feat(crawlproof): what the fleet costs and what it returns, as a command

[ralyodio]

crawlproof joins the other commands on every box.

crawlproof                     # the live dashboard, last day, humans
crawlproof dashboard --range=1m
crawlproof stats [site]        # who arrived and from where, as text
crawlproof dashboard --json    # the same snapshot, for a script

Five screens over three feeds that are not otherwise in the same place: the tracker for who arrived, the ad network for what was delivered, and CoinPay for what the bank actually did. ROI is monthly burn against revenue, cost per reader and break-even; Traffic ranks every site with its share of the cost; Ads is delivery on both sides; Money is earnings, bank position and invoices; Spend is who you pay, largest first.

Bare crawlproof opens the dashboard rather than printing usage — the reason to type it on a box is to look at it.

The private prefix matters more here than for hqtui

hqtui wraps a package whose executable is hqtui-demo, so the names differ. Here upstream's executable is called crawlproof and so is this wrapper. A global install would put two of them on PATH, whichever came first would win, and there is a real chance of the command exec'ing itself.

So it installs into ~/.local/share/cli-tools/vendor/crawlproof, and resolveRunner refuses to follow a PATH entry that resolves back into this repo's bin/. That refusal is load-bearing rather than defensive, and has its own test.

Credentials are reported, not enforced

A missing API token is named before handing over, because the failure it prevents is a 401 from inside a TUI — where there is nowhere good to explain anything. The CoinPay session is probed separately and never required: four of the five screens work without it, and the money panels say what is missing rather than showing zero.

Verified

Ran the wrapper end to end against production with CRAWLPROOF_BIN pointed at the built package: crawlproof stats crawlproof.com returned real numbers, reading the token from ~/.crawlproof.json with nothing exported. Bare invocation correctly refuses without a TTY and points at --json.

bin/*.ts is auto-discovered by install-links.mjs, so nothing else needs wiring.

Tests: 719 passing (17 new). npm run typecheck reports 2 errors in src/free-names.ts and src/generate-names.ts — both pre-existing, identical on master, untouched here.

Depends on

@profullstack/crawlproof being published — profullstack/crawlproof.com#241, which is stacked on #240. Until it is on npm the first run has nothing to install, so this should land alongside that publish.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD

[github-actions]

ThreatCrush Security Scan

10 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 4

Severity	Rule	Location
HIGH	sh-remote-script-execution	root-ubuntu.sh:3004
HIGH	sh-remote-script-execution	root-ubuntu.sh:3008
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:3157
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:4186
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/mail.ts:1042
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:135
LOW	secret-generic-credential	test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.