@runhalo/cli 0.4.1 → 0.5.0

package/dist/index.js

@@ -655,6 +655,10 @@ function escapeHtml(text) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
+// ==================== Module-level scan data for cross-function access ====================
+// Stores the last scan's results so the action handler can regenerate the PDF
+// with AI Review Board data after the review board runs.
+const _lastScanData = { results: [], scoreResult: null, fileCount: 0, projectPath: '' };
 // ==================== PDF Report Generator (P3-2) ====================
 // PDF color constants
 const PDF_COLORS = {
@@ -690,11 +694,7 @@ function severityColor(severity) {
         default: return PDF_COLORS.cyan;
     }
 }
-/**
- * Generate a government-procurement-grade PDF compliance report.
- * Uses PDFKit — pure JS, no browser dependencies, CI-safe.
- */
-function generatePdfReport(results, scoreResult, fileCount, projectPath, history) {
+function generatePdfReport(results, scoreResult, fileCount, projectPath, history, reviewData) {
     return new Promise((resolve, reject) => {
         const doc = new pdfkit_1.default({
             size: 'LETTER',
@@ -983,6 +983,117 @@ function generatePdfReport(results, scoreResult, fileCount, projectPath, history
             }
             addFooter();
         }
+        // ═══════════════ AI REVIEW BOARD (Sprint 9) ═══════════════
+        if (reviewData && reviewData.results.length > 0) {
+            doc.addPage();
+            doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('AI Review Board Assessment', 60, 60);
+            doc.moveTo(60, 88).lineTo(60 + pageWidth, 88).lineWidth(1).strokeColor(PDF_COLORS.border).stroke();
+            y = 100;
+            // Review Board summary box
+            doc.rect(60, y, pageWidth, 70).fill(PDF_COLORS.lightBg);
+            doc.fontSize(10).fillColor(PDF_COLORS.bodyText);
+            doc.text(`${reviewData.summary.total} violations reviewed by Halo AI Review Board`, 70, y + 8, { width: pageWidth - 20 });
+            y += 22;
+            const verdictLine = [
+                reviewData.summary.escalated > 0 ? `🔴 ${reviewData.summary.escalated} escalated` : '',
+                reviewData.summary.confirmed > 0 ? `🟡 ${reviewData.summary.confirmed} confirmed` : '',
+                reviewData.summary.downgraded > 0 ? `🟢 ${reviewData.summary.downgraded} downgraded` : '',
+                reviewData.summary.dismissed > 0 ? `✅ ${reviewData.summary.dismissed} dismissed` : '',
+            ].filter(Boolean).join('   ');
+            doc.fontSize(9).fillColor(PDF_COLORS.bodyText);
+            doc.text(verdictLine, 70, y, { width: pageWidth - 20 });
+            y += 16;
+            // Marshall summary
+            if (reviewData.marshall_summary) {
+                const ms = reviewData.marshall_summary;
+                doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                doc.text(`Marshall Intelligence: ${ms.enriched_count} violations enriched | Avg urgency: ${ms.avg_urgency} | ${ms.active_enforcement_count} in active enforcement areas`, 70, y, { width: pageWidth - 20 });
+            }
+            y += 40; // past the summary box
+            // Per-verdict sections
+            const verdictOrder = [
+                { key: 'escalated', label: 'ESCALATED — More Serious Than Initially Detected', color: PDF_COLORS.red, emoji: '🔴' },
+                { key: 'confirmed', label: 'CONFIRMED — Violations Validated by AI Review', color: PDF_COLORS.orange, emoji: '🟡' },
+                { key: 'downgraded', label: 'DOWNGRADED — Lower Risk Than Severity Suggests', color: PDF_COLORS.green, emoji: '🟢' },
+                { key: 'dismissed', label: 'DISMISSED — False Positives Cleared', color: PDF_COLORS.cyan, emoji: '✅' },
+            ];
+            for (const vType of verdictOrder) {
+                const items = reviewData.results.filter(r => r.verdict === vType.key);
+                if (items.length === 0)
+                    continue;
+                if (y > doc.page.height - 140) {
+                    addFooter();
+                    doc.addPage();
+                    y = 60;
+                }
+                doc.fontSize(12).fillColor(vType.color);
+                doc.text(`${vType.emoji} ${vType.label} (${items.length})`, 60, y);
+                y += 20;
+                // Show up to 10 per verdict type
+                const itemsToShow = items.slice(0, 10);
+                for (const item of itemsToShow) {
+                    if (y > doc.page.height - 100) {
+                        addFooter();
+                        doc.addPage();
+                        y = 60;
+                    }
+                    // Rule ID + verdict
+                    doc.fontSize(9).fillColor(PDF_COLORS.primary);
+                    doc.text(item.ruleId, 70, y);
+                    y += 14;
+                    // Clinical context
+                    if (item.clinicalContext) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.bodyText);
+                        const ctxHeight = doc.heightOfString(item.clinicalContext, { width: pageWidth - 30 });
+                        doc.text(item.clinicalContext, 80, y, { width: pageWidth - 30 });
+                        y += ctxHeight + 4;
+                    }
+                    // Age groups
+                    if (item.ageGroupImpact && item.ageGroupImpact.length > 0) {
+                        doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                        doc.text(`Ages most affected: ${item.ageGroupImpact.join(', ')}`, 80, y);
+                        y += 12;
+                    }
+                    // Regulatory context (Marshall enrichment)
+                    if (item.regulatoryContext) {
+                        const rc = item.regulatoryContext;
+                        const priorityLabel = rc.enforcement_priority === 'active' ? '🔴 ACTIVE'
+                            : rc.enforcement_priority === 'watching' ? '🟡 WATCHING' : '⚪ DORMANT';
+                        doc.fontSize(7).fillColor(PDF_COLORS.red);
+                        doc.text(`Regulatory: ${rc.regulation} | ${priorityLabel} | Penalty: ${rc.penalty_exposure} | Urgency: ${rc.urgency_score}`, 80, y, { width: pageWidth - 30 });
+                        y += 12;
+                        if (rc.recent_case) {
+                            doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                            doc.text(`Recent precedent: ${rc.recent_case}`, 80, y, { width: pageWidth - 30 });
+                            y += 12;
+                        }
+                    }
+                    // Remediation
+                    if (item.remediationGuidance) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.green);
+                        const remHeight = doc.heightOfString(`Fix: ${item.remediationGuidance}`, { width: pageWidth - 30 });
+                        doc.text(`Fix: ${item.remediationGuidance}`, 80, y, { width: pageWidth - 30 });
+                        y += remHeight + 4;
+                    }
+                    y += 8;
+                }
+                if (items.length > 10) {
+                    doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                    doc.text(`+ ${items.length - 10} more ${vType.key} violation(s). See full results on your Halo Dashboard.`, 80, y, { width: pageWidth - 30 });
+                    y += 16;
+                }
+                y += 10;
+            }
+            // Review Board footer note
+            if (y > doc.page.height - 80) {
+                addFooter();
+                doc.addPage();
+                y = 60;
+            }
+            doc.fontSize(7).fillColor(PDF_COLORS.lightText);
+            doc.text(`Reviewed by Halo AI Review Board (Richard + Marshall) in ${reviewData.latency_ms}ms. Cost: $${reviewData.cost.estimated_usd.toFixed(4)}. ${reviewData.summary.cache_hits} results served from cache.`, 60, y, { width: pageWidth });
+            addFooter();
+        }
         // ═══════════════ RECOMMENDATIONS ═══════════════
         doc.addPage();
         doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('Recommendations', 60, 60);
@@ -1068,6 +1179,122 @@ function loadHaloignore(startDir) {
     }
     return undefined;
 }
+/**
+ * Detect the project framework by scanning project files.
+ * Checks package.json, Gemfile, go.mod, Cargo.toml, manage.py, requirements.txt.
+ * Returns a framework identifier string or null if unknown.
+ */
+function detectProjectFramework(dir) {
+    // Check package.json for JS/TS frameworks
+    const pkgPath = path.join(dir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            const allDeps = {
+                ...(pkg.dependencies || {}),
+                ...(pkg.devDependencies || {}),
+            };
+            // Order matters: check specific frameworks before generic ones
+            if (allDeps['next'])
+                return 'nextjs';
+            if (allDeps['@angular/core'])
+                return 'angular';
+            if (allDeps['vue'])
+                return 'vue';
+            if (allDeps['svelte'])
+                return 'svelte';
+            if (allDeps['react'])
+                return 'react';
+        }
+        catch {
+            // Malformed package.json — continue detection
+        }
+    }
+    // Django: manage.py or requirements.txt with django
+    if (fs.existsSync(path.join(dir, 'manage.py')))
+        return 'django';
+    const reqPath = path.join(dir, 'requirements.txt');
+    if (fs.existsSync(reqPath)) {
+        try {
+            const reqs = fs.readFileSync(reqPath, 'utf-8').toLowerCase();
+            if (reqs.includes('django'))
+                return 'django';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Rails: Gemfile with rails
+    const gemfilePath = path.join(dir, 'Gemfile');
+    if (fs.existsSync(gemfilePath)) {
+        try {
+            const gemfile = fs.readFileSync(gemfilePath, 'utf-8').toLowerCase();
+            if (gemfile.includes('rails'))
+                return 'rails';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Go
+    if (fs.existsSync(path.join(dir, 'go.mod')))
+        return 'go';
+    // Rust
+    if (fs.existsSync(path.join(dir, 'Cargo.toml')))
+        return 'rust';
+    return null;
+}
+/**
+ * Get default .haloignore content based on detected framework.
+ */
+function getDefaultHaloignoreContent(framework) {
+    const lines = [
+        '# Halo ignore patterns',
+        '# Generated by: runhalo init',
+        '',
+        'node_modules/',
+        'dist/',
+        'build/',
+        'coverage/',
+        '*.min.js',
+        '*.bundle.js',
+    ];
+    // Add framework-specific ignores
+    switch (framework) {
+        case 'nextjs':
+            lines.push('.next/');
+            lines.push('.vercel/');
+            break;
+        case 'angular':
+            lines.push('.angular/');
+            break;
+        case 'vue':
+            lines.push('.nuxt/');
+            break;
+        case 'svelte':
+            lines.push('.svelte-kit/');
+            break;
+        case 'django':
+            lines.push('__pycache__/');
+            lines.push('*.pyc');
+            lines.push('.venv/');
+            lines.push('venv/');
+            break;
+        case 'rails':
+            lines.push('tmp/');
+            lines.push('log/');
+            lines.push('vendor/bundle/');
+            break;
+        case 'go':
+            lines.push('vendor/');
+            break;
+        case 'rust':
+            lines.push('target/');
+            break;
+    }
+    lines.push('');
+    return lines.join('\n');
+}
 /**
  * Create a Halo engine instance
  */
@@ -1358,6 +1585,108 @@ function saveHistory(entry) {
         // Silent failure — never block scan
     }
 }
+/**
+ * Send webhook notifications to Discord and/or Slack after a scan completes.
+ * Non-blocking — failures are logged but never affect the scan exit code.
+ */
+async function sendWebhookNotifications(rcConfig, lastEntry, verbose) {
+    const notifications = rcConfig?.notifications;
+    if (!notifications)
+        return;
+    const { discord_webhook, slack_webhook } = notifications;
+    if (!discord_webhook && !slack_webhook)
+        return;
+    const hasFailed = lastEntry.totalViolations > 0;
+    const filesScanned = String(lastEntry.filesScanned);
+    const violations = String(lastEntry.totalViolations);
+    const grade = lastEntry.grade || 'N/A';
+    const topRules = lastEntry.rulesTriggered.slice(0, 5).join(', ') || 'None';
+    const timestamp = new Date().toISOString();
+    // Discord webhook
+    if (discord_webhook) {
+        try {
+            const discordPayload = {
+                embeds: [{
+                        title: '\u{1F6E1}\uFE0F Halo Scan Complete',
+                        color: hasFailed ? 15158332 : 3066993,
+                        fields: [
+                            { name: 'Files Scanned', value: filesScanned, inline: true },
+                            { name: 'Violations', value: violations, inline: true },
+                            { name: 'Grade', value: grade, inline: true },
+                            { name: 'Top Rules', value: topRules, inline: false },
+                        ],
+                        footer: { text: 'Halo \u2014 runhalo.dev' },
+                        timestamp,
+                    }],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(discord_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(discordPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Discord'
+                    : `\u26A0\uFE0F  Discord webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Discord webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+    // Slack webhook
+    if (slack_webhook) {
+        try {
+            const slackPayload = {
+                blocks: [
+                    {
+                        type: 'header',
+                        text: { type: 'plain_text', text: '\u{1F6E1}\uFE0F Halo Scan Complete' },
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Files Scanned*\n${filesScanned}` },
+                            { type: 'mrkdwn', text: `*Violations*\n${violations}` },
+                            { type: 'mrkdwn', text: `*Grade*\n${grade}` },
+                        ],
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Top Rules*\n${topRules}` },
+                        ],
+                    },
+                ],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(slack_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(slackPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Slack'
+                    : `\u26A0\uFE0F  Slack webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Slack webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+}
 async function submitCliLead(email) {
     try {
         const res = await fetch(`${SUPABASE_URL}/rest/v1/halo_leads`, {
@@ -1757,6 +2086,7 @@ async function scan(paths, options) {
             'au-sbd': 'AU Safety by Design',
             'au-osa': 'AU Online Safety Act',
             'caadca': 'California AADCA',
+            'eu-ai-act': 'EU AI Act (Children)',
         };
         const packLabel = packs.map(p => packNameMap[p] || p).join(' + ');
         console.error(c(colors.dim, `🔍 Scanning ${uniqueFiles.length} files (${packLabel})...`));
@@ -1843,7 +2173,14 @@ async function scan(paths, options) {
                 output += trendLine + '\n';
             }
     }
+    // Store scan data for potential PDF regeneration with AI Review Board data
+    _lastScanData.results = results;
+    _lastScanData.scoreResult = scoreResult;
+    _lastScanData.fileCount = fileCount;
+    _lastScanData.projectPath = projectPath;
     // Generate report if requested (HTML or PDF based on filename extension)
+    // Note: if --review-board is also set, the PDF will be regenerated with AI data
+    // in the action handler after the review board completes.
     if (options.report) {
         const reportFilename = typeof options.report === 'string'
             ? options.report
@@ -2132,6 +2469,8 @@ program
     .option('--report [filename]', 'Generate HTML compliance report (default: halo-report.html)')
     .option('--upload', 'Upload scan results to Halo Dashboard (requires Pro)')
     .option('--watch', 'Watch for file changes and re-scan automatically')
+    .option('--review-board', 'Enable AI Review Board — clinical assessment of each violation (Pro/Enterprise)')
+    .option('--license-key <key>', 'License key for Pro/Enterprise features (or set HALO_LICENSE_KEY env var)')
     .option('--no-prompt', 'Skip first-run email prompt')
     .option('-v, --verbose', 'Verbose output')
     .action(async (paths, options) => {
@@ -2156,6 +2495,9 @@ program
         if (options.upload && !checkProFeature('Dashboard Upload', '--upload')) {
             process.exit(0);
         }
+        if (options.reviewBoard && !checkProFeature('AI Review Board', '--review-board')) {
+            process.exit(0);
+        }
         // Scan limit check (soft — exit 0, not error)
         if (!checkScanLimit()) {
             process.exit(0);
@@ -2206,6 +2548,9 @@ program
             // Sprint 8: Pass framework and AST config from .halorc.json to scan()
             framework: rcConfig?.framework,
             astAnalysis: rcConfig?.astAnalysis,
+            // Sprint 9: AI Review Board
+            reviewBoard: options.reviewBoard || rcConfig?.reviewBoard || false,
+            licenseKey: options.licenseKey || process.env.HALO_LICENSE_KEY || rcConfig?.licenseKey,
         };
         // ==================== Watch Mode ====================
         if (options.watch) {
@@ -2360,6 +2705,124 @@ program
                 }
             }
         }
+        // ==================== AI Review Board (Sprint 9) ====================
+        let _reviewBoardResult;
+        if (scanOptions.reviewBoard) {
+            const licenseKey = scanOptions.licenseKey || loadConfig().license_key;
+            if (!licenseKey) {
+                console.error('⚠️  AI Review Board requires a license key. Run `halo activate <key>` or pass --license-key.');
+            }
+            else {
+                try {
+                    const history = loadHistory();
+                    const lastEntry = history[history.length - 1];
+                    if (lastEntry && lastEntry.rulesTriggered.length > 0) {
+                        console.error('\n🤖 Running AI Review Board...');
+                        const reviewUrl = 'https://wrfwcmyxxbafcdvxlmug.supabase.co/functions/v1/ai-review';
+                        // Build violations from scan results for review
+                        // We re-scan in JSON to get structured violations
+                        const jsonResults = await scan(paths, { ...scanOptions, format: 'json', output: '' });
+                        // Read the last JSON output from scan history
+                        const reviewHistory = loadHistory();
+                        const reviewEntry = reviewHistory[reviewHistory.length - 1];
+                        if (reviewEntry) {
+                            const reviewRes = await fetch(reviewUrl, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({
+                                    license_key: licenseKey,
+                                    violations: reviewEntry.violations || [],
+                                    repo_metadata: {
+                                        framework: scanOptions.framework,
+                                    },
+                                }),
+                            });
+                            if (reviewRes.ok) {
+                                const review = await reviewRes.json();
+                                _reviewBoardResult = review; // Store for PDF report
+                                // Display Review Board results
+                                console.error(`\n🛡️  Halo AI Review Board — ${review.summary.total} violations analyzed (${review.latency_ms}ms)\n`);
+                                const critical = review.results.filter(r => r.verdict === 'escalated');
+                                const confirmed = review.results.filter(r => r.verdict === 'confirmed');
+                                const downgraded = review.results.filter(r => r.verdict === 'downgraded');
+                                const dismissed = review.results.filter(r => r.verdict === 'dismissed');
+                                if (critical.length > 0) {
+                                    console.error(`🔴 ESCALATED (${critical.length}) — More serious than initially detected`);
+                                    for (const r of critical) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                        if (r.ageGroupImpact.length > 0)
+                                            console.error(`    Ages most affected: ${r.ageGroupImpact.join(', ')}`);
+                                        if (r.remediationGuidance)
+                                            console.error(`    Fix: ${r.remediationGuidance}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (confirmed.length > 0) {
+                                    console.error(`🟡 CONFIRMED (${confirmed.length}) — Violations validated by AI review`);
+                                    for (const r of confirmed) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (downgraded.length > 0) {
+                                    console.error(`🟢 DOWNGRADED (${downgraded.length}) — Lower risk than severity suggests`);
+                                    for (const r of downgraded) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                if (dismissed.length > 0) {
+                                    console.error(`✅ DISMISSED (${dismissed.length}) — False positives cleared by AI review`);
+                                    for (const r of dismissed) {
+                                        console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    }
+                                    console.error('');
+                                }
+                                const cacheStr = review.summary.cache_hits > 0 ? ` (${review.summary.cache_hits} cached)` : '';
+                                console.error(`📊 Cost: $${review.cost.estimated_usd.toFixed(4)}${cacheStr}`);
+                                console.error(`🤖 Reviewed by: Halo AI Review Board (${review.latency_ms}ms)\n`);
+                            }
+                            else {
+                                const err = await reviewRes.json().catch(() => ({}));
+                                console.error(`⚠️  AI Review failed: ${err.error || reviewRes.statusText}`);
+                            }
+                        }
+                    }
+                }
+                catch (reviewErr) {
+                    console.error(`⚠️  AI Review failed: ${reviewErr instanceof Error ? reviewErr.message : reviewErr}`);
+                }
+            }
+        }
+        // ==================== Generate PDF Report with AI Review Board data ====================
+        // If both --review-board and --report *.pdf are set, regenerate the PDF with review data
+        if (options.report && _reviewBoardResult) {
+            const reportFilename = typeof options.report === 'string'
+                ? options.report
+                : 'halo-report.html';
+            if (reportFilename.endsWith('.pdf') && _lastScanData.results.length > 0) {
+                const projectHistory = loadHistory().filter(h => h.projectPath === _lastScanData.projectPath);
+                const historyForReport = projectHistory.slice(0, -1);
+                const pdfBuffer = await generatePdfReport(_lastScanData.results, _lastScanData.scoreResult, _lastScanData.fileCount, _lastScanData.projectPath, historyForReport, _reviewBoardResult);
+                fs.writeFileSync(reportFilename, pdfBuffer);
+                console.error(`📄 PDF report updated with AI Review Board assessment`);
+            }
+        }
+        // ==================== Webhook Notifications (Discord/Slack) ====================
+        if (rcConfig?.notifications) {
+            try {
+                const history = loadHistory();
+                const lastEntry = history[history.length - 1];
+                if (lastEntry) {
+                    await sendWebhookNotifications(rcConfig, lastEntry, options.verbose);
+                }
+            }
+            catch (notifyErr) {
+                if (options.verbose) {
+                    console.error(`\u26A0\uFE0F  Webhook notification error: ${notifyErr instanceof Error ? notifyErr.message : notifyErr}`);
+                }
+            }
+        }
         // Upload to Halo Dashboard (non-blocking — upload failure doesn't affect exit code)
         if (options.upload) {
             try {
@@ -2607,78 +3070,142 @@ function getCopilotInstructionsContent() {
     return getIDERulesContent();
 }
 /**
- * Init command — generate IDE rules files and project configuration.
+ * Init command — detect framework, generate .halorc.json, .haloignore, and IDE rules files.
  */
 async function init(projectPath, options) {
     const resolvedPath = path.resolve(projectPath);
-    if (!options.ide) {
-        console.log('🔮 Halo init — project setup');
+    // --ide flag: generate AI coding assistant rules files (existing behavior)
+    if (options.ide) {
+        console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
+        const files = [
+            {
+                path: path.join(resolvedPath, '.cursor', 'rules'),
+                content: getCursorRulesContent(),
+                label: 'Cursor'
+            },
+            {
+                path: path.join(resolvedPath, '.windsurfrules'),
+                content: getWindsurfRulesContent(),
+                label: 'Windsurf'
+            },
+            {
+                path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
+                content: getCopilotInstructionsContent(),
+                label: 'GitHub Copilot'
+            }
+        ];
+        let created = 0;
+        let skipped = 0;
+        for (const file of files) {
+            const dir = path.dirname(file.path);
+            const relativePath = path.relative(resolvedPath, file.path);
+            if (fs.existsSync(file.path) && !options.force) {
+                console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
+                skipped++;
+                continue;
+            }
+            try {
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true });
+                }
+                fs.writeFileSync(file.path, file.content, 'utf-8');
+                console.log(`  ✅ ${relativePath} — ${file.label} rules`);
+                created++;
+            }
+            catch (err) {
+                console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            }
+        }
         console.log('');
-        console.log('Usage:');
-        console.log('  runhalo init --ide       Generate AI coding assistant rules files');
+        if (created > 0) {
+            console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+        }
+        if (skipped > 0) {
+            console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+        }
         console.log('');
-        console.log('Options:');
-        console.log('  --ide        Generate .cursor/rules, .windsurfrules, .github/copilot-instructions.md');
-        console.log('  --force      Overwrite existing rules files');
+        console.log('What happens next:');
+        console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
+        console.log('  • AI-generated code will follow COPPA compliance patterns');
+        console.log('  • Run "npx runhalo scan ." to verify compliance');
+        console.log('');
+        console.log('Full-stack compliance for the AI coding era:');
+        console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
+        console.log('  Local:     npx runhalo scan . catches violations on your machine');
+        console.log('  Proactive: AI rules files prevent violations before they\'re written');
         return 0;
     }
-    console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
-    const files = [
-        {
-            path: path.join(resolvedPath, '.cursor', 'rules'),
-            content: getCursorRulesContent(),
-            label: 'Cursor'
-        },
-        {
-            path: path.join(resolvedPath, '.windsurfrules'),
-            content: getWindsurfRulesContent(),
-            label: 'Windsurf'
-        },
-        {
-            path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
-            content: getCopilotInstructionsContent(),
-            label: 'GitHub Copilot'
+    // Default init: auto-detect framework, generate .halorc.json and .haloignore
+    console.log('🔮 Halo init — project setup\n');
+    // Step 1: Detect framework
+    const detectedFramework = detectProjectFramework(resolvedPath);
+    if (detectedFramework) {
+        console.log(`  🔍 Detected framework: ${c(colors.bold, detectedFramework)}`);
+    }
+    else {
+        console.log(`  🔍 Framework: ${c(colors.dim, 'not detected (generic config will be generated)')}`);
+    }
+    let configCreated = false;
+    let ignoreCreated = false;
+    // Step 2: Generate .halorc.json
+    const rcPath = path.join(resolvedPath, '.halorc.json');
+    if (fs.existsSync(rcPath) && !options.force) {
+        console.log(`  ⏭  .halorc.json (exists — use --force to overwrite)`);
+    }
+    else {
+        const rcConfig = {
+            packs: ['coppa', 'ethical'],
+            severity_threshold: 'medium',
+            ignore: ['**/test/**', '**/__tests__/**', '**/node_modules/**'],
+            astAnalysis: true,
+            notifications: {},
+        };
+        if (detectedFramework) {
+            rcConfig.framework = detectedFramework;
         }
-    ];
-    let created = 0;
-    let skipped = 0;
-    for (const file of files) {
-        const dir = path.dirname(file.path);
-        const relativePath = path.relative(resolvedPath, file.path);
-        if (fs.existsSync(file.path) && !options.force) {
-            console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
-            skipped++;
-            continue;
+        try {
+            fs.writeFileSync(rcPath, JSON.stringify(rcConfig, null, 2) + '\n', 'utf-8');
+            console.log(`  ✅ .halorc.json — project configuration`);
+            configCreated = true;
+        }
+        catch (err) {
+            console.error(`  ❌ .halorc.json — ${err instanceof Error ? err.message : err}`);
         }
+    }
+    // Step 3: Generate .haloignore
+    const ignorePath = path.join(resolvedPath, '.haloignore');
+    if (fs.existsSync(ignorePath) && !options.force) {
+        console.log(`  ⏭  .haloignore (exists — use --force to overwrite)`);
+    }
+    else {
         try {
-            if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true });
-            }
-            fs.writeFileSync(file.path, file.content, 'utf-8');
-            console.log(`  ✅ ${relativePath} — ${file.label} rules`);
-            created++;
+            const ignoreContent = getDefaultHaloignoreContent(detectedFramework);
+            fs.writeFileSync(ignorePath, ignoreContent, 'utf-8');
+            console.log(`  ✅ .haloignore — scan exclusion patterns`);
+            ignoreCreated = true;
         }
         catch (err) {
-            console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            console.error(`  ❌ .haloignore — ${err instanceof Error ? err.message : err}`);
         }
     }
+    // Step 4: Summary
     console.log('');
-    if (created > 0) {
-        console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+    if (configCreated || ignoreCreated) {
+        const parts = [];
+        if (configCreated)
+            parts.push('.halorc.json');
+        if (ignoreCreated)
+            parts.push('.haloignore');
+        console.log(`Created: ${parts.join(', ')}`);
     }
-    if (skipped > 0) {
-        console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+    else {
+        console.log('No files created (all exist — use --force to overwrite).');
     }
     console.log('');
-    console.log('What happens next:');
-    console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
-    console.log('  • AI-generated code will follow COPPA compliance patterns');
-    console.log('  • Run "npx runhalo scan ." to verify compliance');
+    console.log('Next steps:');
+    console.log(`  ${c(colors.bold, 'npx runhalo scan .')}         Scan your project for compliance issues`);
+    console.log(`  ${c(colors.bold, 'npx runhalo init --ide')}     Generate AI coding assistant rules files`);
     console.log('');
-    console.log('Full-stack compliance for the AI coding era:');
-    console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
-    console.log('  Local:     npx runhalo scan . catches violations on your machine');
-    console.log('  Proactive: AI rules files prevent violations before they\'re written');
     return 0;
 }
 program
@@ -2811,10 +3338,10 @@ program
 });
 program
     .command('init')
-    .description('Initialize Halo in your project (generate IDE rules files)')
+    .description('Initialize Halo in your project (detect framework, generate .halorc.json and .haloignore)')
     .argument('[path]', 'Project root path (default: current directory)', '.')
     .option('--ide', 'Generate AI coding assistant rules files', false)
-    .option('--force', 'Overwrite existing rules files', false)
+    .option('--force', 'Overwrite existing files', false)
     .action(async (projectPath, options) => {
     try {
         const exitCode = await init(projectPath, {