@securityreviewai/securityreview-kit 0.1.32 → 0.1.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/cli.js

@@ -39,7 +39,11 @@ export function run() {
         )
         .option(
             '--profiler-quiet',
-            'When profiling, use minimal agent output (no streaming JSON / verbose progress)',
+            'When profiling, use the standard progress message (default; retained for compatibility)',
+        )
+        .option(
+            '--profiler-verbose',
+            'When profiling, show live agent output for troubleshooting',
         )
         .action(async (options) => {
             try {

package/src/commands/init.js

@@ -457,11 +457,18 @@ export async function initCommand(options) {
                 console.log(chalk.dim('  (Sign-in or approvals may be required in your terminal.)'));
             }
             console.log('');
+            const showProfilerOutput = Boolean(options.profilerVerbose || options.profilerNoTrust);
+            if (showProfilerOutput) {
+                console.log(chalk.dim('  Profiling in progress. Agent output is visible for this run...'));
+            } else {
+                console.log(chalk.dim('  Profiling in progress. This can take a few minutes...'));
+            }
             const pr = runProfilerAgent(cwd, {
                 target: agentTarget,
                 projectName: projectNameForSkill,
                 cursorTrust: !options.profilerNoTrust,
-                streamProgress: !options.profilerQuiet,
+                streamProgress: Boolean(options.profilerVerbose),
+                showOutput: showProfilerOutput,
             });
             if (pr.ok) {
                 console.log(chalk.green('  \u2713 Profiler agent finished.'));

package/src/generators/rules/guardrails-init-profile.md

@@ -21,11 +21,11 @@ Do **not** ask the user to verbally approve MCP for `security-review-mcp`. The r
 
 ## Cursor CLI (scripted)
 
-From the repo root, non-interactive runs should include workspace trust, MCP approval, and **streaming progress** (matches default `securityreview-kit init`):
+From the repo root, non-interactive runs should include workspace trust and MCP approval:
 
-`agent -p "<your profiling instructions>" --output-format stream-json --stream-partial-output --trust --approve-mcps` (or `cursor-agent` if that is what your install provides)
+`agent -p "<your profiling instructions>" --trust --approve-mcps` (or `cursor-agent` if that is what your install provides)
 
-Omit `--output-format` / `--stream-partial-output` if you want less verbose terminal output (or use `securityreview-kit init` with `--profiler-quiet`).
+Add `--output-format stream-json --stream-partial-output` only when you need verbose agent diagnostics (or use `securityreview-kit init` with `--profiler-verbose`).
 
 During `securityreview-kit init`, choose **Yes** when asked to run Cursor login in-terminal, or pass **`--profiler-cursor-login`** with **`--profile-repo`** so login and profiling stay in one run.
 

package/src/utils/profiler-agent.js

@@ -64,18 +64,24 @@ export function pickProfilerAgentTarget(targets) {
  * @param {boolean} [opts.cursorTrust=true] When true, passes `--trust` and `--approve-mcps` so headless init is not blocked by
  *   workspace trust or MCP approval (user confirmed profiling in the kit). Set false with `--profiler-no-trust`
  *   if you need an interactive trust/login/MCP flow in the same terminal.
- * @param {boolean} [opts.streamProgress=true] When true, pass each CLI’s streaming / verbose flags so the terminal shows live progress
- *   (JSON event lines on Cursor/Codex; stream-json + partial messages + verbose on Claude). Disable with `--profiler-quiet`.
+ * @param {boolean} [opts.streamProgress=false] When true, pass each CLI’s streaming / verbose flags.
+ * @param {boolean} [opts.showOutput=false] When true, inherit stdio from the child process.
+ *   Keep both false for init-time profiling so the agent does not flood the terminal with JSON/progress logs.
  */
-export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true, streamProgress = true }) {
+export function runProfilerAgent(
+    cwd,
+    { target, projectName, cursorTrust = true, streamProgress = false, showOutput = streamProgress },
+) {
     const prompt = buildProfilerAgentPrompt(projectName, target);
     const env = augmentPathEnv(process.env);
-    const opts = { cwd, stdio: 'inherit', env };
+    const opts = showOutput
+        ? { cwd, stdio: 'inherit', env }
+        : { cwd, stdio: ['ignore', 'pipe', 'pipe'], env, encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 };
 
     if (streamProgress) {
         console.error(
             '\n[securityreview-kit] Profiler live output: you should see streaming progress below ' +
-                '(JSON lines are normal). Use --profiler-quiet for minimal output.\n',
+                '(JSON lines are normal). Omit --profiler-verbose for minimal output.\n',
         );
     }
 
@@ -99,7 +105,7 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
         if (r.error) {
             return { ok: false, message: r.error.message };
         }
-        return { ok: r.status === 0, status: r.status };
+        return buildProfilerResult(r);
     }
 
     if (target === 'claude') {
@@ -110,7 +116,7 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
             ? ['-p', '--output-format', 'stream-json', '--include-partial-messages', '--verbose', prompt]
             : ['-p', prompt];
         const r = spawnSync('claude', args, opts);
-        return { ok: r.status === 0, status: r.status };
+        return buildProfilerResult(r);
     }
 
     if (target === 'codex') {
@@ -119,8 +125,42 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
         }
         const args = streamProgress ? ['exec', '--json', prompt] : ['exec', prompt];
         const r = spawnSync('codex', args, opts);
-        return { ok: r.status === 0, status: r.status };
+        return buildProfilerResult(r);
     }
 
     return { ok: false, message: 'unsupported agent target' };
 }
+
+function buildProfilerResult(result) {
+    if (result.error) {
+        return { ok: false, status: result.status, message: result.error.message };
+    }
+
+    if (result.status === 0) {
+        return { ok: true, status: result.status };
+    }
+
+    const outputTail = summarizeProfilerOutput(result.stderr || result.stdout || '');
+    const exitDetail =
+        typeof result.status === 'number'
+            ? `exit status ${result.status}`
+            : result.signal
+              ? `signal ${result.signal}`
+              : 'unknown error';
+
+    return {
+        ok: false,
+        status: result.status,
+        message: outputTail ? `${exitDetail}; last output: ${outputTail}` : exitDetail,
+    };
+}
+
+function summarizeProfilerOutput(output) {
+    return String(output || '')
+        .replace(/\u001b\[[0-9;]*m/g, '')
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .slice(-3)
+        .join(' | ');
+}