@securityreviewai/vibereview-cli 0.1.2 → 0.1.4

package/README.md

@@ -13,7 +13,7 @@ Milestone 3 is implemented across Cursor, Codex, Claude Code, and GitHub Copilot
 - deterministic pack matching and guardrail deduplication;
 - bundled `guardrail-generator` skill with a strict, versioned output contract;
 - bounded collection of security-relevant source evidence;
-- automatic code-specific guardrail generation during initialization;
+- optional, explicitly confirmed code-specific guardrail generation;
 - explicit `vibereview guardrails generate` regeneration; and
 - atomic workspace updates that preserve custom guardrails;
 - native workspace instructions, project skills, and session hooks for every provider;
@@ -80,12 +80,16 @@ node bin/vibereview.js init --provider codex --yes
 
 Accepted provider IDs are `cursor`, `codex`, `claude`, and `copilot`.
 
-Initialization performs deterministic stack detection first, then automatically asks the selected provider CLI to generate code-specific rules. If that provider request fails, VibeReview still installs the baseline rules and prints a retry command. To regenerate after the code changes:
+Initialization deterministically installs baseline rules first. In an interactive terminal it then explains code-specific guardrails, discloses that the selected provider agent will consume tokens, and asks for confirmation. Declining leaves the baseline workflow fully active. If the user accepts and authentication is missing, VibeReview launches the provider's browser-capable login flow before generation.
+
+To generate or regenerate code-specific rules later, with the same confirmation:
 
 ```bash
-node bin/vibereview.js guardrails generate
+npx @securityreviewai/vibereview-cli guardrails generate
 ```
 
+For explicitly authorized non-interactive use, pass `--yes`. Non-interactive initialization skips code-specific generation unless `--generate` is also supplied.
+
 Initialization also installs the local security workflow for the selected provider. Restart an already-running IDE agent after initialization so it reloads workspace instructions, skills, and hooks.
 
 Additional options:

package/dist/src/cli.js

@@ -10,12 +10,13 @@ Usage:
   vibereview guardrails generate [options]
 
 Commands:
-  init                 Detect the stack, generate guardrails, and install the IDE workflow
-  guardrails generate  Regenerate code-specific guardrails with the configured provider
+  init                 Detect the stack and install baseline guardrails and the IDE workflow
+  guardrails generate  Optionally generate code-specific guardrails with the configured provider
 
 Options:
   --provider <name>    cursor, codex, claude, or copilot
   --yes, -y            Accept defaults for non-interactive use
+  --generate           Generate code-specific guardrails during non-interactive init
   --force              Refresh managed files; preserve custom rules
   --json               Print machine-readable output
   --verbose            Show detection details and warnings
@@ -48,6 +49,7 @@ function parseInitOptions(args) {
         cwd: process.cwd(), provider: undefined, yes: false, force: false,
         skipPreflight: false, json: false, verbose: false,
         skipGeneration: false,
+        generate: false,
     };
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
@@ -63,6 +65,8 @@ function parseInitOptions(args) {
             options.skipPreflight = true;
         else if (arg === "--skip-generation")
             options.skipGeneration = true;
+        else if (arg === "--generate")
+            options.generate = true;
         else if (arg === "--json")
             options.json = true;
         else if (arg === "--verbose")
@@ -73,7 +77,7 @@ function parseInitOptions(args) {
     return options;
 }
 function parseGenerateOptions(args) {
-    const options = { cwd: process.cwd(), json: false, verbose: false, skipPreflight: false };
+    const options = { cwd: process.cwd(), json: false, verbose: false, skipPreflight: false, yes: false };
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (arg === "--cwd")
@@ -84,6 +88,8 @@ function parseGenerateOptions(args) {
             options.verbose = true;
         else if (arg === "--skip-preflight")
             options.skipPreflight = true;
+        else if (arg === "--yes" || arg === "-y")
+            options.yes = true;
         else
             throw new Error(`Unknown option ${JSON.stringify(arg)}. Run \`vibereview --help\`.`);
     }

package/dist/src/commands/generate.js

@@ -1,8 +1,10 @@
 import path from "node:path";
+import { confirm } from "@inquirer/prompts";
 import { generateCodeGuardrails } from "../core/generator.js";
 import { findRepositoryRoot } from "../core/repository.js";
 import { loadWorkspace, updateCodeSpecificGuardrails } from "../core/workspace.js";
-import { checkProviderPreflight, PROVIDER_NAMES } from "../providers/index.js";
+import { ensureProviderAuthentication, isProviderAuthenticationError, launchProviderAuthentication } from "../providers/auth.js";
+import { PROVIDER_NAMES } from "../providers/index.js";
 import { ui } from "../ui.js";
 export async function generateCommand(options) {
     const root = await findRepositoryRoot(options.cwd);
@@ -10,12 +12,35 @@ export async function generateCommand(options) {
     const provider = workspace.config.provider;
     if (!options.json)
         ui.title("VibeReview guardrail generation");
-    const preflight = options.skipPreflight ? undefined : await checkProviderPreflight(provider);
+    if (!options.yes) {
+        if (options.json || !process.stdin.isTTY || !process.stdout.isTTY) {
+            throw new Error("Code-specific generation requires confirmation. Re-run with `--yes` after accepting the provider token cost.");
+        }
+        ui.info("Code-specific guardrails are repository-specific security invariants derived from a bounded set of source files.");
+        ui.warning(`This runs ${PROVIDER_NAMES[provider]} and consumes tokens from your configured provider account.`);
+        const accepted = await confirm({ message: "Generate code-specific guardrails now?", default: false });
+        if (!accepted) {
+            ui.info("No changes made. Baseline guardrails remain active.");
+            return;
+        }
+    }
+    const preflight = options.skipPreflight ? undefined : await ensureProviderAuthentication(provider);
     if (!options.json) {
         ui.step(`${PROVIDER_NAMES[provider]} CLI detected${preflight ? ` (${preflight.version})` : " (preflight skipped)"}`);
         ui.info(`\nGenerating code-specific guardrails with ${PROVIDER_NAMES[provider]}...`);
     }
-    const result = await generateCodeGuardrails(provider, root, workspace.profile, workspace.guardrails.baseline);
+    let result;
+    try {
+        result = await generateCodeGuardrails(provider, root, workspace.profile, workspace.guardrails.baseline);
+    }
+    catch (error) {
+        if (options.skipPreflight || !isProviderAuthenticationError(error))
+            throw error;
+        if (!options.json)
+            ui.warning(`${PROVIDER_NAMES[provider]} requested authentication. Opening its login flow...`);
+        await launchProviderAuthentication(provider);
+        result = await generateCodeGuardrails(provider, root, workspace.profile, workspace.guardrails.baseline);
+    }
     const outputPath = await updateCodeSpecificGuardrails(root, workspace.guardrails, result.guardrails);
     if (options.json) {
         process.stdout.write(`${JSON.stringify({

package/dist/src/commands/init.js

@@ -1,16 +1,17 @@
 import path from "node:path";
 import { basename } from "node:path";
 import { access } from "node:fs/promises";
-import { select } from "@inquirer/prompts";
+import { confirm, select } from "@inquirer/prompts";
 import { loadCatalog } from "../core/catalog.js";
 import { detectTechnologyProfile } from "../core/detector.js";
 import { sha256, stableJson } from "../core/hash.js";
 import { matchGuardrails } from "../core/matcher.js";
 import { findRepositoryRoot } from "../core/repository.js";
-import { initializeWorkspace } from "../core/workspace.js";
+import { initializeWorkspace, loadWorkspace, updateCodeSpecificGuardrails } from "../core/workspace.js";
 import { generateCodeGuardrails } from "../core/generator.js";
 import { installProviderIntegration } from "../core/integration.js";
-import { checkProviderPreflight, isProvider, PROVIDER_NAMES, PROVIDERS } from "../providers/index.js";
+import { ensureProviderAuthentication, isProviderAuthenticationError, launchProviderAuthentication } from "../providers/auth.js";
+import { isProvider, PROVIDER_NAMES, PROVIDERS } from "../providers/index.js";
 import { ui } from "../ui.js";
 export async function initCommand(options) {
     const root = await findRepositoryRoot(options.cwd);
@@ -21,15 +22,7 @@ export async function initCommand(options) {
     if (!options.force && await exists(path.join(root, ".vibereview", "config.json"))) {
         throw new Error("VibeReview is already initialized. Re-run with `--force` to regenerate its managed files.");
     }
-    const preflight = options.skipPreflight ? undefined : await checkProviderPreflight(provider);
     if (!options.json) {
-        ui.step(`${PROVIDER_NAMES[provider]} CLI detected${preflight ? ` (${preflight.version})` : " (preflight skipped)"}`);
-        if (preflight) {
-            if (preflight.authentication === "deferred")
-                ui.warning(preflight.authenticationMessage);
-            else
-                ui.step(preflight.authenticationMessage);
-        }
         ui.info("\nAnalyzing workspace...");
     }
     const catalog = await loadCatalog();
@@ -50,13 +43,46 @@ export async function initCommand(options) {
                 ui.detail(`  No bundled pack: ${matches.unmatchedTechnologies.join(", ")}`);
         }
     }
+    const written = await initializeWorkspace({
+        root,
+        projectName,
+        provider,
+        profile,
+        guardrails: matches.guardrails,
+        catalogHash: sha256(stableJson(catalog)),
+        force: options.force,
+    });
+    const integrationFiles = await installProviderIntegration({ root, projectName, provider });
+    written.push(...integrationFiles);
+    if (!options.json)
+        ui.step("Installed baseline guardrails and local security workflow");
+    const generationRequested = await shouldGenerateCodeGuardrails(options, provider);
     let generation;
     let generationError;
-    if (!options.skipGeneration) {
+    if (generationRequested) {
         if (!options.json)
             ui.info(`\nGenerating code-specific guardrails with ${PROVIDER_NAMES[provider]}...`);
         try {
-            generation = await generateCodeGuardrails(provider, root, profile, matches.guardrails);
+            const preflight = options.skipPreflight ? undefined : await ensureProviderAuthentication(provider);
+            if (!options.json) {
+                ui.step(`${PROVIDER_NAMES[provider]} CLI detected${preflight ? ` (${preflight.version})` : " (preflight skipped)"}`);
+                if (preflight && preflight.authentication !== "deferred")
+                    ui.step(preflight.authenticationMessage);
+            }
+            try {
+                generation = await generateCodeGuardrails(provider, root, profile, matches.guardrails);
+            }
+            catch (error) {
+                if (options.skipPreflight || !isProviderAuthenticationError(error))
+                    throw error;
+                if (!options.json)
+                    ui.warning(`${PROVIDER_NAMES[provider]} requested authentication. Opening its login flow...`);
+                await launchProviderAuthentication(provider);
+                generation = await generateCodeGuardrails(provider, root, profile, matches.guardrails);
+            }
+            const workspace = await loadWorkspace(root);
+            const outputPath = await updateCodeSpecificGuardrails(root, workspace.guardrails, generation.guardrails);
+            written.push(outputPath);
             if (!options.json) {
                 ui.step(`Analyzed ${generation.evidence.files.length} security-relevant file${generation.evidence.files.length === 1 ? "" : "s"}`);
                 ui.step(`Generated ${generation.guardrails.length} code-specific guardrail${generation.guardrails.length === 1 ? "" : "s"}`);
@@ -67,26 +93,14 @@ export async function initCommand(options) {
         catch (error) {
             generationError = error instanceof Error ? error.message : String(error);
             if (!options.json) {
-                ui.warning("Code-specific generation failed; baseline guardrails will still be installed.");
+                ui.warning("Code-specific generation failed; installed baseline guardrails remain active.");
                 ui.detail(`  ${friendlyGenerationError(provider, generationError)}`);
                 if (options.verbose && friendlyGenerationError(provider, generationError) !== generationError)
                     ui.detail(`  Detail: ${generationError}`);
-                ui.detail("  Retry later with: vibereview guardrails generate");
+                ui.detail("  Retry later with: npx @securityreviewai/vibereview-cli guardrails generate");
             }
         }
     }
-    const written = await initializeWorkspace({
-        root,
-        projectName,
-        provider,
-        profile,
-        guardrails: matches.guardrails,
-        ...(generation ? { codeSpecific: generation.guardrails } : {}),
-        catalogHash: sha256(stableJson(catalog)),
-        force: options.force,
-    });
-    const integrationFiles = await installProviderIntegration({ root, projectName, provider });
-    written.push(...integrationFiles);
     if (options.json) {
         process.stdout.write(`${JSON.stringify({
             project_name: projectName,
@@ -95,7 +109,7 @@ export async function initCommand(options) {
             packs: matches.packs.map((p) => p.slug),
             baseline_guardrail_count: matches.guardrails.length,
             code_specific_guardrail_count: generation?.guardrails.length ?? 0,
-            generation_status: options.skipGeneration ? "skipped" : generation ? "completed" : "failed",
+            generation_status: !generationRequested ? "skipped" : generation ? "completed" : "failed",
             ...(generationError ? { generation_error: generationError } : {}),
             written,
         }, null, 2)}\n`);
@@ -108,6 +122,18 @@ export async function initCommand(options) {
     ui.detail(`Reports:    ${path.relative(root, path.join(root, ".vibereview", "reports"))}/*.md`);
     ui.info("\nVibeReview is ready. Restart the IDE agent if it is already running.\n");
 }
+async function shouldGenerateCodeGuardrails(options, provider) {
+    if (options.skipGeneration)
+        return false;
+    if (options.generate)
+        return true;
+    if (options.json || options.yes || !process.stdin.isTTY || !process.stdout.isTTY)
+        return false;
+    ui.info("\nOptional: generate code-specific guardrails from a bounded set of security-relevant source files.");
+    ui.info("These add repository-specific invariants on top of the installed baseline guardrails.");
+    ui.warning(`This runs ${PROVIDER_NAMES[provider]} and consumes tokens from your configured provider account.`);
+    return confirm({ message: "Generate code-specific guardrails now?", default: false });
+}
 async function exists(filePath) {
     try {
         await access(filePath);

package/dist/src/core/code-guardrails.js

@@ -60,9 +60,15 @@ function unwrapKnownWrapper(value) {
     if (isRecord(value.result))
         return value.result;
     if (typeof value.result === "string") {
-        const nested = tryJson(value.result.trim());
-        if (nested !== undefined)
-            return nested;
+        try {
+            return unwrapProviderOutput(value.result);
+        }
+        catch (error) {
+            if (error instanceof GuardrailOutputError) {
+                throw new GuardrailOutputError(`provider result contained ${value.result.length} characters but no valid guardrail JSON`);
+            }
+            throw error;
+        }
     }
     return value;
 }

package/dist/src/core/generation-prompt.js

@@ -30,6 +30,7 @@ export function buildGenerationPrompt(input) {
     if (input.repairError) {
         sections.push("<repair_request>", `Your previous response failed validation: ${input.repairError}`, "Return a corrected JSON object only.", "<previous_response>", (input.previousResponse ?? "").slice(0, 30_000), "</previous_response>", "</repair_request>");
     }
+    sections.push("<final_response_requirement>", "Return exactly one JSON object that conforms to the output contract.", "The first non-whitespace character must be { and the last must be }.", "Do not return a plan, explanation, acknowledgement, Markdown fence, or tool call.", "When no repository-specific rule qualifies, return a valid object with an empty guardrails array.", "</final_response_requirement>");
     return `${sections.join("\n")}\n`;
 }
 //# sourceMappingURL=generation-prompt.js.map

package/dist/src/providers/auth.js

@@ -0,0 +1,59 @@
+import { spawn } from "node:child_process";
+import { checkProviderPreflight, PROVIDER_NAMES } from "./index.js";
+const LOGIN_COMMANDS = {
+    cursor: { executable: "cursor-agent", args: ["login"] },
+    codex: { executable: "codex", args: ["login"] },
+    claude: { executable: "claude", args: ["auth", "login"] },
+    copilot: { executable: "copilot", args: ["login", "--web-flow"] },
+};
+export function providerLoginCommand(provider) {
+    const command = LOGIN_COMMANDS[provider];
+    return { executable: command.executable, args: [...command.args] };
+}
+export async function ensureProviderAuthentication(provider, dependencies = {}) {
+    const check = dependencies.check ?? checkProviderPreflight;
+    const launch = dependencies.launch ?? launchInteractive;
+    let preflight;
+    try {
+        preflight = await check(provider);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (/not found|could not be started/i.test(message))
+            throw error;
+        await launchProviderAuthentication(provider, launch);
+        return verifyAfterLogin(provider, check);
+    }
+    if (preflight.authentication !== "deferred")
+        return preflight;
+    await launchProviderAuthentication(provider, launch);
+    return verifyAfterLogin(provider, check);
+}
+export function isProviderAuthenticationError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /authentication required|not authenticated|not logged in|logged out|unauthenticated|no authentication information/i.test(message);
+}
+export async function launchProviderAuthentication(provider, launch = launchInteractive) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        const command = providerLoginCommand(provider);
+        throw new Error(`${PROVIDER_NAMES[provider]} authentication requires an interactive terminal. Run \`${[command.executable, ...command.args].join(" ")}\`, then retry.`);
+    }
+    const command = providerLoginCommand(provider);
+    await launch(command.executable, command.args);
+}
+async function verifyAfterLogin(provider, check) {
+    try {
+        return await check(provider);
+    }
+    catch (error) {
+        throw new Error(`${PROVIDER_NAMES[provider]} authentication did not complete successfully.`, { cause: error });
+    }
+}
+function launchInteractive(executable, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executable, args, { stdio: "inherit", env: process.env });
+        child.on("error", reject);
+        child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${executable} login exited with code ${code ?? "unknown"}.`)));
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/runners/cursor.js

@@ -2,7 +2,7 @@ import { executeAgent } from "./process.js";
 export function cursorArguments(input) {
     return [
         "-p",
-        "--mode", "plan",
+        "--mode", "ask",
         "--sandbox", "enabled",
         "--output-format", "json",
         "--workspace", input.temporaryDirectory,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/vibereview-cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Local-first security guardrails for AI coding agents.",
   "type": "module",
   "bin": {