@vibefoundry/vibe-shield 1.1.0 → 1.1.1

package/README.md

@@ -8,8 +8,8 @@ Your agent ships fast. It also ships `NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY`, a
 
 vibe-shield is a **static security scanner built for that failure mode**, plus an **Agent Skill** that makes Claude Code, Codex, Cursor and Windsurf audit before they say *"done"*.
 
-[![version](https://img.shields.io/github/package-json/v/avivgerz-hue/vibe-shield?style=flat-square&label=version&color=cb3837)](https://github.com/avivgerz-hue/vibe-shield/blob/main/package.json)
-[![install](https://img.shields.io/badge/install-github%3Aavivgerz--hue%2Fvibe--shield-cb3837?style=flat-square&logo=npm)](#-quick-start)
+[![npm version](https://img.shields.io/npm/v/@vibefoundry/vibe-shield.svg)](https://www.npmjs.com/package/@vibefoundry/vibe-shield)
+[![npm downloads](https://img.shields.io/npm/dm/@vibefoundry/vibe-shield.svg)](https://www.npmjs.com/package/@vibefoundry/vibe-shield)
 [![CI](https://img.shields.io/github/actions/workflow/status/avivgerz-hue/vibe-shield/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI)](https://github.com/avivgerz-hue/vibe-shield/actions/workflows/ci.yml)
 [![node](https://img.shields.io/badge/node-%E2%89%A518.17.0-5fa04e?style=flat-square&logo=nodedotjs)](#-requirements)
 [![license](https://img.shields.io/github/license/avivgerz-hue/vibe-shield?style=flat-square&color=blue)](./LICENSE)
@@ -18,7 +18,7 @@ vibe-shield is a **static security scanner built for that failure mode**, plus a
 [![self-scan](https://img.shields.io/badge/self--scan-100%2F100%20A%2B-16a34a?style=flat-square)](#-it-scans-itself)
 
 ```bash
-npx github:avivgerz-hue/vibe-shield scan
+npx -y @vibefoundry/vibe-shield scan
 ```
 
 ![vibe-shield terminal preview](./assets/hero-terminal.svg)
@@ -42,7 +42,7 @@ export async function DELETE(req: Request) {
 
 It works. It also has **three critical vulnerabilities** — no authentication, SQL injection, and an IDOR that lets the caller choose whose data they delete. Nothing in a normal review loop catches all three, and the agent reported the task as complete.
 
-`npx github:avivgerz-hue/vibe-shield scan` catches all three in **17 milliseconds**:
+`npx -y @vibefoundry/vibe-shield scan` catches all three in **17 milliseconds**:
 
 ```
 🛡️  vibe-shield v1.0.0 · security scan
@@ -64,15 +64,15 @@ app/api/users/route.ts
   7 files  ·  1 KiB  ·  412 files/s  ·  17 ms  ·  48 rules
 
   ⚠  3 critical findings — rotate any exposed credential before anything else.
-  Fix it      npx github:avivgerz-hue/vibe-shield scan --fix-prompt    # writes SECURITY_PATCH_PROMPT.md for your agent
-  Explain     npx github:avivgerz-hue/vibe-shield explain VSB-AUTH-001
-  Gate CI     npx github:avivgerz-hue/vibe-shield scan --fail-on critical --format github
+  Fix it      npx -y @vibefoundry/vibe-shield scan --fix-prompt    # writes SECURITY_PATCH_PROMPT.md for your agent
+  Explain     npx -y @vibefoundry/vibe-shield explain VSB-AUTH-001
+  Gate CI     npx -y @vibefoundry/vibe-shield scan --fail-on critical --format github
 ```
 
 Then hand the fix list to the agent that wrote the bug:
 
 ```bash
-npx github:avivgerz-hue/vibe-shield scan --fix-prompt   # → SECURITY_PATCH_PROMPT.md
+npx -y @vibefoundry/vibe-shield scan --fix-prompt   # → SECURITY_PATCH_PROMPT.md
 ```
 
 That file contains, for every finding: the severity, the CWE id and link, the exact `file:line`, the vulnerable snippet, the ordered remediation steps, the target code shape, and a verification command. It is written for a machine to execute and a human to audit.
@@ -83,22 +83,23 @@ That file contains, for every finding: the severity, the CWE id and link, the ex
 
 ```bash
 # 1. Scan (no install, no config, no network calls)
-npx github:avivgerz-hue/vibe-shield scan
+npx -y @vibefoundry/vibe-shield scan
 
 # 2. Give your agent the fix list
-npx github:avivgerz-hue/vibe-shield scan --fix-prompt
+npx -y @vibefoundry/vibe-shield scan --fix-prompt
 
 # 3. Install the gate permanently — skill + CI + ignore file
-npx github:avivgerz-hue/vibe-shield init
+npx -y @vibefoundry/vibe-shield init
 ```
 
-> **Why GitHub and not `npx vibe-shield`?** The name `vibe-shield` on the npm
-> registry belongs to a different project with no connection to this one. Running
-> `npx vibe-shield` installs *their* package, not this repository's. Install from
-> GitHub — the compiled CLI is committed, so it needs **no TypeScript** and starts
-> in milliseconds. A scoped npm release (`@vibefoundry/vibe-shield`) may follow.
+> **Use the scoped name.** vibe-shield is published as
+> [`@vibefoundry/vibe-shield`](https://www.npmjs.com/package/@vibefoundry/vibe-shield).
+> The *unscoped* name `vibe-shield` on npm belongs to an unrelated project, so
+> `npx vibe-shield` runs someone else's code. Always include the `@vibefoundry/`
+> scope. The package ships a prebuilt `dist/`, needs **no TypeScript**, and
+> starts in milliseconds.
 
-`npx github:avivgerz-hue/vibe-shield init` writes:
+`npx -y @vibefoundry/vibe-shield init` writes:
 
 | File | What it does |
 | --- | --- |
@@ -131,7 +132,7 @@ vibe-shield encodes those specific shapes: 60 signatures across five families, e
 
 ## 📊 Vulnerability Coverage Matrix
 
-**48 code signatures + 12 agent-integrity signatures = 60.** Every rule has an id, a CWE, a vulnerable example, a fixed example, and ordered remediation steps — run `npx github:avivgerz-hue/vibe-shield rules` or `npx github:avivgerz-hue/vibe-shield explain <ID>`.
+**48 code signatures + 12 agent-integrity signatures = 60.** Every rule has an id, a CWE, a vulnerable example, a fixed example, and ordered remediation steps — run `npx -y @vibefoundry/vibe-shield rules` or `npx -y @vibefoundry/vibe-shield explain <ID>`.
 
 ### Client-side secret & data exposure — `VSB-CLIENT-*`
 
@@ -234,7 +235,8 @@ Claude Code, Claude Desktop, Cursor and Codex can call the scanner as a tool
 instead of shelling out and parsing console output.
 
 ```bash
-npx github:avivgerz-hue/vibe-shield mcp          # JSON-RPC 2.0 over stdio
+npx -y @vibefoundry/vibe-shield mcp          # JSON-RPC 2.0 over stdio
+npx -y @vibefoundry/vibe-shield --mcp        # same thing, if your client prefers a flag
 ```
 
 Three tools:
@@ -245,22 +247,26 @@ Three tools:
 | `vibe_shield_audit_skills` | Audits `.claude/skills`, `.cursor` rules, `AGENTS.md` and MCP configs for prompt injection and exfiltration traps |
 | `vibe_shield_explain_rule` | Full CWE detail, vulnerable/fixed examples and remediation for any rule id or slug |
 
-`npx github:avivgerz-hue/vibe-shield init` writes the config for you, merging into `.mcp.json`
+`npx -y @vibefoundry/vibe-shield init` writes the config for you, merging into `.mcp.json`
 **without clobbering** servers you already have:
 
 ```jsonc
 {
   "mcpServers": {
     "github": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"] },
-    "vibe-shield": { "command": "npx", "args": ["--yes", "github:avivgerz-hue/vibe-shield", "mcp"] }
+    "vibe-shield": { "command": "npx", "args": ["--yes", "@vibefoundry/vibe-shield@1.1.0", "mcp"] }
   }
 }
 ```
 
+The version pin is not cosmetic: an unpinned `npx -y` server is exactly what
+`VSB-AGENT-004` flags as high severity, so vibe-shield's own audit would write
+itself a finding. `init` pins the running version automatically.
+
 Or add it by hand:
 
 ```bash
-claude mcp add vibe-shield -- npx --yes github:avivgerz-hue/vibe-shield mcp
+claude mcp add vibe-shield -- npx -y @vibefoundry/vibe-shield mcp
 ```
 
 The server is zero-dependency, writes **only** JSON-RPC to stdout, honours
@@ -275,15 +281,15 @@ a scanner that says "clean" when it read nothing is worse than no scanner.
 
 ## 🤖 Use it as an Agent Skill
 
-`npx github:avivgerz-hue/vibe-shield init` installs the skill. Once it is in a repository, every
+`npx -y @vibefoundry/vibe-shield init` installs the skill. Once it is in a repository, every
 agent session starts with a contract:
 
 > You are not allowed to say "done" until the code you just wrote passes a security audit.
 
 ```bash
-npx github:avivgerz-hue/vibe-shield init                 # Claude Code + Cursor + AGENTS.md + CI
-npx github:avivgerz-hue/vibe-shield init --agent claude  # just the skill
-npx github:avivgerz-hue/vibe-shield init --no-workflow   # skip the GitHub Action
+npx -y @vibefoundry/vibe-shield init                 # Claude Code + Cursor + AGENTS.md + CI
+npx -y @vibefoundry/vibe-shield init --agent claude  # just the skill
+npx -y @vibefoundry/vibe-shield init --no-workflow   # skip the GitHub Action
 ```
 
 **Why this works better than a prompt snippet:** it names the three commands, gives the agent a reading guide for a finding (`line:col`, rule id, message, CWE), states five hard rules (never suppress, never weaken, always rotate, report honestly, re-verify), and defines "done" as an exit code rather than an opinion.
@@ -294,7 +300,7 @@ The skill itself is [SKILL.md](./SKILL.md) — read it, it is short.
 
 ```bash
 # marketplace-style install
-npx github:avivgerz-hue/vibe-shield init --agent claude
+npx -y @vibefoundry/vibe-shield init --agent claude
 # → .claude/skills/vibe-shield/SKILL.md
 
 # or globally, for every project
@@ -308,7 +314,7 @@ curl -sL https://raw.githubusercontent.com/avivgerz-hue/vibe-shield/main/SKILL.m
 
 ### GitHub Actions (recommended)
 
-`npx github:avivgerz-hue/vibe-shield init` installs a workflow that runs the scan, uploads SARIF to
+`npx -y @vibefoundry/vibe-shield init` installs a workflow that runs the scan, uploads SARIF to
 code scanning, audits the agent surface, and fails the job:
 
 ```yaml
@@ -329,7 +335,7 @@ jobs:
           node-version: 20
 
       - name: Scan and upload SARIF
-        run: npx --yes github:avivgerz-hue/vibe-shield scan --format sarif --out vibe-shield.sarif --fail-on high
+        run: npx -y @vibefoundry/vibe-shield scan --format sarif --out vibe-shield.sarif --fail-on high
         continue-on-error: true
 
       - uses: github/codeql-action/upload-sarif@v3
@@ -339,7 +345,7 @@ jobs:
           category: vibe-shield
 
       - name: Enforce the gate
-        run: npx --yes github:avivgerz-hue/vibe-shield scan --fail-on high
+        run: npx -y @vibefoundry/vibe-shield scan --fail-on high
 ```
 
 Findings appear **inline on the pull request diff** (GitHub annotations) and in
@@ -349,11 +355,11 @@ on the line that introduced it.
 ### Any other CI
 
 ```bash
-npx github:avivgerz-hue/vibe-shield scan --fail-on high                         # exit 1 on findings
-npx github:avivgerz-hue/vibe-shield scan --format compact                       # one line per finding
-npx github:avivgerz-hue/vibe-shield scan --format json > vibe-shield.json       # full report
-npx github:avivgerz-hue/vibe-shield scan --format summary                       # JSON, counts + grade only
-npx github:avivgerz-hue/vibe-shield scan --format github                        # workflow annotations
+npx -y @vibefoundry/vibe-shield scan --fail-on high                         # exit 1 on findings
+npx -y @vibefoundry/vibe-shield scan --format compact                       # one line per finding
+npx -y @vibefoundry/vibe-shield scan --format json > vibe-shield.json       # full report
+npx -y @vibefoundry/vibe-shield scan --format summary                       # JSON, counts + grade only
+npx -y @vibefoundry/vibe-shield scan --format github                        # workflow annotations
 ```
 
 Exit codes: **0** clean · **1** findings at/above `--fail-on` · **2** usage error
@@ -385,7 +391,7 @@ Penalties per finding: critical −30, high −12, medium −5, low −2, info
 This repository runs its own gate on every commit and in CI:
 
 ```console
-$ npx github:avivgerz-hue/vibe-shield scan
+$ npx -y @vibefoundry/vibe-shield scan
 🛡️  vibe-shield v1.0.0 · security scan
 target  /you/vibe-shield
 
@@ -395,7 +401,7 @@ target  /you/vibe-shield
 
   Nothing to fix. Keep the shield up. 🛡️
 
-$ npx github:avivgerz-hue/vibe-shield audit-skills
+$ npx -y @vibefoundry/vibe-shield audit-skills
 🏆 GRADE A+ — 100/100
 
   1 file  ·  6 KiB  ·  14 files/s  ·  69 ms  ·  12 rules
@@ -447,7 +453,7 @@ Suppressed findings are **counted and reported** in the scorecard, never silentl
 2. **Honest.** Every finding carries the exact snippet the developer wrote. Nothing is inferred from a filename alone, and every suppression is counted, not hidden.
 3. **Composable.** `scanProject()` for the CLI, `runRulesOnFile()` for the auditor, `scoreFindings()` for anything that produces findings. The whole API is exported from `vibe-shield`.
 
-**Zero runtime dependencies.** No network calls, no telemetry, no language server, no native binaries. `npx github:avivgerz-hue/vibe-shield scan` works offline and in an air-gapped CI runner.
+**Zero runtime dependencies.** No network calls, no telemetry, no language server, no native binaries. `npx -y @vibefoundry/vibe-shield scan` works offline and in an air-gapped CI runner.
 
 ---
 
@@ -567,5 +573,5 @@ Three tools for the same problem: agents move fast, and something has to keep th
 | 👻 | **[ghost-qa](https://github.com/avivgerz-hue/ghost-qa)** | Autonomous headless-browser QA & self-healing verification loop — stops agents from claiming a UI works when it does not |
 
 ```bash
-npx github:avivgerz-hue/vibe-shield init   # security gate
+npx -y @vibefoundry/vibe-shield init   # security gate
 ```

package/SECURITY.md

@@ -14,7 +14,7 @@
 Email **security@vibefoundry.dev** with:
 
 - a description of the issue and its impact
-- the affected version (`npx github:avivgerz-hue/vibe-shield version`)
+- the affected version (`npx -y @vibefoundry/vibe-shield version`)
 - a minimal reproduction (a snippet, a repository, or a failing test)
 - whether you intend to publish, and any deadline you are working to
 

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: vibe-shield
 description: Audit any change for AI-introduced security bugs (leaked keys, unguarded API routes, disabled Row Level Security, SQL injection, prompt injection, poisoned MCP servers) and fix them before reporting a task as done. Use whenever you write or modify application code, API routes, server actions, database migrations, auth logic, environment variables, LLM calls, webhook handlers, agent skills or MCP configuration.
-allowed-tools: Bash(npx github:avivgerz-hue/vibe-shield scan*), Bash(npx github:avivgerz-hue/vibe-shield audit-skills*), Bash(npx github:avivgerz-hue/vibe-shield explain*), Read(./**), Grep, Glob
+allowed-tools: Bash(npx -y @vibefoundry/vibe-shield scan*), Bash(npx -y @vibefoundry/vibe-shield audit-skills*), Bash(npx -y @vibefoundry/vibe-shield explain*), Read(./**), Grep, Glob
 license: MIT
 metadata:
   author: VibeFoundry
@@ -32,17 +32,17 @@ If you did not touch any of those, you do not need to run it.
 
 ```bash
 # 1. Scan (a whole-repo scan finishes in well under a second)
-npx github:avivgerz-hue/vibe-shield scan --fail-on high
+npx -y @vibefoundry/vibe-shield scan --fail-on high
 
 # 2. If it fails, generate the machine-readable fix list
-npx github:avivgerz-hue/vibe-shield scan --fix-prompt
+npx -y @vibefoundry/vibe-shield scan --fix-prompt
 
 # 3. Read SECURITY_PATCH_PROMPT.md and fix every finding, critical first
 #    Each entry has the exact file:line, the vulnerable snippet, the CWE and
 #    the required change. Apply it literally.
 
 # 4. Re-run until it exits 0
-npx github:avivgerz-hue/vibe-shield scan --fail-on high
+npx -y @vibefoundry/vibe-shield scan --fail-on high
 ```
 
 `--fail-on high` exits non-zero while any high or critical finding exists. That is the gate.
@@ -61,7 +61,7 @@ CRITICAL 47:15    VSB-CLIENT-001  Server-only secret exposed through a public en
 | message | why this specific line is exploitable |
 | `(CWE-200)` | bug class, for a deeper search if the fix is unclear |
 
-Need the full picture? `npx github:avivgerz-hue/vibe-shield explain VSB-CLIENT-001` prints the vulnerable shape, the fixed shape, remediation steps and references.
+Need the full picture? `npx -y @vibefoundry/vibe-shield explain VSB-CLIENT-001` prints the vulnerable shape, the fixed shape, remediation steps and references.
 
 ## Hard rules
 
@@ -76,7 +76,7 @@ Need the full picture? `npx github:avivgerz-hue/vibe-shield explain VSB-CLIENT-0
 When you add or modify a skill, rule file, MCP server or instruction file, also run:
 
 ```bash
-npx github:avivgerz-hue/vibe-shield audit-skills
+npx -y @vibefoundry/vibe-shield audit-skills
 ```
 
 Twelve `VSB-AGENT-*` rules check for hidden Unicode (zero-width and bidi characters used to smuggle instructions past review), `curl`/`wget` exfiltration of environment variables, credential-harvesting instructions (`.env`, `~/.ssh`, `~/.aws`), registry-tag or remote MCP servers, literal tokens in an `env` block, safety-override language, over-broad tool permissions, base64 `eval` payloads, remote-instruction fetching, wildcard `allowed-tools`, and shell injection in skill scripts.
@@ -106,8 +106,8 @@ return structured findings instead of text you have to parse.
 
 ## Definition of done
 
-- [ ] `npx github:avivgerz-hue/vibe-shield scan --fail-on high` exits `0`
-- [ ] `npx github:avivgerz-hue/vibe-shield audit-skills` exits `0` if you touched agent files
+- [ ] `npx -y @vibefoundry/vibe-shield scan --fail-on high` exits `0`
+- [ ] `npx -y @vibefoundry/vibe-shield audit-skills` exits `0` if you touched agent files
 - [ ] every credential the scan surfaced has been flagged to the user for rotation
 - [ ] no suppression directive was added
 - [ ] the feature still works and the existing tests still pass
@@ -115,7 +115,7 @@ return structured findings instead of text you have to parse.
 ## Install it into a repository
 
 ```bash
-npx github:avivgerz-hue/vibe-shield init
+npx -y @vibefoundry/vibe-shield init
 ```
 
 That writes this file to `.claude/skills/vibe-shield/SKILL.md`, appends a security

package/dist/bin/vibe-shield.d.ts

@@ -32,7 +32,7 @@ export declare const defaultIo: () => CliIo;
 export declare const EXIT_OK = 0;
 export declare const EXIT_FINDINGS = 1;
 export declare const EXIT_USAGE = 2;
-declare const HELP = "vibe-shield \u2014 security scanner for AI-generated code\n\nUSAGE\n  vibe-shield <command> [options]\n\nCOMMANDS\n  scan [paths...]        Scan the project (default: current directory).\n  audit-skills [paths...]  Audit agent skills, Cursor rules, AGENTS.md and MCP configs.\n  init                   Install the Agent Skill, AGENTS.md section and CI workflow.\n  rules                  List every detection rule.\n  explain <RULE_ID>      Show full documentation for a rule.\n  mcp                    Serve the Model Context Protocol tools over stdio.\n  version                Print the version.\n  help                   Print this help.\n\nSCAN OPTIONS\n  --format <fmt>         console | compact | summary | json | sarif | github   (console)\n  --out <file>           Write the report to a file instead of stdout.\n  --fix-prompt           Write SECURITY_PATCH_PROMPT.md with exact fix instructions.\n  --fail-on <severity>   Exit 1 when a finding at/above this severity exists. (critical)\n  --severity <severity>  Only report findings at/above this severity.\n  --rules <ids>          Comma-separated rule ids/slugs (supports VSB-DB-*).\n  --ignore <glob>        Extra gitignore-style pattern (repeatable).\n  --include-tests        Include test, spec and fixture files.\n  --include-docs         Include Markdown and docs/.\n  --cache                Reuse .vibe-shield-cache.json between runs.\n  --max-findings <n>     Limit the console list (0 = all).   (50)\n  --quiet                Print only the verdict line and the exit code.\n  --no-color             Disable ANSI colour.\n  --no-shield-ignore     Ignore .vibe-shieldignore (e.g. to scan excluded fixtures).\n  --json                 Shorthand for --format json.\n\nINIT OPTIONS\n  --target <dir>         Repository to install into.          (cwd)\n  --agent <kind>         claude | cursor | generic | all.      (all)\n  --no-workflow          Skip the GitHub Actions workflow.\n  --force                Overwrite existing files.\n  --yes                  Accepted for non-interactive CI use (init never prompts).\n\nEXAMPLES\n  npx github:avivgerz-hue/vibe-shield scan\n  npx github:avivgerz-hue/vibe-shield scan --fail-on high --format github\n  npx github:avivgerz-hue/vibe-shield scan --fix-prompt\n  npx github:avivgerz-hue/vibe-shield init\n  npx github:avivgerz-hue/vibe-shield explain VSB-DB-001\n  npx github:avivgerz-hue/vibe-shield audit-skills .claude\n";
+declare const HELP = "vibe-shield \u2014 security scanner for AI-generated code\n\nUSAGE\n  vibe-shield <command> [options]\n\nCOMMANDS\n  scan [paths...]        Scan the project (default: current directory).\n  audit-skills [paths...]  Audit agent skills, Cursor rules, AGENTS.md and MCP configs.\n  init                   Install the Agent Skill, AGENTS.md section and CI workflow.\n  rules                  List every detection rule.\n  explain <RULE_ID>      Show full documentation for a rule.\n  mcp                    Serve the Model Context Protocol tools over stdio.\n  version                Print the version.\n  help                   Print this help.\n\nSCAN OPTIONS\n  --format <fmt>         console | compact | summary | json | sarif | github   (console)\n  --out <file>           Write the report to a file instead of stdout.\n  --fix-prompt           Write SECURITY_PATCH_PROMPT.md with exact fix instructions.\n  --fail-on <severity>   Exit 1 when a finding at/above this severity exists. (critical)\n  --severity <severity>  Only report findings at/above this severity.\n  --rules <ids>          Comma-separated rule ids/slugs (supports VSB-DB-*).\n  --ignore <glob>        Extra gitignore-style pattern (repeatable).\n  --include-tests        Include test, spec and fixture files.\n  --include-docs         Include Markdown and docs/.\n  --cache                Reuse .vibe-shield-cache.json between runs.\n  --max-findings <n>     Limit the console list (0 = all).   (50)\n  --quiet                Print only the verdict line and the exit code.\n  --no-color             Disable ANSI colour.\n  --no-shield-ignore     Ignore .vibe-shieldignore (e.g. to scan excluded fixtures).\n  --json                 Shorthand for --format json.\n\nINIT OPTIONS\n  --target <dir>         Repository to install into.          (cwd)\n  --agent <kind>         claude | cursor | generic | all.      (all)\n  --no-workflow          Skip the GitHub Actions workflow.\n  --force                Overwrite existing files.\n  --yes                  Accepted for non-interactive CI use (init never prompts).\n\nEXAMPLES\n  npx -y @vibefoundry/vibe-shield scan\n  npx -y @vibefoundry/vibe-shield scan --fail-on high --format github\n  npx -y @vibefoundry/vibe-shield scan --fix-prompt\n  npx -y @vibefoundry/vibe-shield init\n  npx -y @vibefoundry/vibe-shield explain VSB-DB-001\n  npx -y @vibefoundry/vibe-shield audit-skills .claude\n";
 interface ParsedArgs {
     command: string;
     positionals: string[];