@securityreviewai/securityreview-kit 0.1.48 → 0.1.49

package/src/commands/init.js

@@ -1,851 +0,0 @@
-import chalk from 'chalk';
-import { input, checkbox, confirm, password, select } from '@inquirer/prompts';
-import { TARGETS, TARGET_NAMES } from '../utils/constants.js';
-import { detectTargets } from '../utils/detect.js';
-import { ensureIdeClisForTargets } from '../utils/ide-cli-install.js';
-import { writeGuardrailsSkillBundles } from '../utils/guardrails-profiler-bundle.js';
-import {
-    pickProfilerAgentTarget,
-    runClaudeAuthLogin,
-    runClaudeSetupToken,
-    runCodexLogin,
-    runCopilotLogin,
-    runCursorAgentLogin,
-    runProfilerAgent,
-} from '../utils/profiler-agent.js';
-import { fetchVibeReviewProjectNames, getStoredCredentials, normalizeApiUrl } from '../utils/srai.js';
-
-// Dynamic imports for generators (avoids loading all at startup)
-const mcpGenerators = {
-    cursor: () => import('../generators/mcp/cursor.js'),
-    claude: () => import('../generators/mcp/claude.js'),
-    vscode: () => import('../generators/mcp/vscode.js'),
-    windsurf: () => import('../generators/mcp/windsurf.js'),
-    codex: () => import('../generators/mcp/codex.js'),
-    gemini: () => import('../generators/mcp/gemini.js'),
-    antigravity: () => import('../generators/mcp/gemini.js'),
-};
-
-const ruleGenerators = {
-    cursor: () => import('../generators/rules/cursor.js'),
-    claude: () => import('../generators/rules/claude.js'),
-    vscode: () => import('../generators/rules/vscode.js'),
-    windsurf: () => import('../generators/rules/windsurf.js'),
-    codex: () => import('../generators/rules/codex.js'),
-    gemini: () => import('../generators/rules/gemini.js'),
-    antigravity: () => import('../generators/rules/antigravity.js'),
-};
-
-function normalizeRuleResults(rawResult) {
-    const entries = Array.isArray(rawResult) ? rawResult : [rawResult];
-
-    return entries.map((entry) => {
-        if (typeof entry === 'string') {
-            return { filePath: entry, action: 'created', kind: 'rule' };
-        }
-
-        if (entry && typeof entry.filePath === 'string') {
-            const allowedKinds = new Set(['rule', 'command', 'agent', 'skill', 'hooks', 'config']);
-            const kind = allowedKinds.has(entry.kind) ? entry.kind : 'rule';
-            return { filePath: entry.filePath, action: entry.action || 'created', kind };
-        }
-
-        throw new Error('Rule generator returned an invalid result.');
-    });
-}
-
-async function resolveClaudeProfilerAuth(options, interactive, cwd) {
-    const providerModel = String(options.claudeProviderModel || process.env.ANTHROPIC_MODEL || '').trim();
-    let mode = String(options.claudeAuthMode || process.env.SECURITY_REVIEW_CLAUDE_AUTH_MODE || '').trim();
-
-    if (!mode && options.profilerClaudeLogin) {
-        mode = 'claudeai';
-    }
-
-    if (!mode && interactive) {
-        mode = await select({
-            message: 'How should Claude Code authenticate for this profiling run?',
-            default: 'current',
-            choices: [
-                { name: 'Use current Claude Code auth/environment', value: 'current' },
-                { name: 'Claude subscription login', value: 'claudeai' },
-                { name: 'Anthropic Console login', value: 'console' },
-                { name: 'Anthropic API key', value: 'api_key' },
-                { name: 'Anthropic-compatible gateway / proxy', value: 'gateway' },
-                { name: 'AWS Bedrock', value: 'bedrock' },
-                { name: 'Google Vertex AI', value: 'vertex' },
-                { name: 'Long-lived Claude token', value: 'setup_token' },
-            ],
-        });
-    }
-
-    if (!mode) {
-        mode = 'current';
-    }
-
-    const result = {
-        mode,
-        model: providerModel || 'haiku',
-        envOverrides: {},
-        loginRunner: null,
-        loginLabel: '',
-        summary: '',
-    };
-
-    if (mode === 'claudeai') {
-        result.loginRunner = () => runClaudeAuthLogin(cwd, { mode: 'claudeai' });
-        result.loginLabel = 'Claude subscription login';
-        result.summary = 'Claude subscription auth';
-        return result;
-    }
-
-    if (mode === 'console') {
-        result.loginRunner = () => runClaudeAuthLogin(cwd, { mode: 'console' });
-        result.loginLabel = 'Anthropic Console login';
-        result.summary = 'Anthropic Console auth';
-        return result;
-    }
-
-    if (mode === 'setup_token') {
-        result.loginRunner = () => runClaudeSetupToken(cwd);
-        result.loginLabel = 'Claude long-lived token setup';
-        result.summary = 'Claude subscription token auth';
-        return result;
-    }
-
-    if (mode === 'api_key') {
-        let apiKey = String(options.claudeApiKey || process.env.ANTHROPIC_API_KEY || '').trim();
-        if (!apiKey && interactive) {
-            apiKey = await password({
-                message: 'Anthropic API key for this profiling run:',
-                validate: (v) => (String(v || '').trim() ? true : 'API key is required'),
-            });
-        }
-        result.envOverrides = {
-            ANTHROPIC_API_KEY: apiKey,
-            ANTHROPIC_AUTH_TOKEN: null,
-            ANTHROPIC_BASE_URL: null,
-            CLAUDE_CODE_USE_BEDROCK: null,
-            CLAUDE_CODE_USE_VERTEX: null,
-        };
-        result.summary = 'Anthropic API key auth';
-        return result;
-    }
-
-    if (mode === 'gateway') {
-        let baseUrl = String(options.claudeBaseUrl || process.env.ANTHROPIC_BASE_URL || '').trim();
-        let authToken = String(options.claudeAuthToken || process.env.ANTHROPIC_AUTH_TOKEN || '').trim();
-        let model = providerModel;
-
-        if (interactive) {
-            if (!baseUrl) {
-                baseUrl = await input({
-                    message: 'Anthropic-compatible base URL for this profiling run:',
-                    validate: (v) => (String(v || '').trim() ? true : 'Base URL is required'),
-                });
-            }
-            if (!authToken) {
-                authToken = await password({
-                    message: 'Gateway auth token for this profiling run:',
-                    validate: (v) => (String(v || '').trim() ? true : 'Auth token is required'),
-                });
-            }
-            if (!providerModel) {
-                model = String(
-                    await input({
-                        message: 'Provider model override (leave blank to use haiku):',
-                        default: '',
-                    }),
-                ).trim();
-            }
-        }
-
-        result.model = model || 'haiku';
-        result.envOverrides = {
-            ANTHROPIC_BASE_URL: baseUrl,
-            ANTHROPIC_AUTH_TOKEN: authToken,
-            ANTHROPIC_API_KEY: null,
-            CLAUDE_CODE_USE_BEDROCK: null,
-            CLAUDE_CODE_USE_VERTEX: null,
-        };
-        result.summary = `Anthropic-compatible gateway (${baseUrl || 'configured base URL'})`;
-        return result;
-    }
-
-    if (mode === 'bedrock') {
-        let model = providerModel;
-        if (interactive && !providerModel) {
-            model = String(
-                await input({
-                    message: 'Bedrock model override (leave blank to use haiku):',
-                    default: '',
-                }),
-            ).trim();
-        }
-        result.model = model || 'haiku';
-        result.envOverrides = {
-            CLAUDE_CODE_USE_BEDROCK: 'true',
-            CLAUDE_CODE_USE_VERTEX: null,
-            ANTHROPIC_API_KEY: null,
-            ANTHROPIC_AUTH_TOKEN: null,
-        };
-        result.summary = 'AWS Bedrock credentials from your shell/environment';
-        return result;
-    }
-
-    if (mode === 'vertex') {
-        let model = providerModel;
-        if (interactive && !providerModel) {
-            model = String(
-                await input({
-                    message: 'Vertex model override (leave blank to use haiku):',
-                    default: '',
-                }),
-            ).trim();
-        }
-        result.model = model || 'haiku';
-        result.envOverrides = {
-            CLAUDE_CODE_USE_VERTEX: 'true',
-            CLAUDE_CODE_USE_BEDROCK: null,
-            ANTHROPIC_API_KEY: null,
-            ANTHROPIC_AUTH_TOKEN: null,
-        };
-        result.summary = 'Google Vertex AI credentials from your shell/environment';
-        return result;
-    }
-
-    result.summary = 'current Claude Code auth/environment';
-    return result;
-}
-
-/**
- * Resolve environment variables from flags, env, or interactive prompt.
- */
-async function resolveEnvVars(options, interactive, cwd) {
-    let apiUrl = normalizeApiUrl(options.apiUrl || process.env.SECURITY_REVIEW_API_URL || '');
-    let apiToken = options.apiKey || process.env.SECURITY_REVIEW_API_TOKEN || '';
-
-    if (!apiUrl || !apiToken) {
-        const stored = getStoredCredentials(cwd);
-        if (!apiUrl && stored.apiUrl) {
-            apiUrl = stored.apiUrl;
-        }
-        if (!apiToken && stored.apiToken) {
-            apiToken = stored.apiToken;
-        }
-    }
-
-    if (interactive) {
-        if (!apiUrl) {
-            apiUrl = await input({
-                message: '🔗 SRAI API URL:',
-                default: 'app.demo.securityreview.ai',
-                validate: (v) => {
-                    const normalized = normalizeApiUrl(v);
-                    if (!normalized) return 'Must be a valid URL';
-
-                    try {
-                        new URL(normalized);
-                        return true;
-                    } catch {
-                        return 'Must be a valid URL';
-                    }
-                },
-            });
-            apiUrl = normalizeApiUrl(apiUrl);
-        } else {
-            console.log(chalk.dim(`  API URL: ${apiUrl} (from saved config/env/flags)`));
-        }
-
-        if (!apiToken) {
-            apiToken = await input({
-                message: '🔑 SRAI API Token:',
-                validate: (v) => (v.length > 0 ? true : 'Token is required'),
-            });
-        } else {
-            console.log(chalk.dim(`  API Token: ${'•'.repeat(8)} (from saved config/env/flags)`));
-        }
-    } else {
-        if (!apiUrl || !apiToken) {
-            console.log(
-                chalk.yellow(
-                    '⚠  Missing credentials. Set SECURITY_REVIEW_API_URL and SECURITY_REVIEW_API_TOKEN\n' +
-                    '   environment variables, pass --api-url and --api-key flags, or run in interactive mode.',
-                ),
-            );
-            process.exit(1);
-        }
-    }
-
-    return { apiUrl, apiToken };
-}
-
-/**
- * Resolve project mapping from SRAI API.
- */
-async function resolveProjectName(options, interactive, apiUrl, apiToken) {
-    const pinnedProject = (options.projectName || process.env.SECURITY_REVIEW_PROJECT_NAME || '').trim();
-
-    const projectNames = await fetchVibeReviewProjectNames(apiUrl, apiToken);
-
-    if (!interactive) {
-        if (pinnedProject) {
-            if (!projectNames.includes(pinnedProject)) {
-                console.log(
-                    chalk.yellow(
-                        `⚠  Project "${pinnedProject}" is not in the vibe-review-enabled list. ` +
-                            'Only projects with is_vibe_review=true can be selected. Pass a valid --project-name or run interactive mode.',
-                    ),
-                );
-                process.exit(1);
-            }
-            return pinnedProject;
-        }
-
-        if (projectNames.length === 1) {
-            return projectNames[0];
-        }
-
-        console.log(
-            chalk.yellow(
-                '⚠  Multiple vibe-review projects available. Pass --project-name or run interactive mode to choose one.',
-            ),
-        );
-        process.exit(1);
-    }
-
-    const selected = await select({
-        message: '🧩 Select SRAI project (vibe review enabled only):',
-        choices: projectNames.map((name) => ({
-            name,
-            value: name,
-        })),
-        default: projectNames.includes(pinnedProject) ? pinnedProject : undefined,
-        pageSize: 12,
-    });
-
-    return selected;
-}
-
-/**
- * Resolve targets from flags or interactive prompt.
- */
-async function resolveTargets(options, interactive, cwd) {
-    // Flag mode: explicit target(s)
-    if (options.target) {
-        const targets = Array.isArray(options.target) ? options.target : [options.target];
-        for (const t of targets) {
-            if (!TARGET_NAMES.includes(t)) {
-                console.log(chalk.red(`✗ Unknown target: ${t}`));
-                console.log(chalk.dim(`  Valid targets: ${TARGET_NAMES.join(', ')}`));
-                process.exit(1);
-            }
-        }
-        return targets;
-    }
-
-    if (options.all) {
-        return [...TARGET_NAMES];
-    }
-
-    if (!interactive) {
-        console.log(chalk.red('✗ No target specified. Use --target <name> or --all.'));
-        process.exit(1);
-    }
-
-    // Interactive: detect and offer choices
-    const detected = detectTargets(cwd);
-
-    console.log('');
-    if (detected.length > 0) {
-        console.log(
-            chalk.dim(`  Detected IDEs in workspace: ${detected.map((d) => TARGETS[d].name).join(', ')}`),
-        );
-    }
-
-    const selected = await checkbox({
-        message: '🎯 Select target IDE(s) / CLI(s) to configure:',
-        choices: TARGET_NAMES.map((key) => ({
-            name: `${TARGETS[key].name}`,
-            value: key,
-            checked: detected.includes(key),
-        })),
-        validate: (v) => (v.length > 0 ? true : 'Select at least one target'),
-    });
-
-    return selected;
-}
-
-/**
- * Main init command handler.
- */
-export async function initCommand(options) {
-    const cwd = process.cwd();
-    const interactive = !options.target && !options.all;
-
-    // Banner
-    console.log('');
-    console.log(chalk.bold.cyan('  ╔══════════════════════════════════════╗'));
-    console.log(chalk.bold.cyan('  ║') + chalk.bold('   🛡️  Security Review Kit — Init  ') + chalk.bold.cyan('   ║'));
-    console.log(chalk.bold.cyan('  ╚══════════════════════════════════════╝'));
-    console.log('');
-
-    if (interactive) {
-        console.log(chalk.dim('  Interactive setup — follow the prompts below.\n'));
-    }
-
-    // Step 1: Resolve targets
-    console.log(chalk.bold.white('  Step 1 of 5: Select Targets'));
-    console.log(chalk.dim('  ─────────────────────────────────'));
-    const targets = await resolveTargets(options, interactive, cwd);
-    console.log(chalk.green(`  ✓ Targets: ${targets.map((t) => TARGETS[t].name).join(', ')}`));
-    console.log('');
-    console.log(chalk.bold.white('  Step 1b: IDE / agent CLIs'));
-    console.log(chalk.dim('  ─────────────────────────────────'));
-    const cliResults = ensureIdeClisForTargets(targets, { skipInstall: options.skipIdeCliInstall });
-    for (const r of cliResults) {
-        if (r.skipped) continue;
-        const label = TARGETS[r.target]?.name || r.target;
-        if (r.already) {
-            console.log(chalk.dim(`  • ${label} CLI already available`));
-        } else if (r.ok) {
-            console.log(chalk.green(`  \u2713 ${label} CLI install attempted`));
-        } else {
-            console.log(chalk.yellow(`  \u26a0  ${label} CLI: ${r.message || 'install skipped or failed'}`));
-        }
-    }
-    console.log('');
-
-
-    // Step 2: What to install (rules question first, then MCP)
-    let installMcp = !options.skipMcp;
-    let installRules = !options.skipRules;
-
-    if (interactive) {
-        console.log(chalk.bold.white('  Step 2 of 5: Installation Options'));
-        console.log(chalk.dim('  ─────────────────────────────────'));
-        installRules = await confirm({
-            message: '📋 Install workspace security rules?',
-            default: true,
-        });
-        installMcp = await confirm({
-            message: '📡 Install MCP server configuration?',
-            default: true,
-        });
-    }
-
-    if (!installMcp && !installRules) {
-        console.log(chalk.yellow('  ⚠  Nothing to install. Exiting.'));
-        return;
-    }
-    console.log('');
-
-    // Step 3: Resolve credentials (only needed when MCP is being installed)
-    let envVars = { apiUrl: '', apiToken: '' };
-    if (installMcp) {
-        console.log(chalk.bold.white('  Step 3 of 5: SRAI Credentials'));
-        console.log(chalk.dim('  ─────────────────────────────────'));
-        envVars = await resolveEnvVars(options, interactive, cwd);
-        console.log(chalk.green('  ✓ Credentials configured'));
-    } else {
-        console.log(chalk.dim('  Step 3 of 5: Skipping SRAI credentials (MCP not selected).'));
-    }
-    console.log('');
-
-    // Step 4: Resolve project name (only needed when MCP is being installed)
-    let projectName = options.projectName || process.env.SECURITY_REVIEW_PROJECT_NAME || '';
-    if (installMcp) {
-        console.log(chalk.bold.white('  Step 4 of 5: SRAI Project Mapping'));
-        console.log(chalk.dim('  ─────────────────────────────────'));
-        projectName = await resolveProjectName(options, interactive, envVars.apiUrl, envVars.apiToken);
-        if (projectName) {
-            console.log(chalk.green(`  ✓ Project mapped: ${projectName}`));
-        } else {
-            console.log(chalk.dim('  No project name provided. Rules will use a generic project lookup instruction.'));
-        }
-    } else {
-        console.log(chalk.dim('  Step 4 of 5: Skipping SRAI project mapping (MCP not selected).'));
-    }
-    console.log('');
-
-    const projectNameForSkill =
-        (projectName || options.projectName || process.env.SECURITY_REVIEW_PROJECT_NAME || '').trim();
-
-    console.log(chalk.bold.white('  Step 5 of 5: Installing workspace files'));
-    console.log(chalk.dim('  ─────────────────────────────────'));
-
-    const results = [];
-
-    for (const target of targets) {
-        const targetInfo = TARGETS[target];
-        console.log('');
-        console.log(chalk.bold(`  ${targetInfo.name}`));
-
-        if (installMcp) {
-            try {
-                const gen = await mcpGenerators[target]();
-                const mcpPath = gen.generate(cwd, envVars);
-                console.log(chalk.green(`    ✓ MCP config → ${typeof mcpPath === 'string' ? mcpPath : mcpPath}`));
-                results.push({ target, type: 'mcp', status: 'ok', path: mcpPath });
-            } catch (err) {
-                console.log(chalk.red(`    ✗ MCP config failed: ${err.message}`));
-                results.push({ target, type: 'mcp', status: 'error', error: err.message });
-            }
-        }
-
-        if (installRules) {
-            try {
-                const gen = await ruleGenerators[target]();
-                const generatedRules = normalizeRuleResults(gen.generate(cwd, { projectName }));
-
-                for (const rule of generatedRules) {
-                    const labelByKind = {
-                        rule: 'Workspace rule',
-                        command: 'Workspace command',
-                        agent: 'Workspace agent',
-                        skill: 'Workspace skill',
-                        hooks: 'Hooks',
-                        config: 'CLI config',
-                    };
-                    const label = labelByKind[rule.kind] || 'Workspace rule';
-                    console.log(chalk.green(`    ✓ ${label} → ${rule.filePath} (${rule.action})`));
-                    results.push({ target, type: rule.kind, status: 'ok', path: rule.filePath, action: rule.action });
-                }
-            } catch (err) {
-                console.log(chalk.red(`    ✗ Workspace rule failed: ${err.message}`));
-                results.push({ target, type: 'rule', status: 'error', error: err.message });
-            }
-        }
-    }
-
-    if (installRules) {
-        try {
-            const bundlePaths = writeGuardrailsSkillBundles(cwd, {
-                projectName: projectNameForSkill,
-                targets,
-            });
-            if (bundlePaths.length === 0) {
-                console.log(
-                    chalk.dim(
-                        '    (Guardrails skills are only written for Cursor, VS Code Copilot, Claude Code, and Codex targets.)',
-                    ),
-                );
-            }
-            for (const bundlePath of bundlePaths) {
-                console.log(chalk.green(`    \u2713 Guardrails skill bundle \u2192 ${bundlePath}`));
-                results.push({ target: 'kit', type: 'bundle', status: 'ok', path: bundlePath });
-            }
-        } catch (err) {
-            console.log(chalk.red(`    \u2717 Guardrails skill bundle failed: ${err.message}`));
-            results.push({ target: 'kit', type: 'bundle', status: 'error', error: err.message });
-        }
-    }
-
-    // Summary
-    const ok = results.filter((r) => r.status === 'ok').length;
-    const errors = results.filter((r) => r.status === 'error').length;
-
-    console.log('');
-    console.log(chalk.dim('  ─────────────────────────────────'));
-    if (errors === 0) {
-        console.log(chalk.bold.green(`  ✅ Done! ${ok} configuration(s) installed successfully.`));
-    } else {
-        console.log(
-            chalk.bold.yellow(`  ⚠  Done with ${errors} error(s). ${ok} configuration(s) installed.`),
-        );
-    }
-    console.log('');
-
-    const profilerEligible =
-        installMcp && installRules && projectNameForSkill && options.profileRepo !== false;
-
-    let shouldProfile = false;
-    if (profilerEligible) {
-        if (interactive) {
-            shouldProfile = await confirm({
-                message:
-                    'Profile this repository and push the default guardrail pack to SecurityReview.ai (runs your IDE agent CLI)?',
-                default: true,
-            });
-        } else {
-            shouldProfile = Boolean(options.profileRepo);
-        }
-    }
-
-    if (shouldProfile) {
-        const agentTarget = pickProfilerAgentTarget(targets);
-        if (!agentTarget) {
-            console.log(
-                chalk.yellow(
-                    '  \u26a0  Profiling needs Cursor, VS Code Copilot, Claude Code, or Codex in your targets. Add one and re-run, or run the guardrails-init-profile command in your IDE.',
-                ),
-            );
-        } else {
-            console.log('');
-            console.log(chalk.bold.white(`  Starting profiler via ${TARGETS[agentTarget].name} CLI…`));
-            let claudeProfilerAuth = null;
-            if (agentTarget === 'cursor') {
-                console.log(
-                    chalk.dim(
-                        '  Cursor: headless profiling uses `--trust` and `--approve-mcps` on this folder (you confirmed above).',
-                    ),
-                );
-                if (options.profilerNoTrust) {
-                    console.log(
-                        chalk.dim(
-                            '  You passed `--profiler-no-trust`: complete any login or workspace-trust prompts in this terminal.',
-                        ),
-                    );
-                }
-
-                let runLogin = Boolean(options.profilerCursorLogin);
-                if (!runLogin && interactive) {
-                    runLogin = await confirm({
-                        message:
-                            'Run Cursor Agent login in this terminal now? (Same init — profiling runs next. Choose No if already signed in.)',
-                        default: true,
-                    });
-                }
-                if (runLogin) {
-                    console.log('');
-                    console.log(chalk.bold.white('  Cursor Agent login'));
-                    console.log(chalk.dim('  Complete the browser or code prompt, then return here.\n'));
-                    const loginResult = runCursorAgentLogin(cwd);
-                    if (loginResult.ok) {
-                        console.log(chalk.green('  \u2713 Cursor Agent login step finished.'));
-                    } else {
-                        console.log(
-                            chalk.yellow(
-                                `  \u26a0  Login exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
-                            ),
-                        );
-                    }
-                    console.log('');
-                }
-            } else if (agentTarget === 'vscode') {
-                console.log(
-                    chalk.dim(
-                        '  Copilot: profiling uses the VS Code MCP config and Copilot CLI tool approvals for this folder.',
-                    ),
-                );
-
-                let runLogin = Boolean(options.profilerCopilotLogin);
-                if (!runLogin && interactive) {
-                    runLogin = await confirm({
-                        message:
-                            'Run GitHub Copilot CLI login in this terminal now? (Same init — profiling runs next. Choose No if already signed in.)',
-                        default: true,
-                    });
-                }
-                if (runLogin) {
-                    console.log('');
-                    console.log(chalk.bold.white('  GitHub Copilot CLI login'));
-                    console.log(chalk.dim('  Complete the browser or device-code prompt, then return here.\n'));
-                    const loginResult = runCopilotLogin(cwd);
-                    if (loginResult.ok) {
-                        console.log(chalk.green('  \u2713 GitHub Copilot CLI login step finished.'));
-                    } else {
-                        console.log(
-                            chalk.yellow(
-                                `  \u26a0  Copilot login exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
-                            ),
-                        );
-                    }
-                    console.log('');
-                }
-            } else if (agentTarget === 'claude') {
-                claudeProfilerAuth = await resolveClaudeProfilerAuth(options, interactive, cwd);
-                console.log(
-                    chalk.dim(
-                        `  Claude Code: profiling uses \`.mcp.json\`, \`.claude/settings.json\`, bypassed tool prompts for this profiling pass, and \`${claudeProfilerAuth.model}\` for this run.`,
-                    ),
-                );
-                console.log(chalk.dim(`  Auth mode: ${claudeProfilerAuth.summary}.`));
-
-                const needsSetup = typeof claudeProfilerAuth.loginRunner === 'function';
-                let runLogin = needsSetup;
-                if (needsSetup && interactive && !options.claudeAuthMode && !options.profilerClaudeLogin) {
-                    runLogin = await confirm({
-                        message: `${claudeProfilerAuth.loginLabel} in this terminal now? (Same init — profiling runs next.)`,
-                        default: true,
-                    });
-                }
-                if (runLogin && claudeProfilerAuth.loginRunner) {
-                    console.log('');
-                    console.log(chalk.bold.white(`  ${claudeProfilerAuth.loginLabel}`));
-                    console.log(chalk.dim('  Complete the prompt flow, then return here.\n'));
-                    const loginResult = claudeProfilerAuth.loginRunner();
-                    if (loginResult.ok) {
-                        console.log(chalk.green(`  \u2713 ${claudeProfilerAuth.loginLabel} finished.`));
-                    } else {
-                        console.log(
-                            chalk.yellow(
-                                `  \u26a0  ${claudeProfilerAuth.loginLabel} exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; configure auth and re-run init if it fails.`,
-                            ),
-                        );
-                    }
-                    console.log('');
-                }
-            } else if (agentTarget === 'codex') {
-                console.log(
-                    chalk.dim(
-                        '  Codex: profiling passes the SRAI MCP server directly to `codex exec` for this run.',
-                    ),
-                );
-
-                let runLogin = Boolean(options.profilerCodexLogin);
-                if (!runLogin && interactive) {
-                    runLogin = await confirm({
-                        message:
-                            'Run Codex login in this terminal now? (Same init — profiling runs next. Choose No if already signed in.)',
-                        default: true,
-                    });
-                }
-                if (runLogin) {
-                    console.log('');
-                    console.log(chalk.bold.white('  Codex login'));
-                    console.log(chalk.dim('  Complete the device-code prompt, then return here.\n'));
-                    const loginResult = runCodexLogin(cwd);
-                    if (loginResult.ok) {
-                        console.log(chalk.green('  \u2713 Codex login step finished.'));
-                    } else {
-                        console.log(
-                            chalk.yellow(
-                                `  \u26a0  Codex login exited with status ${loginResult.status ?? 'unknown'}. Profiling will still be attempted; sign in and re-run init if it fails.`,
-                            ),
-                        );
-                    }
-                    console.log('');
-                }
-            } else {
-                console.log(chalk.dim('  (Sign-in or approvals may be required in your terminal.)'));
-            }
-            console.log('');
-            const profilerVerbose = Boolean(options.profilerVerbose || options.showProfilerLogs);
-            const showProfilerOutput = Boolean(
-                profilerVerbose || (agentTarget === 'cursor' && options.profilerNoTrust),
-            );
-            if (showProfilerOutput) {
-                console.log(chalk.dim('  Profiling in progress. Live profiler logs are visible for this run...'));
-            } else {
-                console.log(chalk.dim('  Profiling in progress. This can take a few minutes...'));
-            }
-            const pr = runProfilerAgent(cwd, {
-                target: agentTarget,
-                projectName: projectNameForSkill,
-                apiUrl: envVars?.apiUrl,
-                apiToken: envVars?.apiToken,
-                modelOverride: agentTarget === 'claude' ? claudeProfilerAuth?.model : undefined,
-                extraEnv: agentTarget === 'claude' ? claudeProfilerAuth?.envOverrides : undefined,
-                cursorTrust: !options.profilerNoTrust,
-                streamProgress: profilerVerbose,
-                showOutput: showProfilerOutput,
-            });
-            if (pr.ok) {
-                console.log(chalk.green('  \u2713 Profiler agent finished.'));
-                if (pr.logPath) {
-                    console.log(chalk.dim(`  Profiler log saved to ${pr.logPath}`));
-                }
-            } else {
-                const detail =
-                    pr.message ||
-                    (typeof pr.status === 'number' ? `exit status ${pr.status}` : 'unknown error');
-                console.log(
-                    chalk.yellow(
-                        `  \u26a0  Profiler agent exited with an error: ${detail}. You can run the guardrails-init-profile workflow manually.`,
-                    ),
-                );
-                if (pr.logPath) {
-                    console.log(chalk.dim(`  Profiler log saved to ${pr.logPath}`));
-                }
-                if (agentTarget === 'cursor') {
-                    console.log('');
-                    console.log(chalk.dim('  Typical fixes:'));
-                    console.log(
-                        chalk.dim(
-                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for “Run Cursor Agent login”, or pass `--profiler-cursor-login` with `--profile-repo`. Use `agent login` (or `cursor-agent login`) if prompted manually.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • CLI missing: install from https://cursor.com/docs/cli/installation and verify `agent --version` (new installs use the `agent` command; `cursor-agent` is legacy).',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • Want interactive trust instead of `--trust`: run `securityreview-kit init ... --profiler-no-trust` and answer the prompts, then profile again.',
-                        ),
-                    );
-                } else if (agentTarget === 'vscode') {
-                    console.log('');
-                    console.log(chalk.dim('  Typical fixes:'));
-                    console.log(
-                        chalk.dim(
-                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for GitHub Copilot CLI login, or pass `--profiler-copilot-login` with `--profile-repo`.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • CLI missing: install GitHub Copilot CLI and verify `copilot --version`.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • MCP missing: re-run init with VS Code selected and MCP installation enabled so `.vscode/mcp.json` is written.',
-                        ),
-                    );
-                } else if (agentTarget === 'claude') {
-                    console.log('');
-                    console.log(chalk.dim('  Typical fixes:'));
-                    console.log(
-                        chalk.dim(
-                            '    • Choose the right auth mode: subscription, Console, API key, gateway, Bedrock, or Vertex.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • CLI missing: install Claude Code and verify `claude --version`.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • API key / gateway: provide `--claude-api-key`, or `--claude-base-url` plus `--claude-auth-token`, or set the matching env vars before re-running init.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • Bedrock / Vertex: make sure your cloud credentials are already available in this shell before profiling.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • MCP missing: re-run init with Claude Code selected and MCP installation enabled so `.mcp.json` is written and `.claude/settings.json` enables `security-review-mcp`.',
-                        ),
-                    );
-                } else if (agentTarget === 'codex') {
-                    console.log('');
-                    console.log(chalk.dim('  Typical fixes:'));
-                    console.log(
-                        chalk.dim(
-                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for Codex login, or pass `--profiler-codex-login` with `--profile-repo`.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • CLI missing: install Codex CLI and verify `codex --version`.',
-                        ),
-                    );
-                    console.log(
-                        chalk.dim(
-                            '    • MCP missing: re-run init with Codex selected and MCP installation enabled so the SRAI credentials are available for profiling.',
-                        ),
-                    );
-                }
-            }
-        }
-    }
-
-    console.log('');
-    console.log(chalk.dim('  Run `securityreview-kit status` to verify your setup.'));
-    console.log('');
-}