@securityreviewai/securityreview-kit 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/cli.js

@@ -29,6 +29,14 @@ export function run() {
         .option('--skip-ide-cli-install', 'Do not install Cursor / Claude Code / Codex CLIs when those targets are selected')
         .option('--profile-repo', 'After init, run the guardrails profiler agent (non-interactive; needs cursor, claude, or codex target)')
         .option('--no-profile-repo', 'Skip the optional profiler agent step after init')
+        .option(
+            '--profiler-no-trust',
+            'When profiling with Cursor, do not pass --trust (use if you need interactive workspace trust or login in the terminal)',
+        )
+        .option(
+            '--profiler-cursor-login',
+            'Before Cursor profiling, run cursor-agent login in this terminal (then profiling runs in the same init)',
+        )
         .action(async (options) => {
             try {
                 if (options.switchProject) {

package/src/commands/init.js

@@ -4,7 +4,11 @@ import { TARGETS, TARGET_NAMES } from '../utils/constants.js';
 import { detectTargets } from '../utils/detect.js';
 import { ensureIdeClisForTargets } from '../utils/ide-cli-install.js';
 import { writeGuardrailsProfilerBundle } from '../utils/guardrails-profiler-bundle.js';
-import { pickProfilerAgentTarget, runProfilerAgent } from '../utils/profiler-agent.js';
+import {
+    pickProfilerAgentTarget,
+    runCursorAgentLogin,
+    runProfilerAgent,
+} from '../utils/profiler-agent.js';
 import { fetchVibeReviewProjectNames, getStoredCredentials, normalizeApiUrl } from '../utils/srai.js';
 
 // Dynamic imports for generators (avoids loading all at startup)
@@ -397,8 +401,53 @@ export async function initCommand(options) {
         } else {
             console.log('');
             console.log(chalk.bold.white(`  Starting profiler via ${TARGETS[agentTarget].name} CLI…`));
-            console.log(chalk.dim('  (Sign-in or approvals may be required in your terminal.)\n'));
-            const pr = runProfilerAgent(cwd, { target: agentTarget, projectName: projectNameForSkill });
+            if (agentTarget === 'cursor') {
+                console.log(
+                    chalk.dim(
+                        '  Cursor: headless profiling uses `--trust` and `--approve-mcps` on this folder (you confirmed above).',
+                    ),
+                );
+                if (options.profilerNoTrust) {
+                    console.log(
+                        chalk.dim(
+                            '  You passed `--profiler-no-trust`: complete any login or workspace-trust prompts in this terminal.',
+                        ),
+                    );
+                }
+
+                let runLogin = Boolean(options.profilerCursorLogin);
+                if (!runLogin && interactive) {
+                    runLogin = await confirm({
+                        message:
+                            'Run Cursor Agent login in this terminal now? (Same init — profiling runs next. Choose No if already signed in.)',
+                        default: true,
+                    });
+                }
+                if (runLogin) {
+                    console.log('');
+                    console.log(chalk.bold.white('  Cursor Agent login'));
+                    console.log(chalk.dim('  Complete the browser or code prompt, then return here.\n'));
+                    const loginResult = runCursorAgentLogin(cwd);
+                    if (loginResult.ok) {
+                        console.log(chalk.green('  \u2713 Cursor Agent login step finished.'));
+                    } else {
+                        console.log(
+                            chalk.yellow(
+                                `  \u26a0  Login exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
+                            ),
+                        );
+                    }
+                    console.log('');
+                }
+            } else {
+                console.log(chalk.dim('  (Sign-in or approvals may be required in your terminal.)'));
+            }
+            console.log('');
+            const pr = runProfilerAgent(cwd, {
+                target: agentTarget,
+                projectName: projectNameForSkill,
+                cursorTrust: !options.profilerNoTrust,
+            });
             if (pr.ok) {
                 console.log(chalk.green('  \u2713 Profiler agent finished.'));
             } else {
@@ -410,6 +459,20 @@ export async function initCommand(options) {
                         `  \u26a0  Profiler agent exited with an error: ${detail}. You can run the guardrails-init-profile workflow manually.`,
                     ),
                 );
+                if (agentTarget === 'cursor') {
+                    console.log('');
+                    console.log(chalk.dim('  Typical fixes:'));
+                    console.log(
+                        chalk.dim(
+                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for “Run Cursor Agent login”, or pass `--profiler-cursor-login` with `--profile-repo`.',
+                        ),
+                    );
+                    console.log(
+                        chalk.dim(
+                            '    • Want interactive trust instead of `--trust`: run `securityreview-kit init ... --profiler-no-trust` and answer the prompts, then profile again.',
+                        ),
+                    );
+                }
             }
         }
     }

package/src/generators/rules/guardrails-init-profile.md

@@ -16,3 +16,13 @@ Configured SRAI project name: `<SRAI_PROJECT_NAME>`
 3. Call **`update_vibe_profile`** and **`write_default_pack`** on `security-review-mcp` after resolving `project_id` for `<SRAI_PROJECT_NAME>`.
 
 Do not skip MCP upload when credentials and MCP are available.
+
+## Cursor CLI (scripted)
+
+From the repo root, non-interactive runs should include workspace trust and MCP approval (matches `securityreview-kit init`):
+
+`cursor-agent -p "<your profiling instructions>" --trust --approve-mcps`
+
+During `securityreview-kit init`, choose **Yes** when asked to run Cursor login in-terminal, or pass **`--profiler-cursor-login`** with **`--profile-repo`** so login and profiling stay in one run.
+
+You can still sign in manually with `cursor-agent login`. To handle trust/login interactively in the terminal, omit `--trust` and `--approve-mcps`.

package/src/utils/profiler-agent.js

@@ -20,6 +20,18 @@ export function buildProfilerAgentPrompt(projectName) {
     ].join('\n');
 }
 
+/**
+ * Run Cursor Agent OAuth/login in the current terminal (stdio inherited).
+ * Call this from init before profiling so the user does not leave the kit flow.
+ */
+export function runCursorAgentLogin(cwd) {
+    if (!commandOk('cursor-agent', ['--version'])) {
+        return { ok: false, status: null, message: 'cursor-agent not on PATH' };
+    }
+    const r = spawnSync('cursor-agent', ['login'], { cwd, stdio: 'inherit', env: { ...process.env } });
+    return { ok: r.status === 0, status: r.status };
+}
+
 export function pickProfilerAgentTarget(targets) {
     for (const t of PREFERRED_ORDER) {
         if (targets.includes(t)) {
@@ -31,8 +43,13 @@ export function pickProfilerAgentTarget(targets) {
 
 /**
  * Spawn the IDE agent CLI to execute the profiler skill (user must be logged in where required).
+ *
+ * @param {object} opts
+ * @param {boolean} [opts.cursorTrust=true] When true, passes `--trust` and `--approve-mcps` so headless init is not blocked by
+ *   workspace trust or MCP approval (user confirmed profiling in the kit). Set false with `--profiler-no-trust`
+ *   if you need an interactive trust/login/MCP flow in the same terminal.
  */
-export function runProfilerAgent(cwd, { target, projectName }) {
+export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true }) {
     const prompt = buildProfilerAgentPrompt(projectName);
     const opts = { cwd, stdio: 'inherit', env: { ...process.env } };
 
@@ -40,7 +57,11 @@ export function runProfilerAgent(cwd, { target, projectName }) {
         if (!commandOk('cursor-agent', ['--version'])) {
             return { ok: false, message: 'cursor-agent not on PATH' };
         }
-        const r = spawnSync('cursor-agent', ['-p', prompt], opts);
+        const args = ['-p', prompt];
+        if (cursorTrust) {
+            args.push('--trust', '--approve-mcps');
+        }
+        const r = spawnSync('cursor-agent', args, opts);
         return { ok: r.status === 0, status: r.status };
     }