@securityreviewai/vibereview-cli 0.1.0

package/dist/src/providers/claude.js

@@ -0,0 +1,27 @@
+import { cleanVersion, runProviderCommand } from "./process.js";
+export async function checkClaudePreflight(run = runProviderCommand) {
+    let version;
+    try {
+        version = cleanVersion(await run("claude", ["--version"], 10_000));
+    }
+    catch {
+        throw new Error("Claude Code was not found. Install it, then run `claude --version` to verify the installation.");
+    }
+    try {
+        const output = await run("claude", ["auth", "status"]);
+        if (/not logged in|not authenticated|logged out|\berror:/i.test(output))
+            throw new Error("not authenticated");
+    }
+    catch {
+        throw new Error("Claude Code authentication could not be verified. Run `claude auth status` or `claude auth login`, then retry `vibereview init`.");
+    }
+    return {
+        provider: "claude",
+        displayName: "Claude Code",
+        executable: "claude",
+        version,
+        authentication: "verified",
+        authenticationMessage: "Claude Code authentication verified",
+    };
+}
+//# sourceMappingURL=claude.js.map

package/dist/src/providers/codex.js

@@ -0,0 +1,27 @@
+import { cleanVersion, runProviderCommand } from "./process.js";
+export async function checkCodexPreflight(run = runProviderCommand) {
+    let version;
+    try {
+        version = cleanVersion(await run("codex", ["--version"], 10_000));
+    }
+    catch {
+        throw new Error("Codex CLI was not found. Install Codex, then run `codex --version` to verify the installation.");
+    }
+    try {
+        const output = await run("codex", ["login", "status"]);
+        if (/not logged in|not authenticated|logged out|\berror:/i.test(output))
+            throw new Error("not authenticated");
+    }
+    catch {
+        throw new Error("Codex authentication could not be verified. Run `codex login status` or `codex login`, then retry `vibereview init`.");
+    }
+    return {
+        provider: "codex",
+        displayName: "Codex",
+        executable: "codex",
+        version,
+        authentication: "verified",
+        authenticationMessage: "Codex authentication verified",
+    };
+}
+//# sourceMappingURL=codex.js.map

package/dist/src/providers/copilot.js

@@ -0,0 +1,44 @@
+import { cleanVersion, runProviderCommand } from "./process.js";
+const TOKEN_ENV_NAMES = ["COPILOT_PROVIDER_API_KEY", "COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"];
+export async function checkCopilotPreflight(run = runProviderCommand) {
+    let version;
+    try {
+        version = cleanVersion(await run("copilot", ["version"], 10_000));
+    }
+    catch {
+        throw new Error("GitHub Copilot CLI could not be started. Run `copilot version`; if authentication is required, run `copilot login`, then retry `vibereview init`.");
+    }
+    const configuredEnvironment = TOKEN_ENV_NAMES.find((name) => Boolean(process.env[name]));
+    if (configuredEnvironment) {
+        return {
+            provider: "copilot",
+            displayName: "GitHub Copilot",
+            executable: "copilot",
+            version,
+            authentication: "configured",
+            authenticationMessage: `GitHub Copilot credentials configured through ${configuredEnvironment}`,
+        };
+    }
+    try {
+        await run("gh", ["auth", "status"], 10_000);
+        return {
+            provider: "copilot",
+            displayName: "GitHub Copilot",
+            executable: "copilot",
+            version,
+            authentication: "configured",
+            authenticationMessage: "GitHub CLI authentication available to Copilot",
+        };
+    }
+    catch {
+        return {
+            provider: "copilot",
+            displayName: "GitHub Copilot",
+            executable: "copilot",
+            version,
+            authentication: "deferred",
+            authenticationMessage: "GitHub Copilot authentication will be verified on its first agent run",
+        };
+    }
+}
+//# sourceMappingURL=copilot.js.map

package/dist/src/providers/cursor.js

@@ -0,0 +1,27 @@
+import { cleanVersion, runProviderCommand } from "./process.js";
+export async function checkCursorPreflight(run = runProviderCommand) {
+    let version;
+    try {
+        version = cleanVersion(await run("cursor-agent", ["--version"], 10_000));
+    }
+    catch {
+        throw new Error("Cursor CLI was not found. Install it, then run `cursor-agent --version` to verify the installation.");
+    }
+    try {
+        const output = await run("cursor-agent", ["status"]);
+        if (/not authenticated|logged out|unauthenticated|\berror:/i.test(output))
+            throw new Error("authentication check failed");
+    }
+    catch {
+        throw new Error("Cursor CLI authentication could not be verified. Run `cursor-agent status` or `cursor-agent login`, then retry `vibereview init`.");
+    }
+    return {
+        provider: "cursor",
+        displayName: "Cursor",
+        executable: "cursor-agent",
+        version,
+        authentication: "verified",
+        authenticationMessage: "Cursor authentication verified",
+    };
+}
+//# sourceMappingURL=cursor.js.map

package/dist/src/providers/index.js

@@ -0,0 +1,23 @@
+import { checkClaudePreflight } from "./claude.js";
+import { checkCodexPreflight } from "./codex.js";
+import { checkCopilotPreflight } from "./copilot.js";
+import { checkCursorPreflight } from "./cursor.js";
+export const PROVIDER_NAMES = {
+    cursor: "Cursor",
+    codex: "Codex",
+    claude: "Claude Code",
+    copilot: "GitHub Copilot",
+};
+export const PROVIDERS = Object.keys(PROVIDER_NAMES);
+export async function checkProviderPreflight(provider) {
+    switch (provider) {
+        case "cursor": return checkCursorPreflight();
+        case "codex": return checkCodexPreflight();
+        case "claude": return checkClaudePreflight();
+        case "copilot": return checkCopilotPreflight();
+    }
+}
+export function isProvider(value) {
+    return PROVIDERS.includes(value);
+}
+//# sourceMappingURL=index.js.map

package/dist/src/providers/process.js

@@ -0,0 +1,16 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function runProviderCommand(executable, args, timeout = 15_000) {
+    const result = await execFileAsync(executable, args, {
+        timeout,
+        encoding: "utf8",
+        env: process.env,
+    });
+    return `${result.stdout}${result.stderr}`.trim();
+}
+export function cleanVersion(output, fallback = "unknown version") {
+    const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    return lines.find((line) => /\d+\.\d+/.test(line) && !/^warning:/i.test(line)) ?? lines.at(-1) ?? fallback;
+}
+//# sourceMappingURL=process.js.map

package/dist/src/providers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/runners/claude.js

@@ -0,0 +1,22 @@
+import { executeAgent } from "./process.js";
+export function claudeArguments(input) {
+    return [
+        "-p",
+        "--output-format", "json",
+        "--json-schema", JSON.stringify(input.schema),
+        "--permission-mode", "plan",
+        "--tools", "",
+        "--no-session-persistence",
+        "--strict-mcp-config",
+        "--mcp-config", JSON.stringify({ mcpServers: {} }),
+        input.prompt,
+    ];
+}
+export const claudeRunner = {
+    provider: "claude",
+    async run(input) {
+        const { stdout } = await executeAgent("claude", claudeArguments(input), input.temporaryDirectory);
+        return stdout;
+    },
+};
+//# sourceMappingURL=claude.js.map

package/dist/src/runners/codex.js

@@ -0,0 +1,25 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { executeAgent } from "./process.js";
+export function codexArguments(input, outputPath) {
+    return [
+        "exec",
+        "--sandbox", "read-only",
+        "--ephemeral",
+        "--ignore-user-config",
+        "--skip-git-repo-check",
+        "--output-schema", input.schemaPath,
+        "--output-last-message", outputPath,
+        "-C", input.temporaryDirectory,
+        input.prompt,
+    ];
+}
+export const codexRunner = {
+    provider: "codex",
+    async run(input) {
+        const outputPath = path.join(input.temporaryDirectory, "guardrails-output.json");
+        await executeAgent("codex", codexArguments(input, outputPath), input.temporaryDirectory);
+        return readFile(outputPath, "utf8");
+    },
+};
+//# sourceMappingURL=codex.js.map

package/dist/src/runners/copilot.js

@@ -0,0 +1,21 @@
+import { executeAgent } from "./process.js";
+export function copilotArguments(input) {
+    return [
+        "-C", input.temporaryDirectory,
+        "-p", input.prompt,
+        "-s",
+        "--no-ask-user",
+        "--no-custom-instructions",
+        "--available-tools=read",
+        "--allow-tool=read",
+        "--output-format=text",
+    ];
+}
+export const copilotRunner = {
+    provider: "copilot",
+    async run(input) {
+        const { stdout } = await executeAgent("copilot", copilotArguments(input), input.temporaryDirectory);
+        return stdout;
+    },
+};
+//# sourceMappingURL=copilot.js.map

package/dist/src/runners/cursor.js

@@ -0,0 +1,20 @@
+import { executeAgent } from "./process.js";
+export function cursorArguments(input) {
+    return [
+        "-p",
+        "--mode", "plan",
+        "--sandbox", "enabled",
+        "--output-format", "json",
+        "--workspace", input.temporaryDirectory,
+        "--trust",
+        input.prompt,
+    ];
+}
+export const cursorRunner = {
+    provider: "cursor",
+    async run(input) {
+        const { stdout } = await executeAgent("cursor-agent", cursorArguments(input), input.temporaryDirectory);
+        return stdout;
+    },
+};
+//# sourceMappingURL=cursor.js.map

package/dist/src/runners/index.js

@@ -0,0 +1,26 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { claudeRunner } from "./claude.js";
+import { codexRunner } from "./codex.js";
+import { copilotRunner } from "./copilot.js";
+import { cursorRunner } from "./cursor.js";
+const RUNNERS = {
+    cursor: cursorRunner,
+    codex: codexRunner,
+    claude: claudeRunner,
+    copilot: copilotRunner,
+};
+export async function runProviderGeneration(provider, input) {
+    const temporaryDirectory = await mkdtemp(path.join(os.tmpdir(), `vibereview-${provider}-`));
+    try {
+        return await RUNNERS[provider].run({ ...input, temporaryDirectory });
+    }
+    finally {
+        await rm(temporaryDirectory, { recursive: true, force: true });
+    }
+}
+export function getRunner(provider) {
+    return RUNNERS[provider];
+}
+//# sourceMappingURL=index.js.map

package/dist/src/runners/process.js

@@ -0,0 +1,34 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const DEFAULT_TIMEOUT_MS = 5 * 60_000;
+export async function executeAgent(executable, args, cwd) {
+    try {
+        const result = await execFileAsync(executable, args, {
+            cwd,
+            timeout: agentTimeout(),
+            maxBuffer: 8 * 1024 * 1024,
+            encoding: "utf8",
+            env: { ...process.env, VIBEREVIEW_INTERNAL: "1" },
+        });
+        return { stdout: result.stdout, stderr: result.stderr };
+    }
+    catch (error) {
+        const details = commandErrorDetails(error);
+        throw new Error(`${executable} guardrail generation failed${details ? `: ${details}` : "."}`, { cause: error });
+    }
+}
+function agentTimeout() {
+    const configured = Number(process.env.VIBEREVIEW_AGENT_TIMEOUT_MS);
+    return Number.isFinite(configured) && configured >= 10_000 ? configured : DEFAULT_TIMEOUT_MS;
+}
+function commandErrorDetails(error) {
+    if (!error || typeof error !== "object")
+        return "";
+    const value = error;
+    const text = typeof value.stderr === "string" && value.stderr.trim()
+        ? value.stderr.trim()
+        : typeof value.message === "string" ? value.message : "";
+    return text.replace(/\s+/g, " ").slice(-600);
+}
+//# sourceMappingURL=process.js.map

package/dist/src/runners/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export const SCHEMA_VERSION = "1";
+//# sourceMappingURL=types.js.map

package/dist/src/ui.js

@@ -0,0 +1,22 @@
+const color = process.stdout.isTTY && !process.env.NO_COLOR;
+function paint(code, text) {
+    return color ? `\u001b[${code}m${text}\u001b[0m` : text;
+}
+export const ui = {
+    title(text) {
+        process.stdout.write(`\n${paint(1, text)}\n\n`);
+    },
+    step(text) {
+        process.stdout.write(`${paint(32, "✓")} ${text}\n`);
+    },
+    info(text) {
+        process.stdout.write(`${text}\n`);
+    },
+    detail(text) {
+        process.stdout.write(`${paint(2, text)}\n`);
+    },
+    warning(text) {
+        process.stdout.write(`${paint(33, "⚠")} ${text}\n`);
+    },
+};
+//# sourceMappingURL=ui.js.map

package/docs/provider-contracts.md

@@ -0,0 +1,55 @@
+# Provider CLI contracts
+
+These commands are the installation, authentication, and Milestone 2 generation contract. Re-verify them before changing minimum supported provider versions.
+
+| Provider | Executable | Version check | Authentication check | Login recovery |
+|---|---|---|---|---|
+| Cursor | `cursor-agent` | `cursor-agent --version` | `cursor-agent status` | `cursor-agent login` |
+| Codex | `codex` | `codex --version` | `codex login status` | `codex login` |
+| Claude Code | `claude` | `claude --version` | `claude auth status` | `claude auth login` |
+| GitHub Copilot | `copilot` | `copilot version` | Best-effort token/GitHub CLI discovery; definitive check deferred | `copilot login` |
+
+Copilot is deliberately different. Its documentation describes OAuth, environment-token, GitHub CLI fallback, and BYOK authentication, but does not expose a documented non-interactive status command equivalent to the other three. VibeReview does not spend an AI request merely to test Copilot authentication.
+
+## Generation isolation
+
+All providers receive the bundled skill, compact profile, baseline rules, and bounded source evidence as one prompt. Their working directory is a new temporary empty directory, removed after the run.
+
+| Provider | Non-interactive generation controls |
+|---|---|
+| Cursor | `cursor-agent -p --mode plan --sandbox enabled --output-format json --workspace <temporary> --trust <prompt>` |
+| Codex | `codex exec --sandbox read-only --ephemeral --ignore-user-config --skip-git-repo-check --output-schema <schema> --output-last-message <temporary-output> -C <temporary> <prompt>` |
+| Claude Code | `claude -p --output-format json --json-schema <schema> --permission-mode plan --tools "" --no-session-persistence --strict-mcp-config --mcp-config <empty> <prompt>` |
+| GitHub Copilot | `copilot -C <temporary> -p <prompt> -s --no-ask-user --no-custom-instructions --available-tools=read --allow-tool=read --output-format=text` |
+
+The default execution timeout is five minutes and can be changed with `VIBEREVIEW_AGENT_TIMEOUT_MS` (minimum ten seconds). VibeReview performs one additional provider request only when the first response executes successfully but fails the structured-output contract.
+
+## Milestone 3 workspace integration
+
+VibeReview uses provider-native always-on instructions as the enforcement layer and hooks for session/startup context. This split is intentional: not every provider permits a command hook to modify each submitted prompt.
+
+| Provider | Integration contract |
+|---|---|
+| Cursor | An always-applied `.mdc` rule, project skills, and `sessionStart` context injection in `.cursor/hooks.json`. Cursor's `beforeSubmitPrompt` command hook is not used as a context injector. |
+| Codex | A managed root `AGENTS.md` block, project skills, and `.codex/hooks.json` session/prompt context entries. |
+| Claude Code | A managed `.claude/CLAUDE.md` block, project skills, and merged `SessionStart` / `UserPromptSubmit` entries in `.claude/settings.json`. |
+| GitHub Copilot | A managed `.github/copilot-instructions.md` block, project skills, and a repository `sessionStart` prompt hook in `.github/hooks/vibereview.json`. Command-hook prompt modifications are not relied upon. |
+
+The local hook command is `node .vibereview/hooks/context.cjs <provider> <event>`. It accepts the provider's JSON hook payload on stdin, sanitizes a supplied native session ID, and emits only VibeReview workflow context. It performs no source scan or network operation.
+
+Primary hook references:
+
+- [Cursor hooks](https://cursor.com/docs/hooks)
+- [Claude Code hooks](https://docs.anthropic.com/en/docs/claude-code/hooks)
+- [GitHub Copilot hooks](https://docs.github.com/en/copilot/reference/hooks-reference)
+- [Codex documentation](https://developers.openai.com/codex/)
+
+Primary references:
+
+- [Cursor CLI authentication](https://docs.cursor.com/en/cli/reference/authentication)
+- [OpenAI Codex documentation](https://developers.openai.com/codex)
+- [Claude Code CLI reference](https://docs.anthropic.com/en/docs/claude-code/cli-usage)
+- [GitHub Copilot CLI authentication](https://docs.github.com/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/authenticate-copilot-cli)
+- [GitHub Copilot CLI command reference](https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference)
+
+The Codex `login status` and Claude Code `auth status` subcommands were also confirmed through the installed CLIs' built-in help on 2026-08-25.

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@securityreviewai/vibereview-cli",
+  "version": "0.1.0",
+  "description": "Local-first security guardrails for AI coding agents.",
+  "type": "module",
+  "bin": {
+    "vibereview": "bin/vibereview.js"
+  },
+  "files": [
+    "bin",
+    "dist/catalog",
+    "dist/src/**/*.js",
+    "docs",
+    "runtime",
+    "schemas",
+    "skills/guardrail-generator",
+    "skills/vibereview-guardrails",
+    "skills/vibereview-threat-model",
+    "skills/vibereview-osv-scan",
+    "skills/vibereview-secure-code",
+    "skills/vibereview-report",
+    "SECURITY.md"
+  ],
+  "engines": {
+    "node": ">=20.12"
+  },
+  "scripts": {
+    "catalog:import": "node scripts/import-catalog.mjs",
+    "build:catalog": "node scripts/build-catalog.mjs",
+    "build": "npm run build:catalog && tsc -p tsconfig.json",
+    "test": "npm run build && node --test dist/test/*.test.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "start": "node bin/vibereview.js",
+    "prepublishOnly": "npm test"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "^7.8.4",
+    "yaml": "^2.8.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.17.2",
+    "typescript": "^5.9.2"
+  },
+  "license": "Apache-2.0"
+}

package/runtime/hook-context.cjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+"use strict";
+
+const provider = process.argv[2] || "unknown";
+const eventName = process.argv[3] || "SessionStart";
+let input = "";
+
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  if (input.length < 1_000_000) input += chunk;
+});
+process.stdin.on("end", () => {
+  let payload = {};
+  try { payload = input.trim() ? JSON.parse(input) : {}; } catch { payload = {}; }
+  const rawId = payload.session_id || payload.sessionId || payload.conversation_id || payload.conversationId || "";
+  const sessionId = String(rawId).replace(/[^A-Za-z0-9_-]/g, "").slice(0, 160);
+  const reportPath = sessionId ? `.vibereview/reports/${sessionId}.md` : "";
+  const identity = sessionId
+    ? `Use chat_session_id ${sessionId} and report_path ${reportPath} for this IDE chat.`
+    : "No native session ID was supplied; create one UUID on the first security-relevant task, use .vibereview/reports/<uuid>.md, and retain that exact ID and path in conversation context.";
+  const context = [
+    "VibeReview's local security workflow is active for this workspace.",
+    identity,
+    "For every security-relevant prompt, follow the installed VibeReview guardrail, threat-model, secure-code, and report skills before finalizing.",
+    "Maintain exactly one Markdown report for this chat. On every follow-up, read and rewrite that same file to reflect current state; add, revise, or remove stale content as needed. Never create a second report or emit a JSON scan artifact.",
+  ].join(" ");
+
+  if (provider === "cursor") {
+    process.stdout.write(JSON.stringify({
+      ...(sessionId ? { env: { VIBEREVIEW_CHAT_SESSION_ID: sessionId, VIBEREVIEW_REPORT_PATH: reportPath } } : {}),
+      additional_context: context,
+    }));
+    return;
+  }
+  if (provider === "claude" || provider === "codex") {
+    process.stdout.write(JSON.stringify({
+      hookSpecificOutput: { hookEventName: eventName, additionalContext: context },
+    }));
+    return;
+  }
+  process.stdout.write("{}");
+});
+
+process.stdin.resume();

package/schemas/code-guardrails-v1.json

@@ -0,0 +1,45 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "summary", "guardrails"],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "summary": { "type": "string" },
+    "guardrails": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["title", "type", "category", "instruction", "rationale", "confidence", "evidence", "cwe_ids", "owasp_top10"],
+        "properties": {
+          "title": { "type": "string" },
+          "type": { "enum": ["must", "must_not"] },
+          "category": { "type": "string" },
+          "instruction": { "type": "string" },
+          "rationale": { "type": "string" },
+          "confidence": { "enum": ["high", "medium"] },
+          "evidence": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["path", "reason"],
+              "properties": {
+                "path": { "type": "string" },
+                "reason": { "type": "string" }
+              }
+            }
+          },
+          "cwe_ids": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "owasp_top10": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        }
+      }
+    }
+  }
+}