@vibecheckai/cli 2.8.2 → 3.0.0

package/bin/runners/runFixPacks.js

@@ -0,0 +1,2 @@
+async function runFixPacks(args) { console.log("Fix packs not yet implemented"); return 0; }
+module.exports = { runFixPacks };

package/bin/runners/runGate.js

@@ -0,0 +1,17 @@
+// bin/runners/runGate.js
+// CI/CD gate command - wraps ship for pass/fail CI pipelines
+const { runShip } = require("./runShip");
+
+async function runGate(args) {
+  // Gate is essentially ship with strict exit codes for CI
+  // Pass through args to ship
+  const exitCode = await runShip([...args, "--ci"]);
+  
+  // Exit codes:
+  // 0 = SHIP (pass)
+  // 1 = WARN (pass by default, fail with --strict)
+  // 2 = BLOCK (fail)
+  return exitCode;
+}
+
+module.exports = { runGate };

package/bin/runners/runGraph.js

@@ -0,0 +1,283 @@
+/**
+ * vibecheck graph - Reality Proof Graph
+ * 
+ * Builds and visualizes the complete causal chain:
+ * UI action → client function → network call → server route → handler → DB/external
+ * 
+ * Identifies broken edges that indicate:
+ * - Routes referenced but don't exist
+ * - Routes that fail at runtime
+ * - UI showing success but server returning errors
+ */
+
+"use strict";
+
+const path = require("path");
+const fs = require("fs");
+const { buildTruthpack, loadTruthpack } = require("./lib/truth");
+const { 
+  extractStaticGraph, 
+  buildProofGraph, 
+  getFindingsFromGraph,
+  renderGraphHtml,
+  renderGraphMermaid,
+  generateFetchWrapper,
+  collectRequests,
+  buildRuntimeEdges,
+  mergeRuntimeResults
+} = require("./lib/graph");
+
+const c = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  cyan: '\x1b[36m',
+  red: '\x1b[31m',
+  blue: '\x1b[34m',
+};
+
+function ensureDir(p) {
+  fs.mkdirSync(p, { recursive: true });
+}
+
+async function runGraph(args) {
+  const opts = parseArgs(args);
+
+  if (opts.help) {
+    printHelp();
+    return 0;
+  }
+
+  const root = path.resolve(opts.path || process.cwd());
+  const outDir = path.join(root, ".vibecheck", "graph");
+  ensureDir(outDir);
+
+  console.log(`\n${c.cyan}${c.bold}🔍 vibecheck graph${c.reset}`);
+  console.log(`${c.dim}Building Reality Proof Graph...${c.reset}\n`);
+
+  // Load or build truthpack
+  let truthpack = loadTruthpack(root);
+  if (!truthpack) {
+    console.log(`${c.dim}Building truthpack...${c.reset}`);
+    truthpack = await buildTruthpack({ repoRoot: root, fastifyEntry: opts.fastifyEntry });
+  }
+
+  // Extract static graph
+  console.log(`${c.dim}Extracting static edges...${c.reset}`);
+  const staticData = await extractStaticGraph(root, truthpack);
+
+  // Build proof graph
+  let graph = buildProofGraph({
+    nodes: staticData.nodes,
+    edges: staticData.edges,
+    meta: { repoRoot: root }
+  });
+
+  // Runtime verification (optional)
+  if (opts.runtime && opts.url) {
+    console.log(`${c.dim}Collecting runtime edges from ${opts.url}...${c.reset}`);
+    
+    try {
+      const runtimeEdges = await collectRuntimeEdges(opts.url, graph, opts);
+      graph = mergeRuntimeResults(graph, runtimeEdges);
+    } catch (e) {
+      console.log(`${c.yellow}⚠️ Runtime collection failed: ${e.message}${c.reset}`);
+    }
+  }
+
+  // Get findings from broken edges
+  const findings = getFindingsFromGraph(graph);
+
+  // Write outputs
+  fs.writeFileSync(path.join(outDir, "graph.json"), JSON.stringify(graph, null, 2), "utf8");
+  
+  if (!opts.jsonOnly) {
+    const html = renderGraphHtml(graph);
+    fs.writeFileSync(path.join(outDir, "graph.html"), html, "utf8");
+    
+    const mermaid = renderGraphMermaid(graph);
+    fs.writeFileSync(path.join(outDir, "graph.mmd"), mermaid, "utf8");
+  }
+
+  if (findings.length > 0) {
+    fs.writeFileSync(path.join(outDir, "broken-edges.json"), JSON.stringify(findings, null, 2), "utf8");
+  }
+
+  // Print summary
+  console.log(`\n${c.bold}Graph Summary${c.reset}`);
+  console.log(`  Nodes: ${graph.nodes.length}`);
+  console.log(`  Valid edges: ${c.green}${graph.edges.length}${c.reset}`);
+  console.log(`  Broken edges: ${graph.brokenEdges.length > 0 ? c.red : c.green}${graph.brokenEdges.length}${c.reset}`);
+  console.log(`  Coverage: ${graph.coverage.percent}%`);
+
+  if (opts.broken || findings.length > 0) {
+    console.log(`\n${c.bold}Broken Edges${c.reset}`);
+    
+    if (findings.length === 0) {
+      console.log(`  ${c.green}✓ No broken edges found${c.reset}`);
+    } else {
+      for (const f of findings.slice(0, 10)) {
+        const icon = f.severity === "BLOCK" ? `${c.red}✗` : `${c.yellow}⚠`;
+        console.log(`  ${icon} ${f.title}${c.reset}`);
+      }
+      if (findings.length > 10) {
+        console.log(`  ${c.dim}... and ${findings.length - 10} more${c.reset}`);
+      }
+    }
+  }
+
+  console.log(`\n${c.bold}Output${c.reset}`);
+  console.log(`  ${c.dim}Graph:${c.reset} .vibecheck/graph/graph.json`);
+  if (!opts.jsonOnly) {
+    console.log(`  ${c.dim}Visualization:${c.reset} .vibecheck/graph/graph.html`);
+    console.log(`  ${c.dim}Mermaid:${c.reset} .vibecheck/graph/graph.mmd`);
+  }
+  if (findings.length > 0) {
+    console.log(`  ${c.dim}Broken edges:${c.reset} .vibecheck/graph/broken-edges.json`);
+  }
+
+  if (opts.view && !opts.jsonOnly) {
+    const htmlPath = path.join(outDir, "graph.html");
+    console.log(`\n${c.dim}Opening graph visualization...${c.reset}`);
+    
+    // Cross-platform open
+    const { exec } = require("child_process");
+    const cmd = process.platform === "win32" ? `start "" "${htmlPath}"` :
+                process.platform === "darwin" ? `open "${htmlPath}"` :
+                `xdg-open "${htmlPath}"`;
+    exec(cmd);
+  }
+
+  const blocks = findings.filter(f => f.severity === "BLOCK").length;
+  const warns = findings.filter(f => f.severity === "WARN").length;
+
+  console.log(`\n${c.bold}Verdict:${c.reset} ${blocks ? `${c.red}🛑 BLOCK${c.reset}` : warns ? `${c.yellow}⚠️ WARN${c.reset}` : `${c.green}✅ CLEAN${c.reset}`}`);
+
+  return blocks ? 2 : warns ? 1 : 0;
+}
+
+async function collectRuntimeEdges(url, staticGraph, opts) {
+  let chromium;
+  try {
+    chromium = require("playwright").chromium;
+  } catch {
+    throw new Error("Playwright not installed. Run: npm i -D playwright");
+  }
+
+  const browser = await chromium.launch({ headless: !opts.headed });
+  const context = await browser.newContext();
+  const page = await context.newPage();
+
+  // Inject fetch wrapper
+  await page.addInitScript(generateFetchWrapper());
+
+  // Navigate and interact
+  await page.goto(url, { waitUntil: "domcontentloaded" });
+  await page.waitForLoadState("networkidle", { timeout: 10000 }).catch(() => {});
+
+  // Click some interactive elements to trigger requests
+  const buttons = await page.locator("button, a[href^='/'], [role='button']").all();
+  for (const btn of buttons.slice(0, 10)) {
+    try {
+      await btn.click({ timeout: 1000 });
+      await page.waitForTimeout(500);
+    } catch {
+      // Ignore click failures
+    }
+  }
+
+  // Collect requests
+  const requests = await collectRequests(page);
+  
+  await browser.close();
+
+  // Build runtime edges
+  return buildRuntimeEdges(requests, staticGraph);
+}
+
+function parseArgs(args) {
+  const opts = {
+    path: process.cwd(),
+    url: null,
+    runtime: false,
+    view: false,
+    broken: false,
+    jsonOnly: false,
+    headed: false,
+    fastifyEntry: null,
+    help: false,
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--build") continue; // Default behavior
+    else if (arg === "--runtime") opts.runtime = true;
+    else if (arg === "--url") opts.url = args[++i];
+    else if (arg === "--view") opts.view = true;
+    else if (arg === "--broken") opts.broken = true;
+    else if (arg === "--json") opts.jsonOnly = true;
+    else if (arg === "--headed") opts.headed = true;
+    else if (arg === "--fastify-entry") opts.fastifyEntry = args[++i];
+    else if (arg === "--path" || arg === "-p") opts.path = args[++i];
+    else if (arg === "--help" || arg === "-h") opts.help = true;
+  }
+
+  return opts;
+}
+
+function printHelp() {
+  console.log(`
+${c.cyan}${c.bold}🔍 vibecheck graph${c.reset} - Reality Proof Graph
+
+Build and visualize the complete causal chain from UI to database.
+Identify broken edges that indicate missing routes, runtime failures, or causal contradictions.
+
+${c.bold}USAGE${c.reset}
+  vibecheck graph                              ${c.dim}# Build static graph${c.reset}
+  vibecheck graph --runtime --url http://...   ${c.dim}# Add runtime edges${c.reset}
+  vibecheck graph --view                       ${c.dim}# Open visualization${c.reset}
+  vibecheck graph --broken                     ${c.dim}# List broken edges${c.reset}
+
+${c.bold}OPTIONS${c.reset}
+  --build              Build static graph (default)
+  --runtime            Collect runtime edges via Playwright
+  --url <url>          Target URL for runtime collection
+  --view               Open interactive HTML visualization
+  --broken             Show only broken edges
+  --json               Output JSON only (no HTML/Mermaid)
+  --headed             Run browser in headed mode
+  --fastify-entry      Fastify entry file (e.g. src/server.ts)
+  --path, -p           Project path (default: current directory)
+  --help, -h           Show this help
+
+${c.bold}GRAPH NODES${c.reset}
+  • UI Action          onClick, onSubmit, etc.
+  • Client Function    Functions that make network calls
+  • Network Call       fetch(), axios.*()
+  • Server Route       Next API routes, Fastify routes
+  • Handler            Route handler functions
+  • DB Call            Prisma, raw SQL
+  • External Call      Stripe, GitHub, etc.
+
+${c.bold}BROKEN EDGE TYPES${c.reset}
+  • ${c.red}MissingRoute${c.reset}        Route referenced but doesn't exist
+  • ${c.red}RuntimeFailure${c.reset}      Route returns 4xx/5xx at runtime
+  • ${c.red}CausalContradiction${c.reset} UI shows success but server returned error
+
+${c.bold}OUTPUT${c.reset}
+  .vibecheck/graph/
+    graph.json          Machine-readable graph
+    graph.html          Interactive D3 visualization
+    graph.mmd           Mermaid diagram
+    broken-edges.json   Broken edges as findings
+
+${c.bold}EXAMPLES${c.reset}
+  vibecheck graph --view                           ${c.dim}# Build + open visualization${c.reset}
+  vibecheck graph --runtime --url http://localhost:3000 --view
+  vibecheck graph --broken --json                  ${c.dim}# CI mode: just broken edges${c.reset}
+`);
+}
+
+module.exports = { runGraph };

package/bin/runners/runInit.js

@@ -0,0 +1,260 @@
+const fs = require("fs");
+const path = require("path");
+
+// Use enhanced wizard if available
+let InitWizard;
+try {
+  InitWizard = require("./lib/init-wizard").InitWizard;
+} catch {
+  InitWizard = null;
+}
+
+// Enterprise init
+let EnterpriseInit;
+try {
+  EnterpriseInit = require("./lib/enterprise-init").EnterpriseInit;
+} catch {
+  EnterpriseInit = null;
+}
+
+function parseArgs(args) {
+  const out = {
+    path: ".",
+    gitHooks: false,
+    help: false,
+    quick: false,
+    // Enterprise options
+    enterprise: false,
+    ci: false, // true or "github" | "gitlab"
+    compliance: false, // true or "soc2" | "hipaa" | "gdpr" | "pci"
+    team: false,
+    mcp: false,
+    strict: false,
+    failOnWarn: false,
+    detect: false, // Just detect, don't write
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--path=")) out.path = a.split("=")[1];
+    if (a === "--path" || a === "-p") out.path = args[++i];
+    if (a === "--git-hooks") out.gitHooks = true;
+    if (a === "--help" || a === "-h") out.help = true;
+    if (a === "--quick" || a === "-q") out.quick = true;
+    
+    // Enterprise flags
+    if (a === "--enterprise" || a === "-e") out.enterprise = true;
+    if (a === "--ci") {
+      const next = args[i + 1];
+      if (next && !next.startsWith("-")) {
+        out.ci = args[++i];
+      } else {
+        out.ci = true;
+      }
+    }
+    if (a === "--gha" || a === "--github-actions") out.ci = "github";
+    if (a === "--gitlab") out.ci = "gitlab";
+    if (a === "--compliance") {
+      const next = args[i + 1];
+      if (next && !next.startsWith("-")) {
+        out.compliance = args[++i];
+      } else {
+        out.compliance = true;
+      }
+    }
+    if (a === "--soc2") out.compliance = "soc2";
+    if (a === "--hipaa") out.compliance = "hipaa";
+    if (a === "--gdpr") out.compliance = "gdpr";
+    if (a === "--pci") out.compliance = "pci";
+    if (a === "--team") out.team = true;
+    if (a === "--mcp") out.mcp = true;
+    if (a === "--strict") out.strict = true;
+    if (a === "--fail-on-warn") out.failOnWarn = true;
+    if (a === "--detect") out.detect = true;
+    if (a === "--full") {
+      out.enterprise = true;
+      out.ci = true;
+      out.team = true;
+      out.mcp = true;
+    }
+  }
+  return out;
+}
+
+async function runInit(args) {
+  const opts = parseArgs(args);
+  
+  if (opts.help) {
+    printHelp();
+    return 0;
+  }
+
+  const targetDir = path.resolve(opts.path);
+
+  // Enterprise mode - comprehensive setup
+  const useEnterprise = opts.enterprise || opts.ci || opts.compliance || 
+                        opts.team || opts.mcp || opts.detect || opts.full;
+  
+  if (EnterpriseInit && useEnterprise) {
+    const enterprise = new EnterpriseInit(targetDir, opts);
+    return await enterprise.run();
+  }
+
+  // Detect-only mode (quick detection report)
+  if (opts.detect) {
+    const { detectAll } = require("./lib/enterprise-detect");
+    const detection = detectAll(targetDir);
+    console.log(JSON.stringify(detection, null, 2));
+    return 0;
+  }
+
+  // Use wizard for interactive setup (unless --quick)
+  if (InitWizard && !opts.quick) {
+    const wizard = new InitWizard(targetDir, opts);
+    return await wizard.run();
+  }
+
+  // Quick mode - legacy behavior
+  console.log("\n  🚀 vibecheck INIT\n");
+
+  // Create config file
+  const configPath = path.join(targetDir, ".vibecheckrc");
+  if (!fs.existsSync(configPath)) {
+    const defaultConfig = {
+      version: "1.0.0",
+      checks: ["integrity"],
+      output: ".vibecheck",
+      policy: {
+        allowlist: { domains: [], packages: [] },
+        ignore: { paths: ["node_modules", "__tests__", "*.test.*"] },
+      },
+    };
+    fs.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2));
+    console.log("  ✅ Created .vibecheckrc");
+  } else {
+    console.log("  ⚠️ .vibecheckrc already exists");
+  }
+
+  // Create output directory
+  const outputDir = path.join(targetDir, ".vibecheck");
+  if (!fs.existsSync(outputDir)) {
+    fs.mkdirSync(outputDir, { recursive: true });
+    console.log("  ✅ Created .vibecheck/");
+  }
+
+  // Install git hooks if requested
+  if (opts.gitHooks) {
+    const huskyDir = path.join(targetDir, ".husky");
+    if (!fs.existsSync(huskyDir)) {
+      fs.mkdirSync(huskyDir, { recursive: true });
+    }
+
+    const prePushHook = `#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+echo "🚦 Running vibecheck gate..."
+npx vibecheck gate
+
+if [ $? -ne 0 ]; then
+  echo "❌ Push blocked: Gate failed!"
+  exit 1
+fi
+`;
+    fs.writeFileSync(path.join(huskyDir, "pre-push"), prePushHook, {
+      mode: 0o755,
+    });
+    console.log("  ✅ Installed git pre-push hook");
+  }
+
+  // Add to .gitignore
+  const gitignorePath = path.join(targetDir, ".gitignore");
+  if (fs.existsSync(gitignorePath)) {
+    let gitignore = fs.readFileSync(gitignorePath, "utf-8");
+    if (!gitignore.includes(".vibecheck/")) {
+      gitignore += "\n# vibecheck\n.vibecheck/\n";
+      fs.writeFileSync(gitignorePath, gitignore);
+      console.log("  ✅ Added .vibecheck/ to .gitignore");
+    }
+  }
+
+  console.log("\n  ✅ vibecheck initialized!\n");
+  console.log("  Next steps:");
+  console.log("    1. Run: vibecheck scan");
+  console.log("    2. Review: .vibecheck/report.html");
+  console.log("    3. Fix issues and re-scan\n");
+
+  return 0;
+}
+
+function printHelp() {
+  console.log(`
+\x1b[1m\x1b[36m⚡ vibecheck init\x1b[0m — Enterprise Project Setup
+
+\x1b[2mConfigure your project for production-grade verification.\x1b[0m
+
+\x1b[1mUSAGE\x1b[0m
+  vibecheck init                    Interactive setup wizard
+  vibecheck init --enterprise       Full enterprise configuration
+  vibecheck init --full             Everything: CI, team, MCP, security
+
+\x1b[1mBASIC OPTIONS\x1b[0m
+  --path, -p <dir>     Project path (default: current directory)
+  --quick, -q          Skip wizard, use defaults
+  --git-hooks          Install git pre-push hook
+  --help, -h           Show this help
+
+\x1b[1m\x1b[35mENTERPRISE OPTIONS\x1b[0m
+  --enterprise, -e     Enable enterprise mode (detection + config)
+  --full               All enterprise features (CI + team + MCP)
+  --detect             Detection only (JSON output, no writes)
+
+\x1b[1m\x1b[33mCI/CD INTEGRATION\x1b[0m
+  --ci [provider]      Setup CI/CD (auto-detects if no provider)
+  --gha                GitHub Actions workflow
+  --gitlab             GitLab CI configuration
+  --fail-on-warn       CI fails on WARN (default: only BLOCK)
+
+\x1b[1m\x1b[32mCOMPLIANCE TEMPLATES\x1b[0m
+  --compliance [type]  Generate compliance templates
+  --soc2               SOC 2 Type II baseline
+  --hipaa              HIPAA compliance baseline
+  --gdpr               GDPR compliance baseline
+  --pci                PCI-DSS compliance baseline
+
+\x1b[1m\x1b[34mTEAM & SECURITY\x1b[0m
+  --team               Generate team configuration (multi-env)
+  --mcp                Generate MCP server config (AI agents)
+  --strict             Enable strict mode (zero tolerance)
+
+\x1b[1mCREATED FILES\x1b[0m
+  .vibecheck/config.json           Main configuration
+  .vibecheck/invariants.yml        Ship killers & warnings
+  .vibecheck/security-policy.json  Security headers, CORS, rate limits
+  .vibecheck/schemas/              JSON validation schemas
+  .vibecheck/team.json             Team/environment config (--team)
+  .vibecheck/mcp.json              MCP server config (--mcp)
+  .vibecheck/compliance/           Compliance templates (--compliance)
+  .github/workflows/vibecheck.yml  GitHub Actions (--gha)
+
+\x1b[1mEXAMPLES\x1b[0m
+  vibecheck init                         # Interactive wizard
+  vibecheck init --enterprise            # Enterprise config
+  vibecheck init --full                  # Everything
+  vibecheck init --gha                   # + GitHub Actions
+  vibecheck init --gha --fail-on-warn    # Strict CI
+  vibecheck init --soc2                  # + SOC 2 compliance
+  vibecheck init --enterprise --team     # + Team environments
+  vibecheck init --detect                # Detection report only
+
+\x1b[1mDETECTION INCLUDES\x1b[0m
+  Frameworks    Next.js, Remix, Nuxt, SvelteKit, React, Vue, Fastify, Express, NestJS, Hono
+  Databases     Prisma, Drizzle, Mongoose, Supabase, Firebase, Redis
+  Auth          NextAuth, Clerk, Auth0, Lucia, Passport
+  Payments      Stripe, Lemon Squeezy, Paddle
+  CI/CD         GitHub Actions, GitLab CI, CircleCI, Jenkins
+  Deploy        Vercel, Netlify, Railway, Render, Fly.io, Docker, Kubernetes
+  Testing       Jest, Vitest, Playwright, Cypress
+`);
+}
+
+module.exports = { runInit };

package/bin/runners/runInitGha.js

@@ -0,0 +1,101 @@
+// bin/runners/runInitGha.js
+const fs = require("fs");
+const path = require("path");
+
+function ensureDir(p) {
+  fs.mkdirSync(p, { recursive: true });
+}
+
+function workflowYaml({ packageRunner = "npx vibecheck", failOnWarn = false } = {}) {
+  return `name: vibecheck
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  vibecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps (auto)
+        run: |
+          set -e
+          if [ -f pnpm-lock.yaml ]; then
+            corepack enable
+            pnpm install --frozen-lockfile
+          elif [ -f package-lock.json ]; then
+            npm ci
+          elif [ -f yarn.lock ]; then
+            corepack enable
+            yarn install --frozen-lockfile
+          else
+            npm install
+          fi
+
+      - name: vibecheck pr (generate comment)
+        id: vc
+        run: |
+          set +e
+          mkdir -p .vibecheck
+          ${packageRunner} pr --out .vibecheck/pr_comment.md ${failOnWarn ? "--fail-on-warn" : ""}
+          code=$?
+          echo "code=$code" >> $GITHUB_OUTPUT
+          echo "---- vibecheck exit code: $code ----"
+          exit 0
+
+      - name: Post PR comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const body = fs.readFileSync('.vibecheck/pr_comment.md', 'utf8');
+            const pr = context.payload.pull_request;
+            if (!pr) { core.warning('No pull_request in context; skipping comment'); return; }
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              body
+            });
+
+      - name: Enforce verdict
+        run: |
+          code="\${{ steps.vc.outputs.code }}"
+          echo "vibecheck code=$code"
+          if [ "$code" = "0" ]; then
+            echo "SHIP/WARN allowed."
+            exit 0
+          fi
+          if [ "$code" = "1" ]; then
+            echo "WARN failing (policy)."
+            exit 1
+          fi
+          echo "BLOCK failing."
+          exit 1
+`;
+}
+
+async function runInitGha({ repoRoot, failOnWarn = false } = {}) {
+  const root = repoRoot || process.cwd();
+  const wfDir = path.join(root, ".github", "workflows");
+  ensureDir(wfDir);
+
+  const wfPath = path.join(wfDir, "vibecheck.yml");
+  fs.writeFileSync(wfPath, workflowYaml({ failOnWarn }), "utf8");
+
+  console.log(`✅ Wrote: ${path.relative(root, wfPath).replace(/\\/g, "/")}`);
+  console.log(`\nNotes:`);
+  console.log(`- If your CLI isn't called via "npx vibecheck", edit the workflow line.`);
+  console.log(`- Set VIBECHECK_API_KEY as a GitHub Actions secret for cloud features.`);
+}
+
+module.exports = { runInitGha };