@gurulu/cli 1.2.0 → 1.2.2

package/dist/bin.js

@@ -24529,7 +24529,7 @@ class ApiClient {
 }
 
 // src/lib/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 var DEFAULT_ENDPOINT = process.env.GURULU_ENDPOINT ?? "https://api.gurulu.io";
@@ -24586,10 +24586,9 @@ function writeGlobalCredentials(creds) {
   const path = globalCredentialsPath();
   ensureDir(path);
   writeFileSync(path, `${JSON.stringify(creds, null, 2)}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
   try {
-    const fs = __require("node:fs");
-    fs.chmodSync(path, 384);
+    chmodSync(path, 384);
   } catch {}
 }
 function findCredentialForWorkspace(workspaceId) {
@@ -25121,6 +25120,145 @@ import { existsSync as existsSync9, mkdirSync as mkdirSync2, writeFileSync as wr
 import { dirname as dirname3 } from "node:path";
 import * as p3 from "@clack/prompts";
 
+// src/commands/pull.ts
+import { writeFileSync as writeFileSync3 } from "node:fs";
+
+// src/lib/codegen.ts
+function enumKeyName(key) {
+  return key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+}
+function escapePropName(name) {
+  if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+    return name;
+  return `'${name.replace(/'/g, "\\'")}'`;
+}
+function tsType(t2) {
+  switch (t2) {
+    case "string":
+      return "string";
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "date":
+      return "string | Date";
+    case "array":
+      return "unknown[]";
+    case "json":
+      return "Record<string, unknown>";
+    default:
+      return "unknown";
+  }
+}
+function generateTypescript(manifest) {
+  const banner = `// Generated by @gurulu/cli — DO NOT EDIT
+// Workspace: ${manifest.workspace_id} | Manifest version: ${manifest.manifest_version} | Schema: v${manifest.schema_version}
+// Generated: ${manifest.exported_at}
+// Events: ${manifest.events.length}
+
+`;
+  if (manifest.events.length === 0) {
+    return `${banner}export const GuruluEvents = {} as const;
+export type GuruluEvents = (typeof GuruluEvents)[keyof typeof GuruluEvents];
+
+export type EventProperties = Record<never, never>;
+
+export declare function track<E extends GuruluEvents>(
+  event: E,
+  properties: EventProperties[E],
+): Promise<void>;
+`;
+  }
+  const enumLines = manifest.events.map((e2) => `  ${enumKeyName(e2.key)}: '${e2.key}',`);
+  const mapLines = manifest.events.map((e2) => {
+    const props = (e2.properties ?? []).slice().sort((a2, b2) => (a2.position ?? 0) - (b2.position ?? 0)).map((p) => {
+      const optional = p.required ? "" : "?";
+      const comment = p.format ? `  // format: ${p.format}` : "";
+      return `    ${escapePropName(p.name)}${optional}: ${tsType(p.type)};${comment}`;
+    }).join(`
+`);
+    return `  '${e2.key}': {
+${props || "    // no properties"}
+  };`;
+  });
+  return `${banner}export const GuruluEvents = {
+${enumLines.join(`
+`)}
+} as const;
+export type GuruluEvents = (typeof GuruluEvents)[keyof typeof GuruluEvents];
+
+export interface EventProperties {
+${mapLines.join(`
+`)}
+}
+
+/**
+ * Typed track — compile-time validation against pulled registry.
+ * Runtime implementation: @gurulu/web or @gurulu/node.
+ */
+export declare function track<E extends GuruluEvents>(
+  event: E,
+  properties: EventProperties[E],
+): Promise<void>;
+`;
+}
+function generateManifestLock(manifest) {
+  return `${manifest.manifest_version}
+`;
+}
+
+// src/commands/pull.ts
+async function runPull(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const project = readProjectConfig(cwd);
+  if (!project) {
+    throw new Error("no .gurulu/config.json — run `gurulu init` first");
+  }
+  const cred = resolveActiveCredential({
+    workspaceId: opts.workspaceId ?? project.workspace_id,
+    cwd
+  });
+  if (!cred) {
+    throw new Error("no credentials — run `gurulu login` or set GURULU_API_KEY env (workspace sk_xxx)");
+  }
+  const client = new ApiClient({
+    endpoint: project.endpoint ?? cred.endpoint,
+    apiKey: cred.apiKey
+  });
+  const manifest = await client.get("/v1/cli/registry/pull", {
+    workspace_id: cred.workspaceId
+  });
+  writeFileSync3(projectRegistryPath(cwd), `${JSON.stringify(manifest, null, 2)}
+`, "utf-8");
+  const ts = generateTypescript(manifest);
+  writeFileSync3(projectGeneratedPath(cwd), ts, "utf-8");
+  writeFileSync3(projectManifestLockPath(cwd), generateManifestLock(manifest), "utf-8");
+  return manifest;
+}
+var pullCmd = defineCommand({
+  meta: {
+    name: "pull",
+    description: "Pull registry snapshot + code-gen typed events"
+  },
+  args: {
+    workspace: { type: "string", description: "Workspace ID (override project config)" }
+  },
+  async run({ args }) {
+    try {
+      const manifest = await runPull({
+        ...args.workspace ? { workspaceId: String(args.workspace) } : {}
+      });
+      console.log(`[gurulu] pulled ${manifest.events.length} events (manifest ${manifest.manifest_version})`);
+      console.log(`  → ${projectRegistryPath()}`);
+      console.log(`  → ${projectGeneratedPath()}`);
+      console.log(`  → ${projectManifestLockPath()}`);
+    } catch (err) {
+      console.error(`[gurulu] pull failed: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
+});
+
 // src/lib/detect.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname2, join as join5, parse } from "node:path";
@@ -25223,7 +25361,7 @@ function detectProject(dir) {
 }
 
 // src/lib/env-file.ts
-import { appendFileSync, existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { appendFileSync, existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 var ENV_KEY_LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
 function parseEnvKeys(content) {
@@ -25261,7 +25399,7 @@ function writeEnvFile(opts) {
     const block = opts.vars.filter((v2) => added.includes(v2.key)).map((v2) => `${v2.key}=${formatValue(v2.value)}`).join(`
 `);
     if (existing === "") {
-      writeFileSync3(envPath, `# Gurulu
+      writeFileSync4(envPath, `# Gurulu
 ${block}
 `, "utf-8");
     } else {
@@ -25286,7 +25424,7 @@ function ensureGitignored(cwd, file) {
   if (covered)
     return false;
   if (content === "") {
-    writeFileSync3(giPath, `# Gurulu
+    writeFileSync4(giPath, `# Gurulu
 ${file}
 `, "utf-8");
   } else {
@@ -25376,7 +25514,7 @@ async function execInstall(plan, opts) {
 }
 
 // src/lib/inject.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join7 } from "node:path";
 var DIRECTIVE = /^\s*(['"])use [a-z ]+\1;?\s*$/;
 function lastImportEnd(lines, start) {
@@ -25498,7 +25636,7 @@ function applyInjection(opts) {
     const src2 = readFileSync6(abs, "utf-8");
     const res = injectInit(src2, webPieces(workspaceKey, detected.framework));
     if (res.changed)
-      writeFileSync4(abs, res.output, "utf-8");
+      writeFileSync5(abs, res.output, "utf-8");
     return { strategy, changed: res.changed, file: entry, reason: res.reason };
   }
   if (strategy === "create-module") {
@@ -25507,7 +25645,7 @@ function applyInjection(opts) {
     if (existsSync6(abs)) {
       return { strategy, changed: false, file: rel, reason: "already-present", wireHint: opts.placementHint };
     }
-    writeFileSync4(abs, `${opts.snippet}
+    writeFileSync5(abs, `${opts.snippet}
 `, "utf-8");
     return { strategy, changed: true, file: rel, reason: "created", wireHint: opts.placementHint };
   }
@@ -25692,145 +25830,57 @@ function buildInstallPlan(detected, ctx = {}) {
   };
 }
 
-// src/commands/pull.ts
-import { writeFileSync as writeFileSync5 } from "node:fs";
-
-// src/lib/codegen.ts
-function enumKeyName(key) {
-  return key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+// src/lib/ui.ts
+var noColor = Boolean(process.env.NO_COLOR) || process.env.TERM === "dumb" || !process.stdout.isTTY;
+function wrap(open, close) {
+  return (s2) => noColor ? s2 : `\x1B[${open}m${s2}\x1B[${close}m`;
 }
-function escapePropName(name) {
-  if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
-    return name;
-  return `'${name.replace(/'/g, "\\'")}'`;
+function fg(code) {
+  return (s2) => noColor ? s2 : `\x1B[38;5;${code}m${s2}\x1B[39m`;
 }
-function tsType(t2) {
-  switch (t2) {
-    case "string":
-      return "string";
-    case "number":
-      return "number";
-    case "boolean":
-      return "boolean";
-    case "date":
-      return "string | Date";
-    case "array":
-      return "unknown[]";
-    case "json":
-      return "Record<string, unknown>";
-    default:
-      return "unknown";
-  }
+var c3 = {
+  bold: wrap("1", "22"),
+  dim: wrap("2", "22"),
+  italic: wrap("3", "23"),
+  underline: wrap("4", "24"),
+  reset: (s2) => s2,
+  neon: fg(120),
+  green: fg(78),
+  cyan: fg(45),
+  mint: fg(85),
+  violet: fg(141),
+  pink: fg(212),
+  gray: fg(245),
+  slate: fg(240)
+};
+var GRAD = [120, 84, 85, 86, 80, 44, 45, 51];
+function gradient(text) {
+  if (noColor)
+    return text;
+  const chars = [...text];
+  return chars.map((ch, i2) => {
+    if (ch === " ")
+      return ch;
+    const idx = Math.floor(i2 / Math.max(chars.length - 1, 1) * (GRAD.length - 1));
+    const code = GRAD[idx] ?? GRAD[0];
+    return `\x1B[38;5;${code}m${ch}`;
+  }).join("") + "\x1B[39m";
 }
-function generateTypescript(manifest) {
-  const banner = `// Generated by @gurulu/cli — DO NOT EDIT
-// Workspace: ${manifest.workspace_id} | Manifest version: ${manifest.manifest_version} | Schema: v${manifest.schema_version}
-// Generated: ${manifest.exported_at}
-// Events: ${manifest.events.length}
-
-`;
-  if (manifest.events.length === 0) {
-    return `${banner}export const GuruluEvents = {} as const;
-export type GuruluEvents = (typeof GuruluEvents)[keyof typeof GuruluEvents];
-
-export type EventProperties = Record<never, never>;
-
-export declare function track<E extends GuruluEvents>(
-  event: E,
-  properties: EventProperties[E],
-): Promise<void>;
-`;
-  }
-  const enumLines = manifest.events.map((e2) => `  ${enumKeyName(e2.key)}: '${e2.key}',`);
-  const mapLines = manifest.events.map((e2) => {
-    const props = (e2.properties ?? []).slice().sort((a2, b2) => (a2.position ?? 0) - (b2.position ?? 0)).map((p) => {
-      const optional = p.required ? "" : "?";
-      const comment = p.format ? `  // format: ${p.format}` : "";
-      return `    ${escapePropName(p.name)}${optional}: ${tsType(p.type)};${comment}`;
-    }).join(`
-`);
-    return `  '${e2.key}': {
-${props || "    // no properties"}
-  };`;
-  });
-  return `${banner}export const GuruluEvents = {
-${enumLines.join(`
-`)}
-} as const;
-export type GuruluEvents = (typeof GuruluEvents)[keyof typeof GuruluEvents];
-
-export interface EventProperties {
-${mapLines.join(`
+var OWL = ["   ╲▏▔▔▔▔▏╱  ", "   ▕ ◉  ◉ ▏  ", "   ▕  ╲╱  ▏  ", "    ╲▁▁▁▁╱   "];
+var WORD = ["█▀▀ █ █ █▀▄ █ █ █   █ █", "█▄█ █▄█ █▀▄ █▄█ █▄▄ █▄█"];
+function banner(subtitle = "truth layer · otonom kurulum") {
+  if (noColor)
+    return `\uD83E\uDD89 Gurulu — ${subtitle}`;
+  const owlC = OWL.map((l2) => c3.neon(l2));
+  const wordC = WORD.map((l2) => gradient(l2));
+  const right = ["", wordC[0] ?? "", wordC[1] ?? "", c3.gray(subtitle)];
+  const lines = owlC.map((owl, i2) => right[i2] ? `${owl}  ${right[i2]}` : owl);
+  return `
+${lines.join(`
 `)}
-}
-
-/**
- * Typed track — compile-time validation against pulled registry.
- * Runtime implementation: @gurulu/web or @gurulu/node.
- */
-export declare function track<E extends GuruluEvents>(
-  event: E,
-  properties: EventProperties[E],
-): Promise<void>;
-`;
-}
-function generateManifestLock(manifest) {
-  return `${manifest.manifest_version}
 `;
 }
 
-// src/commands/pull.ts
-async function runPull(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  const project = readProjectConfig(cwd);
-  if (!project) {
-    throw new Error("no .gurulu/config.json — run `gurulu init` first");
-  }
-  const cred = resolveActiveCredential({
-    workspaceId: opts.workspaceId ?? project.workspace_id,
-    cwd
-  });
-  if (!cred) {
-    throw new Error("no credentials — run `gurulu login` or set GURULU_API_KEY env (workspace sk_xxx)");
-  }
-  const client = new ApiClient({
-    endpoint: project.endpoint ?? cred.endpoint,
-    apiKey: cred.apiKey
-  });
-  const manifest = await client.get("/v1/cli/registry/pull", {
-    workspace_id: cred.workspaceId
-  });
-  writeFileSync5(projectRegistryPath(cwd), `${JSON.stringify(manifest, null, 2)}
-`, "utf-8");
-  const ts = generateTypescript(manifest);
-  writeFileSync5(projectGeneratedPath(cwd), ts, "utf-8");
-  writeFileSync5(projectManifestLockPath(cwd), generateManifestLock(manifest), "utf-8");
-  return manifest;
-}
-var pullCmd = defineCommand({
-  meta: {
-    name: "pull",
-    description: "Pull registry snapshot + code-gen typed events"
-  },
-  args: {
-    workspace: { type: "string", description: "Workspace ID (override project config)" }
-  },
-  async run({ args }) {
-    try {
-      const manifest = await runPull({
-        ...args.workspace ? { workspaceId: String(args.workspace) } : {}
-      });
-      console.log(`[gurulu] pulled ${manifest.events.length} events (manifest ${manifest.manifest_version})`);
-      console.log(`  → ${projectRegistryPath()}`);
-      console.log(`  → ${projectGeneratedPath()}`);
-      console.log(`  → ${projectManifestLockPath()}`);
-    } catch (err) {
-      console.error(`[gurulu] pull failed: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    }
-  }
-});
-
 // src/wizard/apply.ts
 async function registerNewEvents(client, events) {
   const registered = [];
@@ -26141,16 +26191,17 @@ async function renderPlan(plan) {
 
 // src/wizard/wire.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join10 } from "node:path";
 
 // src/wizard/agent.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join9 } from "node:path";
 import { promisify } from "node:util";
 
 // src/wizard/guard.ts
 import { basename, isAbsolute, relative as relative2, resolve } from "node:path";
+function resolveInCwd(p3, cwd) {
+  return isAbsolute(p3) ? p3 : resolve(cwd, p3);
+}
 function isAdditiveEdit(find, replace) {
   if (find.length === 0)
     return { ok: false, reason: "empty find" };
@@ -26161,22 +26212,45 @@ function isAdditiveEdit(find, replace) {
     return { ok: false, reason: "no-op edit (replace === find)" };
   return { ok: true };
 }
-var BASH_ALLOW_BINS = new Set([
-  "bun",
-  "bunx",
-  "npm",
-  "npx",
-  "pnpm",
-  "yarn",
+var CHECKER_BINS = new Set([
   "tsc",
   "tsgo",
+  "vue-tsc",
+  "svelte-check",
   "biome",
   "eslint",
   "prettier",
-  "vue-tsc",
-  "svelte-check",
   "astro"
 ]);
+var RUNNER_BINS = new Set(["bun", "npm", "pnpm", "yarn"]);
+var DENY_SUBCMDS = new Set([
+  "install",
+  "i",
+  "add",
+  "remove",
+  "rm",
+  "uninstall",
+  "un",
+  "ci",
+  "dlx",
+  "x",
+  "exec",
+  "create",
+  "init",
+  "up",
+  "update",
+  "upgrade",
+  "link",
+  "unlink",
+  "global",
+  "dedupe",
+  "audit",
+  "publish",
+  "pack",
+  "import",
+  "config"
+]);
+var SCRIPT_NAME = /^[a-z0-9][a-z0-9:._-]*$/i;
 var BASH_DENY = /[;&|`$<>]|\.\.\/|\b(rm|curl|wget|sudo|chmod|chown|mv|dd|kill|eval|sh|bash|node|python)\b/;
 function isAllowedBash(cmd) {
   const t2 = cmd.trim();
@@ -26184,10 +26258,24 @@ function isAllowedBash(cmd) {
     return { ok: false, reason: "empty cmd" };
   if (BASH_DENY.test(t2))
     return { ok: false, reason: "yasak operatör/binary" };
-  const bin = t2.split(/\s+/)[0] ?? "";
-  if (!BASH_ALLOW_BINS.has(bin))
-    return { ok: false, reason: `allowlist dışı binary: ${bin}` };
-  return { ok: true };
+  const tokens = t2.split(/\s+/);
+  const bin = tokens[0] ?? "";
+  if (CHECKER_BINS.has(bin))
+    return { ok: true };
+  if (RUNNER_BINS.has(bin)) {
+    const sub = tokens[1] ?? "";
+    if (sub === "run") {
+      const script = tokens[2] ?? "";
+      if (!SCRIPT_NAME.test(script))
+        return { ok: false, reason: `geçersiz script adı: ${script}` };
+      return { ok: true };
+    }
+    if (bin === "yarn" && sub && !DENY_SUBCMDS.has(sub) && SCRIPT_NAME.test(sub)) {
+      return { ok: true };
+    }
+    return { ok: false, reason: `yasak alt-komut (sadece 'run' izinli): ${bin} ${sub}` };
+  }
+  return { ok: false, reason: `allowlist dışı binary: ${bin}` };
 }
 function isAllowedPath(p3, cwd) {
   const abs = isAbsolute(p3) ? p3 : resolve(cwd, p3);
@@ -26207,6 +26295,31 @@ function hasPromptInjection(content) {
 // src/wizard/agent.ts
 var MAX_OBS = 4000;
 var pexec = promisify(execFile);
+function safeEnv() {
+  const keep = [
+    "PATH",
+    "HOME",
+    "USERPROFILE",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "LANG",
+    "LC_ALL",
+    "TERM",
+    "SHELL",
+    "NODE_ENV",
+    "PATHEXT",
+    "SystemRoot",
+    "ComSpec"
+  ];
+  const env2 = {};
+  for (const k2 of keep) {
+    const v2 = process.env[k2];
+    if (v2 !== undefined)
+      env2[k2] = v2;
+  }
+  return env2;
+}
 async function defaultRunBash(cmd, cwd) {
   const parts = cmd.trim().split(/\s+/);
   const bin = parts[0] ?? "";
@@ -26214,7 +26327,8 @@ async function defaultRunBash(cmd, cwd) {
     const { stdout: stdout2, stderr } = await pexec(bin, parts.slice(1), {
       cwd,
       timeout: 120000,
-      maxBuffer: 4 * 1024 * 1024
+      maxBuffer: 4 * 1024 * 1024,
+      env: safeEnv()
     });
     return { stdout: stdout2, stderr };
   } catch (e2) {
@@ -26229,7 +26343,7 @@ async function executeTool(action, deps) {
       const g3 = isAllowedPath(action.path, cwd);
       if (!g3.ok)
         return { ok: false, observation: `read reddedildi: ${g3.reason}` };
-      const abs = join9(cwd, action.path);
+      const abs = resolveInCwd(action.path, cwd);
       if (!existsSync7(abs))
         return { ok: false, observation: `dosya yok: ${action.path}` };
       let content = readFileSync8(abs, "utf-8");
@@ -26247,7 +26361,7 @@ async function executeTool(action, deps) {
       const ga = isAdditiveEdit(action.find, action.replace);
       if (!ga.ok)
         return { ok: false, observation: `edit reddedildi: ${ga.reason}` };
-      const abs = join9(cwd, action.path);
+      const abs = resolveInCwd(action.path, cwd);
       if (!existsSync7(abs))
         return { ok: false, observation: `dosya yok: ${action.path}` };
       const src2 = readFileSync8(abs, "utf-8");
@@ -26283,7 +26397,9 @@ function buildWireSystemPrompt() {
     "- `find` must be an EXACT, UNIQUE snippet copied from a file you have read (read before edit).",
     "- Use the exact provided event_key (snake_case). Wire gurulu.track(...) at the right place and",
     "  gurulu.identify(...) at the auth point if given.",
-    "- bash only for verification (typecheck/build/lint) — no install, no other commands.",
+    "- bash is ONLY for verification: the project's own scripts (`npm run typecheck`, `bun run build`,",
+    "  `pnpm run lint`) or a checker binary (`tsc --noEmit`, `biome check`, `eslint .`). Installing or",
+    "  fetching packages (`npm install`, `npx`, `bunx`, `pnpm dlx`, `add`, `exec`) is REJECTED by the guard.",
     "- After wiring, run the project typecheck/build to verify; if it breaks, fix additively.",
     "- When all events are wired and verify passes, emit done{summary}. Keep edits minimal."
   ].join(`
@@ -26317,17 +26433,35 @@ async function runWireAgent(client, input, snapshots) {
     try {
       res = await client.agentStep({ messages, first: i2 === 0 });
     } catch {
-      return { edits, changedFiles: [...changed], summary: "gateway hata", steps: i2, stoppedReason: "error" };
+      return {
+        edits,
+        changedFiles: [...changed],
+        summary: "gateway hata",
+        steps: i2,
+        stoppedReason: "error"
+      };
     }
     if (res.status === "stub") {
-      return { edits, changedFiles: [...changed], summary: "AI kullanılamadı", steps: i2, stoppedReason: "stub" };
+      return {
+        edits,
+        changedFiles: [...changed],
+        summary: "AI kullanılamadı",
+        steps: i2,
+        stoppedReason: "stub"
+      };
     }
     const { action, reasoning } = res.step;
     if (action.tool === "done") {
-      return { edits, changedFiles: [...changed], summary: action.summary, steps: i2, stoppedReason: "done" };
+      return {
+        edits,
+        changedFiles: [...changed],
+        summary: action.summary,
+        steps: i2,
+        stoppedReason: "done"
+      };
     }
     if (action.tool === "edit") {
-      const abs = join10(input.cwd, action.path);
+      const abs = resolveInCwd(action.path, input.cwd);
       if (!snapshots.has(action.path) && existsSync8(abs)) {
         snapshots.set(action.path, readFileSync9(abs, "utf-8"));
       }
@@ -26340,11 +26474,17 @@ async function runWireAgent(client, input, snapshots) {
     messages.push({ role: "assistant", content: JSON.stringify(res.step) });
     messages.push({ role: "user", content: `[${reasoning}] → ${out.observation}` });
   }
-  return { edits, changedFiles: [...changed], summary: "adım limiti", steps: MAX_STEPS, stoppedReason: "cap" };
+  return {
+    edits,
+    changedFiles: [...changed],
+    summary: "adım limiti",
+    steps: MAX_STEPS,
+    stoppedReason: "cap"
+  };
 }
 function restoreSnapshots(cwd, snapshots) {
   for (const [rel, content] of snapshots) {
-    writeFileSync7(join10(cwd, rel), content, "utf-8");
+    writeFileSync7(resolveInCwd(rel, cwd), content, "utf-8");
   }
 }
 function unifiedDiff(oldStr, newStr, file, context = 2) {
@@ -26376,7 +26516,7 @@ function unifiedDiff(oldStr, newStr, file, context = 2) {
 function formatWireDiff(cwd, snapshots) {
   const blocks = [];
   for (const [rel, oldContent] of snapshots) {
-    const abs = join10(cwd, rel);
+    const abs = resolveInCwd(rel, cwd);
     const cur = existsSync8(abs) ? readFileSync9(abs, "utf-8") : "";
     if (cur !== oldContent)
       blocks.push(unifiedDiff(oldContent, cur, rel));
@@ -26406,14 +26546,23 @@ function bail() {
   process.exit(0);
 }
 async function runWizard(opts) {
-  p3.intro("\uD83E\uDD89 Gurulu kurulum sihirbazı");
+  if (process.stdout.isTTY)
+    process.stdout.write(banner());
+  p3.intro(c3.dim("otonom kurulum başlıyor — auth → workspace → install → wire"));
+  const TOTAL = 6;
+  const phase = (n2, label) => {
+    p3.log.step(`${c3.dim(`[${n2}/${TOTAL}]`)} ${c3.bold(label)}`);
+  };
+  phase(1, "Kimlik doğrulama");
   const auth = await ensureAuth({
     ...opts.endpoint ? { endpoint: opts.endpoint } : {},
     ...opts.apiKey ? { apiKey: opts.apiKey } : {},
     ...opts.workspaceId ? { workspaceId: opts.workspaceId } : {}
   });
   const client = new ApiClient({ endpoint: auth.endpoint, apiKey: auth.apiKey });
+  phase(2, "Workspace");
   const { workspaceId, writeKey } = await resolveWorkspace(client, auth.workspaceId, opts);
+  phase(3, "Proje tespiti & plan");
   const detected = detectProject(opts.cwd);
   let framework = detected.framework;
   if (opts.framework && FRAMEWORKS.includes(opts.framework)) {
@@ -26438,9 +26587,10 @@ async function runWizard(opts) {
   const project = { ...detected, framework };
   const plan = buildInstallPlan(project, { writeKey, workspaceId });
   const isNode = plan.sdk === "@gurulu/node";
+  const authed = Boolean(auth.apiKey);
   let approvedEvents = [];
   let identifyHint = null;
-  if (!opts.noAi && detected.hasPackageJson) {
+  if (!opts.noAi && authed && detected.hasPackageJson) {
     const ctx = gatherContext({ cwd: opts.cwd });
     const aiPlan = await fetchPlan(client, ctx, { framework });
     if (aiPlan) {
@@ -26452,6 +26602,7 @@ async function runWizard(opts) {
       p3.log.info("AI planı yok — autocapture + sektör paketi (deterministik floor).");
     }
   }
+  phase(4, "SDK kurulumu");
   let installed = false;
   if (opts.noInstall) {
     p3.log.info(`SDK kurulumu atlandı — elle: ${plan.installCommand}`);
@@ -26468,6 +26619,7 @@ async function runWizard(opts) {
       s2.stop(`Kurulum başarısız — elle çalıştır: ${plan.installCommand}`, 1);
     }
   }
+  phase(5, "Kod & env wiring");
   const inj = applyInjection({
     cwd: opts.cwd,
     detected: project,
@@ -26478,10 +26630,15 @@ async function runWizard(opts) {
   const envFile = isNode ? ".env" : ".env.local";
   const vars = [];
   for (const k2 of plan.envKeys) {
-    if (k2.key.endsWith("_WORKSPACE"))
+    if (k2.key.endsWith("_WORKSPACE")) {
       vars.push({ key: k2.key, value: writeKey });
-    else if (k2.key === "GURULU_SECRET_KEY")
-      vars.push({ key: k2.key, value: auth.apiKey });
+    } else if (k2.key === "GURULU_SECRET_KEY") {
+      if (auth.apiKey.startsWith("sk_")) {
+        vars.push({ key: k2.key, value: auth.apiKey });
+      } else {
+        p3.log.warn("GURULU_SECRET_KEY atlandı (login token workspace sk_ anahtarı değil). Dashboard → Settings → API Keys'ten server key oluşturup .env'e elle ekle.");
+      }
+    }
   }
   const envRes = vars.length > 0 ? writeEnvFile({ cwd: opts.cwd, file: envFile, vars }) : null;
   writeProjectScaffold(opts.cwd, {
@@ -26489,6 +26646,7 @@ async function runWizard(opts) {
     endpoint: auth.endpoint,
     sdkPref: isNode ? "node" : "web"
   });
+  phase(6, "Registry & rapor");
   let pulled = false;
   if (!opts.noPull) {
     try {
@@ -26518,7 +26676,9 @@ ${captureGuide(approvedEvents, identifyHint, isNode)}`);
       s2.stop(`wire: ${outcome.changedFiles.length} dosya / ${outcome.steps} adım (${outcome.stoppedReason})`);
       if (outcome.changedFiles.length > 0) {
         p3.log.message(formatWireDiff(opts.cwd, snapshots));
-        const keep = opts.yes ? true : await p3.confirm({ message: `${outcome.changedFiles.length} dosyadaki wire değişikliklerini tut?` });
+        const keep = opts.yes ? true : await p3.confirm({
+          message: `${outcome.changedFiles.length} dosyadaki wire değişikliklerini tut?`
+        });
         if (p3.isCancel(keep) || !keep) {
           restoreSnapshots(opts.cwd, snapshots);
           p3.log.info("Wire geri alındı — capture snippet rehberi:");
@@ -26548,13 +26708,13 @@ ${captureGuide(approvedEvents, identifyHint, isNode)}`);
   }
   lines.push(`✓ .gurulu/config.json${pulled ? " + registry pull" : ""}`);
   p3.note(lines.join(`
-`), "Değişiklikler");
+`), c3.neon("✦ Değişiklikler"));
   if (inj.strategy !== "prepend-entry" || inj.reason === "no-entry") {
     p3.log.info(`Wire: ${inj.wireHint ?? plan.placementHint}`);
     if (inj.strategy === "manual")
       p3.log.message(plan.initSnippet);
   }
-  p3.outro(`Hazır \uD83C\uDF89  Doğrula: gurulu doctor  ·  Dashboard: https://dashboard.gurulu.io/app?onboard=done`);
+  p3.outro(`${c3.neon("\uD83E\uDD89 Hazır!")}  ${c3.dim("Doğrula:")} ${c3.bold("gurulu doctor")}  ${c3.dim("·")}  ${c3.dim("Dashboard:")} ${c3.cyan("https://dashboard.gurulu.io/app?onboard=done")}`);
 }
 async function resolveWorkspace(client, authWorkspaceId, opts) {
   if (opts.writeKey) {
@@ -26664,11 +26824,19 @@ var wizardArgs = {
   framework: { type: "string", description: "Framework override (auto-detect yerine)" },
   install: { type: "boolean", description: "SDK install (--no-install ile atla)", default: true },
   pull: { type: "boolean", description: "İlk registry pull (--no-pull ile atla)", default: true },
-  ai: { type: "boolean", description: "AI Plan/wire fazı (--no-ai ile atla → floor)", default: true },
+  ai: {
+    type: "boolean",
+    description: "AI Plan/wire fazı (--no-ai ile atla → floor)",
+    default: true
+  },
   yes: { type: "boolean", description: "Onayları otomatik geç" },
   ci: { type: "boolean", description: "Non-interaktif (api-key + workspace zorunlu)" }
 };
 async function runWizardFromArgs(args) {
+  if (args.ci && (!args["api-key"] || !args.workspace)) {
+    console.error("[gurulu] --ci için --api-key <sk_...> ve --workspace <uuid> zorunlu (non-interaktif kurulum).");
+    process.exit(1);
+  }
   const opts = {
     cwd: process.cwd(),
     noInstall: args.install === false,
@@ -26702,7 +26870,7 @@ var initCmd = defineCommand({
 // src/lib/editor-mcp.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname4, join as join11 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 var SERVER_NAME = "gurulu";
 function buildMcpServerConfig(creds) {
   return {
@@ -26716,14 +26884,14 @@ function buildMcpServerConfig(creds) {
   };
 }
 var EDITORS = {
-  cursor: { path: () => join11(homedir2(), ".cursor", "mcp.json"), key: "mcpServers", label: "Cursor" },
-  claude: { path: () => join11(homedir2(), ".claude.json"), key: "mcpServers", label: "Claude Code" },
+  cursor: { path: () => join9(homedir2(), ".cursor", "mcp.json"), key: "mcpServers", label: "Cursor" },
+  claude: { path: () => join9(homedir2(), ".claude.json"), key: "mcpServers", label: "Claude Code" },
   windsurf: {
-    path: () => join11(homedir2(), ".codeium", "windsurf", "mcp_config.json"),
+    path: () => join9(homedir2(), ".codeium", "windsurf", "mcp_config.json"),
     key: "mcpServers",
     label: "Windsurf"
   },
-  vscode: { path: (cwd) => join11(cwd, ".vscode", "mcp.json"), key: "servers", label: "VS Code" }
+  vscode: { path: (cwd) => join9(cwd, ".vscode", "mcp.json"), key: "servers", label: "VS Code" }
 };
 function mergeMcpConfig(existing, serverConfig, key) {
   const servers = existing[key] ?? {};
@@ -26919,7 +27087,7 @@ var pushCmd = defineCommand({
 // src/commands/uninstall.ts
 import { execFile as execFile2 } from "node:child_process";
 import { existsSync as existsSync11, readFileSync as readFileSync11, rmSync, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join10 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 import * as p4 from "@clack/prompts";
 var pexec2 = promisify2(execFile2);
@@ -26975,7 +27143,7 @@ var uninstallCmd = defineCommand({
     }
     const cleaned = [];
     for (const f3 of ENV_FILES) {
-      const abs = join12(cwd, f3);
+      const abs = join10(cwd, f3);
       if (!existsSync11(abs))
         continue;
       const { content, removed } = removeEnvKeys(readFileSync11(abs, "utf-8"), GURULU_PREFIXES);
@@ -26984,7 +27152,7 @@ var uninstallCmd = defineCommand({
         cleaned.push(`${f3} (-${removed.length})`);
       }
     }
-    const guruluDir = join12(cwd, ".gurulu");
+    const guruluDir = join10(cwd, ".gurulu");
     if (existsSync11(guruluDir))
       rmSync(guruluDir, { recursive: true, force: true });
     p4.outro(`Kaldırıldı. env: ${cleaned.join(", ") || "değişiklik yok"} · .gurulu silindi. (Koddaki init/track çağrılarını elle çıkar.)`);
@@ -26992,7 +27160,7 @@ var uninstallCmd = defineCommand({
 });
 
 // src/index.ts
-var VERSION = "1.2.0";
+var VERSION = "1.2.2";
 var mainCmd = defineCommand({
   meta: {
     name: "gurulu",