securevibe 0.1.14 → 0.1.15

package/README.md

@@ -17,8 +17,9 @@ securevibe fix <path> --apply   # apply + back up originals (asks per change)
 From a clone of this repo instead: `pnpm install && pnpm build`, then
 `node packages/cli/dist/index.js scan <path>` (`pnpm demo` scans the bundled sample).
 
-The free beta includes a daily usage limit (50 analyses per day, reset at local
-midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE).
+The free beta includes a daily usage limit, reset at local midnight (the current count and
+limit are shown after each run; the limit itself is remotely adjustable and not a fixed
+number, see below). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE).
 
 ## Commands
 
@@ -147,7 +148,11 @@ against a local copy of the [OSV](https://osv.dev) advisory database, and report
   no network. `db update` and `update` are the only commands that **download** anything (OSV
   advisory dumps, or the CLI's own next version, respectively). `pr-comment` is the only command
   that **uploads** anything, and only a findings summary already computed locally — never your
-  code or package list.
+  code or package list. Most other commands also make one small background check: a newer
+  version notice (the npm registry, cached a day, exempt under `--json`/`--sarif`/`--staged`)
+  and the current daily usage limit (a public read only endpoint, cached an hour, exempt under
+  `--staged`/`--diff`). Both are tiny GET requests for a version string or a number, and never
+  send your code, your findings, or anything else about your project.
 - **Honest framing.** A clean result reads "no known advisories as of `<db date>`", not "secure" —
   it means nothing matched the local database on that date, which is not a proof of safety.
 

package/dist/index.js

@@ -38,7 +38,7 @@ async function meter(opts = {}) {
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
-        process.stderr.write(limitMessage() + "\n");
+        process.stderr.write(limitMessage(r.limit) + "\n");
         process.exit(1);
     }
     return r;

package/dist/remote-limit.js

@@ -0,0 +1,83 @@
+/**
+ * Remote, admin editable override for the daily usage limit. Same
+ * fetch/cache/TTL/fail-open shape as update-check.ts, checking a small
+ * public endpoint instead of the npm registry. Never throws — offline, a
+ * down endpoint, an invalid value, or a corrupt cache all resolve to the
+ * last known good cached value, or ultimately to the caller supplied
+ * fallback (usage.ts's DAILY_LIMIT).
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const LIMITS_URL = "https://limits-config.vercel.app/api/limits";
+const CACHE_TTL_MS = 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1500;
+export function cacheFilePath() {
+    return path.join(os.homedir(), ".securevibe", "remote-limit.json");
+}
+/** A remote value is only trusted if it's "unlimited" or a finite positive number. */
+function isValidLimit(value) {
+    return value === "unlimited" || (typeof value === "number" && Number.isFinite(value) && value > 0);
+}
+async function readCache(file) {
+    try {
+        const raw = JSON.parse(await fs.readFile(file, "utf8"));
+        if (typeof raw?.checkedAt === "number" && isValidLimit(raw?.dailyLimit))
+            return raw;
+    }
+    catch {
+        /* missing or corrupt → treated as no cache */
+    }
+    return null;
+}
+async function writeCache(file, state) {
+    try {
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");
+    }
+    catch {
+        /* best effort — a failed write must never break the command */
+    }
+}
+export async function fetchRemoteLimit(fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetchImpl(LIMITS_URL, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        return isValidLimit(json?.dailyLimit) ? json.dailyLimit : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Returns the effective daily limit: a fresh or cached remote override when
+ * one is known and valid, else the caller supplied fallback. Never throws.
+ */
+export async function resolveDailyLimit(opts) {
+    const file = opts.file ?? cacheFilePath();
+    const now = opts.now ?? Date.now();
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const fallback = opts.fallback;
+    try {
+        const cached = await readCache(file);
+        if (cached && now - cached.checkedAt < CACHE_TTL_MS) {
+            return cached.dailyLimit;
+        }
+        const fetched = await fetchRemoteLimit(fetchImpl);
+        if (fetched !== null) {
+            await writeCache(file, { checkedAt: now, dailyLimit: fetched });
+            return fetched;
+        }
+        return cached ? cached.dailyLimit : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}

package/dist/repl.js

@@ -35,7 +35,7 @@ async function meterOrPrint(io) {
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
     if (!r.allowed) {
-        write(io, limitMessage() + "\n");
+        write(io, limitMessage(r.limit) + "\n");
         return undefined;
     }
     return r;

package/dist/ui/usage.js

@@ -7,6 +7,6 @@ function bar(fraction, width = 20) {
     return color("█".repeat(filled)) + pc.dim("░".repeat(width - filled));
 }
 export function renderUsageLine(usage) {
-    const fraction = usage.limit > 0 ? usage.used / usage.limit : 0;
+    const fraction = usage.limit === "unlimited" || usage.limit <= 0 ? 0 : usage.used / usage.limit;
     return pc.dim("  Free beta usage today  ") + bar(fraction) + pc.dim(`  ${usage.used}/${usage.limit}`);
 }

package/dist/usage.js

@@ -4,10 +4,14 @@
  * design — there is no account system yet — so this establishes the metering
  * UX honestly without pretending to be tamper-proof. The --staged commit guard
  * is never metered: a quota must not block someone's commit.
+ *
+ * The enforced limit is resolved through remote-limit.ts on every call: an
+ * admin editable value if one is known and valid, else this file's DAILY_LIMIT.
  */
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { resolveDailyLimit } from "./remote-limit.js";
 export const DAILY_LIMIT = 200;
 export function usageFilePath() {
     return path.join(os.homedir(), ".securevibe", "usage.json");
@@ -19,10 +23,10 @@ export function localDay(now = new Date()) {
     const d = String(now.getDate()).padStart(2, "0");
     return `${y}-${m}-${d}`;
 }
-/** Pure state transition: same day increments, a new day resets, limit blocks. */
+/** Pure state transition: same day increments, a new day resets, limit blocks — "unlimited" never blocks. */
 export function nextUsage(state, today, limit = DAILY_LIMIT) {
     const base = state && state.date === today ? state : { date: today, count: 0 };
-    if (base.count >= limit) {
+    if (limit !== "unlimited" && base.count >= limit) {
         return { state: base, result: { allowed: false, used: base.count, limit } };
     }
     const next = { date: today, count: base.count + 1 };
@@ -42,12 +46,13 @@ async function readState(file) {
 }
 /**
  * Record one use against today's quota. Returns whether the command may run.
- * Metering failures (unwritable home, etc.) never break the tool: on any IO
- * error the use is allowed.
+ * Metering failures (unwritable home, unreachable remote limit, etc.) never
+ * break the tool: on any IO error the use is allowed.
  */
-export async function recordUse(file = usageFilePath(), now = new Date()) {
+export async function recordUse(file = usageFilePath(), now = new Date(), resolveLimit = () => resolveDailyLimit({ fallback: DAILY_LIMIT })) {
     try {
-        const { state, result } = nextUsage(await readState(file), localDay(now));
+        const limit = await resolveLimit();
+        const { state, result } = nextUsage(await readState(file), localDay(now), limit);
         if (result.allowed) {
             await fs.mkdir(path.dirname(file), { recursive: true });
             await fs.writeFile(file, JSON.stringify(state) + "\n", "utf8");

package/dist/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the CLI's own version, so it can't drift from
 // what commander reports and what the update-check compares against.
 // Kept in sync with the "version" field in package.json by hand at release time.
-export const VERSION = "0.1.14";
+export const VERSION = "0.1.15";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securevibe",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",