@securityreviewai/securityreview-kit 0.1.25 → 0.1.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/cli.js

@@ -37,6 +37,10 @@ export function run() {
             '--profiler-cursor-login',
             'Before Cursor profiling, run cursor-agent login in this terminal (then profiling runs in the same init)',
         )
+        .option(
+            '--profiler-quiet',
+            'When profiling, use minimal agent output (no streaming JSON / verbose progress)',
+        )
         .action(async (options) => {
             try {
                 if (options.switchProject) {

package/src/commands/init.js

@@ -459,6 +459,7 @@ export async function initCommand(options) {
                 target: agentTarget,
                 projectName: projectNameForSkill,
                 cursorTrust: !options.profilerNoTrust,
+                streamProgress: !options.profilerQuiet,
             });
             if (pr.ok) {
                 console.log(chalk.green('  \u2713 Profiler agent finished.'));

package/src/generators/rules/guardrails-init-profile.md

@@ -19,9 +19,11 @@ Do not skip MCP upload when credentials and MCP are available.
 
 ## Cursor CLI (scripted)
 
-From the repo root, non-interactive runs should include workspace trust and MCP approval (matches `securityreview-kit init`):
+From the repo root, non-interactive runs should include workspace trust, MCP approval, and **streaming progress** (matches default `securityreview-kit init`):
 
-`cursor-agent -p "<your profiling instructions>" --trust --approve-mcps`
+`cursor-agent -p "<your profiling instructions>" --output-format stream-json --stream-partial-output --trust --approve-mcps`
+
+Omit `--output-format` / `--stream-partial-output` if you want less verbose terminal output (or use `securityreview-kit init` with `--profiler-quiet`).
 
 During `securityreview-kit init`, choose **Yes** when asked to run Cursor login in-terminal, or pass **`--profiler-cursor-login`** with **`--profile-repo`** so login and profiling stay in one run.
 

package/src/utils/profiler-agent.js

@@ -52,16 +52,28 @@ export function pickProfilerAgentTarget(targets) {
  * @param {boolean} [opts.cursorTrust=true] When true, passes `--trust` and `--approve-mcps` so headless init is not blocked by
  *   workspace trust or MCP approval (user confirmed profiling in the kit). Set false with `--profiler-no-trust`
  *   if you need an interactive trust/login/MCP flow in the same terminal.
+ * @param {boolean} [opts.streamProgress=true] When true, pass each CLI’s streaming / verbose flags so the terminal shows live progress
+ *   (JSON event lines on Cursor/Codex; stream-json + partial messages + verbose on Claude). Disable with `--profiler-quiet`.
  */
-export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true }) {
+export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true, streamProgress = true }) {
     const prompt = buildProfilerAgentPrompt(projectName, target);
     const opts = { cwd, stdio: 'inherit', env: { ...process.env } };
 
+    if (streamProgress) {
+        console.error(
+            '\n[securityreview-kit] Profiler live output: you should see streaming progress below ' +
+                '(JSON lines are normal). Use --profiler-quiet for minimal output.\n',
+        );
+    }
+
     if (target === 'cursor') {
         if (!commandOk('cursor-agent', ['--version'])) {
             return { ok: false, message: 'cursor-agent not on PATH' };
         }
         const args = ['-p', prompt];
+        if (streamProgress) {
+            args.push('--output-format', 'stream-json', '--stream-partial-output');
+        }
         if (cursorTrust) {
             args.push('--trust', '--approve-mcps');
         }
@@ -73,7 +85,10 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true
         if (!commandOk('claude', ['--version'])) {
             return { ok: false, message: 'claude not on PATH' };
         }
-        const r = spawnSync('claude', ['-p', prompt], opts);
+        const args = streamProgress
+            ? ['-p', '--output-format', 'stream-json', '--include-partial-messages', '--verbose', prompt]
+            : ['-p', prompt];
+        const r = spawnSync('claude', args, opts);
         return { ok: r.status === 0, status: r.status };
     }
 
@@ -81,7 +96,8 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true
         if (!commandOk('codex', ['--version'])) {
             return { ok: false, message: 'codex not on PATH' };
         }
-        const r = spawnSync('codex', ['exec', prompt], opts);
+        const args = streamProgress ? ['exec', '--json', prompt] : ['exec', prompt];
+        const r = spawnSync('codex', args, opts);
         return { ok: r.status === 0, status: r.status };
     }