remote-limit.js

@@ -0,0 +1,83 @@
+/**
+ * Remote, admin editable override for the daily usage limit. Same
+ * fetch/cache/TTL/fail-open shape as update-check.ts, checking a small
+ * public endpoint instead of the npm registry. Never throws — offline, a
+ * down endpoint, an invalid value, or a corrupt cache all resolve to the
+ * last known good cached value, or ultimately to the caller supplied
+ * fallback (usage.ts's DAILY_LIMIT).
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const LIMITS_URL = "https://limits-config.vercel.app/api/limits";
+const CACHE_TTL_MS = 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1500;
+export function cacheFilePath() {
+    return path.join(os.homedir(), ".securevibe", "remote-limit.json");
+}
+/** A remote value is only trusted if it's "unlimited" or a finite positive number. */
+function isValidLimit(value) {
+    return value === "unlimited" || (typeof value === "number" && Number.isFinite(value) && value > 0);
+}
+async function readCache(file) {
+    try {
+        const raw = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof raw?.checkedAt === "number" && isValidLimit(raw?.dailyLimit))
+            return raw;
+    }
+    catch {
+        /* missing or corrupt → treated as no cache */
+    }
+    return null;
+}
+async function writeCache(file, state) {
+    try {
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");
+    }
+    catch {
+        /* best effort — a failed write must never break the command */
+    }
+}
+export async function fetchRemoteLimit(fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetchImpl(LIMITS_URL, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        return isValidLimit(json?.dailyLimit) ? json.dailyLimit : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Returns the effective daily limit: a fresh or cached remote override when
+ * one is known and valid, else the caller supplied fallback. Never throws.
+ */
+export async function resolveDailyLimit(opts) {
+    const file = opts.file ?? cacheFilePath();
+    const now = opts.now ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const fallback = opts.fallback;
+    try {
+        const cached = await readCache(file);
+        if (cached && now - cached.checkedAt < CACHE_TTL_MS) {
+            return cached.dailyLimit;
+        }
+        const fetched = await fetchRemoteLimit(fetchImpl);
+        if (fetched !== null) {
+            await writeCache(file, { checkedAt: now, dailyLimit: fetched });
+            return fetched;
+        }
+        return cached ? cached.dailyLimit : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}

package/dist/repl.js

@@ -35,7 +35,7 @@ async function meterOrPrint(io) {
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
-        write(io, limitMessage() + "\n");
+        write(io, limitMessage(r.limit) + "\n");
         return undefined;
     }
     return r;

package/dist/ui/usage.js

@@ -7,6 +7,6 @@ function bar(fraction, width = 20) {
     return color("█".repeat(filled)) + pc.dim("░".repeat(width - filled));
 }
 export function renderUsageLine(usage) {
-    const fraction = usage.limit > 0 ? usage.used / usage.limit : 0;
+    const fraction = usage.limit === "unlimited" || usage.limit <= 0 ? 0 : usage.used / usage.limit;
     return pc.dim("  Free beta usage today  ") + bar(fraction) + pc.dim(`  ${usage.used}/${usage.limit}`);
 }

package/dist/update-check.js

@@ -28,6 +28,16 @@ export function isNewer(current, latest) {
     }
     return false;
 }
+/**
+ * True when the running script is npm's npx cache copy rather than a
+ * persistent global install — npx always resolves to the latest published
+ * version on every invocation, so there is nothing for `securevibe update`
+ * to do in that case. The npx cache directory is named `_npx` on both Unix
+ * (~/.npm/_npx/...) and Windows (%LocalAppData%\npm-cache\_npx\...).
+ */
+export function isRunningViaNpx(scriptPath = process.argv[1] ?? "") {
+    return scriptPath.split(/[\\/]/).includes("_npx");
+}
 async function readCache(file) {
     try {
         const raw = JSON.parse(await fs.readFile(file, "utf8"));
@@ -48,7 +58,7 @@ async function writeCache(file, state) {
         /* best effort — a failed write must never break the command */
     }
 }
-async function fetchLatest(fetchImpl) {
+export async function fetchLatest(fetchImpl) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
@@ -96,6 +106,6 @@ export async function checkForUpdate(currentVersion, opts = {}) {
 export function updateNotice(currentVersion, latestVersion) {
     return [
         `  A new version of securevibe is available: ${latestVersion} (you have ${currentVersion}).`,
-        "  Update: npm install -g securevibe",
+        "  Update: securevibe update  (or: npm install -g securevibe)",
     ].join("\n");
 }

package/dist/update-command.js

@@ -0,0 +1,79 @@
+/**
+ * `securevibe update` — an explicit, user-triggered self-update for npm
+ * global installs. Reuses the same registry check as the passive daily
+ * notice (update-check.ts) but always fetches fresh: "check right now" is
+ * the whole point of running this command instead of waiting for tomorrow's
+ * cached check.
+ */
+import { isNewer, isRunningViaNpx, fetchLatest as defaultFetchLatest } from "./update-check.js";
+import { VERSION } from "./version.js";
+async function defaultSpawnNpmInstall(write) {
+    const { spawn } = await import("node:child_process");
+    return new Promise((resolve) => {
+        const child = spawn("npm", ["install", "-g", "securevibe@latest"], {
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: process.platform === "win32",
+        });
+        let output = "";
+        const onChunk = (chunk) => {
+            const text = chunk.toString("utf8");
+            output += text;
+            write(text);
+        };
+        child.stdout?.on("data", onChunk);
+        child.stderr?.on("data", onChunk);
+        child.on("error", (err) => resolve({ code: 1, output: output + String(err?.message ?? err) }));
+        child.on("close", (code) => resolve({ code, output }));
+    });
+}
+export function defaultUpdateCommandDeps() {
+    return {
+        currentVersion: VERSION,
+        platform: process.platform,
+        isNpx: () => isRunningViaNpx(),
+        fetchLatest: defaultFetchLatest,
+        fetchImpl: fetch,
+        spawnNpmInstall: defaultSpawnNpmInstall,
+        write: (text) => process.stderr.write(text),
+    };
+}
+/**
+ * True when npm's own output looks like a permission error and a sudo
+ * re-run would plausibly help. Never true on Windows, where elevation isn't
+ * a one-line fix.
+ */
+export function shouldShowSudoHint(output, platform = process.platform) {
+    return platform !== "win32" && /eacces|permission denied/i.test(output);
+}
+/**
+ * Runs the `securevibe update` flow. Returns the process exit code (0
+ * success, 1 failure) rather than calling process.exit itself, so callers
+ * (and tests) control process lifecycle. Never throws.
+ */
+export async function runUpdateCommand(deps = {}) {
+    const d = { ...defaultUpdateCommandDeps(), ...deps };
+    if (d.isNpx()) {
+        d.write("  You're running securevibe via npx, which always uses the latest published version — nothing to update.\n");
+        return 0;
+    }
+    const latest = await d.fetchLatest(d.fetchImpl);
+    if (latest === null) {
+        d.write("  Could not reach the npm registry to check for updates. Check your network and try again.\n");
+        return 1;
+    }
+    if (!isNewer(d.currentVersion, latest)) {
+        d.write(`  Already on the latest version (${d.currentVersion}).\n`);
+        return 0;
+    }
+    d.write(`  Updating securevibe ${d.currentVersion} -> ${latest}...\n`);
+    const result = await d.spawnNpmInstall(d.write);
+    if (result.code === 0) {
+        d.write(`  Updated to ${latest}.\n`);
+        return 0;
+    }
+    d.write("  Update failed.\n");
+    if (shouldShowSudoHint(result.output, d.platform)) {
+        d.write("  Try: sudo npm install -g securevibe@latest\n");
+    }
+    return 1;
+}

package/dist/usage.js

@@ -4,10 +4,14 @@
  * design — there is no account system yet — so this establishes the metering
  * UX honestly without pretending to be tamper-proof. The --staged commit guard
  * is never metered: a quota must not block someone's commit.
+ *
+ * The enforced limit is resolved through remote-limit.ts on every call: an
+ * admin editable value if one is known and valid, else this file's DAILY_LIMIT.
  */
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { resolveDailyLimit } from "./remote-limit.js";
 export const DAILY_LIMIT = 200;
 export function usageFilePath() {
     return path.join(os.homedir(), ".securevibe", "usage.json");
@@ -19,10 +23,10 @@ export function localDay(now = new Date()) {
     const d = String(now.getDate()).padStart(2, "0");
     return `${y}-${m}-${d}`;
 }
-/** Pure state transition: same day increments, a new day resets, limit blocks. */
+/** Pure state transition: same day increments, a new day resets, limit blocks — "unlimited" never blocks. */
 export function nextUsage(state, today, limit = DAILY_LIMIT) {
     const base = state && state.date === today ? state : { date: today, count: 0 };
-    if (base.count >= limit) {
+    if (limit !== "unlimited" && base.count >= limit) {
         return { state: base, result: { allowed: false, used: base.count, limit } };
     }
     const next = { date: today, count: base.count + 1 };
@@ -42,12 +46,13 @@ async function readState(file) {
 }
 /**
  * Record one use against today's quota. Returns whether the command may run.
- * Metering failures (unwritable home, etc.) never break the tool: on any IO
- * error the use is allowed.
+ * Metering failures (unwritable home, unreachable remote limit, etc.) never
+ * break the tool: on any IO error the use is allowed.
  */
-export async function recordUse(file = usageFilePath(), now = new Date()) {
+export async function recordUse(file = usageFilePath(), now = new Date(), resolveLimit = () => resolveDailyLimit({ fallback: DAILY_LIMIT })) {
     try {
-        const { state, result } = nextUsage(await readState(file), localDay(now));
+        const limit = await resolveLimit();
+        const { state, result } = nextUsage(await readState(file), localDay(now), limit);
         if (result.allowed) {
             await fs.mkdir(path.dirname(file), { recursive: true });
             await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");

package/dist/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the CLI's own version, so it can't drift from
 // what commander reports and what the update-check compares against.
 // Kept in sync with the "version" field in package.json by hand at release time.
-export const VERSION = "0.1.13";
+export const VERSION = "0.1.15";

package/package.json

@@ -1,71 +1,71 @@
-{
-  "name": "securevibe",
-  "version": "0.1.13",
-  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
-  "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
-  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
-  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
-    "directory": "packages/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
-  },
-  "keywords": [
-    "security",
-    "scanner",
-    "sast",
-    "ai security",
-    "prompt injection",
-    "vulnerability",
-    "secrets",
-    "sca",
-    "cve",
-    "launch readiness",
-    "vibe coding",
-    "cli"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "securevibe": "./dist/index.js"
-  },
-  "files": [
-    "dist",
-    "data",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "node run-tests.mjs"
-  },
-  "dependencies": {
-    "commander": "^12.1.0",
-    "diff": "^5.2.0",
-    "ink": "^6.8.0",
-    "ink-text-input": "^6.0.0",
-    "picocolors": "^1.1.1",
-    "react": "^19.2.7",
-    "tree-sitter-wasms": "^0.1.12",
-    "web-tree-sitter": "^0.25.10",
-    "yauzl": "^3.2.0"
-  },
-  "optionalDependencies": {
-    "@anthropic-ai/sdk": "^0.39.0"
-  },
-  "devDependencies": {
-    "@types/diff": "^5.2.0",
-    "@types/node": "^20.14.0",
-    "@types/react": "^19.2.17",
-    "@types/yauzl": "^2.10.3",
-    "ink-testing-library": "^4.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "securevibe",
+  "version": "0.1.15",
+  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
+  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "sast",
+    "ai security",
+    "prompt injection",
+    "vulnerability",
+    "secrets",
+    "sca",
+    "cve",
+    "launch readiness",
+    "vibe coding",
+    "cli"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "securevibe": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "data",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "node run-tests.mjs"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "diff": "^5.2.0",
+    "ink": "^6.8.0",
+    "ink-text-input": "^6.0.0",
+    "picocolors": "^1.1.1",
+    "react": "^19.2.7",
+    "tree-sitter-wasms": "^0.1.12",
+    "web-tree-sitter": "^0.25.10",
+    "yauzl": "^3.2.0"
+  },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": "^0.39.0"
+  },
+  "devDependencies": {
+    "@types/diff": "^5.2.0",
+    "@types/node": "^20.14.0",
+    "@types/react": "^19.2.17",
+    "@types/yauzl": "^2.10.3",
+    "ink-testing-library": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}