@securityreviewai/securityreview-kit 0.1.34 → 0.1.35

package/README.md

@@ -53,7 +53,7 @@ Options:
   --skip-rules            Skip workspace rule installation
   --profile-repo          Run the guardrails profiler after init
   --profiler-copilot-login
-                          Run GitHub Copilot CLI setup before VS Code Copilot profiling
+                          Run GitHub Copilot CLI login before VS Code Copilot profiling
 ```
 
 ### `@securityreviewai/securityreview-kit init --switch-project`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/cli.js

@@ -39,7 +39,7 @@ export function run() {
         )
         .option(
             '--profiler-copilot-login',
-            'Before VS Code Copilot profiling, run `copilot` in this terminal so you can complete /login and workspace trust',
+            'Before VS Code Copilot profiling, run `copilot login` in this terminal',
         )
         .option(
             '--profiler-quiet',

package/src/commands/init.js

@@ -465,21 +465,21 @@ export async function initCommand(options) {
                 if (!runLogin && interactive) {
                     runLogin = await confirm({
                         message:
-                            'Run GitHub Copilot CLI setup in this terminal now? Use /login if prompted, then exit Copilot to continue profiling.',
+                            'Run GitHub Copilot CLI login in this terminal now? (Same init — profiling runs next. Choose No if already signed in.)',
                         default: true,
                     });
                 }
                 if (runLogin) {
                     console.log('');
-                    console.log(chalk.bold.white('  GitHub Copilot CLI setup'));
-                    console.log(chalk.dim('  Complete /login or workspace trust prompts, then exit Copilot to continue.\n'));
+                    console.log(chalk.bold.white('  GitHub Copilot CLI login'));
+                    console.log(chalk.dim('  Complete the browser or device-code prompt, then return here.\n'));
                     const loginResult = runCopilotLogin(cwd);
                     if (loginResult.ok) {
-                        console.log(chalk.green('  \u2713 GitHub Copilot CLI setup step finished.'));
+                        console.log(chalk.green('  \u2713 GitHub Copilot CLI login step finished.'));
                     } else {
                         console.log(
                             chalk.yellow(
-                                `  \u26a0  Copilot setup exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
+                                `  \u26a0  Copilot login exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
                             ),
                         );
                     }
@@ -538,7 +538,7 @@ export async function initCommand(options) {
                     console.log(chalk.dim('  Typical fixes:'));
                     console.log(
                         chalk.dim(
-                            '    • Not signed in or workspace not trusted: re-run `securityreview-kit init` and choose Yes for GitHub Copilot CLI setup, or pass `--profiler-copilot-login` with `--profile-repo`.',
+                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for GitHub Copilot CLI login, or pass `--profiler-copilot-login` with `--profile-repo`.',
                         ),
                     );
                     console.log(

package/src/generators/rules/guardrails-init-profile.md

@@ -37,4 +37,4 @@ From the repo root, non-interactive runs should load the SRAI MCP server and all
 
 `copilot -p "<your profiling instructions>" --additional-mcp-config '{"mcpServers":{"security-review-mcp":{"type":"stdio","command":"npx","args":["-y","@securityreviewai/security-review-mcp@latest"]}}}' --allow-all`
 
-During `securityreview-kit init`, choose **Yes** when asked to run GitHub Copilot CLI setup, or pass **`--profiler-copilot-login`** with **`--profile-repo`** so `/login`, workspace trust, and profiling stay in one run.
+During `securityreview-kit init`, choose **Yes** when asked to run GitHub Copilot CLI login, or pass **`--profiler-copilot-login`** with **`--profile-repo`** so `copilot login` and profiling stay in one run.

package/src/utils/profiler-agent.js

@@ -51,7 +51,8 @@ export function runCursorAgentLogin(cwd) {
 }
 
 /**
- * Run GitHub Copilot CLI so the user can complete /login in this terminal.
+ * Run GitHub Copilot CLI OAuth login in the current terminal (stdio inherited).
+ * `copilot login` exits after the device-flow succeeds, so init can continue into profiling.
  */
 export function runCopilotLogin(cwd) {
     const env = augmentPathEnv(process.env);
@@ -63,7 +64,7 @@ export function runCopilotLogin(cwd) {
                 'GitHub Copilot CLI not found (`copilot`). Install from https://docs.github.com/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli.',
         };
     }
-    const r = spawnSync('copilot', [], { cwd, stdio: 'inherit', env });
+    const r = spawnSync('copilot', ['login'], { cwd, stdio: 'inherit', env });
     const spawnErr = r.error ? r.error.message : null;
     if (r.status === null && spawnErr) {
         return { ok: false, status: null, message: spawnErr };