@rahul05ranjan/dhruv-cli 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -1,16 +1,23 @@
-# [1.4.0](https://github.com/rahul05ranjan/dhruv-cli/compare/v1.4.6...v1.4.0) (2026-09-18)
+# [1.4.0](https://github.com/rahul05ranjan/dhruv-cli/compare/v1.5.0...v1.4.0) (2026-09-18)
 
 
 ### Bug Fixes
 
-* change moduleResolution from Node to Bundler in tsconfig ([b8339bb](https://github.com/rahul05ranjan/dhruv-cli/commit/b8339bb89781490d5678f43052b606138f375d21))
-* drop unused menu loop flag ([51eeec6](https://github.com/rahul05ranjan/dhruv-cli/commit/51eeec6a607299120ce3e1f15af9f9dc62396ce7))
-* stabilize health and CLI contract tests on CI ([3b3e650](https://github.com/rahul05ranjan/dhruv-cli/commit/3b3e6503591c8c33d36f1887e94358dafe6163ce))
+* **test:** allow health --json contract test to inspect stdout on offline service exit code ([6231027](https://github.com/rahul05ranjan/dhruv-cli/commit/623102722d5c3ac2604dfffa276868a3b7eecdb8))
 
 
 ### Features
 
-* improve cli experience across commands ([ce41913](https://github.com/rahul05ranjan/dhruv-cli/commit/ce4191350ca3d1c5f49b371508e66de9421f6d20))
+* **ai:** ensure complete and streamable responses across commands (closes [#70](https://github.com/rahul05ranjan/dhruv-cli/issues/70)) ([285655e](https://github.com/rahul05ranjan/dhruv-cli/commit/285655e49eab1cbe87492cba2602a27a4bfecdfe))
+* **catalog:** unified command catalog, menu, and shell completions (closes [#79](https://github.com/rahul05ranjan/dhruv-cli/issues/79)) ([13a9c83](https://github.com/rahul05ranjan/dhruv-cli/commit/13a9c836a52933357b9ca187c787e3b9ae8f4948))
+* **cli:** standardize exit codes, timeouts, and cancellation (closes [#72](https://github.com/rahul05ranjan/dhruv-cli/issues/72)) ([d075d16](https://github.com/rahul05ranjan/dhruv-cli/commit/d075d16d1cfb3c000d156bcd238e3c261f0fc66a))
+* **cli:** standardize reliable json output contract (closes [#71](https://github.com/rahul05ranjan/dhruv-cli/issues/71)) ([e0de862](https://github.com/rahul05ranjan/dhruv-cli/commit/e0de86224b54dcf43652b5daf3f4b403d6aa7d8f))
+* **detection:** expand project detection and diagnostics (closes [#77](https://github.com/rahul05ranjan/dhruv-cli/issues/77)) ([221414a](https://github.com/rahul05ranjan/dhruv-cli/commit/221414a7c1156a650c9c746b5345b871e5274c57))
+* **diagnostics:** improve first-run model readiness and health diagnostics (closes [#78](https://github.com/rahul05ranjan/dhruv-cli/issues/78)) ([95cd3a8](https://github.com/rahul05ranjan/dhruv-cli/commit/95cd3a8d772024847a86ba53fb6391f8024ab962))
+* **generate:** previewable generation and multi-language test support (closes [#75](https://github.com/rahul05ranjan/dhruv-cli/issues/75)) ([c7f3dbe](https://github.com/rahul05ranjan/dhruv-cli/commit/c7f3dbe3902ee903220a40a4fae051b3a03797ac))
+* **metrics:** persistent invocation metrics with reset and export (closes [#76](https://github.com/rahul05ranjan/dhruv-cli/issues/76)) ([0b5c4db](https://github.com/rahul05ranjan/dhruv-cli/commit/0b5c4db69e85d10f6afeca1d26e8d9a089ce6e4c))
+* **review:** project-aware review and diff scanning (closes [#73](https://github.com/rahul05ranjan/dhruv-cli/issues/73)) ([290e4a1](https://github.com/rahul05ranjan/dhruv-cli/commit/290e4a18f21dfa9ea5a1f5fb51e2f8d98d83df53))
+* **security:** safe credential redaction and strict checks (closes [#74](https://github.com/rahul05ranjan/dhruv-cli/issues/74)) ([2467d37](https://github.com/rahul05ranjan/dhruv-cli/commit/2467d37f4404f7e16e2a10cfed860a76661d6c60))
 # Changelog
 
 ## [1.1.1](https://github.com/rahul05ranjan/dhruv-cli/compare/v1.1.0...v1.1.1) (2025-06-29)

package/__tests__/cli-contract.test.ts

@@ -37,6 +37,27 @@ describe('CLI output contract', () => {
 
     expect(result.stdout).toContain('status');
     expect(result.stdout).toContain('--json');
+    expect(result.stdout).toContain('tests documentation docs component');
+  });
+
+  it('generates valid zsh and fish completion scripts with subcommands', async () => {
+    const zshResult = await execFileAsync(
+      process.execPath,
+      ['--loader', loaderEntry, sourceEntry, 'completion', 'zsh'],
+      { cwd: repoRoot, env: { ...process.env, DHRUV_METRICS_ENABLED: 'false' } },
+    );
+    expect(zshResult.stdout).toContain('#compdef dhruv');
+    expect(zshResult.stdout).toContain('generate');
+    expect(zshResult.stdout).not.toContain('\u001b[');
+
+    const fishResult = await execFileAsync(
+      process.execPath,
+      ['--loader', loaderEntry, sourceEntry, 'completion', 'fish'],
+      { cwd: repoRoot, env: { ...process.env, DHRUV_METRICS_ENABLED: 'false' } },
+    );
+    expect(fishResult.stdout).toContain('complete -c dhruv');
+    expect(fishResult.stdout).toContain('__fish_seen_subcommand_from generate');
+    expect(fishResult.stdout).not.toContain('\u001b[');
   });
 
   it('rejects unsupported completion shells', async () => {
@@ -101,4 +122,49 @@ describe('CLI output contract', () => {
 
     expect(result.stdout).toContain('--details');
   });
+
+  it('outputs exactly one valid JSON document on stdout with no ANSI or extra text', async () => {
+    const result = await execFileAsync(
+      process.execPath,
+      ['--loader', loaderEntry, sourceEntry, 'metrics', '--json'],
+      {
+        cwd: repoRoot,
+        env: { ...process.env, DHRUV_METRICS_ENABLED: 'false' },
+      },
+    );
+
+    expect(result.stdout).not.toContain('\u001b[');
+    const parsed = JSON.parse(result.stdout.trim()) as Record<string, unknown>;
+    expect(parsed).toMatchObject({
+      ok: true,
+      command: 'metrics',
+    });
+  });
+
+  it('outputs valid JSON for health command with expected top-level schema', async () => {
+    let stdout = '';
+    try {
+      const result = await execFileAsync(
+        process.execPath,
+        ['--loader', loaderEntry, sourceEntry, 'health', '--json'],
+        {
+          cwd: repoRoot,
+          env: { ...process.env, DHRUV_METRICS_ENABLED: 'false' },
+        },
+      );
+      stdout = result.stdout;
+    } catch (err: unknown) {
+      const execError = err as { stdout?: string; code?: number };
+      if (typeof execError?.stdout === 'string' && execError.stdout.trim().length > 0) {
+        stdout = execError.stdout;
+      } else {
+        throw err;
+      }
+    }
+
+    expect(stdout).not.toContain('\u001b[');
+    const parsed = JSON.parse(stdout.trim()) as Record<string, unknown>;
+    expect(parsed).toHaveProperty('ok');
+    expect(parsed.command).toBe('health');
+  });
 });

package/__tests__/core.test.ts

@@ -7,7 +7,7 @@ import {
 } from '../src/core/ai';
 import { loadConfig, saveConfig } from '../src/config/config';
 import { createSpinner } from '../src/utils/ux';
-import { detectProjectType } from '../src/utils/projectType';
+import { detectProjectType, detectProjectDetails } from '../src/utils/projectType';
 import { getSystemMessage } from '../src/core/prompts';
 import { runCommand } from '../src/core/command-runner';
 import fs from 'fs';
@@ -204,11 +204,56 @@ describe('Dhruv CLI Core Systems', () => {
       const mockReadFileSync = jest.spyOn(fs, 'readFileSync');
       mockReadFileSync.mockReturnValue('{ malformed');
 
+      const details = detectProjectDetails();
+      expect(details.type).toBe('unknown');
+      expect(details.diagnostic).toContain('Malformed package.json');
       expect(detectProjectType()).toBe('unknown');
 
       mockExistsSync.mockRestore();
       mockReadFileSync.mockRestore();
     });
+
+    it('should detect Python project with FastAPI framework', () => {
+      const mockExistsSync = jest.spyOn(fs, 'existsSync');
+      mockExistsSync.mockImplementation((filePath: fs.PathLike) => path.basename(filePath.toString()) === 'requirements.txt');
+      const mockReadFileSync = jest.spyOn(fs, 'readFileSync');
+      mockReadFileSync.mockReturnValue('fastapi>=0.100.0\nuvicorn>=0.20.0');
+
+      expect(detectProjectType()).toBe('python-fastapi');
+
+      mockExistsSync.mockRestore();
+      mockReadFileSync.mockRestore();
+    });
+
+    it('should detect Go project from go.mod', () => {
+      const mockExistsSync = jest.spyOn(fs, 'existsSync');
+      mockExistsSync.mockImplementation((filePath: fs.PathLike) => path.basename(filePath.toString()) === 'go.mod');
+
+      expect(detectProjectType()).toBe('go');
+
+      mockExistsSync.mockRestore();
+    });
+
+    it('should detect Rust project from Cargo.toml', () => {
+      const mockExistsSync = jest.spyOn(fs, 'existsSync');
+      mockExistsSync.mockImplementation((filePath: fs.PathLike) => path.basename(filePath.toString()) === 'Cargo.toml');
+
+      expect(detectProjectType()).toBe('rust');
+
+      mockExistsSync.mockRestore();
+    });
+
+    it('should detect Java Spring Boot project', () => {
+      const mockExistsSync = jest.spyOn(fs, 'existsSync');
+      mockExistsSync.mockImplementation((filePath: fs.PathLike) => path.basename(filePath.toString()) === 'pom.xml');
+      const mockReadFileSync = jest.spyOn(fs, 'readFileSync');
+      mockReadFileSync.mockReturnValue('<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter</artifactId></dependency>');
+
+      expect(detectProjectType()).toBe('java-spring-boot');
+
+      mockExistsSync.mockRestore();
+      mockReadFileSync.mockRestore();
+    });
   });
 
   describe('System Message Templates', () => {
@@ -366,6 +411,32 @@ describe('Dhruv CLI Core Systems', () => {
       expect(jest.mocked(printError).mock.calls.length).toBeGreaterThan(0);
     });
 
+    it('maps an untyped ECONNREFUSED error to the ollama-serve hint', async () => {
+      setAIClient({
+        ask: async () => { throw new Error('connect ECONNREFUSED 127.0.0.1:11434'); },
+        listModels: async () => [],
+      });
+      const consoleSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+      await runCommand(makeSpec());
+      expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('ollama serve'));
+      consoleSpy.mockRestore();
+    });
+
+    it('displays completed response when streaming is unavailable', async () => {
+      setAIClient({
+        ask: async () => 'static completed response',
+        listModels: async () => [],
+      });
+      const output: string[] = [];
+      const writeSpy = jest.spyOn(process.stdout, 'write').mockImplementation((chunk: unknown) => {
+        output.push(String(chunk));
+        return true;
+      });
+      await runCommand(makeSpec());
+      expect(output.join('')).toContain('static completed response');
+      writeSpy.mockRestore();
+    });
+
     it('marks the process unsuccessful when an AI command fails', async () => {
       const originalExitCode = process.exitCode;
       process.exitCode = undefined;

package/__tests__/diagnostics.test.ts

@@ -152,4 +152,28 @@ describe('diagnostic commands', () => {
       metricsCollector.resetPersistent();
     }
   });
+
+  it('tolerates filesystem storage failures without throwing during recording', () => {
+    const fs = require('node:fs');
+    const writeSpy = jest.spyOn(fs, 'writeFileSync').mockImplementation(() => {
+      const err = new Error('EACCES: permission denied');
+      (err as NodeJS.ErrnoException).code = 'EACCES';
+      throw err;
+    });
+
+    expect(() => {
+      metricsCollector.recordCommand('explain', 100, true);
+    }).not.toThrow();
+
+    writeSpy.mockRestore();
+    metricsCollector.resetPersistent();
+  });
+
+  it('resets local metrics intentionally and clears persisted state', () => {
+    metricsCollector.recordCommand('explain', 200, true);
+    expect(metricsCollector.getSummary().commands.explain.runs).toBeGreaterThan(0);
+
+    metricsCollector.resetPersistent();
+    expect(metricsCollector.getSummary().commands.explain).toBeUndefined();
+  });
 });

package/__tests__/file-workflows.test.ts

@@ -99,6 +99,22 @@ describe('file analysis commands', () => {
     expect(client.requests[0].prompt).not.toContain('node_modules/library/ignored.ts');
   });
 
+  it('excludes build and framework cache directories during recursive review', async () => {
+    fs.mkdirSync(path.join(root, '.next'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'vendor'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.next', 'bundle.js'), 'console.log("cached");');
+    fs.writeFileSync(path.join(root, 'vendor', 'lib.go'), 'package vendor');
+    fs.writeFileSync(path.join(root, 'src', 'main.ts'), 'export const main = 1;');
+
+    await review(root);
+
+    expect(client.requests).toHaveLength(1);
+    expect(client.requests[0].prompt).toContain('src/main.ts');
+    expect(client.requests[0].prompt).not.toContain('.next/bundle.js');
+    expect(client.requests[0].prompt).not.toContain('vendor/lib.go');
+  });
+
   it('includes detected project context in review requests', async () => {
     fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ devDependencies: { typescript: '^5.0.0' } }));
     fs.writeFileSync(path.join(root, 'index.ts'), 'export const value = 1;');
@@ -129,6 +145,18 @@ describe('file analysis commands', () => {
     expect(client.requests[0].prompt).toContain('rotate the credential');
   });
 
+  it('redacts GitHub tokens and AWS keys with remediation guidance', async () => {
+    const source = path.join(root, 'secrets.ts');
+    fs.writeFileSync(source, 'const GITHUB_TOKEN = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";\nconst AWS_KEY = "AKIA1234567890ABCDEF";');
+
+    await securityCheck(source);
+
+    expect(client.requests[0].prompt).not.toContain('ghp_1234567890abcdefghijklmnopqrstuvwxyz');
+    expect(client.requests[0].prompt).not.toContain('AKIA1234567890ABCDEF');
+    expect(client.requests[0].prompt).toContain('GitHub token detected');
+    expect(client.requests[0].prompt).toContain('AWS access key ID detected');
+  });
+
   it('scans nested project files without sending dependency directories', async () => {
     fs.mkdirSync(path.join(root, 'src', 'nested'), { recursive: true });
     fs.mkdirSync(path.join(root, 'node_modules', 'library'), { recursive: true });
@@ -174,6 +202,17 @@ describe('file analysis commands', () => {
     expect(fs.existsSync(path.join(root, 'sample.test.ts'))).toBe(true);
   });
 
+  it('preserves the Python language and conventions when generating tests', async () => {
+    const source = path.join(root, 'math_utils.py');
+    fs.writeFileSync(source, 'def add(a, b):\n    return a + b\n');
+
+    await generate('tests', source, { apply: true });
+
+    expect(client.requests[0].prompt).toContain('Python code');
+    expect(client.requests[0].prompt).toContain('pytest');
+    expect(fs.existsSync(path.join(root, 'math_utils.test.py'))).toBe(true);
+  });
+
   it('previews generated tests without writing by default', async () => {
     const source = path.join(root, 'preview.ts');
     fs.writeFileSync(source, 'export const value = 1;');

package/__tests__/interactive.test.ts

@@ -72,6 +72,21 @@ describe('interactive commands', () => {
     }
   });
 
+  it('handles init non-interactive TTY failure with failure exit code', async () => {
+    jest.mocked(listModels).mockResolvedValue(['test-model']);
+    const prompt = jest.mocked(inquirer.prompt);
+    prompt.mockRejectedValueOnce({ isTtyError: true, message: 'TTY required' });
+    process.exitCode = undefined;
+
+    try {
+      await init();
+      expect(process.exitCode).toBe(1);
+    } finally {
+      prompt.mockReset();
+      process.exitCode = undefined;
+    }
+  });
+
   it('asks whether init should save project-local or user-global settings', async () => {
     jest.mocked(listModels).mockResolvedValue(['test-model']);
     const prompt = jest.mocked(inquirer.prompt);

package/dist/commands/generate.js

@@ -4,23 +4,42 @@ import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
 import { printError, printSuccess, printInfo } from '../utils/ux.js';
 import { loadConfig } from '../config/config.js';
-function buildPrompt(type, content) {
+function getLanguageForFile(target) {
+    const ext = path.extname(target).toLowerCase();
+    switch (ext) {
+        case '.py':
+            return { name: 'Python', testFramework: 'pytest or unittest' };
+        case '.go':
+            return { name: 'Go', testFramework: 'standard testing package' };
+        case '.rs':
+            return { name: 'Rust', testFramework: 'standard Rust test framework' };
+        case '.ts':
+        case '.tsx':
+            return { name: 'TypeScript', testFramework: 'Jest or Vitest' };
+        case '.java':
+            return { name: 'Java', testFramework: 'JUnit 5' };
+        default:
+            return { name: 'JavaScript', testFramework: 'Jest or Mocha' };
+    }
+}
+function buildPrompt(type, content, target) {
+    const lang = getLanguageForFile(target);
     if (type === 'tests' || type === 'test') {
-        return `Generate comprehensive unit tests for the following JavaScript code. Use Jest or Mocha syntax. Only return the test code without explanations:\n\n${content}`;
+        return `Generate comprehensive unit tests for the following ${lang.name} code. Use ${lang.testFramework} syntax. Only return the test code without explanations:\n\n${content}`;
     }
     if (type === 'documentation' || type === 'docs') {
-        return `Generate JSDoc documentation for the following code:\n\n${content}`;
+        return `Generate ${lang.name === 'Python' ? 'docstrings' : 'JSDoc/documentation'} for the following code:\n\n${content}`;
     }
     return `Generate ${type} for this code:\n\n${content}`;
 }
 /** Extracts test code from the response: a fenced block if present, else the raw response. */
 function extractTestCode(response) {
-    const fenced = response.match(/```(?:javascript|js)?\s*\n([\s\S]*?)```/);
+    const fenced = response.match(/```(?:javascript|js|typescript|ts|python|py|go|rust|rs|java)?\s*\n([\s\S]*?)```/i);
     if (fenced?.[1])
         return fenced[1].trim();
     return response
-        .replace(/^.*?(?=const|describe|test|it\s*\()/s, '')
-        .replace(/```[a-z]*\n?/g, '')
+        .replace(/^.*?(?=const|describe|test|it\s*\(|def test_|func Test|#\[test\])/s, '')
+        .replace(/```[a-z]*\n?/gi, '')
         .trim();
 }
 export async function generate(type, target, options = {}) {
@@ -34,7 +53,7 @@ export async function generate(type, target, options = {}) {
         input: { type, target },
         header: `🔨 Generating ${type}: `,
         buildRequest: (input, model) => ({
-            prompt: buildPrompt(input.type, content),
+            prompt: buildPrompt(input.type, content, input.target),
             systemMessage: getSystemMessage('generate'),
             model,
         }),

package/dist/commands/init.js

@@ -12,15 +12,16 @@ export async function init() {
         }
     }
     catch {
-        console.log(chalk.yellow('Warning: Could not fetch available models from Ollama.'));
-        console.log(chalk.yellow('Using default model choices.'));
+        console.log(chalk.yellow('Warning: Could not connect to Ollama.'));
+        console.log(chalk.yellow('💡 Start Ollama with: ollama serve'));
+        console.log(chalk.yellow(`💡 Install default model with: ollama pull ${current.model}\n`));
     }
     try {
         const answers = await inquirer.prompt([
             {
                 type: 'list',
                 name: 'model',
-                message: 'Which Ollama model do you want to use?',
+                message: `Which Ollama model do you want to use? (default: ${current.model})`,
                 choices: modelChoices,
                 default: current.model,
             },
@@ -57,12 +58,13 @@ export async function init() {
         console.log(chalk.green(`Configuration saved ${scope === 'global' ? 'for your user account' : 'in this project'}!`));
     }
     catch (error) {
-        process.exitCode = 130;
-        if (error?.isTtyError) {
+        const isTty = Boolean(error?.isTtyError);
+        process.exitCode = isTty ? 1 : 130;
+        if (isTty) {
             console.log(chalk.red('This command requires an interactive terminal.'));
         }
         else {
-            console.log(chalk.red('Configuration cancelled or failed.'));
+            console.log(chalk.red('Configuration cancelled.'));
         }
     }
 }

package/dist/commands/metrics.js

@@ -73,8 +73,18 @@ export async function metrics(options = {}) {
         logger.info('Metrics displayed successfully', { metricsCount: metricsData.length });
     }
     catch (error) {
-        printError('Failed to retrieve metrics');
-        console.error(chalk.red(error.message));
+        process.exitCode = 1;
+        if (loadConfig().responseFormat === 'json') {
+            process.stdout.write(`${JSON.stringify({
+                ok: false,
+                command: 'metrics',
+                error: error.message,
+            })}\n`);
+        }
+        else {
+            printError('Failed to retrieve metrics');
+            console.error(chalk.red(error.message));
+        }
         logger.error('Metrics command failed', error);
     }
 }

package/dist/commands/review.js

@@ -3,10 +3,24 @@ import path from 'path';
 import { execFileSync } from 'child_process';
 import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
-import { printError } from '../utils/ux.js';
+import { printError, printInfo } from '../utils/ux.js';
 import { detectProjectType } from '../utils/projectType.js';
 const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+const IGNORED_DIRECTORIES = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.dhruv-cache',
+    'logs',
+    '.next',
+    '.turbo',
+    '__pycache__',
+    '.pytest_cache',
+    'target',
+    'vendor',
+]);
 /** Reads a file or up to 10 code files from a directory tree. */
 function readCode(fileOrDir) {
     // Read first, branch on the error: no separate existence check to race against.
@@ -47,6 +61,9 @@ function readDirectory(dir) {
         printError(`No code files found in directory "${dir}".`);
         return undefined;
     }
+    if (files.length >= 10) {
+        printInfo('Note: Directory review is capped at the first 10 source files.');
+    }
     let code = '';
     for (const f of files) {
         try {

package/dist/commands/security-check.js

@@ -4,12 +4,29 @@ import { runCommand } from '../core/command-runner.js';
 import { getSystemMessage } from '../core/prompts.js';
 import { printError } from '../utils/ux.js';
 const CODE_FILE = /\.(js|ts|jsx|tsx|py|java|cpp|c|go|rs|rb|php)$/;
-const IGNORED_DIRECTORIES = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', '.dhruv-cache', 'logs']);
+const IGNORED_DIRECTORIES = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.dhruv-cache',
+    'logs',
+    '.next',
+    '.turbo',
+    '__pycache__',
+    '.pytest_cache',
+    'target',
+    'vendor',
+]);
 function redactSensitiveContent(content) {
     return content
         .replace(/(\b(?:api[_-]?key|secret|token|password|authorization)\s*[:=]\s*["'`])[^"'`\r\n]+(["'`])/gi, '$1[REDACTED]$2')
         .replace(/\b(?:sk|pk)-[a-z0-9_-]{8,}\b/gi, '[REDACTED]')
-        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]');
+        .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]')
+        .replace(/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g, '[REDACTED]')
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, '[REDACTED]')
+        .replace(/-----BEGIN (?:RSA|OPENSSH|EC|PGP|DSA)? PRIVATE KEY-----[\s\S]*?-----END (?:RSA|OPENSSH|EC|PGP|DSA)? PRIVATE KEY-----/g, '[REDACTED PRIVATE KEY]');
 }
 function findHighConfidenceFindings(content) {
     const findings = [];
@@ -39,6 +56,22 @@ function findHighConfidenceFindings(content) {
                 remediation: 'revoke the token and use a secure runtime secret store',
             });
         }
+        else if (/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/.test(line)) {
+            findings.push({
+                line: index + 1,
+                severity: 'high',
+                description: 'GitHub token detected',
+                remediation: 'revoke the GitHub token and store it in GitHub Secrets or environment variables',
+            });
+        }
+        else if (/\bAKIA[0-9A-Z]{16}\b/.test(line)) {
+            findings.push({
+                line: index + 1,
+                severity: 'high',
+                description: 'AWS access key ID detected',
+                remediation: 'rotate the AWS access key and use IAM roles or AWS Secrets Manager',
+            });
+        }
     });
     return findings;
 }

package/dist/commands/status.js

@@ -69,15 +69,17 @@ export async function status() {
         else {
             process.exitCode = 1;
             printError(`✗ Configured model '${config.model}' is not available`);
+            console.log(chalk.yellow(`💡 Install the model: ollama pull ${config.model}`));
             if (models.length > 0) {
                 console.log(chalk.yellow(`Available models: ${models.join(', ')}`));
             }
         }
     }
     catch (error) {
+        process.exitCode = 1;
         printError('✗ Ollama connection failed');
         console.log(chalk.red(error.message));
-        console.log(chalk.yellow('\nTo start Ollama, run: ollama serve'));
-        console.log(chalk.yellow('To install a model, run: ollama pull llama2'));
+        console.log(chalk.yellow('\n💡 To start Ollama, run: ollama serve'));
+        console.log(chalk.yellow(`💡 To install the configured model, run: ollama pull ${config.model}`));
     }
 }

package/dist/core/command-runner.js

@@ -16,7 +16,14 @@ import { securityManager } from '../core/security.js';
 /** Maps typed AI errors to user-facing hints — once, not per command. */
 function describeAIError(error, model) {
     if (!error || typeof error !== 'object' || !('kind' in error)) {
-        return error instanceof Error ? error.message : String(error);
+        const msg = error instanceof Error ? error.message : String(error);
+        if (/econnrefused|failed to connect|fetch failed/i.test(msg)) {
+            return `💡 Make sure Ollama is running: ollama serve`;
+        }
+        if (/model.*not found/i.test(msg)) {
+            return `💡 Install the model: ollama pull ${model}`;
+        }
+        return msg;
     }
     const typedError = error;
     switch (typedError.kind) {
@@ -119,7 +126,6 @@ export async function runCommand(spec) {
             if (!streamed)
                 process.stdout.write(response);
             process.stdout.write('\n');
-            console.log('\n');
             if (spec.footer)
                 console.log(chalk.dim(spec.footer));
         }

package/dist/core/metrics.js

@@ -239,8 +239,9 @@ export class MetricsCollector {
             fs.unlinkSync(this.persistentPath());
         }
         catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
+            if (error.code !== 'ENOENT') {
+                logger.debug('Failed to unlink persistent metrics', { error: error.message });
+            }
         }
     }
     persistentPath() {