@securityreviewai/securityreview-kit 0.1.50 → 0.1.52

package/src/utils/cursor-agent-path.js

@@ -0,0 +1,67 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { delimiter, isAbsolute, join } from 'node:path';
+
+/**
+ * Extra PATH segments where Cursor / other CLIs are often installed.
+ * GUI-launched terminals load shell rc files; Node subprocesses often do not.
+ */
+export function augmentPathEnv(baseEnv = process.env) {
+    const home = homedir();
+    const extra = [
+        join(home, '.local', 'bin'),
+        join(home, '.cursor', 'bin'),
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+    ];
+    if (process.platform === 'win32') {
+        extra.push(join(home, 'AppData', 'Local', 'Programs', 'cursor'));
+    }
+    const pathKey = process.platform === 'win32' ? 'Path' : 'PATH';
+    const current = baseEnv[pathKey] || baseEnv.PATH || '';
+    const merged = [...extra.filter((p) => p), current].filter(Boolean).join(delimiter);
+    return { ...baseEnv, [pathKey]: merged, PATH: merged };
+}
+
+/**
+ * Cursor Agent CLI binary (`agent` or legacy `cursor-agent`) that responds to `--version`, or null.
+ * New installs often only ship `agent` in ~/.local/bin (see https://cursor.com/docs/cli/installation).
+ */
+export function resolveCursorAgentExecutable() {
+    const env = augmentPathEnv();
+    const home = homedir();
+    const candidates = [
+        join(home, '.local', 'bin', 'agent'),
+        join(home, '.local', 'bin', 'cursor-agent'),
+        ...(process.platform === 'win32'
+            ? [
+                  join(home, '.local', 'bin', 'agent.cmd'),
+                  join(home, '.local', 'bin', 'cursor-agent.cmd'),
+              ]
+            : []),
+        join(home, '.cursor', 'bin', 'agent'),
+        join(home, '.cursor', 'bin', 'cursor-agent'),
+        'agent',
+        'cursor-agent',
+    ];
+    if (process.platform === 'win32') {
+        const base = join(home, 'AppData', 'Local', 'Programs', 'cursor');
+        candidates.splice(
+            candidates.length - 2,
+            0,
+            join(base, 'agent.exe'),
+            join(base, 'cursor-agent.exe'),
+        );
+    }
+    for (const cmd of candidates) {
+        if (isAbsolute(cmd) && !existsSync(cmd)) {
+            continue;
+        }
+        const r = spawnSync(cmd, ['--version'], { stdio: 'ignore', env });
+        if (r.status === 0) {
+            return cmd;
+        }
+    }
+    return null;
+}

package/src/utils/cursor-cli-permissions.js

@@ -0,0 +1,28 @@
+import { join } from 'node:path';
+import { MCP_SERVER_NAME } from './constants.js';
+import { readJson, writeJson } from './fs-helpers.js';
+
+/**
+ * Merge project-level Cursor CLI permissions so cursor-agent can use the SRAI MCP tools.
+ * @see https://docs.cursor.com/cli/reference/configuration
+ * @see https://docs.cursor.com/cli/reference/permissions
+ */
+export function mergeCursorCliMcpAllowlist(cwd) {
+    const cliPath = join(cwd, '.cursor', 'cli.json');
+    const existing = readJson(cliPath) || {};
+    if (!existing.permissions || typeof existing.permissions !== 'object' || Array.isArray(existing.permissions)) {
+        existing.permissions = {};
+    }
+    if (!Array.isArray(existing.permissions.allow)) {
+        existing.permissions.allow = [];
+    }
+    const token = `Mcp(${MCP_SERVER_NAME}:*)`;
+    if (!existing.permissions.allow.includes(token)) {
+        existing.permissions.allow.push(token);
+    }
+    if (!Array.isArray(existing.permissions.deny)) {
+        existing.permissions.deny = [];
+    }
+    writeJson(cliPath, existing);
+    return cliPath;
+}

package/src/utils/detect.js

@@ -0,0 +1,27 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { TARGETS, TARGET_NAMES } from './constants.js';
+
+/**
+ * Auto-detect which IDE/CLI targets are configured in the given directory
+ * by checking for known directories.
+ * @param {string} cwd - The directory to scan
+ * @returns {string[]} - List of detected target keys
+ */
+export function detectTargets(cwd) {
+    const detected = [];
+    const seen = new Set();
+
+    for (const key of TARGET_NAMES) {
+        const target = TARGETS[key];
+        for (const dir of target.detectDirs) {
+            const fullPath = join(cwd, dir);
+            if (existsSync(fullPath) && !seen.has(key)) {
+                detected.push(key);
+                seen.add(key);
+            }
+        }
+    }
+
+    return detected;
+}

package/src/utils/fs-helpers.js

@@ -0,0 +1,82 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { SENTINEL_START, SENTINEL_END } from './constants.js';
+
+/**
+ * Ensure a directory exists, creating parent dirs as needed.
+ */
+export function ensureDir(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true });
+    }
+}
+
+/**
+ * Read a JSON file, returning null if it doesn't exist or is invalid.
+ */
+export function readJson(filePath) {
+    try {
+        const raw = readFileSync(filePath, 'utf-8');
+        return JSON.parse(raw);
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Write an object as pretty-printed JSON.
+ */
+export function writeJson(filePath, data) {
+    ensureDir(dirname(filePath));
+    writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+}
+
+/**
+ * Read a text file, returning empty string if it doesn't exist.
+ */
+export function readText(filePath) {
+    try {
+        return readFileSync(filePath, 'utf-8');
+    } catch {
+        return '';
+    }
+}
+
+/**
+ * Write raw text to a file, ensuring parent dirs exist.
+ */
+export function writeText(filePath, content) {
+    ensureDir(dirname(filePath));
+    writeFileSync(filePath, content, 'utf-8');
+}
+
+/**
+ * Append or replace a sentinel-guarded block in a file.
+ * If the file exists and already has the block, it replaces it.
+ * If the file exists but doesn't have the block, it appends.
+ * If the file doesn't exist, it creates it with just the block.
+ */
+export function upsertSentinelBlock(filePath, content) {
+    const block = `${SENTINEL_START}\n${content}\n${SENTINEL_END}`;
+    const existing = readText(filePath);
+
+    if (!existing) {
+        writeText(filePath, block + '\n');
+        return 'created';
+    }
+
+    const startIdx = existing.indexOf(SENTINEL_START);
+    const endIdx = existing.indexOf(SENTINEL_END);
+
+    if (startIdx !== -1 && endIdx !== -1) {
+        const before = existing.substring(0, startIdx);
+        const after = existing.substring(endIdx + SENTINEL_END.length);
+        writeText(filePath, before + block + after);
+        return 'updated';
+    }
+
+    // Append with a blank line separator
+    const separator = existing.endsWith('\n') ? '\n' : '\n\n';
+    writeText(filePath, existing + separator + block + '\n');
+    return 'appended';
+}

package/src/utils/guardrails-profiler-bundle.js

@@ -0,0 +1,84 @@
+import { copyFileSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { GUARDRAILS_PROFILER_SKILL_REL_DIR, GUARDRAILS_SELECTION_SKILL_REL_DIR } from './constants.js';
+import { ensureDir, writeText } from './fs-helpers.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+function sanitizeProjectName(value) {
+    return String(value || '').replace(/[\r\n`]/g, ' ').trim();
+}
+
+function injectProjectName(content, projectName) {
+    const resolved = sanitizeProjectName(projectName) || '<SRAI_PROJECT_NAME>';
+    return content.replaceAll('{{SRAI_PROJECT_NAME}}', resolved).replaceAll('<SRAI_PROJECT_NAME>', resolved);
+}
+
+function injectSkillDir(content, skillDirRel) {
+    return content
+        .replaceAll('<GUARDRAILS_SKILL_DIR>', skillDirRel)
+        .replaceAll('{{GUARDRAILS_SELECTION_SKILL_DIR}}', skillDirRel);
+}
+
+function injectSkillTemplate(content, projectName, skillDirRel) {
+    return injectSkillDir(injectProjectName(content, projectName), skillDirRel);
+}
+
+const PROFILER_BUNDLE_ROOT = join(__dirname, '..', 'generators', 'rules', 'guardrails-profiler');
+const SELECTION_BUNDLE_ROOT = join(__dirname, '..', 'generators', 'rules', 'guardrails-selection');
+
+/**
+ * Writes bundled guardrails skills under each selected IDE skills directory.
+ *
+ * @returns {string[]} Absolute paths to each skill root written */
+export function writeGuardrailsSkillBundles(cwd, options = {}) {
+    const targets = Array.isArray(options.targets) ? options.targets : [];
+    const written = [];
+
+    for (const target of targets) {
+        const profilerRel = GUARDRAILS_PROFILER_SKILL_REL_DIR[target];
+        if (profilerRel) {
+            const profilerDestBase = join(cwd, profilerRel);
+            const profilerDestRefs = join(profilerDestBase, 'references');
+            ensureDir(profilerDestRefs);
+
+            const profilerSkillTemplate = readFileSync(join(PROFILER_BUNDLE_ROOT, 'SKILL.md'), 'utf-8');
+            writeText(
+                join(profilerDestBase, 'SKILL.md'),
+                injectSkillTemplate(profilerSkillTemplate, options.projectName, profilerRel),
+            );
+
+            copyFileSync(
+                join(PROFILER_BUNDLE_ROOT, 'references', 'signal-registry.json'),
+                join(profilerDestRefs, 'signal-registry.json'),
+            );
+
+            written.push(profilerDestBase);
+        }
+
+        const selectionRel = GUARDRAILS_SELECTION_SKILL_REL_DIR[target];
+        if (selectionRel) {
+            const selectionDestBase = join(cwd, selectionRel);
+            const selectionDestRefs = join(selectionDestBase, 'references');
+            ensureDir(selectionDestRefs);
+
+            const selectionSkillTemplate = readFileSync(join(SELECTION_BUNDLE_ROOT, 'SKILL.md'), 'utf-8');
+            writeText(
+                join(selectionDestBase, 'SKILL.md'),
+                injectSkillTemplate(selectionSkillTemplate, options.projectName, selectionRel),
+            );
+
+            copyFileSync(
+                join(SELECTION_BUNDLE_ROOT, 'references', 'category-threat-map.md'),
+                join(selectionDestRefs, 'category-threat-map.md'),
+            );
+
+            written.push(selectionDestBase);
+        }
+    }
+
+    return written;
+}
+
+export const writeGuardrailsProfilerBundles = writeGuardrailsSkillBundles;

package/src/utils/ide-cli-install.js

@@ -0,0 +1,138 @@
+import { spawnSync } from 'node:child_process';
+import { augmentPathEnv, resolveCursorAgentExecutable } from './cursor-agent-path.js';
+
+const AGENT_CLI_TARGETS = new Set(['cursor', 'claude', 'vscode', 'codex']);
+
+function commandOk(cmd, args = ['--version'], env = process.env) {
+    const r = spawnSync(cmd, args, { stdio: 'ignore', env });
+    return r.status === 0;
+}
+
+function runShell(script) {
+    return spawnSync(script, { shell: true, stdio: 'inherit' });
+}
+
+/**
+ * Ensure Cursor / Claude Code / Copilot / Codex CLIs are present when those targets are selected.
+ * Installation uses vendor scripts or npm where appropriate.
+ */
+export function ensureIdeCliForTarget(target, options = {}) {
+    const { skipInstall = false } = options;
+
+    if (!AGENT_CLI_TARGETS.has(target)) {
+        return { target, ok: true, skipped: true };
+    }
+
+    if (target === 'cursor') {
+        if (resolveCursorAgentExecutable()) {
+            return { target, ok: true, already: true };
+        }
+        if (skipInstall) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'Cursor Agent CLI not found (`agent` or `cursor-agent`). Install from https://cursor.com/docs/cli/installation.',
+            };
+        }
+        if (process.platform === 'win32') {
+            return {
+                target,
+                ok: false,
+                message: 'Install Cursor CLI manually: https://cursor.com/cli',
+            };
+        }
+        const r = runShell('curl -fsSL https://cursor.com/install | bash');
+        if (r.status !== 0) {
+            return { target, ok: false, message: 'Cursor CLI install script failed' };
+        }
+        if (!resolveCursorAgentExecutable()) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'Cursor Agent CLI (`agent` / `cursor-agent`) not found after install; open a new shell or ensure ~/.local/bin exists and re-run init',
+            };
+        }
+        return { target, ok: true };
+    }
+
+    if (target === 'claude') {
+        if (commandOk('claude', ['--version'], augmentPathEnv())) {
+            return { target, ok: true, already: true };
+        }
+        if (skipInstall) {
+            return { target, ok: false, message: 'claude not found on PATH' };
+        }
+        if (process.platform === 'win32') {
+            const r = runShell('powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://claude.ai/install.ps1 | iex"');
+            return r.status === 0
+                ? { target, ok: true }
+                : { target, ok: false, message: 'Claude Code install failed' };
+        }
+        const r = runShell('curl -fsSL https://claude.ai/install.sh | bash');
+        return r.status === 0
+            ? { target, ok: true }
+            : { target, ok: false, message: 'Claude Code install failed' };
+    }
+
+    if (target === 'codex') {
+        if (commandOk('codex', ['--version'], augmentPathEnv())) {
+            return { target, ok: true, already: true };
+        }
+        if (skipInstall) {
+            return { target, ok: false, message: 'codex not found on PATH' };
+        }
+        const r = runShell('npm install -g @openai/codex');
+        return r.status === 0
+            ? { target, ok: true }
+            : { target, ok: false, message: 'Codex CLI npm install failed' };
+    }
+
+    if (target === 'vscode') {
+        if (commandOk('copilot', ['--version'], augmentPathEnv())) {
+            return { target, ok: true, already: true };
+        }
+        if (skipInstall) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'GitHub Copilot CLI not found (`copilot`). Install from https://docs.github.com/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli.',
+            };
+        }
+        if (process.platform === 'win32') {
+            const r = runShell('winget install GitHub.Copilot');
+            if (r.status !== 0) {
+                return { target, ok: false, message: 'GitHub Copilot CLI winget install failed' };
+            }
+            return commandOk('copilot', ['--version'], augmentPathEnv())
+                ? { target, ok: true }
+                : {
+                      target,
+                      ok: false,
+                      message:
+                          'GitHub Copilot CLI (`copilot`) not found after install; open a new shell or ensure it is on PATH and re-run init',
+                  };
+        }
+        const r = runShell('curl -fsSL https://gh.io/copilot-install | bash');
+        if (r.status !== 0) {
+            return { target, ok: false, message: 'GitHub Copilot CLI install script failed' };
+        }
+        if (!commandOk('copilot', ['--version'], augmentPathEnv())) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'GitHub Copilot CLI (`copilot`) not found after install; open a new shell or ensure the install directory is on PATH and re-run init',
+            };
+        }
+        return { target, ok: true };
+    }
+
+    return { target, ok: true, skipped: true };
+}
+
+export function ensureIdeClisForTargets(targets, options = {}) {
+    return targets.map((t) => ensureIdeCliForTarget(t, options));
+}