@viberaven/cli 1.0.3 → 1.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +150 -147
- package/README.md +87 -80
- package/SECURITY.md +1 -0
- package/dist/cli.js +795 -135
- package/dist/cli.js.map +4 -4
- package/package.json +5 -2
- package/templates/AGENTS.snippet.md +52 -51
- package/templates/CLAUDE.snippet.md +17 -16
- package/templates/CURSOR.snippet.md +17 -16
package/AGENTS.md
CHANGED
|
@@ -1,147 +1,150 @@
|
|
|
1
|
-
<!-- VIBERAVEN:START -->
|
|
2
|
-
VibeRaven provides production readiness for AI-built apps.
|
|
3
|
-
|
|
4
|
-
Canonical command: `npx -y viberaven --agent-mode`
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
-
|
|
26
|
-
-
|
|
27
|
-
- Read `.viberaven/
|
|
28
|
-
- Read `.viberaven/
|
|
29
|
-
- Read `.viberaven/
|
|
30
|
-
-
|
|
31
|
-
-
|
|
32
|
-
-
|
|
33
|
-
-
|
|
34
|
-
-
|
|
35
|
-
-
|
|
36
|
-
-
|
|
37
|
-
-
|
|
38
|
-
-
|
|
39
|
-
-
|
|
40
|
-
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
VibeRaven
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
```
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
```
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
-
|
|
146
|
-
-
|
|
147
|
-
-
|
|
1
|
+
<!-- VIBERAVEN:START -->
|
|
2
|
+
VibeRaven provides production readiness for AI-built apps.
|
|
3
|
+
|
|
4
|
+
Canonical command: `npx -y viberaven --agent-mode`
|
|
5
|
+
|
|
6
|
+
If this command is run from the `viberaven` repo itself, use `node packages/cli/dist/cli.js --agent-mode` to avoid resolving the local package metadata.
|
|
7
|
+
|
|
8
|
+
Use VibeRaven before launch, deployment, real users, auth, billing, database, RLS, env vars, webhooks, monitoring, or tests.
|
|
9
|
+
|
|
10
|
+
Agent loop: run VibeRaven, read Mission Map (`.viberaven/mission-map.md`), fix one launch gap, re-run VibeRaven.
|
|
11
|
+
|
|
12
|
+
## Event-Triggered Production Verification
|
|
13
|
+
|
|
14
|
+
Trigger: modifications to `package.json`, `vercel.json`, `supabase/migrations/**/*`, `.env.example`, auth/billing/webhook paths, or deploy workflow files.
|
|
15
|
+
|
|
16
|
+
1. Do NOT claim "production ready" or close a deploy checklist until `gate.status === "clear"` in `.viberaven/gate-result.json`.
|
|
17
|
+
2. Do NOT run verify after every file patch. Batch heals, then `npx -y viberaven --verify` once per loop.
|
|
18
|
+
3. Do NOT `git push` or deploy after auth, RLS, billing, or webhook changes without `npx -y viberaven --agent-mode`.
|
|
19
|
+
4. If anomalies appear, read `.viberaven/agent-tasklist.md` fully before writing new repo logic.
|
|
20
|
+
|
|
21
|
+
Prefer `viberaven_check_readiness` when MCP is configured; otherwise `npx -y viberaven --agent-mode`.
|
|
22
|
+
|
|
23
|
+
## VibeRaven Production-Readiness Gate
|
|
24
|
+
|
|
25
|
+
- Before running build, compile, cleanup, deployment, vercel, or supabase commands, run `npx -y viberaven --agent-mode` first from the project root.
|
|
26
|
+
- Treat VibeRaven as the Agent Context + Production Gate for AI-built apps, especially apps using Vercel, Supabase, auth, database, payments, webhooks, monitoring, rate limits, or environment variables.
|
|
27
|
+
- Read `.viberaven/agent-tasklist.md` first. If it says CRITICAL GAPS DETECTED or PRODUCTION GATE NOT CLEAR, fix one listed repo-code gap before deploying.
|
|
28
|
+
- Read `.viberaven/gate-result.json` for the machine verdict.
|
|
29
|
+
- Read `.viberaven/context-map.json` for compact agent context.
|
|
30
|
+
- Read `.viberaven/agent-summary.md` second for scan context.
|
|
31
|
+
- Read `.viberaven/launch-playbook.md` third for the full checklist.
|
|
32
|
+
- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
|
|
33
|
+
- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
|
|
34
|
+
- Run `npx -y viberaven --verify` after one fix.
|
|
35
|
+
- Run `npx -y viberaven --strict` before deploy or CI pass.
|
|
36
|
+
- Use `npx -y viberaven --heal --plan --gap <id>` before any heal apply.
|
|
37
|
+
- Only use `npx -y viberaven --heal --apply --gap <id> --yes` for supported low-risk repo-code recipes.
|
|
38
|
+
- Preview local rule installation with `npx -y viberaven init --agents all --dry-run`.
|
|
39
|
+
- Cleanup is non-destructive: only run `npx -y viberaven clean --plan` to create a reviewable cleanup plan.
|
|
40
|
+
- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider MCP evidence.
|
|
41
|
+
- Do not claim provider dashboard work is fixed by repo-code edits.
|
|
42
|
+
- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
|
|
43
|
+
|
|
44
|
+
## VibeRaven Production Copilot Loop
|
|
45
|
+
|
|
46
|
+
After every scan, read `.viberaven/agent-tasklist.md` for the prioritized task list.
|
|
47
|
+
|
|
48
|
+
The loop is:
|
|
49
|
+
|
|
50
|
+
1. Read `VIBERAVEN_NEXT_ACTION` from scan output for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
|
|
51
|
+
2. If `stalled: true`, stop calling verify — address provider-action gaps or report to the user.
|
|
52
|
+
3. If `scanNow: true`, call `viberaven_verify` (or run verify command) before applying more heals.
|
|
53
|
+
4. For each repo-code task where `requiresUserAction: false` (up to `batchSize` per batch):
|
|
54
|
+
- Call MCP: `viberaven_heal_apply { gap: "<gapId>", yes: true }`
|
|
55
|
+
- Or run heal apply command
|
|
56
|
+
5. After a successful heal, VibeRaven increments `.viberaven/loop-state.json`. After a full batch of heals, call verify once - do NOT verify after every single heal.
|
|
57
|
+
6. If verify prints `SCAN_DEFERRED`, do not retry verify. Apply the next listed repo-code heal. Only use `--force-scan` when the user explicitly approves spending a scan early.
|
|
58
|
+
7. Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`.
|
|
59
|
+
8. If `requiresUserAction: true`:
|
|
60
|
+
- Read `VIBERAVEN_PROVIDER_ACTION` from terminal output.
|
|
61
|
+
- Present `dashboardUrl` and `exactStep` to the user.
|
|
62
|
+
- Wait for user confirmation, then verify.
|
|
63
|
+
9. If `fixType === 'upgrade-required'`, provide upgradeUrl and move on.
|
|
64
|
+
|
|
65
|
+
Do not stop at "scan complete." The loop is not done until `gate.status === 'clear'`.
|
|
66
|
+
<!-- VIBERAVEN:END -->
|
|
67
|
+
|
|
68
|
+
# VibeRaven CLI - Agent Instructions
|
|
69
|
+
|
|
70
|
+
Use VibeRaven when the user asks whether an app is production-ready, launch-ready, safe to deploy, or missing auth, database, payments, deployment, monitoring, security, provider setup, Vercel, or Supabase checks.
|
|
71
|
+
|
|
72
|
+
VibeRaven is the Agent Context + Production Gate.
|
|
73
|
+
|
|
74
|
+
## Required Agent Loop
|
|
75
|
+
|
|
76
|
+
Run from the project root:
|
|
77
|
+
|
|
78
|
+
```bash
|
|
79
|
+
npx -y viberaven --agent-mode
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
Read in this order:
|
|
83
|
+
|
|
84
|
+
1. `.viberaven/agent-tasklist.md` - the tasklist-first gate
|
|
85
|
+
2. `.viberaven/gate-result.json` - the machine verdict
|
|
86
|
+
3. `.viberaven/context-map.json` - compact context for the next agent step
|
|
87
|
+
4. `.viberaven/agent-summary.md` - scan context
|
|
88
|
+
5. `.viberaven/launch-playbook.md` - full launch checklist
|
|
89
|
+
|
|
90
|
+
Fix one repo-code gap at a time. Prefer:
|
|
91
|
+
|
|
92
|
+
```bash
|
|
93
|
+
npx -y viberaven next --json
|
|
94
|
+
npx -y viberaven prompt --gap <id>
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
After a fix:
|
|
98
|
+
|
|
99
|
+
```bash
|
|
100
|
+
npx -y viberaven --verify
|
|
101
|
+
npx -y viberaven --strict
|
|
102
|
+
```
|
|
103
|
+
|
|
104
|
+
For Vercel + Supabase checks:
|
|
105
|
+
|
|
106
|
+
```bash
|
|
107
|
+
npx -y viberaven audit --vercel-supabase
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## Production Copilot Loop
|
|
111
|
+
|
|
112
|
+
After every scan, read `.viberaven/agent-tasklist.md` for the prioritized task list.
|
|
113
|
+
|
|
114
|
+
The loop is:
|
|
115
|
+
|
|
116
|
+
1. Read `VIBERAVEN_NEXT_ACTION` from scan output for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
|
|
117
|
+
2. If `stalled: true`, stop calling verify — address provider-action gaps or report to the user.
|
|
118
|
+
3. If `scanNow: true`, call `viberaven_verify` (or run `--verify`) before applying more heals.
|
|
119
|
+
4. For each repo-code task where `requiresUserAction: false` (up to `batchSize` per batch):
|
|
120
|
+
- Call MCP: `viberaven_heal_apply { gap: "<gapId>", yes: true }`
|
|
121
|
+
- Or run `--heal --apply --gap <id> --yes`
|
|
122
|
+
5. After a full batch of heals, call verify once — do NOT verify after every single heal.
|
|
123
|
+
6. Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`.
|
|
124
|
+
7. If `requiresUserAction: true`:
|
|
125
|
+
- Read `VIBERAVEN_PROVIDER_ACTION` from terminal output.
|
|
126
|
+
- Present `dashboardUrl` and `exactStep` to the user.
|
|
127
|
+
- Wait for user confirmation, then verify.
|
|
128
|
+
8. If `fixType === 'upgrade-required'`, provide `upgradeUrl` and move on.
|
|
129
|
+
|
|
130
|
+
Do not stop at "scan complete." The loop is not done until `gate.status === 'clear'`.
|
|
131
|
+
|
|
132
|
+
### Batch discipline
|
|
133
|
+
|
|
134
|
+
```
|
|
135
|
+
for each repo-code task (up to batchSize):
|
|
136
|
+
viberaven_heal_apply { gap: "<gapId>", yes: true }
|
|
137
|
+
|
|
138
|
+
viberaven_verify ← once per batch, not per fix
|
|
139
|
+
```
|
|
140
|
+
|
|
141
|
+
On Pro plans, `viberaven_provider_verify` is available as an MCP tool for read-only provider gap verification via Supabase/Vercel MCP evidence.
|
|
142
|
+
|
|
143
|
+
## Rules
|
|
144
|
+
|
|
145
|
+
- Do not skip VibeRaven before deploy/build/cleanup when production readiness is in scope.
|
|
146
|
+
- Do not claim provider dashboard checks are fixed by repo-code edits.
|
|
147
|
+
- Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
|
|
148
|
+
- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval."
|
|
149
|
+
- Do not ask for passwords, tokens, cookies, or secrets.
|
|
150
|
+
|
package/README.md
CHANGED
|
@@ -1,80 +1,87 @@
|
|
|
1
|
-
# @viberaven/cli
|
|
2
|
-
|
|
3
|
-
VibeRaven is the Agent Context + Production Gate for AI-built apps. It gives Claude Code, Codex, Cursor, and other coding agents a production-readiness loop before Vercel/Supabase deployment.
|
|
4
|
-
|
|
5
|
-
## Humans
|
|
6
|
-
|
|
7
|
-
```bash
|
|
8
|
-
npx -y viberaven
|
|
9
|
-
```
|
|
10
|
-
|
|
11
|
-
No subcommand is needed in a real terminal. It opens the interactive menu for sign-in, scan, report, provider guides, dashboards, prompts, and sign-out.
|
|
12
|
-
|
|
13
|
-
## Coding Agents
|
|
14
|
-
|
|
15
|
-
Agents should run:
|
|
16
|
-
|
|
17
|
-
```bash
|
|
18
|
-
npx -y viberaven --agent-mode
|
|
19
|
-
```
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
npx -y viberaven
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
```
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
1
|
+
# @viberaven/cli
|
|
2
|
+
|
|
3
|
+
VibeRaven is the Agent Context + Production Gate for AI-built apps. It gives Claude Code, Codex, Cursor, and other coding agents a production-readiness loop before Vercel/Supabase deployment.
|
|
4
|
+
|
|
5
|
+
## Humans
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npx -y viberaven
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
No subcommand is needed in a real terminal. It opens the interactive menu for sign-in, scan, report, provider guides, dashboards, prompts, and sign-out.
|
|
12
|
+
|
|
13
|
+
## Coding Agents
|
|
14
|
+
|
|
15
|
+
Agents should run:
|
|
16
|
+
|
|
17
|
+
```bash
|
|
18
|
+
npx -y viberaven --agent-mode
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
If running from the `viberaven` monorepo root, run:
|
|
22
|
+
|
|
23
|
+
```bash
|
|
24
|
+
node packages/cli/dist/cli.js --agent-mode
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
Then read artifacts in this order:
|
|
28
|
+
|
|
29
|
+
1. `.viberaven/agent-tasklist.md`
|
|
30
|
+
2. `.viberaven/gate-result.json`
|
|
31
|
+
3. `.viberaven/context-map.json`
|
|
32
|
+
4. `.viberaven/agent-summary.md`
|
|
33
|
+
5. `.viberaven/launch-playbook.md`
|
|
34
|
+
|
|
35
|
+
Fix one repo-code gap, then run:
|
|
36
|
+
|
|
37
|
+
```bash
|
|
38
|
+
npx -y viberaven --verify
|
|
39
|
+
npx -y viberaven --strict
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
For focused work:
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
npx -y viberaven next --json
|
|
46
|
+
npx -y viberaven prompt --gap <id>
|
|
47
|
+
npx -y viberaven audit --vercel-supabase
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
|
|
51
|
+
|
|
52
|
+
## Production Copilot Loop
|
|
53
|
+
|
|
54
|
+
VibeRaven runs a batch-disciplined loop until the production gate clears. Do not stop at "scan complete."
|
|
55
|
+
|
|
56
|
+
1. **Scan** — Run `--agent-mode`. Read `.viberaven/agent-tasklist.md` and parse `VIBERAVEN_NEXT_ACTION` from stdout for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
|
|
57
|
+
2. **Batch heals** — For each repo-code task where `requiresUserAction: false`, apply up to `batchSize` heals per batch (free=3, pro=10) via `viberaven_heal_apply { gap: "<gapId>", yes: true }` or `--heal --apply --gap <id> --yes`. When `scanNow: true`, verify before applying more heals.
|
|
58
|
+
3. **Verify and clear** — Run `--verify` once per batch (not after every heal). Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`. For provider gaps, read `VIBERAVEN_PROVIDER_ACTION`, complete the dashboard step, then verify.
|
|
59
|
+
|
|
60
|
+
If `stalled: true`, stop calling verify and address provider-action gaps or report to the user. Run `--strict` before deploy or CI pass.
|
|
61
|
+
|
|
62
|
+
## Machine Output
|
|
63
|
+
|
|
64
|
+
```bash
|
|
65
|
+
npx -y viberaven --agent-mode --json
|
|
66
|
+
npx -y viberaven --agent-mode --jsonl
|
|
67
|
+
npx -y viberaven --strict --json
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
Machine artifact contract:
|
|
71
|
+
|
|
72
|
+
```text
|
|
73
|
+
docs/contracts/artifacts.md
|
|
74
|
+
https://viberaven.dev/schemas/gate-result.schema.json
|
|
75
|
+
https://viberaven.dev/schemas/context-map.schema.json
|
|
76
|
+
https://viberaven.dev/schemas/gap.schema.json
|
|
77
|
+
https://viberaven.dev/schemas/heal-result.schema.json
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
## Development
|
|
81
|
+
|
|
82
|
+
```bash
|
|
83
|
+
npm run cli:build
|
|
84
|
+
npm run cli:test
|
|
85
|
+
node packages/cli/dist/cli.js scan
|
|
86
|
+
```
|
|
87
|
+
|
package/SECURITY.md
CHANGED
|
@@ -50,3 +50,4 @@ Provider dashboard checks are not cleared by repo-code edits. Billing/product co
|
|
|
50
50
|
## Reporting Issues
|
|
51
51
|
|
|
52
52
|
If you believe a scan artifact leaked a secret, rotate the key immediately and open an issue at https://github.com/ohad6k/VibeRaven/issues with the redacted file path only.
|
|
53
|
+
|