@codebakers/cli 2.5.0 → 2.6.1

package/dist/commands/install.js

@@ -9,6 +9,7 @@ const ora_1 = __importDefault(require("ora"));
 const fs_1 = require("fs");
 const path_1 = require("path");
 const config_js_1 = require("../config.js");
+const api_js_1 = require("../lib/api.js");
 async function install() {
     console.log(chalk_1.default.blue('\n  CodeBakers Install\n'));
     const apiKey = (0, config_js_1.getApiKey)();
@@ -41,14 +42,22 @@ async function install() {
             (0, fs_1.writeFileSync)((0, path_1.join)(cwd, 'CLAUDE.md'), content.router);
         }
         // Write modules
+        const modulesDir = (0, path_1.join)(cwd, '.claude');
         if (content.modules && Object.keys(content.modules).length > 0) {
-            const modulesDir = (0, path_1.join)(cwd, '.claude');
             if (!(0, fs_1.existsSync)(modulesDir)) {
                 (0, fs_1.mkdirSync)(modulesDir, { recursive: true });
             }
             for (const [name, data] of Object.entries(content.modules)) {
                 (0, fs_1.writeFileSync)((0, path_1.join)(modulesDir, name), data);
             }
+            // Write version file for tracking
+            const versionInfo = {
+                version: content.version,
+                moduleCount: Object.keys(content.modules).length,
+                installedAt: new Date().toISOString(),
+                cliVersion: (0, api_js_1.getCliVersion)(),
+            };
+            (0, fs_1.writeFileSync)((0, path_1.join)(modulesDir, '.version.json'), JSON.stringify(versionInfo, null, 2));
         }
         // Add to .gitignore if not present
         const gitignorePath = (0, path_1.join)(cwd, '.gitignore');

package/dist/commands/upgrade.js

@@ -74,6 +74,15 @@ async function upgrade() {
             }
             console.log(chalk_1.default.green(`  ✓ Updated ${moduleCount} modules in .claude/`));
         }
+        // Write version file for tracking
+        const versionInfo = {
+            version: content.version,
+            moduleCount,
+            updatedAt: new Date().toISOString(),
+            cliVersion: (0, api_js_1.getCliVersion)(),
+        };
+        (0, fs_1.writeFileSync)((0, path_1.join)(claudeDir, '.version.json'), JSON.stringify(versionInfo, null, 2));
+        console.log(chalk_1.default.green('  ✓ Version info saved'));
         console.log(chalk_1.default.green(`\n  ✅ Upgraded to patterns v${content.version}!\n`));
         // Show what's new if available
         console.log(chalk_1.default.gray('  Changes take effect in your next AI session.\n'));

package/dist/mcp/server.js

@@ -41,6 +41,7 @@ const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const config_js_1 = require("../config.js");
 const audit_js_1 = require("../commands/audit.js");
 const heal_js_1 = require("../commands/heal.js");
+const api_js_1 = require("../lib/api.js");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
@@ -239,6 +240,46 @@ class CodeBakersServer {
         }
         return context;
     }
+    async checkPatternVersion() {
+        const cwd = process.cwd();
+        const versionPath = path.join(cwd, '.claude', '.version.json');
+        // Read local version
+        let installed = null;
+        if (fs.existsSync(versionPath)) {
+            try {
+                installed = JSON.parse(fs.readFileSync(versionPath, 'utf-8'));
+            }
+            catch {
+                // Ignore parse errors
+            }
+        }
+        // Fetch latest version from API
+        let latest = null;
+        try {
+            const response = await fetch(`${this.apiUrl}/api/content/version`, {
+                headers: this.apiKey ? { 'Authorization': `Bearer ${this.apiKey}` } : {},
+            });
+            if (response.ok) {
+                latest = await response.json();
+            }
+        }
+        catch {
+            // Ignore fetch errors
+        }
+        // Compare versions
+        let updateAvailable = false;
+        let message = null;
+        if (installed && latest) {
+            if (installed.version !== latest.version) {
+                updateAvailable = true;
+                message = `⚠️ Pattern update available: v${installed.version} → v${latest.version} (${latest.moduleCount - installed.moduleCount} new modules)\n   Run \`codebakers upgrade\` to update`;
+            }
+        }
+        else if (!installed && latest) {
+            message = `ℹ️ No version tracking found. Run \`codebakers upgrade\` to sync patterns`;
+        }
+        return { installed, latest, updateAvailable, message };
+    }
     formatContextForPrompt(context) {
         const lines = [];
         lines.push(`Project: ${context.projectName}`);
@@ -602,7 +643,7 @@ class CodeBakersServer {
                 case 'get_experience_level':
                     return this.handleGetExperienceLevel();
                 case 'get_status':
-                    return this.handleGetStatus();
+                    return await this.handleGetStatus();
                 case 'run_audit':
                     return this.handleRunAudit();
                 case 'heal':
@@ -1400,16 +1441,28 @@ phase: development
             };
         }
     }
-    handleGetStatus() {
+    async handleGetStatus() {
         const level = (0, config_js_1.getExperienceLevel)();
         const context = this.gatherProjectContext();
+        const versionCheck = await this.checkPatternVersion();
+        const cliVersion = (0, api_js_1.getCliVersion)();
+        // Build version status section
+        let versionSection = `- **CLI Version:** ${cliVersion}`;
+        if (versionCheck.installed) {
+            versionSection += `\n- **Patterns Version:** ${versionCheck.installed.version} (${versionCheck.installed.moduleCount} modules)`;
+        }
+        // Build update alert if needed
+        let updateAlert = '';
+        if (versionCheck.message) {
+            updateAlert = `\n\n## ${versionCheck.updateAvailable ? '⚠️ Update Available' : 'ℹ️ Version Info'}\n${versionCheck.message}\n`;
+        }
         const statusText = `# ✅ CodeBakers is Active!
 
 ## Connection Status
 - **MCP Server:** Running
 - **API Connected:** Yes
-- **Version:** 2.2.0
-
+${versionSection}
+${updateAlert}
 ## Current Settings
 - **Experience Level:** ${level.charAt(0).toUpperCase() + level.slice(1)}
 - **Project:** ${context.projectName}
@@ -1646,6 +1699,248 @@ Just describe what you want to build! I'll automatically:
         catch {
             response += `*(TODO scan unavailable)*\n\n`;
         }
+        // Dependency Security Scan (npm audit)
+        response += `### 🔒 Dependency Security Scan\n\n`;
+        try {
+            const auditOutput = (0, child_process_1.execSync)('npm audit --json 2>/dev/null', {
+                cwd,
+                encoding: 'utf-8',
+                timeout: 30000,
+            });
+            const audit = JSON.parse(auditOutput);
+            const vulns = audit.metadata?.vulnerabilities || {};
+            const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+            if (total > 0) {
+                response += `Found **${total} vulnerabilities**:\n\n`;
+                if (vulns.critical > 0)
+                    response += `- 🔴 **${vulns.critical} Critical**\n`;
+                if (vulns.high > 0)
+                    response += `- 🟠 **${vulns.high} High**\n`;
+                if (vulns.moderate > 0)
+                    response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+                if (vulns.low > 0)
+                    response += `- 🟢 **${vulns.low} Low**\n`;
+                response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+            }
+            else {
+                response += `✅ No known vulnerabilities in dependencies!\n\n`;
+            }
+        }
+        catch (error) {
+            // npm audit exits with non-zero if vulnerabilities found
+            const execError = error;
+            if (execError.stdout) {
+                try {
+                    const audit = JSON.parse(execError.stdout);
+                    const vulns = audit.metadata?.vulnerabilities || {};
+                    const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+                    if (total > 0) {
+                        response += `Found **${total} vulnerabilities**:\n\n`;
+                        if (vulns.critical > 0)
+                            response += `- 🔴 **${vulns.critical} Critical**\n`;
+                        if (vulns.high > 0)
+                            response += `- 🟠 **${vulns.high} High**\n`;
+                        if (vulns.moderate > 0)
+                            response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+                        if (vulns.low > 0)
+                            response += `- 🟢 **${vulns.low} Low**\n`;
+                        response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+                    }
+                }
+                catch {
+                    response += `*(Dependency scan unavailable)*\n\n`;
+                }
+            }
+            else {
+                response += `*(Dependency scan unavailable)*\n\n`;
+            }
+        }
+        // TypeScript Strictness Check
+        response += `### 📝 TypeScript Configuration\n\n`;
+        try {
+            const tsconfigPath = path.join(cwd, 'tsconfig.json');
+            if (fs.existsSync(tsconfigPath)) {
+                const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, 'utf-8'));
+                const compilerOptions = tsconfig.compilerOptions || {};
+                const checks = [
+                    { name: 'strict', value: compilerOptions.strict, recommended: true },
+                    { name: 'noImplicitAny', value: compilerOptions.noImplicitAny, recommended: true },
+                    { name: 'strictNullChecks', value: compilerOptions.strictNullChecks, recommended: true },
+                    { name: 'noUnusedLocals', value: compilerOptions.noUnusedLocals, recommended: true },
+                    { name: 'noUnusedParameters', value: compilerOptions.noUnusedParameters, recommended: true },
+                ];
+                const enabled = checks.filter(c => c.value === true);
+                const missing = checks.filter(c => c.value !== true && c.recommended);
+                if (compilerOptions.strict === true) {
+                    response += `✅ **Strict mode enabled** - Good!\n\n`;
+                }
+                else {
+                    response += `⚠️ **Strict mode not enabled**\n\n`;
+                    if (missing.length > 0) {
+                        response += `Missing recommended options:\n`;
+                        missing.forEach(m => {
+                            response += `- \`${m.name}: true\`\n`;
+                        });
+                        response += `\n`;
+                    }
+                }
+                // Check for any types
+                try {
+                    const anyCount = (0, child_process_1.execSync)('grep -r ": any" --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v node_modules | wc -l', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                    const count = parseInt(anyCount);
+                    if (count > 10) {
+                        response += `⚠️ Found **${count}** uses of \`: any\` - consider typing these\n\n`;
+                    }
+                    else if (count > 0) {
+                        response += `📝 Found **${count}** uses of \`: any\`\n\n`;
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            else {
+                response += `⚠️ No tsconfig.json found - not a TypeScript project?\n\n`;
+            }
+        }
+        catch {
+            response += `*(TypeScript check unavailable)*\n\n`;
+        }
+        // Environment Variable Audit
+        response += `### 🔐 Environment Variable Audit\n\n`;
+        try {
+            const envExamplePath = path.join(cwd, '.env.example');
+            const envLocalPath = path.join(cwd, '.env.local');
+            const envPath = path.join(cwd, '.env');
+            const hasEnvExample = fs.existsSync(envExamplePath);
+            const hasEnvLocal = fs.existsSync(envLocalPath);
+            const hasEnv = fs.existsSync(envPath);
+            if (hasEnvExample) {
+                response += `✅ \`.env.example\` exists - good for documentation\n`;
+            }
+            else {
+                response += `⚠️ No \`.env.example\` - add one for team onboarding\n`;
+            }
+            // Check for hardcoded secrets in code
+            try {
+                const secretPatterns = [
+                    'sk-[a-zA-Z0-9]{20,}', // OpenAI keys
+                    'sk_live_[a-zA-Z0-9]+', // Stripe live keys
+                    'pk_live_[a-zA-Z0-9]+', // Stripe public live keys
+                    'ghp_[a-zA-Z0-9]+', // GitHub tokens
+                    'AKIA[A-Z0-9]{16}', // AWS access keys
+                ];
+                let secretsFound = 0;
+                for (const pattern of secretPatterns) {
+                    try {
+                        const matches = (0, child_process_1.execSync)(`grep -rE "${pattern}" --include="*.ts" --include="*.tsx" --include="*.js" 2>/dev/null | grep -v node_modules | grep -v ".env" | wc -l`, { cwd, encoding: 'utf-8', timeout: 5000 }).trim();
+                        secretsFound += parseInt(matches) || 0;
+                    }
+                    catch {
+                        // Pattern not found
+                    }
+                }
+                if (secretsFound > 0) {
+                    response += `\n🔴 **CRITICAL: Found ${secretsFound} potential hardcoded secrets in code!**\n`;
+                    response += `*These should be moved to environment variables immediately.*\n`;
+                }
+                else {
+                    response += `\n✅ No hardcoded secrets detected in code\n`;
+                }
+            }
+            catch {
+                // Ignore
+            }
+            // Check if .env is gitignored
+            try {
+                const gitignorePath = path.join(cwd, '.gitignore');
+                if (fs.existsSync(gitignorePath)) {
+                    const gitignore = fs.readFileSync(gitignorePath, 'utf-8');
+                    if (!gitignore.includes('.env')) {
+                        response += `\n⚠️ \`.env\` not in .gitignore - secrets could be committed!\n`;
+                    }
+                }
+            }
+            catch {
+                // Ignore
+            }
+            response += `\n`;
+        }
+        catch {
+            response += `*(Environment audit unavailable)*\n\n`;
+        }
+        // Test Coverage Analysis
+        response += `### 🧪 Test Coverage\n\n`;
+        try {
+            const hasPlaywright = context.dependencies.includes('@playwright/test');
+            const hasVitest = context.dependencies.includes('vitest');
+            const hasJest = context.dependencies.includes('jest');
+            if (hasPlaywright || hasVitest || hasJest) {
+                const framework = hasPlaywright ? 'Playwright' : hasVitest ? 'Vitest' : 'Jest';
+                response += `✅ Test framework detected: **${framework}**\n\n`;
+                // Count test files
+                try {
+                    const testFiles = (0, child_process_1.execSync)('find . -name "*.test.ts" -o -name "*.test.tsx" -o -name "*.spec.ts" -o -name "*.spec.tsx" 2>/dev/null | grep -v node_modules | wc -l', { cwd, encoding: 'utf-8', timeout: 10000 }).trim();
+                    const count = parseInt(testFiles);
+                    if (count > 0) {
+                        response += `Found **${count} test files**\n\n`;
+                    }
+                    else {
+                        response += `⚠️ No test files found - add tests!\n\n`;
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            else {
+                response += `⚠️ **No test framework detected**\n\n`;
+                response += `Recommended: Add \`vitest\` or \`@playwright/test\`\n\n`;
+            }
+        }
+        catch {
+            response += `*(Test analysis unavailable)*\n\n`;
+        }
+        // API Endpoint Inventory
+        response += `### 🔌 API Endpoint Inventory\n\n`;
+        if (context.existingApiRoutes.length > 0) {
+            response += `Found **${context.existingApiRoutes.length} API routes**:\n\n`;
+            // Check for auth protection on routes
+            let protectedCount = 0;
+            let unprotectedCount = 0;
+            for (const route of context.existingApiRoutes.slice(0, 10)) {
+                try {
+                    const routePath = path.join(cwd, route);
+                    if (fs.existsSync(routePath)) {
+                        const content = fs.readFileSync(routePath, 'utf-8');
+                        const hasAuth = content.includes('getServerSession') ||
+                            content.includes('auth(') ||
+                            content.includes('requireAuth') ||
+                            content.includes('Authorization') ||
+                            content.includes('authenticate');
+                        if (hasAuth) {
+                            protectedCount++;
+                        }
+                        else {
+                            unprotectedCount++;
+                        }
+                    }
+                }
+                catch {
+                    // Ignore
+                }
+            }
+            if (protectedCount > 0 || unprotectedCount > 0) {
+                response += `- 🔒 **${protectedCount}** routes with auth checks\n`;
+                response += `- 🔓 **${unprotectedCount}** routes without visible auth\n\n`;
+                if (unprotectedCount > protectedCount) {
+                    response += `⚠️ *Many routes lack visible auth - review if intentional*\n\n`;
+                }
+            }
+        }
+        else {
+            response += `No API routes detected yet.\n\n`;
+        }
         response += `---\n\n`;
         // Scan for upgrade opportunities
         response += `## Upgrade Opportunities\n\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codebakers/cli",
-  "version": "2.5.0",
+  "version": "2.6.1",
   "description": "CodeBakers CLI - Production patterns for AI-assisted development",
   "main": "dist/index.js",
   "bin": {

package/src/commands/install.ts

@@ -3,6 +3,7 @@ import ora from 'ora';
 import { writeFileSync, mkdirSync, existsSync } from 'fs';
 import { join } from 'path';
 import { getApiKey, getApiUrl } from '../config.js';
+import { getCliVersion } from '../lib/api.js';
 
 interface ContentResponse {
   version: string;
@@ -51,8 +52,8 @@ export async function install(): Promise<void> {
     }
 
     // Write modules
+    const modulesDir = join(cwd, '.claude');
     if (content.modules && Object.keys(content.modules).length > 0) {
-      const modulesDir = join(cwd, '.claude');
       if (!existsSync(modulesDir)) {
         mkdirSync(modulesDir, { recursive: true });
       }
@@ -60,6 +61,15 @@ export async function install(): Promise<void> {
       for (const [name, data] of Object.entries(content.modules)) {
         writeFileSync(join(modulesDir, name), data);
       }
+
+      // Write version file for tracking
+      const versionInfo = {
+        version: content.version,
+        moduleCount: Object.keys(content.modules).length,
+        installedAt: new Date().toISOString(),
+        cliVersion: getCliVersion(),
+      };
+      writeFileSync(join(modulesDir, '.version.json'), JSON.stringify(versionInfo, null, 2));
     }
 
     // Add to .gitignore if not present

package/src/commands/upgrade.ts

@@ -91,6 +91,16 @@ export async function upgrade(): Promise<void> {
       console.log(chalk.green(`  ✓ Updated ${moduleCount} modules in .claude/`));
     }
 
+    // Write version file for tracking
+    const versionInfo = {
+      version: content.version,
+      moduleCount,
+      updatedAt: new Date().toISOString(),
+      cliVersion: getCliVersion(),
+    };
+    writeFileSync(join(claudeDir, '.version.json'), JSON.stringify(versionInfo, null, 2));
+    console.log(chalk.green('  ✓ Version info saved'));
+
     console.log(chalk.green(`\n  ✅ Upgraded to patterns v${content.version}!\n`));
 
     // Show what's new if available

package/src/mcp/server.ts

@@ -11,11 +11,21 @@ import {
 import { getApiKey, getApiUrl, getExperienceLevel, setExperienceLevel, type ExperienceLevel } from '../config.js';
 import { audit as runAudit } from '../commands/audit.js';
 import { heal as runHeal } from '../commands/heal.js';
+import { getCliVersion } from '../lib/api.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import * as templates from '../templates/nextjs-supabase.js';
 
+// Version info type
+interface VersionInfo {
+  version: string;
+  moduleCount: number;
+  installedAt?: string;
+  updatedAt?: string;
+  cliVersion: string;
+}
+
 // Pattern cache to avoid repeated API calls
 const patternCache = new Map<string, { content: string; timestamp: number }>();
 const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
@@ -243,6 +253,54 @@ class CodeBakersServer {
     return context;
   }
 
+  private async checkPatternVersion(): Promise<{
+    installed: VersionInfo | null;
+    latest: { version: string; moduleCount: number } | null;
+    updateAvailable: boolean;
+    message: string | null;
+  }> {
+    const cwd = process.cwd();
+    const versionPath = path.join(cwd, '.claude', '.version.json');
+
+    // Read local version
+    let installed: VersionInfo | null = null;
+    if (fs.existsSync(versionPath)) {
+      try {
+        installed = JSON.parse(fs.readFileSync(versionPath, 'utf-8'));
+      } catch {
+        // Ignore parse errors
+      }
+    }
+
+    // Fetch latest version from API
+    let latest: { version: string; moduleCount: number } | null = null;
+    try {
+      const response = await fetch(`${this.apiUrl}/api/content/version`, {
+        headers: this.apiKey ? { 'Authorization': `Bearer ${this.apiKey}` } : {},
+      });
+      if (response.ok) {
+        latest = await response.json();
+      }
+    } catch {
+      // Ignore fetch errors
+    }
+
+    // Compare versions
+    let updateAvailable = false;
+    let message: string | null = null;
+
+    if (installed && latest) {
+      if (installed.version !== latest.version) {
+        updateAvailable = true;
+        message = `⚠️ Pattern update available: v${installed.version} → v${latest.version} (${latest.moduleCount - installed.moduleCount} new modules)\n   Run \`codebakers upgrade\` to update`;
+      }
+    } else if (!installed && latest) {
+      message = `ℹ️ No version tracking found. Run \`codebakers upgrade\` to sync patterns`;
+    }
+
+    return { installed, latest, updateAvailable, message };
+  }
+
   private formatContextForPrompt(context: ProjectContext): string {
     const lines: string[] = [];
 
@@ -651,7 +709,7 @@ class CodeBakersServer {
           return this.handleGetExperienceLevel();
 
         case 'get_status':
-          return this.handleGetStatus();
+          return await this.handleGetStatus();
 
         case 'run_audit':
           return this.handleRunAudit();
@@ -1579,17 +1637,31 @@ phase: development
     }
   }
 
-  private handleGetStatus() {
+  private async handleGetStatus() {
     const level = getExperienceLevel();
     const context = this.gatherProjectContext();
+    const versionCheck = await this.checkPatternVersion();
+    const cliVersion = getCliVersion();
+
+    // Build version status section
+    let versionSection = `- **CLI Version:** ${cliVersion}`;
+    if (versionCheck.installed) {
+      versionSection += `\n- **Patterns Version:** ${versionCheck.installed.version} (${versionCheck.installed.moduleCount} modules)`;
+    }
+
+    // Build update alert if needed
+    let updateAlert = '';
+    if (versionCheck.message) {
+      updateAlert = `\n\n## ${versionCheck.updateAvailable ? '⚠️ Update Available' : 'ℹ️ Version Info'}\n${versionCheck.message}\n`;
+    }
 
     const statusText = `# ✅ CodeBakers is Active!
 
 ## Connection Status
 - **MCP Server:** Running
 - **API Connected:** Yes
-- **Version:** 2.2.0
-
+${versionSection}
+${updateAlert}
 ## Current Settings
 - **Experience Level:** ${level.charAt(0).toUpperCase() + level.slice(1)}
 - **Project:** ${context.projectName}
@@ -1859,6 +1931,251 @@ Just describe what you want to build! I'll automatically:
       response += `*(TODO scan unavailable)*\n\n`;
     }
 
+    // Dependency Security Scan (npm audit)
+    response += `### 🔒 Dependency Security Scan\n\n`;
+    try {
+      const auditOutput = execSync('npm audit --json 2>/dev/null', {
+        cwd,
+        encoding: 'utf-8',
+        timeout: 30000,
+      });
+      const audit = JSON.parse(auditOutput);
+      const vulns = audit.metadata?.vulnerabilities || {};
+      const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+
+      if (total > 0) {
+        response += `Found **${total} vulnerabilities**:\n\n`;
+        if (vulns.critical > 0) response += `- 🔴 **${vulns.critical} Critical**\n`;
+        if (vulns.high > 0) response += `- 🟠 **${vulns.high} High**\n`;
+        if (vulns.moderate > 0) response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+        if (vulns.low > 0) response += `- 🟢 **${vulns.low} Low**\n`;
+        response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+      } else {
+        response += `✅ No known vulnerabilities in dependencies!\n\n`;
+      }
+    } catch (error) {
+      // npm audit exits with non-zero if vulnerabilities found
+      const execError = error as { stdout?: string };
+      if (execError.stdout) {
+        try {
+          const audit = JSON.parse(execError.stdout);
+          const vulns = audit.metadata?.vulnerabilities || {};
+          const total = (vulns.critical || 0) + (vulns.high || 0) + (vulns.moderate || 0) + (vulns.low || 0);
+
+          if (total > 0) {
+            response += `Found **${total} vulnerabilities**:\n\n`;
+            if (vulns.critical > 0) response += `- 🔴 **${vulns.critical} Critical**\n`;
+            if (vulns.high > 0) response += `- 🟠 **${vulns.high} High**\n`;
+            if (vulns.moderate > 0) response += `- 🟡 **${vulns.moderate} Moderate**\n`;
+            if (vulns.low > 0) response += `- 🟢 **${vulns.low} Low**\n`;
+            response += `\n*Run \`npm audit fix\` to auto-fix, or \`npm audit\` for details.*\n\n`;
+          }
+        } catch {
+          response += `*(Dependency scan unavailable)*\n\n`;
+        }
+      } else {
+        response += `*(Dependency scan unavailable)*\n\n`;
+      }
+    }
+
+    // TypeScript Strictness Check
+    response += `### 📝 TypeScript Configuration\n\n`;
+    try {
+      const tsconfigPath = path.join(cwd, 'tsconfig.json');
+      if (fs.existsSync(tsconfigPath)) {
+        const tsconfig = JSON.parse(fs.readFileSync(tsconfigPath, 'utf-8'));
+        const compilerOptions = tsconfig.compilerOptions || {};
+
+        const checks = [
+          { name: 'strict', value: compilerOptions.strict, recommended: true },
+          { name: 'noImplicitAny', value: compilerOptions.noImplicitAny, recommended: true },
+          { name: 'strictNullChecks', value: compilerOptions.strictNullChecks, recommended: true },
+          { name: 'noUnusedLocals', value: compilerOptions.noUnusedLocals, recommended: true },
+          { name: 'noUnusedParameters', value: compilerOptions.noUnusedParameters, recommended: true },
+        ];
+
+        const enabled = checks.filter(c => c.value === true);
+        const missing = checks.filter(c => c.value !== true && c.recommended);
+
+        if (compilerOptions.strict === true) {
+          response += `✅ **Strict mode enabled** - Good!\n\n`;
+        } else {
+          response += `⚠️ **Strict mode not enabled**\n\n`;
+          if (missing.length > 0) {
+            response += `Missing recommended options:\n`;
+            missing.forEach(m => {
+              response += `- \`${m.name}: true\`\n`;
+            });
+            response += `\n`;
+          }
+        }
+
+        // Check for any types
+        try {
+          const anyCount = execSync(
+            'grep -r ": any" --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v node_modules | wc -l',
+            { cwd, encoding: 'utf-8', timeout: 10000 }
+          ).trim();
+          const count = parseInt(anyCount);
+          if (count > 10) {
+            response += `⚠️ Found **${count}** uses of \`: any\` - consider typing these\n\n`;
+          } else if (count > 0) {
+            response += `📝 Found **${count}** uses of \`: any\`\n\n`;
+          }
+        } catch {
+          // Ignore
+        }
+      } else {
+        response += `⚠️ No tsconfig.json found - not a TypeScript project?\n\n`;
+      }
+    } catch {
+      response += `*(TypeScript check unavailable)*\n\n`;
+    }
+
+    // Environment Variable Audit
+    response += `### 🔐 Environment Variable Audit\n\n`;
+    try {
+      const envExamplePath = path.join(cwd, '.env.example');
+      const envLocalPath = path.join(cwd, '.env.local');
+      const envPath = path.join(cwd, '.env');
+
+      const hasEnvExample = fs.existsSync(envExamplePath);
+      const hasEnvLocal = fs.existsSync(envLocalPath);
+      const hasEnv = fs.existsSync(envPath);
+
+      if (hasEnvExample) {
+        response += `✅ \`.env.example\` exists - good for documentation\n`;
+      } else {
+        response += `⚠️ No \`.env.example\` - add one for team onboarding\n`;
+      }
+
+      // Check for hardcoded secrets in code
+      try {
+        const secretPatterns = [
+          'sk-[a-zA-Z0-9]{20,}',  // OpenAI keys
+          'sk_live_[a-zA-Z0-9]+', // Stripe live keys
+          'pk_live_[a-zA-Z0-9]+', // Stripe public live keys
+          'ghp_[a-zA-Z0-9]+',     // GitHub tokens
+          'AKIA[A-Z0-9]{16}',     // AWS access keys
+        ];
+
+        let secretsFound = 0;
+        for (const pattern of secretPatterns) {
+          try {
+            const matches = execSync(
+              `grep -rE "${pattern}" --include="*.ts" --include="*.tsx" --include="*.js" 2>/dev/null | grep -v node_modules | grep -v ".env" | wc -l`,
+              { cwd, encoding: 'utf-8', timeout: 5000 }
+            ).trim();
+            secretsFound += parseInt(matches) || 0;
+          } catch {
+            // Pattern not found
+          }
+        }
+
+        if (secretsFound > 0) {
+          response += `\n🔴 **CRITICAL: Found ${secretsFound} potential hardcoded secrets in code!**\n`;
+          response += `*These should be moved to environment variables immediately.*\n`;
+        } else {
+          response += `\n✅ No hardcoded secrets detected in code\n`;
+        }
+      } catch {
+        // Ignore
+      }
+
+      // Check if .env is gitignored
+      try {
+        const gitignorePath = path.join(cwd, '.gitignore');
+        if (fs.existsSync(gitignorePath)) {
+          const gitignore = fs.readFileSync(gitignorePath, 'utf-8');
+          if (!gitignore.includes('.env')) {
+            response += `\n⚠️ \`.env\` not in .gitignore - secrets could be committed!\n`;
+          }
+        }
+      } catch {
+        // Ignore
+      }
+
+      response += `\n`;
+    } catch {
+      response += `*(Environment audit unavailable)*\n\n`;
+    }
+
+    // Test Coverage Analysis
+    response += `### 🧪 Test Coverage\n\n`;
+    try {
+      const hasPlaywright = context.dependencies.includes('@playwright/test');
+      const hasVitest = context.dependencies.includes('vitest');
+      const hasJest = context.dependencies.includes('jest');
+
+      if (hasPlaywright || hasVitest || hasJest) {
+        const framework = hasPlaywright ? 'Playwright' : hasVitest ? 'Vitest' : 'Jest';
+        response += `✅ Test framework detected: **${framework}**\n\n`;
+
+        // Count test files
+        try {
+          const testFiles = execSync(
+            'find . -name "*.test.ts" -o -name "*.test.tsx" -o -name "*.spec.ts" -o -name "*.spec.tsx" 2>/dev/null | grep -v node_modules | wc -l',
+            { cwd, encoding: 'utf-8', timeout: 10000 }
+          ).trim();
+          const count = parseInt(testFiles);
+          if (count > 0) {
+            response += `Found **${count} test files**\n\n`;
+          } else {
+            response += `⚠️ No test files found - add tests!\n\n`;
+          }
+        } catch {
+          // Ignore
+        }
+      } else {
+        response += `⚠️ **No test framework detected**\n\n`;
+        response += `Recommended: Add \`vitest\` or \`@playwright/test\`\n\n`;
+      }
+    } catch {
+      response += `*(Test analysis unavailable)*\n\n`;
+    }
+
+    // API Endpoint Inventory
+    response += `### 🔌 API Endpoint Inventory\n\n`;
+    if (context.existingApiRoutes.length > 0) {
+      response += `Found **${context.existingApiRoutes.length} API routes**:\n\n`;
+
+      // Check for auth protection on routes
+      let protectedCount = 0;
+      let unprotectedCount = 0;
+
+      for (const route of context.existingApiRoutes.slice(0, 10)) {
+        try {
+          const routePath = path.join(cwd, route);
+          if (fs.existsSync(routePath)) {
+            const content = fs.readFileSync(routePath, 'utf-8');
+            const hasAuth = content.includes('getServerSession') ||
+                           content.includes('auth(') ||
+                           content.includes('requireAuth') ||
+                           content.includes('Authorization') ||
+                           content.includes('authenticate');
+            if (hasAuth) {
+              protectedCount++;
+            } else {
+              unprotectedCount++;
+            }
+          }
+        } catch {
+          // Ignore
+        }
+      }
+
+      if (protectedCount > 0 || unprotectedCount > 0) {
+        response += `- 🔒 **${protectedCount}** routes with auth checks\n`;
+        response += `- 🔓 **${unprotectedCount}** routes without visible auth\n\n`;
+
+        if (unprotectedCount > protectedCount) {
+          response += `⚠️ *Many routes lack visible auth - review if intentional*\n\n`;
+        }
+      }
+    } else {
+      response += `No API routes detected yet.\n\n`;
+    }
+
     response += `---\n\n`;
 
     // Scan for upgrade opportunities