@flowrail/init 0.0.7 → 0.0.8

package/README.md

@@ -18,10 +18,10 @@ What it writes:
 
 The installer also probes `https://api.flowrail.ai/mcp` with the env-supplied bearer to confirm end-to-end auth before exiting. A 401 gets a tester-actionable message; transport failures get a different one.
 
-**Full install guide**: <https://github.com/anshumanbh/flowstate/blob/main/docs/INSTALL.md>
+**Full install guide**: <https://github.com/anshumanbh/flowstate/blob/main/docs/guides/INSTALL.md>
 
-**Troubleshooting**: <https://github.com/anshumanbh/flowstate/blob/main/docs/TROUBLESHOOTING.md>
+**Troubleshooting**: <https://github.com/anshumanbh/flowstate/blob/main/docs/guides/TROUBLESHOOTING.md>
 
-**Honest limits**: <https://github.com/anshumanbh/flowstate/blob/main/docs/LIMITS.md>
+**Honest limits**: <https://github.com/anshumanbh/flowstate/blob/main/docs/guides/LIMITS.md>
 
 This is a POC — eval-only, not for production. Source: <https://github.com/anshumanbh/flowstate>.

package/dist/init.js

@@ -39,6 +39,7 @@ const hook_install_1 = require("./hook-install");
 const mcp_config_1 = require("./mcp-config");
 const npm_hooks_1 = require("./npm-hooks");
 const preflight_1 = require("./preflight");
+const repo_scan_trigger_1 = require("./repo-scan-trigger");
 const skills_1 = require("./skills");
 const verify_write_1 = require("./verify-write");
 async function runInit(options = {}) {
@@ -47,6 +48,7 @@ async function runInit(options = {}) {
     const env = options.env ?? process.env;
     const log = options.log ?? ((line) => process.stdout.write(line + '\n'));
     const gitChecker = options.gitChecker ?? git_check_1.isMcpJsonGitTracked;
+    const noScan = argv.includes('--no-scan') || argv.includes('--no-retro-scan');
     (0, env_1.rejectKeyArgv)(argv);
     const { apiKey } = (0, env_1.readApiKeyFromEnv)(env);
     // ``FLOWRAIL_MCP_URL`` is the BASE URL — same shape @flowrail/hook
@@ -112,7 +114,20 @@ async function runInit(options = {}) {
         fetcher: options.connectivityFetcher,
     });
     log('✓ connectivity check passed');
+    if (!noScan) {
+        log('→ scanning your existing dependencies for known CVEs…');
+        const scanner = options.repoScanner ?? repo_scan_trigger_1.defaultRepoScanner;
+        try {
+            await scanner({ projectRoot, mcpBaseUrl, apiKey, log });
+        }
+        catch (err) {
+            log(`FlowRail: retroactive scan could not complete (${messageForError(err)}); skipping.`);
+        }
+    }
     log('');
     log('FlowRail is installed. Open this repo in Claude Code and start coding —');
     log('design-review, verify, and dep-check skills are wired into the agent.');
 }
+function messageForError(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/repo-scan-trigger.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultRepoScanner = defaultRepoScanner;
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const verify_write_1 = require("./verify-write");
+const SCAN_TIMEOUT_MS = 20000;
+function defaultRepoScanner(ctx) {
+    try {
+        const hookBinPath = (0, verify_write_1.resolveInstalledHookBinPath)(ctx.projectRoot);
+        const scanBinPath = path_1.default.resolve(path_1.default.dirname(hookBinPath), 'scan-cli.js');
+        const result = (0, child_process_1.spawnSync)(process.execPath, [scanBinPath], {
+            cwd: ctx.projectRoot,
+            env: {
+                ...process.env,
+                FLOWRAIL_MCP_URL: ctx.mcpBaseUrl,
+                FLOWRAIL_API_KEY: ctx.apiKey,
+            },
+            encoding: 'utf8',
+            timeout: SCAN_TIMEOUT_MS,
+        });
+        const stdout = result.stdout ?? '';
+        for (const line of nonEmptyLines(stdout)) {
+            ctx.log(line);
+        }
+        if (result.error) {
+            ctx.log(`FlowRail: retroactive scan could not complete (${result.error.message}); skipping.`);
+            return;
+        }
+        const stderr = (result.stderr ?? '').trim();
+        if (stderr.length > 0) {
+            ctx.log(firstLine(stderr));
+            return;
+        }
+        if (result.status !== 0) {
+            ctx.log(`FlowRail: retroactive scan could not complete (exit ${result.status}); skipping.`);
+        }
+    }
+    catch (err) {
+        ctx.log(`FlowRail: retroactive scan could not complete (${messageForError(err)}); skipping.`);
+    }
+}
+function nonEmptyLines(value) {
+    return value
+        .split(/\r\n|\n|\r/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+}
+function firstLine(value) {
+    return value.split(/\r\n|\n|\r/, 1)[0];
+}
+function messageForError(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowrail/init",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "One-shot FlowRail installer for Claude Code. Wires PreToolUse hooks, MCP server config, and skill markdown into a tester's repo, then probes the FlowRail server with their bearer.",
   "license": "UNLICENSED",
   "private": false,