@rahul05ranjan/dhruv-cli 1.4.6 → 1.6.0

package/src/commands/security-check.ts

@@ -4,6 +4,90 @@ import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
 import { printError } from '../utils/ux.js';
 
+const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
+const IGNORED_DIRECTORIES = new Set([
+  '.git',
+  'node_modules',
+  'dist',
+  'build',
+  'coverage',
+  '.dhruv-cache',
+  'logs',
+  '.next',
+  '.turbo',
+  '__pycache__',
+  '.pytest_cache',
+  'target',
+  'vendor',
+]);
+
+function redactSensitiveContent(content: string): string {
+  return content
+    .replace(/(\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`])[^"'`\r\n]+(["'`])/gi, '$1[REDACTED]$2')
+    .replace(/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/gi, '[REDACTED]')
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]')
+    .replace(/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g, '[REDACTED]')
+    .replace(/\bAKIA[0-9A-Z]{16}\b/g, '[REDACTED]')
+    .replace(/-----BEGIN (?:RSA|OPENSSH|EC|PGP|DSA)? PRIVATE KEY-----[\s\S]*?-----END (?:RSA|OPENSSH|EC|PGP|DSA)? PRIVATE KEY-----/g, '[REDACTED PRIVATE KEY]');
+}
+
+interface SecurityFinding {
+  line: number;
+  severity: 'high';
+  description: string;
+  remediation: string;
+}
+
+function findHighConfidenceFindings(content: string): SecurityFinding[] {
+  const findings: SecurityFinding[] = [];
+  const lines = content.split(/\r?\n/);
+
+  lines.forEach((line, index) => {
+    if (/\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`][^"'`\r\n]+["'`]/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like value assigned in source',
+        remediation: 'rotate the credential and load it from a secret manager or environment variable',
+      });
+    } else if (/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'credential-like API key detected',
+        remediation: 'rotate the credential and remove it from source control',
+      });
+    } else if (/\bBearer\s+[A-Za-z0-9._~+/=-]+/i.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'bearer token detected',
+        remediation: 'revoke the token and use a secure runtime secret store',
+      });
+    } else if (/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'GitHub token detected',
+        remediation: 'revoke the GitHub token and store it in GitHub Secrets or environment variables',
+      });
+    } else if (/\bAKIA[0-9A-Z]{16}\b/.test(line)) {
+      findings.push({
+        line: index + 1,
+        severity: 'high',
+        description: 'AWS access key ID detected',
+        remediation: 'rotate the AWS access key and use IAM roles or AWS Secrets Manager',
+      });
+    }
+  });
+
+  return findings;
+}
+
+export interface SecurityCheckOptions {
+  strict?: boolean;
+}
+
 /** Reads a file or the code files of a directory (up to 10), concatenated. */
 function readCode(fileOrDir: string): string | undefined {
   // Read first, branch on the error: no separate existence check to race against.
@@ -22,10 +106,22 @@ function readCode(fileOrDir: string): string | undefined {
 }
 
 function readDirectory(dir: string): string | undefined {
-  const files = fs
-    .readdirSync(dir)
-    .filter((f) => f.match(/\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/))
-    .slice(0, 10);
+  const files: string[] = [];
+
+  function collect(current: string): void {
+    if (files.length >= 10) return;
+    for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (files.length >= 10) return;
+      const absolute = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRECTORIES.has(entry.name)) collect(absolute);
+      } else if (entry.isFile() && CODE_FILE.test(entry.name)) {
+        files.push(path.relative(dir, absolute).split(path.sep).join('/'));
+      }
+    }
+  }
+
+  collect(dir);
 
   if (files.length === 0) {
     printError(`No code files found in directory "${dir}".`);
@@ -43,16 +139,25 @@ function readDirectory(dir: string): string | undefined {
   return code;
 }
 
-export async function securityCheck(fileOrDir: string = '.') {
+export async function securityCheck(fileOrDir: string = '.', options: SecurityCheckOptions = {}) {
   const code = readCode(fileOrDir);
   if (code === undefined) return;
+  const findings = findHighConfidenceFindings(code);
+  const safeCode = redactSensitiveContent(code);
+  const findingSummary = findings.length === 0
+    ? 'none'
+    : findings.map((finding) => `- ${finding.severity} at line ${finding.line}: ${finding.description}; remediation: ${finding.remediation}`).join('\n');
+
+  if (options.strict && findings.length > 0) {
+    process.exitCode = 1;
+  }
 
   await runCommand({
     name: 'security-check',
     input: { fileOrDir },
     header: '🛡️  Security Analysis: ',
     buildRequest: (input, model) => ({
-      prompt: `Perform a security analysis on this code. Look for common security vulnerabilities, unsafe practices, potential injection attacks, and provide recommendations for improvement:\n\n${code}`,
+      prompt: `Perform a security analysis on this code. Look for common security vulnerabilities, unsafe practices, potential injection attacks, and provide recommendations for improvement. High-confidence pre-scan findings:\n${findingSummary}\n\n${safeCode}`,
       systemMessage: getSystemMessage('security'),
       model,
     }),

package/src/commands/status.ts

@@ -1,12 +1,47 @@
 import chalk from 'chalk';
 import { loadConfig } from '../config/config.js';
 import { printSuccess, printError, printInfo } from '../utils/ux.js';
-import { listModels } from '../core/ai.js';
+import { getOllamaStatus, listModels } from '../core/ai.js';
 
 export async function status() {
-  console.log(chalk.blue('🔍 Dhruv CLI Status Check\n'));
-
   const config = loadConfig();
+  if (config.responseFormat === 'json') {
+    try {
+      const models = await listModels();
+      const server = await getOllamaStatus();
+      const configuredModelAvailable = models.includes(config.model);
+      process.stdout.write(`${JSON.stringify({
+        ok: configuredModelAvailable,
+        command: 'status',
+        model: config.model,
+        responseFormat: config.responseFormat,
+        verbose: config.verbose,
+        theme: config.theme,
+        availableModels: models,
+        configuredModelAvailable,
+        endpoint: server.endpoint,
+        version: server.version ?? null,
+        ollama: 'connected',
+        nextSteps: configuredModelAvailable ? [] : [`ollama pull ${config.model}`],
+      })}\n`);
+      if (!configuredModelAvailable) process.exitCode = 1;
+    } catch (error) {
+      process.exitCode = 1;
+      process.stdout.write(`${JSON.stringify({
+        ok: false,
+        command: 'status',
+        model: config.model,
+        ollama: 'unavailable',
+        error: (error as Error).message,
+      })}\n`);
+    }
+    return;
+  }
+
+  console.log(chalk.blue('🔍 Dhruv CLI Status Check\n'));
+  const server = await getOllamaStatus();
+  printInfo(`Ollama endpoint: ${server.endpoint}`);
+  printInfo(`Ollama version: ${server.version ?? 'unavailable'}\n`);
   printInfo(`Current configuration:`);
   console.log(`  Model: ${config.model}`);
   console.log(`  Response Format: ${config.responseFormat}`);
@@ -33,15 +68,18 @@ export async function status() {
     if (models.includes(config.model)) {
       printSuccess(`✓ Configured model '${config.model}' is available`);
     } else {
+      process.exitCode = 1;
       printError(`✗ Configured model '${config.model}' is not available`);
+      console.log(chalk.yellow(`💡 Install the model: ollama pull ${config.model}`));
       if (models.length > 0) {
         console.log(chalk.yellow(`Available models: ${models.join(', ')}`));
       }
     }
   } catch (error) {
+    process.exitCode = 1;
     printError('✗ Ollama connection failed');
     console.log(chalk.red((error as Error).message));
-    console.log(chalk.yellow('\nTo start Ollama, run: ollama serve'));
-    console.log(chalk.yellow('To install a model, run: ollama pull llama2'));
+    console.log(chalk.yellow('\n💡 To start Ollama, run: ollama serve'));
+    console.log(chalk.yellow(`💡 To install the configured model, run: ollama pull ${config.model}`));
   }
 }

package/src/config/config.ts

@@ -1,12 +1,17 @@
 import fs from 'fs';
 import path from 'path';
+import os from 'os';
 
-const CONFIG_FILE = path.join(process.cwd(), '.dhruv-config.json');
+const LOCAL_CONFIG_FILE = path.join(process.cwd(), '.dhruv-config.json');
+const GLOBAL_CONFIG_FILE = path.join(os.homedir(), '.config', 'dhruv', 'config.json');
+
+export type ConfigScope = 'local' | 'global';
 
 export interface DhruvConfig {
   model: string;
   verbose: boolean;
   responseFormat: 'text' | 'json' | 'markdown';
+  timeoutMs: number;
   theme?: 'default' | 'dark' | 'light' | 'mono';
 }
 
@@ -14,13 +19,14 @@ const defaultConfig: DhruvConfig = {
   model: 'gemma3:270m',
   verbose: false,
   responseFormat: 'text',
+  timeoutMs: 45000,
   theme: 'default',
 };
 
-export function loadConfig(): DhruvConfig {
-  if (fs.existsSync(CONFIG_FILE)) {
+function readConfigFile(file: string): DhruvConfig {
+  if (fs.existsSync(file)) {
     try {
-      const fileContent = fs.readFileSync(CONFIG_FILE, 'utf-8');
+      const fileContent = fs.readFileSync(file, 'utf-8');
       const parsedConfig = JSON.parse(fileContent);
       return validateAndMergeConfig(parsedConfig);
     } catch (error) {
@@ -31,6 +37,12 @@ export function loadConfig(): DhruvConfig {
   return defaultConfig;
 }
 
+export function loadConfig(): DhruvConfig {
+  if (fs.existsSync(LOCAL_CONFIG_FILE)) return readConfigFile(LOCAL_CONFIG_FILE);
+  if (fs.existsSync(GLOBAL_CONFIG_FILE)) return readConfigFile(GLOBAL_CONFIG_FILE);
+  return defaultConfig;
+}
+
 function validateAndMergeConfig(config: Partial<DhruvConfig>): DhruvConfig {
   const validatedConfig = { ...defaultConfig };
   
@@ -48,6 +60,10 @@ function validateAndMergeConfig(config: Partial<DhruvConfig>): DhruvConfig {
   if (config.responseFormat && ['text', 'json', 'markdown'].includes(config.responseFormat)) {
     validatedConfig.responseFormat = config.responseFormat as 'text' | 'json' | 'markdown';
   }
+
+  if (typeof config.timeoutMs === 'number' && Number.isFinite(config.timeoutMs) && config.timeoutMs > 0) {
+    validatedConfig.timeoutMs = Math.round(config.timeoutMs);
+  }
   
   // Validate theme
   if (config.theme && ['default', 'dark', 'light', 'mono'].includes(config.theme)) {
@@ -57,9 +73,12 @@ function validateAndMergeConfig(config: Partial<DhruvConfig>): DhruvConfig {
   return validatedConfig;
 }
 
-export function saveConfig(config: Partial<DhruvConfig>) {
-  const current = loadConfig();
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify({ ...current, ...config }, null, 2));
+export function saveConfig(config: Partial<DhruvConfig>, options: { scope?: ConfigScope } = {}) {
+  const scope = options.scope ?? 'local';
+  const file = scope === 'global' ? GLOBAL_CONFIG_FILE : LOCAL_CONFIG_FILE;
+  const current = scope === 'global' ? readConfigFile(GLOBAL_CONFIG_FILE) : loadConfig();
+  if (scope === 'global') fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify({ ...current, ...config }, null, 2));
 }
 
 // Use .js extension for ESM compatibility if imported elsewhere

package/src/core/ai.ts

@@ -15,12 +15,15 @@ import fs from 'fs';
 import path from 'path';
 import crypto from 'crypto';
 import { loadConfig } from '../config/config.js';
+import { metricsCollector } from './metrics.js';
 
 /** Typed errors: the runner maps these to user-facing hints, never by string matching. */
 export type AIError =
   | { kind: 'connection'; cause: string }
   | { kind: 'model-not-found'; model: string }
   | { kind: 'empty-response'; model: string }
+  | { kind: 'timeout'; timeoutMs: number }
+  | { kind: 'cancelled' }
   | { kind: 'request'; cause: string };
 
 export interface AIRequest {
@@ -29,6 +32,7 @@ export interface AIRequest {
   context?: string;
   model?: string;
   onToken?: (token: string) => void;
+  signal?: AbortSignal;
 }
 
 /** The seam. Both adapters implement this; commands and tests depend on it, never on Ollama. */
@@ -110,9 +114,8 @@ function toAIError(err: unknown, model: string): AIError {
   if (message.includes('ECONNREFUSED') || message.includes('fetch failed') || message.includes('ENOTFOUND')) {
     return { kind: 'connection', cause: message };
   }
-  if (message.includes('not found')) {
-    return { kind: 'model-not-found', model };
-  }
+  if (message.includes('returned empty response')) return { kind: 'empty-response', model };
+  if (message.includes('not found')) return { kind: 'model-not-found', model };
   return { kind: 'request', cause: message };
 }
 
@@ -136,9 +139,11 @@ export class OllamaAIClient implements AIClient {
 
     const cached = readCache(request, model);
     if (cached !== undefined) {
+      metricsCollector.recordCacheHit('ai-response');
       if (request.onToken) request.onToken(cached);
       return cached;
     }
+    metricsCollector.recordCacheMiss('ai-response');
 
     try {
       const streaming = Boolean(request.onToken);
@@ -146,11 +151,17 @@ export class OllamaAIClient implements AIClient {
 
       if (streaming) {
         const stream = await this.client.generate({ model, prompt: fullPrompt, stream: true });
-        for await (const chunk of stream) {
-          const token = typeof chunk === 'object' && chunk !== null && 'response' in chunk ? chunk.response : '';
-          if (!token) continue;
-          result += token;
-          if (request.onToken) request.onToken(token);
+        const abort = () => stream.abort();
+        request.signal?.addEventListener('abort', abort, { once: true });
+        try {
+          for await (const chunk of stream) {
+            const token = typeof chunk === 'object' && chunk !== null && 'response' in chunk ? chunk.response : '';
+            if (!token) continue;
+            result += token;
+            if (request.onToken) request.onToken(token);
+          }
+        } finally {
+          request.signal?.removeEventListener('abort', abort);
         }
       } else {
         const response = await this.client.generate({ model, prompt: fullPrompt, stream: false });
@@ -246,6 +257,23 @@ export async function listModels(): Promise<string[]> {
   return getAIClient().listModels();
 }
 
+export interface OllamaStatus {
+  endpoint: string;
+  version?: string;
+}
+
+export async function getOllamaStatus(): Promise<OllamaStatus> {
+  const endpoint = (process.env.OLLAMA_HOST ?? 'http://127.0.0.1:11434').replace(/\/$/, '');
+  try {
+    const response = await fetch(`${endpoint}/api/version`, { signal: AbortSignal.timeout(1000) });
+    if (!response.ok) return { endpoint };
+    const body = await response.json() as { version?: unknown };
+    return { endpoint, version: typeof body.version === 'string' ? body.version : undefined };
+  } catch {
+    return { endpoint };
+  }
+}
+
 /** Default model, from configuration — one source of truth. */
 export function defaultModel(): string {
   return loadConfig().model;

package/src/core/command-catalog.ts

@@ -0,0 +1,37 @@
+export interface CommandCatalogEntry {
+  name: string;
+  description: string;
+  menuLabel: string;
+  options?: string[];
+}
+
+export const commandCatalog: CommandCatalogEntry[] = [
+  { name: 'explain', description: 'Explain a concept or command', menuLabel: 'Explain' },
+  { name: 'suggest', description: 'Get AI-powered suggestions', menuLabel: 'Suggest' },
+  { name: 'fix', description: 'Get a fix for a coding issue or error', menuLabel: 'Fix' },
+  { name: 'review', description: 'Review code in a file or directory', menuLabel: 'Review', options: ['--diff'] },
+  { name: 'optimize', description: 'Optimize a file (e.g., package.json)', menuLabel: 'Optimize' },
+  { name: 'security-check', description: 'Run a security check on code', menuLabel: 'Security Check', options: ['--strict'] },
+  { name: 'generate', description: 'Generate code/tests for a file', menuLabel: 'Generate', options: ['--apply', '--output', '--overwrite'] },
+  { name: 'init', description: 'Interactive setup/configuration wizard', menuLabel: 'Init (Setup)' },
+  { name: 'status', description: 'Check Ollama connection and available models', menuLabel: 'Status' },
+  { name: 'health', description: 'Run comprehensive health check', menuLabel: 'Health Check', options: ['--details'] },
+  { name: 'metrics', description: 'Display CLI usage metrics', menuLabel: 'Metrics', options: ['--raw', '--reset'] },
+  { name: 'project-type', description: 'Detect and print the current project type', menuLabel: 'Project Type' },
+  { name: 'menu', description: 'Interactive command palette', menuLabel: 'Menu' },
+  { name: 'completion', description: 'Generate shell completion script', menuLabel: 'Shell Completion' },
+];
+
+export function commandDescription(name: string): string {
+  return commandCatalog.find((command) => command.name === name)?.description ?? name;
+}
+
+export function completionCommands(): string {
+  return commandCatalog.map((command) => command.name).join(' ');
+}
+
+export function completionOptions(): string {
+  const options = new Set(['--help', '--version', '--model', '--verbose', '--json', '--timeout']);
+  commandCatalog.forEach((command) => command.options?.forEach((option) => options.add(option)));
+  return [...options].join(' ');
+}

package/src/core/command-runner.ts

@@ -14,6 +14,16 @@ import { logger, logCommand, logPerformance, logError } from '../core/logger.js'
 import { metricsCollector } from '../core/metrics.js';
 import { securityManager } from '../core/security.js';
 
+interface CommandResult {
+  ok: boolean;
+  command: string;
+  model?: string;
+  response?: string;
+  error?: string;
+  hint?: string;
+  durationMs?: number;
+}
+
 /** What makes a command distinct. The runner owns everything else. */
 export interface CommandSpec {
   /** Commander command name, for validation, logging, and metrics. */
@@ -31,16 +41,32 @@ export interface CommandSpec {
 }
 
 /** Maps typed AI errors to user-facing hints — once, not per command. */
-function describeAIError(error: AIError, model: string): string {
-  switch (error.kind) {
+function describeAIError(error: unknown, model: string): string {
+  if (!error || typeof error !== 'object' || !('kind' in error)) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (/econnrefused|failed to connect|fetch failed/i.test(msg)) {
+      return `💡 Make sure Ollama is running: ollama serve`;
+    }
+    if (/model.*not found/i.test(msg)) {
+      return `💡 Install the model: ollama pull ${model}`;
+    }
+    return msg;
+  }
+
+  const typedError = error as AIError;
+  switch (typedError.kind) {
     case 'connection':
       return `💡 Make sure Ollama is running: ollama serve`;
     case 'model-not-found':
-      return `💡 Install the model: ollama pull ${error.model || model}`;
+      return `💡 Install the model: ollama pull ${typedError.model || model}`;
     case 'empty-response':
-      return `💡 Model returned nothing. Install it: ollama pull ${error.model || model}`;
+      return `💡 Model returned nothing. Install it: ollama pull ${typedError.model || model}`;
+    case 'timeout':
+      return `💡 The request timed out after ${typedError.timeoutMs}ms. Try again, use a smaller prompt, or increase --timeout.`;
+    case 'cancelled':
+      return '💡 Request cancelled. Run the command again when ready.';
     default:
-      return error.cause;
+      return typedError.cause;
   }
 }
 
@@ -48,9 +74,16 @@ export async function runCommand(spec: CommandSpec): Promise<void> {
   const startTime = Date.now();
   const { name, input } = spec;
   const config = loadConfig();
+  const jsonOutput = config.responseFormat === 'json';
+
+  const writeJson = (result: CommandResult): void => {
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+  };
 
   const fail = (error: string): void => {
-    printError(error);
+    process.exitCode = 2;
+    if (jsonOutput) writeJson({ ok: false, command: name, error, model: config.model, durationMs: Date.now() - startTime });
+    else printError(error);
     logCommand(name, startTime, false, { error });
     metricsCollector.recordCommand(name, Date.now() - startTime, false);
   };
@@ -68,34 +101,87 @@ export async function runCommand(spec: CommandSpec): Promise<void> {
     return;
   }
 
-  const spinner = ora('Thinking...').start();
+  const spinner = jsonOutput ? undefined : ora('Thinking...').start();
+  let requestTimeout: ReturnType<typeof setTimeout> | undefined;
+  let sigintHandler: (() => void) | undefined;
   try {
-    spinner.stop();
+    spinner?.stop();
 
-    console.log(chalk.yellowBright('🤖 Dhruv CLI: AI-powered developer assistant'));
-    console.log(chalk.green.bold(spec.header));
-    console.log();
+    if (!jsonOutput) {
+      console.log(chalk.yellowBright('🤖 Dhruv CLI: AI-powered developer assistant'));
+      console.log(chalk.green.bold(spec.header));
+      console.log();
+    }
 
-    const response = await ask(spec.buildRequest(input, config.model));
+    let streamed = false;
+    const controller = new AbortController();
+    const request = {
+      ...spec.buildRequest(input, config.model),
+      signal: controller.signal,
+      onToken: (token: string) => {
+        streamed = true;
+        if (!jsonOutput) process.stdout.write(token);
+      },
+    };
+    const aiStartTime = Date.now();
+    const responsePromise = ask(request);
+    const cancellationPromise = new Promise<string>((_, reject) => {
+      sigintHandler = () => {
+        controller.abort();
+        reject({ kind: 'cancelled' } satisfies AIError);
+      };
+      process.once('SIGINT', sigintHandler);
+    });
+    const response = config.timeoutMs > 0
+      ? await Promise.race([
+        responsePromise,
+        cancellationPromise,
+        new Promise<string>((_, reject) => {
+          requestTimeout = setTimeout(() => {
+            controller.abort();
+            reject({ kind: 'timeout', timeoutMs: config.timeoutMs } satisfies AIError);
+          }, config.timeoutMs);
+        }),
+      ])
+      : await Promise.race([responsePromise, cancellationPromise]);
+    if (requestTimeout) clearTimeout(requestTimeout);
+    if (sigintHandler) process.removeListener('SIGINT', sigintHandler);
+    if (!response.trim()) {
+      throw { kind: 'empty-response', model: config.model } satisfies AIError;
+    }
 
-    console.log('\n');
-    if (spec.footer) {
-      console.log(chalk.dim(spec.footer));
+    const durationMs = Date.now() - startTime;
+    if (jsonOutput) {
+      writeJson({ ok: true, command: name, model: config.model, response, durationMs });
+    } else {
+      if (!streamed) process.stdout.write(response);
+      process.stdout.write('\n');
+      if (spec.footer) console.log(chalk.dim(spec.footer));
     }
 
     if (spec.onComplete) spec.onComplete(response, input);
 
-    const duration = Date.now() - startTime;
+    metricsCollector.recordAIRequest(config.model, name, Date.now() - aiStartTime, true);
     logCommand(name, startTime, true, { model: config.model });
-    logPerformance(name, duration);
-    metricsCollector.recordCommand(name, duration, true);
-    logger.info(`${name} command completed successfully`, { duration });
+    logPerformance(name, durationMs);
+    metricsCollector.recordCommand(name, durationMs, true);
+    logger.info(`${name} command completed successfully`, { duration: durationMs });
   } catch (err) {
-    spinner.stop();
+    spinner?.stop();
+    if (requestTimeout) clearTimeout(requestTimeout);
+    if (sigintHandler) process.removeListener('SIGINT', sigintHandler);
+    const cancelled = typeof err === 'object' && err !== null && 'kind' in err && (err as { kind?: string }).kind === 'cancelled';
+    process.exitCode = cancelled ? 130 : 1;
     const duration = Date.now() - startTime;
+    const hint = describeAIError(err as AIError, config.model);
+    metricsCollector.recordAIRequest(config.model, name, duration, false);
 
-    printError(`Command failed.`);
-    console.log(chalk.yellow(describeAIError(err as AIError, config.model)));
+    if (jsonOutput) {
+      writeJson({ ok: false, command: name, model: config.model, error: 'Command failed.', hint, durationMs: duration });
+    } else {
+      printError(`Command failed.`);
+      console.log(chalk.yellow(hint));
+    }
 
     logError(`${name} command failed`, err as Error, { command: name });
     logCommand(name, startTime, false, { error: (err as Error).message });

package/src/core/logger.ts

@@ -61,6 +61,7 @@ class Logger {
       // Console transport for development
       new winston.transports.Console({
         level: config.verbose ? 'debug' : 'info',
+        stderrLevels: ['error', 'warn', 'info', 'debug'],
         format: winston.format.combine(
           winston.format.colorize(),
           winston.format.simple(),