@ganakailabs/cloudeval-cli 0.30.1 → 0.30.3

package/README.md

@@ -1,197 +1,266 @@
 # CloudEval CLI
 
+Review Azure infrastructure before merge - from CLI, CI, and AI agents.
+
 <p align="center">
   <img src="https://raw.githubusercontent.com/ganakailabs/cloudeval-cli/main/docs/assets/images/cli/tui-chat.png" alt="CloudEval CLI terminal UI" width="100%">
 </p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@ganakailabs/cloudeval-cli"><img alt="npm version" src="https://img.shields.io/npm/v/@ganakailabs/cloudeval-cli?style=flat-square&logo=npm"></a>
-  <a href="https://www.npmjs.com/package/@ganakailabs/cloudeval-cli"><img alt="npm downloads" src="https://img.shields.io/npm/dm/@ganakailabs/cloudeval-cli?style=flat-square&logo=npm&label=npm%20downloads"></a>
-  <a href="https://github.com/ganakailabs/cloudeval-cli/releases"><img alt="release" src="https://img.shields.io/github/v/release/ganakailabs/cloudeval-cli?sort=semver&style=flat-square"></a>
-  <a href="https://github.com/ganakailabs/cloudeval-cli/releases"><img alt="GitHub downloads" src="https://img.shields.io/github/downloads/ganakailabs/cloudeval-cli/total?style=flat-square&logo=github&label=release%20downloads"></a>
   <a href="https://github.com/ganakailabs/cloudeval-cli/actions/workflows/semantic-release.yml"><img alt="release health" src="https://img.shields.io/github/actions/workflow/status/ganakailabs/cloudeval-cli/semantic-release.yml?branch=main&style=flat-square&label=release%20health"></a>
-  <a href="https://github.com/ganakailabs/cloudeval-cli/blob/main/LICENSE"><img alt="license" src="https://img.shields.io/badge/license-CloudEval%20CLI%20License-blue?style=flat-square"></a>
+  <a href="https://cloudeval.ai"><img alt="CloudEval app" src="https://img.shields.io/badge/app-cloudeval.ai-b6f23c?style=flat-square&labelColor=0b0f0a"></a>
   <a href="https://docs.cloudeval.ai/reference/cli-overview"><img alt="docs" src="https://img.shields.io/badge/docs-docs.cloudeval.ai-2d6cdf?style=flat-square"></a>
-  <a href="https://discord.gg/tk5dcU2a7T"><img alt="Discord" src="https://img.shields.io/badge/Discord-community-5865F2?style=flat-square&logo=discord&logoColor=white"></a>
+  <a href="https://github.com/ganakailabs/cloudeval-cli/blob/main/LICENSE"><img alt="license" src="https://img.shields.io/badge/license-CloudEval%20CLI%20License-blue?style=flat-square"></a>
 </p>
 
-CloudEval CLI brings CloudEval into your terminal, scripts, and agent tools. It
-supports cloud chat, Agent mode, Agent Profiles, project and report inspection,
-template validation, recipes, local hooks, MCP server workflows, and local
-thread switching in the Terminal UI.
+CloudEval CLI brings **CloudEval** into terminals, CI pipelines, and MCP-capable coding agents. Use it to review Azure ARM templates, Bicep-generated ARM JSON, and live Azure context with cost, architecture, and Well-Architected signals.
+
+## What It Does
+
+CloudEval helps teams catch infrastructure risk before merge:
 
-[CloudEval](https://cloudeval.ai) | [Docs](https://docs.cloudeval.ai/reference/cli-overview) | [GitHub](https://github.com/ganakailabs/cloudeval-cli) | [Discord](https://discord.gg/tk5dcU2a7T) | [Issues](https://github.com/ganakailabs/cloudeval-cli/issues) | [Releases](https://github.com/ganakailabs/cloudeval-cli/releases)
+- reviews **ARM JSON** and **Bicep-generated ARM JSON** templates;
+- validates templates from local files or CI workspaces;
+- connects to live Azure context for cloud review workflows;
+- exposes machine-readable output for scripts and GitHub Actions;
+- runs as an MCP server for Codex, Cursor, Claude, VS Code, and other clients.
 
-## Install
+## Quickstart: Run Your First Azure/IaC Review
+
+Install from npm:
 
 ```bash
 npm install -g @ganakailabs/cloudeval-cli
 cloudeval --help
 ```
 
-The npm package requires Node.js 20 or newer and installs these command aliases:
+Sign in for local use:
 
-- `cloudeval`
-- `cloud`
-- `eva`
+```bash
+cloudeval login
+cloudeval status
+```
 
-For standalone macOS, Linux, and Windows binaries, use the GitHub releases or
-the installers:
+Validate an ARM template:
 
 ```bash
-curl -fsSL https://cli.cloudeval.ai/install.sh | bash
+cloudeval validate template \
+  --template-file ./infra/azuredeploy.json \
+  --wait \
+  --progress stderr \
+  --format json \
+  --non-interactive
 ```
 
-```powershell
-irm https://cli.cloudeval.ai/install.ps1 | iex
-```
+Full setup docs: [Use the CLI](https://docs.cloudeval.ai/quickstart/use-the-cli.md) and [CLI command reference](https://docs.cloudeval.ai/reference/cli-command-reference.md).
 
-The shell installer can detect Codex, Claude Desktop, Cursor, and VS Code,
-skip clients where CloudEval MCP is already configured, and offer setup only
-for missing clients that can be configured automatically. Manual-only clients
-are summarized with a follow-up command instead of forcing another prompt.
-It also asks whether to share limited CLI telemetry, defaulting to yes; decline
-or set `CLOUDEVAL_TELEMETRY=0` to write `telemetry.enabled=false`.
-When a CLI update exposes new MCP capabilities, restart or reload your MCP
-client when you are ready; CloudEval never restarts those apps automatically.
+## Choose Your Workflow
 
-`npm install -g` does not run that installer wizard. After installing from npm,
-use `cloudeval login` for first-run auth, `cloudeval mcp setup <client>` to
-configure MCP in your editor, or `cloudeval update` (TTY) to rerun the shell
-installer and optionally accept agent/MCP setup prompts.
+### Local ARM / Bicep-Generated ARM JSON
 
-## Common Commands
+Use `validate template` for local review and scriptable checks:
+
+```bash
+cloudeval validate template \
+  --template-file ./infra/azuredeploy.json \
+  --parameters-file ./infra/azuredeploy.parameters.json \
+  --wait \
+  --progress stderr \
+  --format json
+```
+
+### Live Azure Sync
+
+Use CloudEval projects and reports after connecting Azure in the app or CLI:
 
 ```bash
-cloudeval                         # Terminal UI
-cloudeval login                   # Browser device login
-cloudeval status                  # Account, API, and local CLI status
-cloudeval ask "Summarize my cloud risk" --format json
-cloudeval agent "Find cost and architecture risks" --format json
-cloudeval agents list
-cloudeval agents run cost --project <project-id> --format json
 cloudeval projects list
 cloudeval reports list
+cloudeval ask "Summarize my Azure architecture risks" --format json
+```
+
+### GitHub Actions / CI
+
+Use a scoped `CLOUDEVAL_ACCESS_KEY` secret and keep generated JSON on stdout:
+
+```yaml
+name: CloudEval review
+
+on:
+  pull_request:
+    paths:
+      - "infra/**"
+
+jobs:
+  cloudeval:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - run: npm install -g @ganakailabs/cloudeval-cli
+
+      - name: Validate ARM template
+        env:
+          CLOUDEVAL_ACCESS_KEY: ${{ secrets.CLOUDEVAL_ACCESS_KEY }}
+        run: |
+          cloudeval validate template \
+            --template-file ./infra/azuredeploy.json \
+            --wait \
+            --progress stderr \
+            --format json \
+            --non-interactive
+```
+
+Public example: [passing baseline PR #6](https://github.com/ganakailabs/cloudeval-azure-arm-review-example/pull/6) in [`ganakailabs/cloudeval-azure-arm-review-example`](https://github.com/ganakailabs/cloudeval-azure-arm-review-example). Review comments show a merge-gate table, CloudEval report badges, a visible AI summary, a folded detailed AI reviewer note, a Well-Architected radar/table drilldown, and cost Mermaid charts.
+
+### MCP For Codex, Cursor, Claude, VS Code
+
+Start with read-only agent integration:
+
+```bash
 cloudeval mcp serve --toolset readonly
+```
+
+Setup docs: [MCP client setup](https://docs.cloudeval.ai/reference/mcp-client-setup.md) and [agent automation rules](https://docs.cloudeval.ai/reference/agent-and-automation-rules.md).
+
+## Example Outputs
+
+Human-facing commands print concise summaries by default:
+
+```bash
+cloudeval status
+cloudeval reports list
+cloudeval rules search "public network"
+cloudeval agents run cost --project <project-id> --format json
+```
+
+Automation should request structured output:
+
+```bash
 cloudeval capabilities --format json
+cloudeval validate template --template-file ./infra/azuredeploy.json --wait --format json --non-interactive
+cloudeval ask "Summarize top risks" --format ndjson --progress ndjson --non-interactive
 ```
 
-## Telemetry
+## Trust, Privacy, And Limits
+
+CloudEval is designed for review workflows, not silent cloud mutation.
+
+- Azure is the primary supported live-cloud provider today.
+- ARM JSON and Bicep-generated ARM JSON are the strongest current IaC paths.
+- AWS and GCP live sync are not full-parity workflows today.
+- Machine-readable commands write payloads to stdout.
+- Prompts, warnings, progress, and browser-open messages go to stderr.
+- Telemetry does not send raw prompts, command output, tokens, local paths, resource IDs, tenant IDs, cloud resource names, stack traces, or raw error messages.
+- Use `--format json --non-interactive` for scripts and CI.
+- Use `cloudeval mcp serve --toolset readonly` as the default agent integration mode.
+
+Privacy and automation details: [agent and automation rules](https://docs.cloudeval.ai/reference/agent-and-automation-rules.md).
 
-Telemetry is default-on and uses curated Azure Application Insights custom
-events only. CloudEval records command family, success, duration, safe option
-enums, CLI/runtime versions, OS major version, architecture, install source,
-update/install outcomes, MCP tool names, TUI metadata, a W3C `traceId`, and a
-per-command `requestId` for backend correlation. After login, events may include
-a hashed internal user ID only.
+## Automation Contract
 
-Telemetry does not include prompts, command output, tokens, local paths, project
-or resource IDs, raw email/name fields, account/session/tenant IDs, stack
-traces, raw error messages, command arguments, cwd, file paths, or cloud
-resource names.
+CloudEval separates machine output from human/operator messages:
+
+- **stdout**: JSON, NDJSON, Markdown, or text payload requested by `--format`;
+- **stderr**: prompts, warnings, progress, browser-open messages, and MCP diagnostics;
+- **JSON/NDJSON**: use `--format json` for one final payload or `--format ndjson` for streaming events where supported;
+- **exit codes**: non-zero exits indicate failed commands, validation failures, missing auth, or required human approval;
+- **non-interactive mode**: use `--non-interactive` in CI so commands fail instead of prompting.
+
+Recommended CI shape:
 
 ```bash
-cloudeval config set telemetry.enabled false
-cloudeval config get telemetry.enabled --format json
-cloudeval config set telemetry.enabled true
-cloudeval config unset telemetry.enabled
+cloudeval validate template \
+  --template-file ./infra/azuredeploy.json \
+  --wait \
+  --progress stderr \
+  --format json \
+  --non-interactive
 ```
 
-For one run, use `CLOUDEVAL_TELEMETRY=0` or `CLOUDEVAL_TELEMETRY=1`.
+## MCP For Coding Agents
+
+Use MCP when an AI coding agent should inspect CloudEval projects, reports, rules, recipes, or validation capabilities.
 
-## Uninstall
+```bash
+cloudeval mcp serve --toolset readonly
+```
 
-To remove local installer-owned artifacts while keeping CloudEval config,
-sessions, and auth:
+Common setup commands:
 
 ```bash
-cloudeval uninstall --yes
+codex mcp add cloudeval -- cloudeval mcp serve --toolset readonly
+cloudeval mcp setup cursor --dry-run --toolset readonly --format json
+cloudeval mcp setup vscode --dry-run --toolset readonly --format json
 ```
 
-To preview cleanup first:
+MCP stdout is reserved for JSON-RPC. Diagnostics go to stderr.
+
+## Advanced Install, Update, Uninstall
+
+Standalone installers are available for macOS, Linux, WSL2, Git Bash, and PowerShell 7+:
 
 ```bash
-cloudeval uninstall --dry-run
+curl -fsSL https://cli.cloudeval.ai/install.sh | bash
+```
+
+```powershell
+irm https://cli.cloudeval.ai/install.ps1 | iex
 ```
 
-To remove local config and session state too:
+Update and uninstall:
 
 ```bash
+cloudeval update --check
+cloudeval update --yes
+cloudeval uninstall --dry-run
+cloudeval uninstall --yes
 cloudeval uninstall --yes --remove-config
+npm uninstall -g @ganakailabs/cloudeval-cli
 ```
 
-If you installed through npm, remove the npm package as the final step:
+The installer can offer optional MCP setup for detected clients. It does not create access keys or write secrets into MCP client config.
+
+## Full Docs
+
+- [CloudEval app](https://cloudeval.ai)
+- [CLI overview](https://docs.cloudeval.ai/reference/cli-overview)
+- [Use the CLI](https://docs.cloudeval.ai/quickstart/use-the-cli.md)
+- [CLI command reference](https://docs.cloudeval.ai/reference/cli-command-reference.md)
+- [MCP client setup](https://docs.cloudeval.ai/reference/mcp-client-setup.md)
+- [Agent and automation rules](https://docs.cloudeval.ai/reference/agent-and-automation-rules.md)
+- [Sign-in and onboarding troubleshooting](https://docs.cloudeval.ai/troubleshooting/sign-in-and-onboarding.md)
+- [GitHub issues](https://github.com/ganakailabs/cloudeval-cli/issues)
+- [Releases](https://github.com/ganakailabs/cloudeval-cli/releases)
+- [Discord](https://discord.gg/tk5dcU2a7T)
+
+## Build From Source / Contributing
+
+Read [AGENTS.md](https://github.com/ganakailabs/cloudeval-cli/blob/main/AGENTS.md) before touching auth, credentials, smoke artifacts, or user-facing command behavior.
 
 ```bash
-npm uninstall -g @ganakailabs/cloudeval-cli
+git clone https://github.com/ganakailabs/cloudeval-cli.git
+cd cloudeval-cli
+pnpm install
+pnpm build
+pnpm -C packages/cli dev --help
 ```
 
-## What It Covers
-
-- Terminal UI for chat, Agent mode, Agent Profile selection, recent thread
-  switching, projects, reports, billing, context rail, task ledger, artifact
-  chips, and a docked composer.
-- Scriptable commands with `json`, `ndjson`, `markdown`, and text output.
-- Agent Profiles: `architecture`, `cost`, `triage`, and `remediation`.
-- MCP tools for Codex, Cursor, Claude, VS Code, and other stdio JSON-RPC hosts.
-- Project graph, report, recipe, rules, and validation workflows.
-- Local opt-in hooks for CLI and Agent Profile events.
-
-In the Terminal UI, use the Thread control or `/thread` to choose open chat
-sessions, recent CloudEval chat threads, and local CLI sessions. `/thread new`
-starts another independent open session, and `/open` opens the matching
-CloudEval web chat thread when the active session has a thread id. Roomy
-terminals show a context rail with project, thread, model, mode, profile, report
-artifact chips; narrower terminals
-keep the chat first and expose the same controls through the docked composer and
-slash commands. Typing `/` opens a bottom command completion strip; use Tab or
-Up/Down to move, Right to accept the ghost text, and Enter to choose the
-highlighted command. Streaming work appears as a task ledger in the thread.
-Grounded answers show numbered citations and a Sources section instead of raw
-`[S_tool_...]` tags, with citation numbers highlighted inline; `/copy` copies
-the latest assistant response and `/download` writes a Markdown transcript with
-the same references. Project and Connection tabs include selected-item detail
-panes for backend fields, report coverage, sync state, and linked records; use
-`J`/`K` or Up/Down on Projects and Connections to move the selected row, then
-Enter to confirm it. The billing header separates credits left from observed
-credits used so usage does not look like the current budget. Use the Profile
-control or `/profile architecture|cost|triage|remediation` to choose an Agent
-Profile for the next chat stream. Selecting a profile switches to Agent mode;
-selecting Ask mode clears the profile back to the default chat flow. Starter
-prompts stay hidden until you run `/starter`. Press `Esc` from the prompt to
-leave text editing so tab, arrow, and number shortcuts move through controls
-and tabs; type again to resume editing. Busy loaders and the input cursor animate
-unless you pass `--no-anim`. The
-banner details include the logged-in user. Focused controls and the active top
-tab use the shared warm banner-yellow accent, with the active tab filled across
-its full button interior.
-
-## Authentication
-
-Use `cloudeval login` for local development. For CI or hosted agents, create a
-scoped CloudEval access key in the app or with `cloudeval credentials create`,
-then provide it as `CLOUDEVAL_ACCESS_KEY`.
-
-Stored device-login sessions are refreshed automatically before authenticated
-requests. If a long-running terminal session receives an expired-token response
-from the chat stream, the CLI refreshes the stored session and retries the
-request once. If the refresh token is revoked or expired, run `cloudeval login`
-again.
-
-## Documentation
-
-- CLI overview: <https://docs.cloudeval.ai/reference/cli-overview>
-- Command reference: <https://docs.cloudeval.ai/reference/cli-command-reference>
-- MCP setup: <https://docs.cloudeval.ai/reference/mcp-client-setup>
-- Release smoke tests: <https://github.com/ganakailabs/cloudeval-cli/blob/main/docs/release-smoke-tests.md>
-
-## License And Notices
-
-CloudEval CLI first-party code is provided under the
-[CloudEval CLI License](https://github.com/ganakailabs/cloudeval-cli/blob/main/LICENSE).
-Production third-party package attribution is published in
-[THIRD_PARTY_NOTICES.md](https://github.com/ganakailabs/cloudeval-cli/blob/main/THIRD_PARTY_NOTICES.md),
-and the release SBOM is published as
-[sbom.spdx.json](https://github.com/ganakailabs/cloudeval-cli/blob/main/sbom.spdx.json).
-Installer releases also place these notice files under
-`~/.local/share/cloudeval/licenses`.
+Run focused package checks:
+
+```bash
+pnpm test:npm-package
+pnpm -C packages/cli test:cli:noninteractive
+```
+
+## License
+
+CloudEval CLI first-party code is provided under the [CloudEval CLI License](https://github.com/ganakailabs/cloudeval-cli/blob/main/LICENSE).
+
+Production third-party attribution is published in [THIRD_PARTY_NOTICES.md](https://github.com/ganakailabs/cloudeval-cli/blob/main/THIRD_PARTY_NOTICES.md), and the release SBOM is published as [sbom.spdx.json](https://github.com/ganakailabs/cloudeval-cli/blob/main/sbom.spdx.json).

package/THIRD_PARTY_NOTICES.md

@@ -14,7 +14,7 @@ This notice is not a substitute for legal review before public or enterprise dis
 | --- | ---: |
 | (MIT OR CC0-1.0) | 2 |
 | 0BSD | 1 |
-| Apache-2.0 | 50 |
+| Apache-2.0 | 51 |
 | BSD-3-Clause | 3 |
 | ISC | 12 |
 | MIT | 172 |
@@ -226,6 +226,7 @@ This notice is not a substitute for legal review before public or enterprise dis
 | semver | 7.7.3 | ISC | GitHub Inc. | https://github.com/npm/node-semver#readme |
 | shell-quote | 1.8.4 | MIT | James Halliday | https://github.com/ljharb/shell-quote |
 | signal-exit | 3.0.7 | ISC | Ben Coe | https://github.com/tapjs/signal-exit |
+| signalstory | 0.1.0 | Apache-2.0 | NOASSERTION | NOASSERTION |
 | skin-tone | 2.0.0 | MIT | Sindre Sorhus | https://github.com/sindresorhus/skin-tone#readme |
 | slice-ansi | 5.0.0 | MIT | NOASSERTION | https://github.com/chalk/slice-ansi#readme |
 | slice-ansi | 6.0.0 | MIT | NOASSERTION | https://github.com/chalk/slice-ansi#readme |

package/dist/{App-IRVY4LSK.js → App-SKVX7NAF.js}

@@ -38,10 +38,10 @@ import {
 } from "./chunk-NXM4JEOB.js";
 import {
   Banner
-} from "./chunk-P5JXFRYX.js";
+} from "./chunk-QB3BBKVH.js";
 import {
   CLI_VERSION
-} from "./chunk-STE265DV.js";
+} from "./chunk-FPZWMNAI.js";
 import {
   raisedButtonStyle,
   terminalTheme

package/dist/{Banner-4PWF5O3B.js → Banner-CRBHEOTC.js}

@@ -3,8 +3,8 @@ import {
   bannerMetaColor,
   bannerSegmentColor,
   splitBannerLineSegments
-} from "./chunk-P5JXFRYX.js";
-import "./chunk-STE265DV.js";
+} from "./chunk-QB3BBKVH.js";
+import "./chunk-FPZWMNAI.js";
 import "./chunk-ZDKRIOMB.js";
 export {
   Banner,

package/dist/{chunk-STE265DV.js → chunk-FPZWMNAI.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var CLI_VERSION = "0.30.1";
+var CLI_VERSION = "0.30.3";
 
 export {
   CLI_VERSION

package/dist/{chunk-P5JXFRYX.js → chunk-QB3BBKVH.js}

@@ -1,6 +1,6 @@
 import {
   CLI_VERSION
-} from "./chunk-STE265DV.js";
+} from "./chunk-FPZWMNAI.js";
 import {
   shouldUseColor,
   terminalTheme

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
 } from "./chunk-NXM4JEOB.js";
 import {
   CLI_VERSION
-} from "./chunk-STE265DV.js";
+} from "./chunk-FPZWMNAI.js";
 
 // src/runtime/prepareInk.ts
 import fs from "fs";
@@ -2541,6 +2541,85 @@ var fetchCloudEvalJson = async ({
   return await response.json();
 };
 
+// src/signalstoryReviewAdapter.ts
+import {
+  createSignalStoryEngine,
+  renderPlainText
+} from "signalstory/core";
+import { renderGithubSummary } from "signalstory/markdown";
+var renderSignalStoryPlainText = (parts = []) => renderPlainText(parts);
+var REVIEW_FALLBACK_RULE_PACK = {
+  id: "cloudeval-review-fallback",
+  rules: [
+    {
+      id: "review-fallback",
+      when: { signal: "gateStatus", exists: true },
+      story: {
+        id: "review-fallback",
+        severity: "high",
+        icon: "git-pull-request",
+        priority: 100,
+        sentence: [
+          { text: "CloudEval review completed with " },
+          { path: "gateStatus", marks: ["bold"] },
+          { text: ". Well-Architected posture is " },
+          { path: "score", marks: ["bold"] },
+          { text: " (" },
+          { path: "rating", marks: ["bold"] },
+          { text: "), validation has " },
+          { path: "failedTests", suffix: " failed unit tests", marks: ["bold"] },
+          { text: ", policy checks are " },
+          { path: "policyStatus", marks: ["bold"] },
+          { text: ", and monthly cost is " },
+          { path: "monthlyCost", marks: ["bold"] },
+          { text: ". Prioritize " },
+          { text: "failed validation checks", marks: ["bold"] },
+          { text: " and " },
+          { path: "weakestPillar", marks: ["bold"] },
+          { text: " first." }
+        ],
+        rationale: [
+          {
+            text: "Failed validation, weak architecture pillars, and cost over budget are the highest-signal remediation inputs before merge."
+          }
+        ],
+        action: { label: "Fix failed validation checks and rerun the review." }
+      }
+    }
+  ]
+};
+var buildSignalStoryReviewFallback = (input) => {
+  const engine = createSignalStoryEngine({
+    rulePacks: [REVIEW_FALLBACK_RULE_PACK]
+  });
+  const stories = engine.generate({ signals: input });
+  const primary = stories[0];
+  if (!primary) {
+    return null;
+  }
+  const shortSummary = renderSignalStoryPlainText(primary.sentence);
+  const detailsMarkdown = [
+    `**Main risk**
+${renderSignalStoryPlainText(primary.sentence)}`,
+    `**Why it matters**
+${renderSignalStoryPlainText(primary.rationale ?? [])}`,
+    `**Recommended actions**
+${primary.action?.label ?? "Rerun the review after remediation."}`,
+    "**Evidence used**\n**Gate status**, **Well-Architected score**, **validation totals**, **policy totals**, and **monthly cost**."
+  ].join("\n\n");
+  return {
+    enabled: true,
+    status: "fallback",
+    fallbackUsed: true,
+    warnings: [],
+    shortSummary,
+    detailsMarkdown,
+    markdown: renderGithubSummary(stories, {
+      title: "CloudEval review summary"
+    })
+  };
+};
+
 // src/reviewCommand.ts
 var DIRTY_REVIEW_MESSAGE = "Reviews pushed commits only. Add --ignore-dirty to review HEAD anyway.";
 var runGit = async (cwd, args) => {
@@ -3167,22 +3246,184 @@ var compactCostRowsForChart = (rows, totalAmount, currency, options = {}) => {
   return result;
 };
 var markdownLink = (label, url) => url ? `[${label}](${url})` : label;
-var openInCloudEvalLines = (links) => {
+var shieldSegment = (value) => encodeURIComponent(value.trim().replace(/-/g, "--").replace(/_/g, "__"));
+var badgeLink = ({
+  label,
+  message,
+  color,
+  url
+}) => {
+  if (!url) {
+    return void 0;
+  }
+  return `[![${label}](https://img.shields.io/badge/${shieldSegment(label)}-${shieldSegment(message)}-${color}?style=flat-square)](${url})`;
+};
+var openInCloudEvalBadges = (links) => {
   if (!links) {
     return [];
   }
   const reports = asRecord(links.reports);
   const downloads = asRecord(links.downloads);
-  const entries = [
-    ["Project preview", links.project],
-    ["Architecture report", reports.architecture],
-    ["Cost report", reports.cost],
-    ["Validation details", reports.validation],
-    ["Download PDF", downloads.pdf],
-    ["Workflow run", links.workflowRun],
-    ["Download review artifacts", downloads.reviewArtifacts]
-  ].filter((entry) => typeof entry[1] === "string" && entry[1].length > 0);
-  return entries.map(([label, url]) => `- ${markdownLink(label, url)}`);
+  return [
+    badgeLink({
+      label: "Project",
+      message: "preview",
+      color: "2563eb",
+      url: typeof links.project === "string" ? links.project : void 0
+    }),
+    badgeLink({
+      label: "Report",
+      message: "architecture",
+      color: "16a34a",
+      url: typeof reports.architecture === "string" ? reports.architecture : void 0
+    }),
+    badgeLink({
+      label: "Cost",
+      message: "drilldown",
+      color: "0f766e",
+      url: typeof reports.cost === "string" ? reports.cost : void 0
+    }),
+    badgeLink({
+      label: "Validation",
+      message: "details",
+      color: "d97706",
+      url: typeof reports.validation === "string" ? reports.validation : void 0
+    }),
+    badgeLink({
+      label: "PDF",
+      message: "download",
+      color: "7c3aed",
+      url: typeof downloads.pdf === "string" ? downloads.pdf : void 0
+    }),
+    badgeLink({
+      label: "Workflow",
+      message: "run",
+      color: "475569",
+      url: typeof links.workflowRun === "string" ? links.workflowRun : void 0
+    }),
+    badgeLink({
+      label: "Artifacts",
+      message: "review",
+      color: "475569",
+      url: typeof downloads.reviewArtifacts === "string" ? downloads.reviewArtifacts : void 0
+    })
+  ].filter((entry) => Boolean(entry));
+};
+var signalTableCell = (summaryLine) => {
+  const match = summaryLine.match(/^(\S+)\s+[^:]+:\s*(.+)$/);
+  if (!match) {
+    return compactMarkdownCell(summaryLine);
+  }
+  return `${match[1]} **${compactMarkdownCell(match[2])}**`;
+};
+var reviewDecisionLine = ({
+  gateStatus,
+  score,
+  rating
+}) => {
+  if (gateStatus === "FAIL") {
+    return `${statusIcon(gateStatus)} **FAIL** - configured gates failed. Do not merge until the action queue is resolved and CloudEval is rerun.`;
+  }
+  if (gateStatus === "WARN") {
+    return `${statusIcon(gateStatus)} **WARN** - configured gates are warning-only or non-blocking for this run. Review the action queue before merge.`;
+  }
+  if (rating === "CRITICAL" || rating === "POOR") {
+    return `${statusIcon(gateStatus)} **PASS** - configured gates passed, but observed Well-Architected posture is **${formatScore(score)} (${rating})**. Tighten gate thresholds if this posture should block pull requests.`;
+  }
+  return `${statusIcon(gateStatus)} **PASS** - configured gates passed for this review. Use the drilldowns below to keep the posture improving.`;
+};
+var strongestPillarRisk = (pillars) => pillars.map((pillar) => ({
+  label: String(pillar.label ?? pillar.id ?? "Well-Architected pillar"),
+  score: numberFrom(pillar.score)
+})).filter((pillar) => pillar.score !== void 0).sort((left, right) => left.score - right.score).map((pillar) => ({
+  ...pillar,
+  rating: scoreRating(pillar.score)
+}))[0];
+var reviewActionItems = ({
+  data,
+  pillars,
+  cost,
+  validation
+}) => {
+  const endpointActions = Array.isArray(data.aiSummary?.recommendedActions) ? data.aiSummary.recommendedActions.map((action) => compactMarkdownCell(action, "")).filter(Boolean) : [];
+  const failedUnitTests = numberFrom(validation?.unitTests?.failed) ?? 0;
+  const failedPolicyChecks = numberFrom(validation?.policyChecks?.failed) ?? 0;
+  const weakest = strongestPillarRisk(pillars);
+  const currentCost = numberFrom(cost?.amount);
+  const savings = numberFrom(data.gate?.cost?.estimatedSavings?.amount);
+  const currency = cost?.currency ?? data.gate?.cost?.estimatedSavings?.currency;
+  const actions = [...endpointActions];
+  if (failedUnitTests > 0 || failedPolicyChecks > 0) {
+    const parts = [];
+    if (failedUnitTests > 0) {
+      parts.push(`${displayNumber(failedUnitTests)} failed unit tests`);
+    }
+    if (failedPolicyChecks > 0) {
+      parts.push(`${displayNumber(failedPolicyChecks)} failed policy checks`);
+    }
+    actions.push(
+      `**Fix validation failures** - resolve ${joinReadableList(parts)} and rerun CloudEval review.`
+    );
+  }
+  if (weakest) {
+    actions.push(
+      `**Prioritize ${weakest.label}** - weakest pillar is **${formatScore(weakest.score)} (${weakest.rating ?? "UNKNOWN"})**.`
+    );
+  }
+  if (currentCost !== void 0) {
+    const savingsText = savings !== void 0 && savings > 0 ? `; review the estimated **${formatMonthlyMoney(savings, currency)}** savings` : "";
+    actions.push(
+      `**Review cost drivers** - current monthly cost is **${formatMonthlyMoney(currentCost, currency)}**${savingsText}.`
+    );
+  }
+  if (Array.isArray(data.gate?.failures)) {
+    for (const failure of data.gate.failures) {
+      actions.push(`**Address gate failure** - ${compactMarkdownCell(failure)}.`);
+    }
+  }
+  actions.push("**Rerun CloudEval** - confirm the updated gate, reports, and PR comment after remediation.");
+  const unique2 = [];
+  for (const action of actions) {
+    if (!unique2.includes(action)) {
+      unique2.push(action);
+    }
+    if (unique2.length >= 3) {
+      break;
+    }
+  }
+  return unique2.map((action, index) => `${index + 1}. ${action}`);
+};
+var mermaidAxisId = (label) => {
+  const normalized = normalizeKey(label).replace(/[^a-z0-9_]/g, "_");
+  return normalized || "pillar";
+};
+var wellArchitectedRadarLines = (pillars) => {
+  const scored = pillars.map((pillar) => {
+    const label = String(pillar.label ?? pillar.id ?? "Pillar");
+    const score = numberFrom(pillar.score);
+    return score === void 0 ? void 0 : {
+      id: mermaidAxisId(label),
+      label,
+      score
+    };
+  }).filter(
+    (pillar) => pillar !== void 0
+  );
+  if (scored.length < 3) {
+    return [];
+  }
+  return [
+    "```mermaid",
+    "radar-beta",
+    "  title Well-Architected posture",
+    `  axis ${scored.map((pillar) => `${pillar.id}["${mermaidLabel(pillar.label)}"]`).join(", ")}`,
+    `  curve current["Current"]{${scored.map((pillar) => trimNumber(pillar.score, 3)).join(", ")}}`,
+    "  max 100",
+    "  min 0",
+    "```",
+    "",
+    "_If GitHub does not render Mermaid radar charts yet, use the table below as the fallback._"
+  ];
 };
 var monthlyCostImpactLines = (currentAmount, savingsAmount, currency) => {
   const current = numberFrom(currentAmount);
@@ -3665,7 +3906,7 @@ var renderAiSummarySections = (shortSummary, detailsMarkdown) => {
     lines.push(
       "",
       "<details>",
-      "<summary>AI details</summary>",
+      "<summary><strong>Detailed AI reviewer note - evidence, reasoning, and next actions</strong></summary>",
       "",
       detailsMarkdown.trim(),
       "",
@@ -3698,7 +3939,7 @@ var reviewSurface = () => {
   const ref = String(process.env.GITHUB_REF ?? "").toLowerCase();
   return event.startsWith("pull_request") || ref.startsWith("refs/pull/") ? "pull_request" : "local_review";
 };
-var buildReviewSummaryPayload = (data) => ({
+var buildReviewSummaryPayload = (data, preferences = {}) => ({
   source: process.env.GITHUB_ACTIONS === "true" ? "github_action" : "cli",
   surface: reviewSurface(),
   project: data.project ?? { id: data.projectId },
@@ -3717,7 +3958,12 @@ var buildReviewSummaryPayload = (data) => ({
   validation: data.gate?.validation ?? {},
   policy: data.gate?.validation?.policy ?? data.gate?.policy ?? {},
   architecture_signals: data.gate?.architecture ?? {},
-  changed_files: data.changedFiles ?? []
+  changed_files: data.changedFiles ?? [],
+  ai_preferences: {
+    mode: preferences.mode ?? "ask",
+    ...preferences.agentProfileId ? { agent_profile_id: preferences.agentProfileId } : {},
+    ...preferences.model ? { model: preferences.model } : {}
+  }
 });
 var deterministicAiSummary = (data, error) => {
   const score = data.gate?.wellArchitected?.overall?.score ?? data.gate?.overallScore;
@@ -3732,6 +3978,27 @@ var deterministicAiSummary = (data, error) => {
   )[0] : void 0;
   const weakestPillarLabel = weakestPillar?.label ?? weakestPillar?.id ?? "the weakest Well-Architected pillar";
   const highRisk = numberFrom(data.gate?.wellArchitected?.risks?.high) ?? 0;
+  const signalStorySummary = buildSignalStoryReviewFallback({
+    gateStatus: String(data.gate?.status ?? "UNKNOWN").toUpperCase(),
+    score: formatScore(score),
+    rating,
+    failedTests,
+    policyStatus,
+    monthlyCost: formatMonthlyMoney(cost?.amount, cost?.currency),
+    weakestPillar: weakestPillarLabel
+  });
+  if (signalStorySummary) {
+    const signalStoryShortSummary = String(signalStorySummary.shortSummary ?? "").trim();
+    const signalStoryDetailsMarkdown = String(signalStorySummary.detailsMarkdown ?? "").trim();
+    return {
+      ...signalStorySummary,
+      warnings: error ? [`Review summary endpoint failed: ${error}`] : [],
+      markdown: renderAiSummarySections(
+        signalStoryShortSummary,
+        signalStoryDetailsMarkdown
+      )
+    };
+  }
   const summary = [
     `CloudEval review completed with **${String(data.gate?.status ?? "UNKNOWN").toUpperCase()}**.`,
     `Well-Architected posture is **${formatScore(score)} (${rating})**, validation has **${displayNumber(failedTests)} failed unit tests**, policy checks are **${policyStatus}**, and monthly cost is **${formatMonthlyMoney(cost?.amount, cost?.currency)}**.`,
@@ -3758,7 +4025,11 @@ Fix **${displayNumber(failedTests)} failed unit tests**, address **${weakestPill
 };
 var generateAiSummary = async (input) => {
   try {
-    const payload = buildReviewSummaryPayload(input.data);
+    const payload = buildReviewSummaryPayload(input.data, {
+      model: input.model,
+      mode: input.mode,
+      agentProfileId: input.agentProfileId
+    });
     const response = await fetchCloudEvalJson({
       baseUrl: input.baseUrl,
       authToken: input.token,
@@ -3808,7 +4079,8 @@ var buildMarkdownSummary = (data) => {
   const repository = String(data.repo ?? "unknown repository");
   const ref = String(data.ref ?? "unknown ref");
   const commit = String(data.commitSha ?? "unknown").slice(0, 12);
-  const pillarLines = Array.isArray(data.gate?.wellArchitected?.pillars) ? data.gate.wellArchitected.pillars.map((pillar) => {
+  const pillars = Array.isArray(data.gate?.wellArchitected?.pillars) ? data.gate.wellArchitected.pillars : [];
+  const pillarLines = pillars.length ? pillars.map((pillar) => {
     const rating = scoreRating(pillar.score);
     return `| ${pillar.label} | **${formatScore(pillar.score)}** | ${scoreRatingIcon(rating)} ${rating ?? "UNKNOWN"} |`;
   }) : [];
@@ -3834,47 +4106,87 @@ var buildMarkdownSummary = (data) => {
   );
   const costPieRows = namedResourceCosts.length ? positiveResourceCosts : costServices.filter((service) => service.amount > 0);
   const costPieTitle = namedResourceCosts.length ? "Monthly cost by resource" : "Monthly cost by service";
-  const openLinks = openInCloudEvalLines(data.links);
+  const linkBadges = openInCloudEvalBadges(data.links);
   const architectureLines = architectureSignalLines({
     architecture,
     costServices,
     costCurrency: cost?.currency,
     highRiskFindings: data.gate?.wellArchitected?.risks?.high,
-    pillars: Array.isArray(data.gate?.wellArchitected?.pillars) ? data.gate.wellArchitected.pillars : []
+    pillars
   });
   const validationRows = validationFailureRows(validation);
   const overallRating = scoreRating(score);
+  const actionLines = reviewActionItems({
+    data,
+    pillars,
+    cost,
+    validation
+  });
+  const radarLines = wellArchitectedRadarLines(pillars);
   const lines = [
-    `${statusIcon(data.gate?.status)} **Overall** : ${gateStatus}`,
-    `${scoreRatingIcon(overallRating)} Well-Architected Posture: ${formatScore(score)} (${overallRating ?? "UNKNOWN"})`,
-    validationSummaryLine(validation),
-    policySummaryLine(validation),
-    costSummaryLine(cost),
+    "## CloudEval infrastructure review",
+    "",
+    "| Signal | Result |",
+    "| --- | --- |",
+    `| Merge gate | ${statusIcon(data.gate?.status)} **${gateStatus}** |`,
+    `| Observed posture | ${scoreRatingIcon(overallRating)} **${formatScore(score)} (${overallRating ?? "UNKNOWN"})** |`,
+    `| Validation | ${signalTableCell(validationSummaryLine(validation))} |`,
+    `| Policy | ${signalTableCell(policySummaryLine(validation))} |`,
+    `| Cost | ${signalTableCell(costSummaryLine(cost))} |`
+  ];
+  if (linkBadges.length) {
+    lines.push("", "### Links", "", linkBadges.join(" "));
+  }
+  lines.push(
     "",
-    "#### Source",
+    "### Decision",
+    "",
+    reviewDecisionLine({ gateStatus, score, rating: overallRating }),
+    "",
+    "<details>",
+    "<summary><strong>Source</strong></summary>",
     "",
     `- **CloudEval project**: ${projectDisplay}`,
     `- **Repository**: \`${repository}\``,
     `- **Ref**: \`${ref}\``,
-    `- **Commit**: \`${commit}\``
-  ];
-  if (openLinks.length) {
-    lines.push("", "#### Open in CloudEval", "", ...openLinks);
-  }
+    `- **Commit**: \`${commit}\``,
+    "",
+    "</details>"
+  );
   if (data.aiSummary?.markdown) {
-    lines.push("", "#### AI summary", "", data.aiSummary.markdown);
+    lines.push("", "### AI summary", "", data.aiSummary.markdown);
+  }
+  if (actionLines.length) {
+    lines.push(
+      "",
+      "<details open>",
+      `<summary><strong>Action queue - ${actionLines.length} recommended fixes</strong></summary>`,
+      "",
+      ...actionLines,
+      "",
+      "</details>"
+    );
   }
   if (Array.isArray(data.gate?.failures) && data.gate.failures.length) {
-    lines.push("", "#### Gate failures", "", ...data.gate.failures.map((failure) => `- ${failure}`));
+    lines.push(
+      "",
+      "<details>",
+      "<summary><strong>Gate failures</strong></summary>",
+      "",
+      ...data.gate.failures.map((failure) => `- ${failure}`),
+      "",
+      "</details>"
+    );
   }
   if (pillarLines.length) {
     lines.push(
       "",
       "<details>",
-      "<summary>Well-Architected drilldown</summary>",
+      "<summary><strong>Well-Architected drilldown</strong></summary>",
       "",
       ...riskLines,
       "",
+      ...radarLines.length ? [...radarLines, ""] : [],
       "| Pillar | Score | Rating |",
       "| --- | ---: | --- |",
       ...pillarLines,
@@ -3921,7 +4233,7 @@ var buildMarkdownSummary = (data) => {
       lines.push(
         "",
         "<details>",
-        "<summary>Cost drilldown</summary>",
+        "<summary><strong>Cost drilldown</strong></summary>",
         "",
         ...costLines,
         "",
@@ -3933,7 +4245,7 @@ var buildMarkdownSummary = (data) => {
     lines.push(
       "",
       "<details>",
-      `<summary>${validationRows.length ? "Validation failures" : "Validation details"}</summary>`,
+      `<summary><strong>${validationRows.length ? "Validation failures" : "Validation details"}</strong></summary>`,
       "",
       ...validationDetailLines(validation),
       ...validationRows.length ? [
@@ -3950,7 +4262,7 @@ var buildMarkdownSummary = (data) => {
     lines.push(
       "",
       "<details>",
-      "<summary>Architecture signals</summary>",
+      "<summary><strong>Architecture signals</strong></summary>",
       "",
       ...architectureLines,
       "",
@@ -16869,7 +17181,7 @@ program.command("tui").description("Open the CloudEval Terminal UI").option("--b
   const { assertSecureBaseUrl } = await import("./dist-6LEMVXIY.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-IRVY4LSK.js")
+    import("./App-SKVX7NAF.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -16930,7 +17242,7 @@ program.command("chat").description("Start an interactive chat session").option(
   const { assertSecureBaseUrl } = await import("./dist-6LEMVXIY.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-IRVY4LSK.js")
+    import("./App-SKVX7NAF.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -17722,7 +18034,7 @@ Error: ${errorMsg}
 program.command("banner").description("Preview the startup banner and terminal capabilities").action(async () => {
   const { render } = await import("ink");
   const BannerPreview = React.lazy(async () => ({
-    default: (await import("./Banner-4PWF5O3B.js")).Banner
+    default: (await import("./Banner-CRBHEOTC.js")).Banner
   }));
   render(
     /* @__PURE__ */ jsx(React.Suspense, { fallback: null, children: /* @__PURE__ */ jsx(BannerPreview, { disable: false }) })

package/package.json

@@ -1,24 +1,27 @@
 {
   "name": "@ganakailabs/cloudeval-cli",
-  "version": "0.30.1",
+  "version": "0.30.3",
   "license": "LicenseRef-CloudEval-CLI",
   "type": "module",
-  "description": "CloudEval CLI for cloud architecture, cost, report, automation, and MCP workflows.",
+  "description": "Review Cloud infra-as-code and live environments from CLI, CI, and MCP agents.",
   "author": "Ganak AI Labs (https://cloudeval.ai)",
   "keywords": [
     "cloudeval",
-    "cloud",
     "azure",
-    "cli",
-    "mcp",
-    "agents",
-    "automation",
-    "iac",
+    "azure-devops",
     "arm-template",
+    "bicep",
+    "infrastructure-as-code",
+    "iac-review",
+    "cloud-architecture",
+    "cloud-cost",
     "well-architected",
-    "cost",
-    "architecture",
-    "devops"
+    "finops",
+    "devops",
+    "github-actions",
+    "ci-cd",
+    "mcp",
+    "agents"
   ],
   "homepage": "https://docs.cloudeval.ai/reference/cli-overview",
   "repository": {
@@ -83,6 +86,7 @@
     "marked-terminal": "^7.3.0",
     "react": "^18.3.1",
     "react-devtools-core": "^4.28.5",
+    "signalstory": "https://github.com/ganakailabs/signalstory/archive/refs/tags/v0.1.0.tar.gz",
     "sql.js": "^1.14.1"
   },
   "devDependencies": {

package/sbom.spdx.json

@@ -14,7 +14,7 @@
     {
       "SPDXID": "SPDXRef-Package-CloudEval-CLI",
       "name": "CloudEval CLI",
-      "versionInfo": "0.30.1",
+      "versionInfo": "0.30.3",
       "downloadLocation": "https://github.com/ganakailabs/cloudeval-cli",
       "filesAnalyzed": false,
       "licenseConcluded": "LicenseRef-CloudEval-CLI",
@@ -2254,6 +2254,17 @@
       "copyrightText": "Ben Coe",
       "summary": "when you want to fire an event no matter how a process exits."
     },
+    {
+      "SPDXID": "SPDXRef-Package-signalstory-0.1.0",
+      "name": "signalstory",
+      "versionInfo": "0.1.0",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "Apache-2.0",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "summary": "Composable signal-to-story generation for evidence-grounded product, ops, and review narratives."
+    },
     {
       "SPDXID": "SPDXRef-Package-skin-tone-2.0.0",
       "name": "skin-tone",
@@ -3678,6 +3689,11 @@
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Package-signal-exit-3.0.7"
     },
+    {
+      "spdxElementId": "SPDXRef-Package-CloudEval-CLI",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Package-signalstory-0.1.0"
+    },
     {
       "spdxElementId": "SPDXRef-Package-CloudEval-CLI",
       "relationshipType": "DEPENDS_ON",