@prism-d1/cli 1.0.75 → 1.0.77

package/dist/assets/eval-harness/README.md

@@ -1,8 +1,38 @@
 # Eval Harness
 
-Evaluate AI-generated code against rubrics using Amazon Bedrock. Runs per-file, calculates weighted scores client-side, and integrates with the PRISM eval gate workflow.
+Evaluate code quality in CI using either **kiro-cli headless mode** (recommended) or Amazon Bedrock rubrics.
 
-## Install
+## Modes
+
+| Mode | Install Command | How It Works |
+|---|---|---|
+| **Kiro** (recommended) | `prism-cli bootstrapper install-eval-harness --mode kiro` | kiro-cli reads files, follows `.kiro/steering/code-review.md`, outputs structured JSON findings |
+| **Bedrock** (legacy) | `prism-cli bootstrapper install-eval-harness --with-rubrics` | Per-file rubric scoring via Bedrock API, weighted average client-side |
+
+## Kiro Mode
+
+```bash
+prism-cli bootstrapper install-eval-harness --mode kiro
+```
+
+This installs:
+- `.kiro/steering/code-review.md` — review rules (plain English)
+- `.github/workflows/prism-eval-gate.yml` — kiro-cli headless CI workflow
+
+**Requirements:**
+- `KIRO_API_KEY` repository secret (generate at https://app.kiro.dev → Settings → API Keys)
+- (Optional) `PRISM_METRICS_ROLE_ARN` for EventBridge metrics + AWS Continuum security scanning
+
+**How it works:**
+1. PR opened → workflow triggers
+2. kiro-cli reads changed files + the diff via `--trust-all-tools`
+3. Outputs structured JSON: findings with file/line, severity, score
+4. Gate fails if any high-severity finding or score < 0.82
+5. PR comment posted with findings table
+
+## Bedrock Mode (Legacy)
+
+## Bedrock Mode (Legacy) — Install
 
 ```bash
 # Workshop mode — empty rubrics, create your own

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -283,10 +283,43 @@ jobs:
           REPO_SLUG=$(echo "${REPO}" | tr '/' '-')
           CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
           if [ -z "$CODE_REVIEW_ID" ]; then
-            echo "::warning::No Code Review resource for ${REPO_SLUG} -- run 'prism-cli securityagent setup' first. Skipping."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
+            echo "No Code Review found for ${REPO_SLUG} -- bootstrapping..."
+
+            # Get service role (SSM or convention fallback)
+            SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
+            if [ -z "$SERVICE_ROLE" ]; then
+              ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+              SERVICE_ROLE="arn:aws:iam::${ACCOUNT_ID}:role/prism-d1-security-agent-prism-d1-security"
+              echo "  Using convention role: ${SERVICE_ROLE}"
+            fi
+
+            # Upload repo ZIP as source context
+            git archive HEAD --format=zip -o /tmp/repo.zip
+            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
+
+            # Create the Code Review resource
+            CR_OUTPUT=$(aws securityagent create-code-review \
+              --agent-space-id "$AGENT_SPACE_ID" \
+              --title "${REPO_SLUG}-ci-diff-scan" \
+              --service-role "$SERVICE_ROLE" \
+              --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
+              --output json 2>&1) || true
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+
+            if [ -z "$CODE_REVIEW_ID" ]; then
+              echo "::warning::Bootstrap failed: ${CR_OUTPUT}"
+              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
+              echo "findings=0" >> "$GITHUB_OUTPUT"
+              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            # Persist for future runs
+            aws ssm put-parameter \
+              --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
+              --value "$CODE_REVIEW_ID" \
+              --type String --overwrite > /dev/null
+            echo "  Code Review created: ${CODE_REVIEW_ID} (saved to SSM)"
           fi
 
           # Diff must be uploaded with .patch extension (API requirement)
@@ -306,13 +339,13 @@ jobs:
           echo "Continuum job started: ${JOB_ID}"
 
           STATUS="UNKNOWN"
-          for i in $(seq 1 30); do
+          for i in $(seq 1 60); do
             sleep 30
             STATUS=$(aws securityagent batch-get-code-review-jobs \
               --agent-space-id "${AGENT_SPACE_ID}" \
               --code-review-job-ids "${JOB_ID}" \
               --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
-            echo "  Poll ${i}/30: ${STATUS}"
+            echo "  Poll ${i}/60: ${STATUS}"
             case "$STATUS" in COMPLETED|FAILED|STOPPED) break ;; esac
           done
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {