@viberaven/cli 1.0.4 → 1.0.6

package/dist/cli.js

@@ -167,6 +167,7 @@ __export(cli_exports, {
   parseArgs: () => parseArgs,
   printHelp: () => printHelp,
   resolveDefaultEntrypointMode: () => resolveDefaultEntrypointMode,
+  resolveLaunchPermissionMode: () => resolveLaunchPermissionMode,
   runScanCommand: () => runScanCommand
 });
 module.exports = __toCommonJS(cli_exports);
@@ -7992,7 +7993,7 @@ async function runProjectScan(options) {
 
 // src/artifacts.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 
 // src/capabilities/classify.ts
 function gapText(gap) {
@@ -8853,7 +8854,11 @@ function buildProviderAction(gap, provider2) {
       envKeyExample: void 0,
       // Use step title as the done signal
       doneSignal: `${step.title} step completed`,
-      verifyCommand: PUBLIC_VERIFY_COMMAND
+      verifyCommand: PUBLIC_VERIFY_COMMAND,
+      actionClass: "provider_write",
+      approvalRequired: true,
+      manualFallback: `Open ${step.openUrl ?? `https://${provider2}.com`} and complete: ${step.instruction}`,
+      copyValues: []
     };
   } catch {
     return void 0;
@@ -9407,35 +9412,458 @@ function sanitizeArtifactForDisk(artifact) {
   return redactUnknown(artifact);
 }
 
+// src/providerMcpBridge.ts
+var import_node_fs7 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path8 = require("node:path");
+var UPGRADE_URL4 = "https://viberaven.dev/pricing";
+var FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
+var SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
+var configPathsOverride;
+function defaultMcpConfigPaths() {
+  const home = (0, import_node_os2.homedir)();
+  return [
+    (0, import_node_path8.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path8.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path8.join)(home, ".gemini", "antigravity", "mcp_config.json")
+  ];
+}
+function resolveConfigPaths() {
+  return configPathsOverride ?? defaultMcpConfigPaths();
+}
+function parseMcpServers(raw) {
+  if (!raw || typeof raw !== "object") {
+    return void 0;
+  }
+  const obj = raw;
+  if (obj.mcpServers && typeof obj.mcpServers === "object") {
+    return obj.mcpServers;
+  }
+  if (obj.servers && typeof obj.servers === "object") {
+    return obj.servers;
+  }
+  return void 0;
+}
+function findServerEntry(servers, provider2) {
+  if (servers[provider2]) {
+    return servers[provider2];
+  }
+  const key = Object.keys(servers).find((candidate) => candidate.toLowerCase() === provider2);
+  return key ? servers[key] : void 0;
+}
+function findProviderMcpConfig(provider2, configPaths) {
+  const paths = configPaths ?? resolveConfigPaths();
+  for (const path of paths) {
+    if (!(0, import_node_fs7.existsSync)(path)) {
+      continue;
+    }
+    try {
+      const raw = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
+      const servers = parseMcpServers(raw);
+      if (!servers) {
+        continue;
+      }
+      const entry = findServerEntry(servers, provider2);
+      if (!entry || typeof entry !== "object") {
+        continue;
+      }
+      const server = entry;
+      return {
+        command: typeof server.command === "string" ? server.command : void 0,
+        args: Array.isArray(server.args) ? server.args.filter((arg) => typeof arg === "string") : void 0,
+        url: typeof server.url === "string" ? server.url : void 0,
+        source: path
+      };
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+async function verifyProviderGap(options) {
+  if (options.plan !== "pro") {
+    return {
+      verified: false,
+      reason: "pro-required",
+      upgradeUrl: UPGRADE_URL4
+    };
+  }
+  const provider2 = options.provider.toLowerCase().trim();
+  if (!SUPPORTED_PROVIDERS.has(provider2)) {
+    return {
+      verified: false,
+      reason: "unsupported-provider"
+    };
+  }
+  const mcpConfig = findProviderMcpConfig(provider2);
+  if (!mcpConfig) {
+    return {
+      verified: false,
+      mcpUnavailable: true,
+      fallbackCommand: FALLBACK_COMMAND
+    };
+  }
+  return {
+    verified: false,
+    mcpUnavailable: true,
+    fallbackCommand: FALLBACK_COMMAND
+  };
+}
+function defaultProviderDashboardUrl(provider2) {
+  const normalized = provider2.toLowerCase();
+  if (normalized === "vercel") return "https://vercel.com/dashboard";
+  if (normalized === "supabase") return "https://supabase.com/dashboard/projects";
+  if (normalized === "stripe") return "https://dashboard.stripe.com/webhooks";
+  if (normalized === "posthog") return "https://us.posthog.com/project/settings";
+  return void 0;
+}
+
+// src/launch/providerAutomation.ts
+function buildProviderAutomationOptions(options) {
+  const provider2 = options.provider.toLowerCase();
+  const result = [];
+  if (options.mcpConfig) {
+    result.push({
+      kind: "mcp",
+      provider: provider2,
+      available: true,
+      label: `${provider2} MCP configured`,
+      source: options.mcpConfig.source,
+      openUrl: options.mcpConfig.url
+    });
+  }
+  if (options.cli?.available) {
+    result.push({
+      kind: "cli",
+      provider: provider2,
+      available: true,
+      label: options.cli.authenticated ? `${options.cli.command} CLI authenticated` : `${options.cli.command} CLI needs login`,
+      command: options.cli.authenticated ? options.cli.command : `${options.cli.command} login`,
+      reason: options.cli.detail
+    });
+  }
+  const dashboardUrl = defaultProviderDashboardUrl(provider2);
+  if (dashboardUrl) {
+    result.push({
+      kind: "dashboard",
+      provider: provider2,
+      available: true,
+      label: `Open ${provider2} dashboard`,
+      openUrl: dashboardUrl
+    });
+  }
+  result.push({
+    kind: "manual",
+    provider: provider2,
+    available: true,
+    label: `Show manual ${provider2} setup steps`,
+    reason: "Manual fallback is always available"
+  });
+  return result;
+}
+
+// src/launch/providerActions.ts
+var VERIFY_COMMAND = "npx -y viberaven --verify";
+function buildLaunchProviderActions(options) {
+  const actions = [];
+  const providers = new Set(options.recipe.providers);
+  if (providers.has("vercel")) {
+    actions.push({
+      provider: "vercel",
+      actionClass: "preview_deploy",
+      title: "Create a Vercel preview URL",
+      detail: "Run a preview deploy so the vibe coder can see the app live before production promotion.",
+      openUrl: "https://vercel.com/new",
+      command: "vercel deploy",
+      copyValues: [],
+      verifyCommand: VERIFY_COMMAND,
+      approvalRequired: true,
+      manualFallback: "Open Vercel, import or link this project, then create a preview deployment.",
+      automation: buildProviderAutomationOptions({ provider: "vercel" })
+    });
+  }
+  if (providers.has("supabase")) {
+    actions.push({
+      provider: "supabase",
+      actionClass: "provider_write",
+      title: "Connect Supabase project and env values",
+      detail: "Connect the production Supabase project, then verify env wiring, migrations, auth, and RLS evidence.",
+      openUrl: defaultProviderDashboardUrl("supabase"),
+      copyValues: [
+        { label: "Public URL env name", value: "NEXT_PUBLIC_SUPABASE_URL", secret: false },
+        { label: "Anon key env name", value: "NEXT_PUBLIC_SUPABASE_ANON_KEY", secret: false }
+      ],
+      verifyCommand: VERIFY_COMMAND,
+      approvalRequired: true,
+      manualFallback: "Open Supabase project settings, copy the project URL and anon key, then add them to Vercel preview and production env vars.",
+      automation: buildProviderAutomationOptions({ provider: "supabase" })
+    });
+  }
+  if (providers.has("stripe")) {
+    const baseUrl = options.productionDomain ?? "https://<production-domain>";
+    actions.push({
+      provider: "stripe",
+      actionClass: "provider_write",
+      title: "Finish Stripe products and webhook setup",
+      detail: "Configure Stripe products/prices and add the production webhook endpoint with required billing events.",
+      openUrl: defaultProviderDashboardUrl("stripe"),
+      copyValues: [
+        { label: "Webhook endpoint", value: `${baseUrl}/api/stripe/webhook`, secret: false },
+        { label: "Required event", value: "checkout.session.completed", secret: false },
+        { label: "Required event", value: "customer.subscription.updated", secret: false },
+        { label: "Required event", value: "customer.subscription.deleted", secret: false },
+        { label: "Required event", value: "invoice.payment_failed", secret: false },
+        { label: "Webhook secret env name", value: "STRIPE_WEBHOOK_SECRET", secret: false }
+      ],
+      verifyCommand: VERIFY_COMMAND,
+      approvalRequired: true,
+      manualFallback: "Open Stripe Webhooks, add the endpoint URL, select the listed events, then store the signing secret as STRIPE_WEBHOOK_SECRET.",
+      automation: buildProviderAutomationOptions({ provider: "stripe" })
+    });
+  }
+  return actions;
+}
+
+// src/launch/recipes.ts
+function textIncludes(text, token) {
+  return text.toLowerCase().includes(token.toLowerCase());
+}
+function selectedProviderSet(artifact) {
+  return new Set(Object.values(artifact.selectedProviders ?? {}).map((value) => value.toLowerCase()));
+}
+function hasProvider(artifact, provider2) {
+  const selected = selectedProviderSet(artifact);
+  return selected.has(provider2);
+}
+function isNextLike(artifact) {
+  const text = [artifact.archetype, artifact.summary].join(" ");
+  return textIncludes(text, "next") || textIncludes(text, "nextjs") || textIncludes(text, "next.js");
+}
+function detectLaunchRecipe(artifact) {
+  const next = isNextLike(artifact);
+  const vercel = hasProvider(artifact, "vercel");
+  const supabase = hasProvider(artifact, "supabase");
+  const stripe = hasProvider(artifact, "stripe");
+  if (next && supabase && stripe && vercel) {
+    return {
+      id: "nextjs-supabase-stripe-vercel",
+      label: "Next.js + Supabase + Stripe + Vercel SaaS",
+      confidence: "high",
+      goal: "preview-first",
+      providers: ["vercel", "supabase", "stripe"],
+      reasons: ["Next.js/Vercel evidence detected", "Supabase evidence detected", "Stripe billing evidence detected"]
+    };
+  }
+  if (next && supabase && vercel) {
+    return {
+      id: "nextjs-supabase-vercel",
+      label: "Next.js + Supabase + Vercel app",
+      confidence: "high",
+      goal: "preview-first",
+      providers: ["vercel", "supabase"],
+      reasons: ["Next.js/Vercel evidence detected", "Supabase evidence detected"]
+    };
+  }
+  if (next && vercel) {
+    return {
+      id: "nextjs-vercel",
+      label: "Next.js + Vercel app",
+      confidence: "medium",
+      goal: "preview-first",
+      providers: ["vercel"],
+      reasons: ["Next.js/Vercel evidence detected"]
+    };
+  }
+  return {
+    id: "generic-preview-first",
+    label: "Generic preview-first launch",
+    confidence: "low",
+    goal: "preview-first",
+    providers: vercel ? ["vercel"] : [],
+    reasons: ["Provider evidence is incomplete, so VibeRaven will use a conservative preview-first path"]
+  };
+}
+
+// src/launch/buildLaunchPlan.ts
+function isSafeRepoTask(task) {
+  return task.fixType === "repo-code" && task.requiresUserAction === false;
+}
+function providerActionFromTask(task) {
+  if (task.fixType !== "provider-action" || !task.providerAction) {
+    return void 0;
+  }
+  const providerAction = task.providerAction;
+  return {
+    provider: providerAction.provider,
+    actionClass: providerAction.actionClass,
+    title: task.title,
+    detail: providerAction.exactStep,
+    openUrl: providerAction.dashboardUrl,
+    copyValues: providerAction.copyValues,
+    verifyCommand: providerAction.verifyCommand,
+    approvalRequired: providerAction.approvalRequired,
+    manualFallback: providerAction.manualFallback,
+    automation: buildProviderAutomationOptions({ provider: providerAction.provider })
+  };
+}
+function mergeTaskProviderActions(recipeActions, tasks) {
+  const actions = [...recipeActions];
+  for (const task of tasks) {
+    const taskAction = providerActionFromTask(task);
+    if (!taskAction) continue;
+    const alreadyCovered = actions.some(
+      (action) => action.provider === taskAction.provider && action.actionClass === taskAction.actionClass
+    );
+    if (!alreadyCovered) {
+      actions.push(taskAction);
+    }
+  }
+  return actions;
+}
+function selectNextAction(options) {
+  const safeRepoTask = options.safeRepoTasks[0];
+  if (safeRepoTask) {
+    return {
+      type: "safe_repo_gap",
+      title: safeRepoTask.title,
+      detail: safeRepoTask.exactFix ?? "Apply the supported VibeRaven safe repo fix, then verify after the batch.",
+      actionClass: "local_repo_write",
+      gapId: safeRepoTask.gapId,
+      approvalRequired: false,
+      manualFallback: "Use VIBERAVEN_NEXT_ACTION or viberaven_heal_apply for the supported safe repo fix, then run verify after the batch."
+    };
+  }
+  const preview = options.providerActions.find((action) => action.actionClass === "preview_deploy");
+  if (preview) {
+    return {
+      type: "preview_deploy",
+      title: preview.title,
+      detail: preview.detail,
+      actionClass: "preview_deploy",
+      provider: preview.provider,
+      approvalRequired: preview.approvalRequired,
+      openUrl: preview.openUrl,
+      command: preview.command,
+      manualFallback: preview.manualFallback
+    };
+  }
+  const provider2 = options.providerActions[0];
+  if (provider2) {
+    return {
+      type: "provider_setup",
+      title: provider2.title,
+      detail: provider2.detail,
+      actionClass: provider2.actionClass,
+      provider: provider2.provider,
+      approvalRequired: provider2.approvalRequired,
+      openUrl: provider2.openUrl,
+      command: provider2.command,
+      manualFallback: provider2.manualFallback
+    };
+  }
+  return {
+    type: "done",
+    title: "Launch path is clear",
+    detail: "No launch action is currently required. Run verify before claiming production readiness.",
+    actionClass: "local_repo_read",
+    approvalRequired: false
+  };
+}
+function buildLaunchPlan(options) {
+  const permissionMode = options.permissionMode ?? "ask";
+  const recipe = detectLaunchRecipe(options.artifact);
+  const tasks = options.tasks ?? buildTaskList(options.artifact);
+  const safeRepoTasks = tasks.filter(isSafeRepoTask);
+  const providerActions = mergeTaskProviderActions(buildLaunchProviderActions({ recipe }), tasks);
+  const criticalGaps = options.artifact.gaps.filter((gap) => gap.severity === "critical");
+  return {
+    version: 1,
+    generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    permissionMode,
+    recipe,
+    usageLine: options.artifact.usageLine,
+    safeRepoTasks,
+    providerActions,
+    nextAction: selectNextAction({ safeRepoTasks, providerActions }),
+    previewFirst: true,
+    productionGate: {
+      status: criticalGaps.length > 0 ? "blocked" : "unknown",
+      reasons: criticalGaps.length > 0 ? ["Critical launch gaps remain"] : ["Preview deploy should be verified before production promotion"]
+    }
+  };
+}
+
 // src/artifacts.ts
 async function copyReportAssets(reportAssetsDir) {
   const sourceDir = getBundledReportAssetsDir();
-  await (0, import_promises5.mkdir)((0, import_node_path8.join)(reportAssetsDir, "assets"), { recursive: true });
+  await (0, import_promises5.mkdir)((0, import_node_path9.join)(reportAssetsDir, "assets"), { recursive: true });
   for (const rel of REPORT_ASSET_FILES) {
-    await (0, import_promises5.copyFile)((0, import_node_path8.join)(sourceDir, rel), (0, import_node_path8.join)(reportAssetsDir, rel));
+    await (0, import_promises5.copyFile)((0, import_node_path9.join)(sourceDir, rel), (0, import_node_path9.join)(reportAssetsDir, rel));
   }
 }
+function renderLaunchTasklist(plan) {
+  const lines = [
+    "# VibeRaven Launch Autopilot",
+    "",
+    `Recipe: ${plan.recipe.label}`,
+    `Goal: preview URL first, production gate second`,
+    `Mode: ${plan.permissionMode}`,
+    "",
+    `Safe repo tasks: ${plan.safeRepoTasks.length}`,
+    `Provider actions: ${plan.providerActions.length}`,
+    "",
+    "## Best Next Move",
+    "",
+    `**Type:** ${plan.nextAction.type}`,
+    `**Title:** ${plan.nextAction.title}`,
+    `**Detail:** ${plan.nextAction.detail}`,
+    `**Approval required:** ${plan.nextAction.approvalRequired}`
+  ];
+  if (plan.nextAction.openUrl) lines.push(`**Open:** ${plan.nextAction.openUrl}`);
+  if (plan.nextAction.command) lines.push(`**Command:** \`${plan.nextAction.command}\``);
+  if (plan.nextAction.manualFallback) lines.push(`**Manual fallback:** ${plan.nextAction.manualFallback}`);
+  lines.push("", "## Production Gate", "");
+  lines.push(`Status: ${plan.productionGate.status}`);
+  for (const reason of plan.productionGate.reasons) {
+    lines.push(`- ${reason}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
 async function writeScanArtifacts(options) {
   const cwd = options.cwd ?? options.artifact.workspacePath;
   const dir = getProjectArtifactsDir(cwd);
   await (0, import_promises5.mkdir)(dir, { recursive: true });
-  const jsonPath = (0, import_node_path8.join)(dir, "last-scan.json");
-  const gateResultPath = (0, import_node_path8.join)(dir, "gate-result.json");
-  const contextMapPath = (0, import_node_path8.join)(dir, "context-map.json");
-  const gapsDir = (0, import_node_path8.join)(dir, "gaps");
-  const tasklistPath = (0, import_node_path8.join)(dir, "agent-tasklist.md");
-  const summaryPath = (0, import_node_path8.join)(dir, "agent-summary.md");
-  const playbookPath = (0, import_node_path8.join)(dir, "launch-playbook.md");
-  const reportPath = (0, import_node_path8.join)(dir, "report.html");
-  const reportAssetsDir = (0, import_node_path8.join)(dir, "report");
+  const jsonPath = (0, import_node_path9.join)(dir, "last-scan.json");
+  const gateResultPath = (0, import_node_path9.join)(dir, "gate-result.json");
+  const contextMapPath = (0, import_node_path9.join)(dir, "context-map.json");
+  const gapsDir = (0, import_node_path9.join)(dir, "gaps");
+  const tasklistPath = (0, import_node_path9.join)(dir, "agent-tasklist.md");
+  const summaryPath = (0, import_node_path9.join)(dir, "agent-summary.md");
+  const playbookPath = (0, import_node_path9.join)(dir, "launch-playbook.md");
+  const launchPlanPath = (0, import_node_path9.join)(dir, "launch-plan.json");
+  const launchTasklistPath = (0, import_node_path9.join)(dir, "launch-tasklist.md");
+  const providerActionsPath = (0, import_node_path9.join)(dir, "provider-actions.json");
+  const reportPath = (0, import_node_path9.join)(dir, "report.html");
+  const reportAssetsDir = (0, import_node_path9.join)(dir, "report");
   await (0, import_promises5.mkdir)(gapsDir, { recursive: true });
   const safe = sanitizeArtifactForDisk(options.artifact);
+  const tasks = buildTaskList(safe);
+  const launchPlan = buildLaunchPlan({
+    artifact: safe,
+    tasks,
+    permissionMode: options.launchPermissionMode
+  });
+  const launchPlanJson = `${JSON.stringify(launchPlan, null, 2)}
+`;
+  const launchTasklist = renderLaunchTasklist(launchPlan);
+  const providerActionsJson = `${JSON.stringify({ providerActions: launchPlan.providerActions }, null, 2)}
+`;
   const json = `${JSON.stringify(safe, null, 2)}
 `;
   const summary = generateAgentSummary(safe);
   const playbook = generateLaunchPlaybook(safe);
   const html = generateReportHtml(safe);
-  const tasks = buildTaskList(safe);
   const tasklist = buildTaskListMarkdown(tasks);
   const gateResult = `${JSON.stringify(generateGateResult(safe), null, 2)}
 `;
@@ -9446,9 +9874,12 @@ async function writeScanArtifacts(options) {
   await (0, import_promises5.writeFile)(gateResultPath, gateResult, "utf-8");
   await (0, import_promises5.writeFile)(contextMapPath, contextMap, "utf-8");
   for (const gap of gapEvidenceFiles) {
-    await (0, import_promises5.writeFile)((0, import_node_path8.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
+    await (0, import_promises5.writeFile)((0, import_node_path9.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
 `, "utf-8");
   }
+  await (0, import_promises5.writeFile)(launchPlanPath, launchPlanJson, "utf-8");
+  await (0, import_promises5.writeFile)(launchTasklistPath, launchTasklist, "utf-8");
+  await (0, import_promises5.writeFile)(providerActionsPath, providerActionsJson, "utf-8");
   await (0, import_promises5.writeFile)(tasklistPath, tasklist, "utf-8");
   await (0, import_promises5.writeFile)(jsonPath, json, "utf-8");
   await (0, import_promises5.writeFile)(summaryPath, summary, "utf-8");
@@ -9463,8 +9894,13 @@ async function writeScanArtifacts(options) {
     tasklistPath,
     summaryPath,
     playbookPath,
+    launchPlanPath,
+    launchTasklistPath,
+    providerActionsPath,
     reportPath,
-    reportAssetsDir
+    reportAssetsDir,
+    tasks,
+    launchPlan
   };
 }
 
@@ -9705,7 +10141,7 @@ function printScanSummary(artifact, paths) {
 
 // src/runnerConnect.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path9 = require("node:path");
+var import_node_path10 = require("node:path");
 var import_node_child_process3 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 
@@ -10053,7 +10489,7 @@ async function createSafeFixFile(job, input, targetPath) {
   } catch {
   }
   try {
-    await (0, import_promises6.mkdir)((0, import_node_path9.dirname)(targetPath), { recursive: true });
+    await (0, import_promises6.mkdir)((0, import_node_path10.dirname)(targetPath), { recursive: true });
     await writeNewFileAtomically(targetPath, input.content);
   } catch {
     return safeFixNeedsUser(job, "SAFE_FIX_WRITE_FAILED", `Could not create ${input.path}.`);
@@ -10121,12 +10557,12 @@ function safeFixNeedsUser(job, code, message) {
   };
 }
 async function resolveSafeFixTarget(workspaceRoot, relativePath) {
-  const root = await (0, import_promises6.realpath)(workspaceRoot).catch(() => (0, import_node_path9.resolve)(workspaceRoot));
-  const target = (0, import_node_path9.resolve)(root, relativePath);
+  const root = await (0, import_promises6.realpath)(workspaceRoot).catch(() => (0, import_node_path10.resolve)(workspaceRoot));
+  const target = (0, import_node_path10.resolve)(root, relativePath);
   if (!isInsideRoot(root, target)) {
     return { ok: false, reason: "Safe fix target escaped the workspace root." };
   }
-  const parent = (0, import_node_path9.dirname)(target);
+  const parent = (0, import_node_path10.dirname)(target);
   const parentReal = await realpathNearestExisting(parent, root);
   if (!isInsideRoot(root, parentReal)) {
     return { ok: false, reason: "Safe fix parent path escaped the workspace root." };
@@ -10144,7 +10580,7 @@ async function realpathNearestExisting(path, root) {
       await (0, import_promises6.lstat)(candidate);
       return (0, import_promises6.realpath)(candidate);
     } catch {
-      const next = (0, import_node_path9.dirname)(candidate);
+      const next = (0, import_node_path10.dirname)(candidate);
       if (next === candidate) {
         break;
       }
@@ -10154,8 +10590,8 @@ async function realpathNearestExisting(path, root) {
   return root;
 }
 function isInsideRoot(root, candidate) {
-  const rel = (0, import_node_path9.relative)(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path9.isAbsolute)(rel);
+  const rel = (0, import_node_path10.relative)(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path10.isAbsolute)(rel);
 }
 async function writeNewFileAtomically(targetPath, content) {
   const tempPath = tempPathFor(targetPath);
@@ -10176,7 +10612,7 @@ async function replaceFileAtomically(targetPath, content) {
   }
 }
 function tempPathFor(targetPath) {
-  return (0, import_node_path9.join)((0, import_node_path9.dirname)(targetPath), `.${(0, import_node_path9.basename)(targetPath)}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+  return (0, import_node_path10.join)((0, import_node_path10.dirname)(targetPath), `.${(0, import_node_path10.basename)(targetPath)}.${(0, import_node_crypto.randomUUID)()}.tmp`);
 }
 async function executePackageScriptJob(job, scriptName, options) {
   const packageJson = await readPackageJson(options.workspaceRoot);
@@ -10350,7 +10786,7 @@ function proofItemForJob(job, kind, label, summary, evidence, redactionSecrets =
 }
 async function readPackageJson(workspaceRoot) {
   try {
-    const raw = await (0, import_promises6.readFile)((0, import_node_path9.join)(workspaceRoot, "package.json"), "utf-8");
+    const raw = await (0, import_promises6.readFile)((0, import_node_path10.join)(workspaceRoot, "package.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (isRecord6(parsed) && isRecord6(parsed.scripts)) {
       return { scripts: Object.fromEntries(Object.entries(parsed.scripts).filter(([, value]) => typeof value === "string")) };
@@ -10433,7 +10869,7 @@ async function collectLocalRepoMetadata(workspaceRoot, commandRunner = runComman
   const headSha = headResult.ok ? normalizeSha(headResult.stdout) : null;
   const dirty = statusResult.ok ? statusResult.stdout.trim().length > 0 : void 0;
   return {
-    rootName: (0, import_node_path9.basename)(workspaceRoot) || "workspace",
+    rootName: (0, import_node_path10.basename)(workspaceRoot) || "workspace",
     remotes: remoteResult.ok ? parseGitRemotes(remoteResult.stdout) : [],
     branch,
     headSha,
@@ -10451,7 +10887,7 @@ async function detectPackageManager(workspaceRoot) {
   ];
   for (const [manager, file] of checks) {
     try {
-      await (0, import_promises6.access)((0, import_node_path9.join)(workspaceRoot, file));
+      await (0, import_promises6.access)((0, import_node_path10.join)(workspaceRoot, file));
       return manager;
     } catch {
     }
@@ -10642,7 +11078,7 @@ function isRecord6(value) {
 }
 
 // src/tui/runInteractive.ts
-var import_node_path14 = require("node:path");
+var import_node_path15 = require("node:path");
 
 // ../../node_modules/@clack/core/dist/index.mjs
 var import_sisteransi = __toESM(require_src(), 1);
@@ -11229,7 +11665,7 @@ function buildAgentFixPrompt(artifact, gap) {
 }
 
 // src/version.ts
-var VERSION = "1.0.3";
+var VERSION = "1.0.6";
 
 // src/commands/guide.ts
 var import_picocolors3 = __toESM(require_picocolors());
@@ -11299,7 +11735,7 @@ async function runGuideCommand(options) {
 
 // src/commands/audit.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var ENV_FILES = [
   ".env",
   ".env.local",
@@ -11399,7 +11835,7 @@ function buildVercelSupabaseAudit(input) {
 }
 async function readIfExists(projectRoot, relativePath) {
   try {
-    const absolutePath = (0, import_node_path10.join)(projectRoot, relativePath);
+    const absolutePath = (0, import_node_path11.join)(projectRoot, relativePath);
     const fileStat = await (0, import_promises7.stat)(absolutePath);
     if (!fileStat.isFile()) {
       return void 0;
@@ -11413,7 +11849,7 @@ async function readIfExists(projectRoot, relativePath) {
   }
 }
 async function collectSqlFiles(projectRoot, root) {
-  const base = (0, import_node_path10.join)(projectRoot, root);
+  const base = (0, import_node_path11.join)(projectRoot, root);
   try {
     const rootStat = await (0, import_promises7.stat)(base);
     if (!rootStat.isDirectory()) {
@@ -11433,17 +11869,17 @@ async function collectSqlFiles(projectRoot, root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name)) {
-          await visit((0, import_node_path10.join)(dir, entry.name));
+          await visit((0, import_node_path11.join)(dir, entry.name));
         }
         continue;
       }
       if (!entry.isFile() || !entry.name.toLowerCase().endsWith(".sql")) {
         continue;
       }
-      const absolutePath = (0, import_node_path10.join)(dir, entry.name);
+      const absolutePath = (0, import_node_path11.join)(dir, entry.name);
       try {
         files.push({
-          path: (0, import_node_path10.relative)(projectRoot, absolutePath).replace(/\\/g, "/"),
+          path: (0, import_node_path11.relative)(projectRoot, absolutePath).replace(/\\/g, "/"),
           content: await (0, import_promises7.readFile)(absolutePath, "utf8")
         });
       } catch {
@@ -11493,7 +11929,7 @@ function renderVercelSupabaseAudit(result) {
 
 // src/commands/initRules.ts
 var import_promises10 = require("node:fs/promises");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 
 // src/commands/agentRulesBlock.ts
 var VIBERAVEN_BLOCK_START = "<!-- VIBERAVEN:START -->";
@@ -11731,7 +12167,7 @@ function escapeRegExp3(value) {
 
 // src/commands/cursorRulesPack.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 var CURSOR_RULES_DIR = ".cursor/rules";
 var LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
 var DOMAIN_PATH_POINTER = "Before editing these files, read `.viberaven/agent-context.md` and `.viberaven/mission-map.md`.";
@@ -11815,17 +12251,17 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path = (0, import_node_path11.join)(options.cwd, file);
+    const path = (0, import_node_path12.join)(options.cwd, file);
     const existing = await readExistingFile(path);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises8.mkdir)((0, import_node_path11.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises8.mkdir)((0, import_node_path12.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
       await (0, import_promises8.writeFile)(path, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path, action });
   }
-  const legacyPath = (0, import_node_path11.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path12.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
     await (0, import_promises8.rm)(legacyPath, { force: true });
   }
@@ -11936,17 +12372,17 @@ function getAgentRulesTargets(value) {
 }
 
 // src/commands/seedPackageJsonScripts.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_promises9 = require("node:fs/promises");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
   "viberaven:gate": PUBLIC_AGENT_MODE_COMMAND,
   "viberaven:verify": PUBLIC_VERIFY_COMMAND,
   "viberaven:strict": PUBLIC_STRICT_COMMAND
 };
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path12.join)(options.cwd, "package.json");
-  if (!(0, import_node_fs7.existsSync)(packageJsonPath)) {
+  const packageJsonPath = (0, import_node_path13.join)(options.cwd, "package.json");
+  if (!(0, import_node_fs8.existsSync)(packageJsonPath)) {
     return null;
   }
   const raw = await (0, import_promises9.readFile)(packageJsonPath, "utf-8");
@@ -11994,12 +12430,12 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path13.join)(options.cwd, file);
+    const path = (0, import_node_path14.join)(options.cwd, file);
     const existing = await readExistingFile2(path);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises10.mkdir)((0, import_node_path13.dirname)(path), { recursive: true });
+      await (0, import_promises10.mkdir)((0, import_node_path14.dirname)(path), { recursive: true });
       await (0, import_promises10.writeFile)(path, injected.content, "utf-8");
     }
     results.push({ target, file, path, action });
@@ -12376,7 +12812,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors4.default.bold("VibeRaven")} ${import_picocolors4.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path14.resolve)(artifactsAt) !== (0, import_node_path14.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path15.resolve)(artifactsAt) !== (0, import_node_path15.resolve)(startDir)) {
     M2.message(import_picocolors4.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors4.default.dim(`Project folder: ${cwd}`));
@@ -12444,11 +12880,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
 
 // src/commands/condense.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact = JSON.parse(await (0, import_promises11.readFile)((0, import_node_path15.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path15.join)(dir, "context-map.json");
+  const artifact = JSON.parse(await (0, import_promises11.readFile)((0, import_node_path16.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path16.join)(dir, "context-map.json");
   await (0, import_promises11.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
 `, "utf8");
   return { contextMapPath };
@@ -12456,16 +12892,16 @@ async function runCondenseCommand(options) {
 
 // src/heal/apply.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_fs10 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path20 = require("node:path");
 
 // src/heal/pathSafety.ts
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path16.resolve)(cwd);
-  const absolute = (0, import_node_path16.resolve)(root, target);
-  const rel = (0, import_node_path16.relative)(root, absolute);
+  const root = (0, import_node_path17.resolve)(cwd);
+  const absolute = (0, import_node_path17.resolve)(root, target);
+  const rel = (0, import_node_path17.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -12488,9 +12924,9 @@ function applyEmptyCatchRecipe(source) {
 }
 
 // src/heal/recipes/index.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 
 // src/heal/recipes/envAuthSecret.ts
 function applyAuthSecretRecipe(source) {
@@ -12871,8 +13307,8 @@ function applyRateLimitRecipe(source, hasUpstash) {
 }
 
 // src/heal/recipes/eslintRestrictedImports.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path18 = require("node:path");
 var VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
 var RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
 var RESTRICTED_PATHS = [
@@ -12902,7 +13338,7 @@ var ESLINT_CONFIG_CANDIDATES = [
 ];
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs8.existsSync)((0, import_node_path17.join)(cwd, candidate))) {
+    if ((0, import_node_fs9.existsSync)((0, import_node_path18.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -13077,13 +13513,13 @@ function defaultTargetFile(gapId) {
   return map[gapId];
 }
 async function readSourceOrEmpty(absolutePath) {
-  if (!(0, import_node_fs9.existsSync)(absolutePath)) return "";
+  if (!(0, import_node_fs10.existsSync)(absolutePath)) return "";
   return (0, import_promises12.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path18.join)(cwd, "package.json");
-    if (!(0, import_node_fs9.existsSync)(pkgPath)) return false;
+    const pkgPath = (0, import_node_path19.join)(cwd, "package.json");
+    if (!(0, import_node_fs10.existsSync)(pkgPath)) return false;
     const raw = await (0, import_promises12.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
@@ -13099,7 +13535,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path18.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path19.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -13113,25 +13549,25 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path18.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path19.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path18.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path19.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path18.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path19.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path18.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path19.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
@@ -13149,10 +13585,10 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path18.join)(cwd, configFile);
-    if (!(0, import_node_fs9.existsSync)(absolutePath)) {
+    let absolutePath = (0, import_node_path19.join)(cwd, configFile);
+    if (!(0, import_node_fs10.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path18.join)(cwd, configFile);
+      absolutePath = (0, import_node_path19.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -13164,7 +13600,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path18.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path19.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -13186,7 +13622,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path18.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path19.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -13261,13 +13697,13 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path19.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path20.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises13.mkdir)((0, import_node_path19.dirname)(absoluteTarget), { recursive: true });
-      const healDir2 = (0, import_node_path19.join)(options.cwd, ".viberaven", "heal", id);
-      await (0, import_promises13.mkdir)((0, import_node_path19.join)(healDir2, "before"), { recursive: true });
-      const beforeContent = (0, import_node_fs10.existsSync)(absoluteTarget) ? await (0, import_promises13.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises13.mkdir)((0, import_node_path20.dirname)(absoluteTarget), { recursive: true });
+      const healDir2 = (0, import_node_path20.join)(options.cwd, ".viberaven", "heal", id);
+      await (0, import_promises13.mkdir)((0, import_node_path20.join)(healDir2, "before"), { recursive: true });
+      const beforeContent = (0, import_node_fs11.existsSync)(absoluteTarget) ? await (0, import_promises13.readFile)(absoluteTarget, "utf8") : "";
+      await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
       await (0, import_promises13.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
@@ -13278,7 +13714,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -13289,7 +13725,7 @@ async function applyHeal(options) {
         gapId: options.gapId,
         recipe: dispatched.recipeName,
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path19.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path20.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id}/patch.diff`,
           result: `.viberaven/heal/${id}/result.json`
@@ -13299,7 +13735,7 @@ async function applyHeal(options) {
           instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
         }
       };
-      await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -13336,9 +13772,9 @@ async function applyHeal(options) {
       rollback: { available: false, instructions: "No supported heal recipe matched this file." }
     };
   }
-  const healDir = (0, import_node_path19.join)(options.cwd, ".viberaven", "heal", id);
-  await (0, import_promises13.mkdir)((0, import_node_path19.join)(healDir, "before"), { recursive: true });
-  await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir, "before", "target.txt"), before, "utf8");
+  const healDir = (0, import_node_path20.join)(options.cwd, ".viberaven", "heal", id);
+  await (0, import_promises13.mkdir)((0, import_node_path20.join)(healDir, "before"), { recursive: true });
+  await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir, "before", "target.txt"), before, "utf8");
   await (0, import_promises13.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
@@ -13349,7 +13785,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -13360,7 +13796,7 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path19.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path20.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id}/patch.diff`,
       result: `.viberaven/heal/${id}/result.json`
@@ -13370,19 +13806,19 @@ async function applyHeal(options) {
       instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
     }
   };
-  await (0, import_promises13.writeFile)((0, import_node_path19.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises13.writeFile)((0, import_node_path20.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
 
 // src/heal/plan.ts
 var import_promises14 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 function healId2() {
   return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
 }
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path20.join)(options.cwd, ".viberaven");
+  const dir = (0, import_node_path21.join)(options.cwd, ".viberaven");
   await (0, import_promises14.mkdir)(dir, { recursive: true });
   const id = healId2();
   const target = options.target ?? `gap:${options.gapId}`;
@@ -13410,20 +13846,20 @@ async function writeHealPlan(options) {
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises14.writeFile)((0, import_node_path20.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises14.writeFile)((0, import_node_path20.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises14.writeFile)((0, import_node_path21.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises14.writeFile)((0, import_node_path21.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
 
 // src/heal/prompt.ts
 var import_promises15 = require("node:fs/promises");
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 function healId3() {
   return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
 }
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path21.join)(options.cwd, ".viberaven");
+  const dir = (0, import_node_path22.join)(options.cwd, ".viberaven");
   await (0, import_promises15.mkdir)(dir, { recursive: true });
   const id = healId3();
   const target = options.target ?? `gap:${options.gapId}`;
@@ -13451,7 +13887,7 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises15.writeFile)((0, import_node_path21.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises15.writeFile)((0, import_node_path22.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
 
@@ -13537,8 +13973,8 @@ async function runHealCommand(options) {
 
 // src/stackRecommend.ts
 var import_promises17 = require("node:fs/promises");
-var import_node_fs11 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_path23 = require("node:path");
 var DEFAULT_STACK = {
   frontend: "react",
   ui: "tailwind + shadcn/ui",
@@ -13549,8 +13985,8 @@ var DEFAULT_STACK = {
   reason: "Agent-default stack for lowest launch friction when repo signals are ambiguous"
 };
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path22.join)(cwd, "package.json");
-  if (!(0, import_node_fs11.existsSync)(pkgPath)) {
+  const pkgPath = (0, import_node_path23.join)(cwd, "package.json");
+  if (!(0, import_node_fs12.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
   const pkg = JSON.parse(await (0, import_promises17.readFile)(pkgPath, "utf-8"));
@@ -13606,7 +14042,7 @@ async function runInitCommand(options) {
 
 // src/commands/doctorAgents.ts
 var import_promises18 = require("node:fs/promises");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var REQUIRED_EXISTENCE_CHECKS = [
   { id: "agents-md", file: "AGENTS.md" },
   { id: "claude-md", file: "CLAUDE.md" },
@@ -13626,7 +14062,7 @@ var STALE_PATTERNS = [
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item3 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path23.join)(cwd, item3.file));
+    const exists = await fileExists2((0, import_node_path24.join)(cwd, item3.file));
     checks.push({
       id: item3.id,
       status: exists ? "pass" : "fail",
@@ -13634,17 +14070,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item3 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path23.join)(cwd, item3.file));
+    const exists = await fileExists2((0, import_node_path24.join)(cwd, item3.file));
     checks.push({
       id: item3.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item3.file} exists` : `Missing ${item3.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path23.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path24.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
     const legacyContent = await (0, import_promises18.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path23.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const hasCoreSplit = await fileExists2((0, import_node_path24.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -13655,7 +14091,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path23.join)(cwd, file);
+    const path = (0, import_node_path24.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -13898,6 +14334,20 @@ async function runValidateNpmPackageCommand(options) {
   return hasBlocking ? 2 : 0;
 }
 
+// src/commands/runAudit.ts
+async function runAuditCommand(input) {
+  const auditInput = await collectVercelSupabaseAuditInput(input.cwd);
+  const result = buildVercelSupabaseAudit(auditInput);
+  if (input.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  } else {
+    process.stdout.write(`${renderVercelSupabaseAudit(result)}
+`);
+  }
+  return result.status === "pass" ? 0 : 1;
+}
+
 // src/output/nextActionBlock.ts
 function buildNextActionBlock(tasks, loopState, plan) {
   const batchSize = plan === "pro" ? 10 : 3;
@@ -13995,7 +14445,11 @@ function buildProviderActionBlock(task) {
       envKeyExample: pa.envKeyExample ?? null,
       doneSignal: pa.doneSignal,
       verifyCommand: task.verifyCommand,
-      mcpAlternative: task.mcpTool ?? pa.mcpAlternative ?? null
+      mcpAlternative: task.mcpTool ?? pa.mcpAlternative ?? null,
+      actionClass: pa.actionClass,
+      approvalRequired: pa.approvalRequired,
+      manualFallback: pa.manualFallback,
+      copyValues: pa.copyValues
     }
   };
 }
@@ -14016,104 +14470,54 @@ function printNextActionBlock(block) {
   console.log(NEXT_ACTION_END);
 }
 
-// src/providerMcpBridge.ts
-var import_node_fs12 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path24 = require("node:path");
-var UPGRADE_URL4 = "https://viberaven.dev/pricing";
-var FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
-var SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
-var configPathsOverride;
-function defaultMcpConfigPaths() {
-  const home = (0, import_node_os2.homedir)();
-  return [
-    (0, import_node_path24.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path24.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path24.join)(home, ".gemini", "antigravity", "mcp_config.json")
+// src/output/launchActionBlock.ts
+var LAUNCH_ACTION_START = "VIBERAVEN_LAUNCH_ACTION_START";
+var LAUNCH_ACTION_END = "VIBERAVEN_LAUNCH_ACTION_END";
+function renderLaunchSummary(plan) {
+  const lines = [
+    "",
+    "VibeRaven Launch Autopilot",
+    "",
+    `Recipe: ${plan.recipe.label}`,
+    "Goal: preview URL first, production gate second",
+    `Mode: ${plan.permissionMode}`
   ];
-}
-function resolveConfigPaths() {
-  return configPathsOverride ?? defaultMcpConfigPaths();
-}
-function parseMcpServers(raw) {
-  if (!raw || typeof raw !== "object") {
-    return void 0;
+  if (plan.usageLine) {
+    lines.push(`Scan usage: ${plan.usageLine}`);
   }
-  const obj = raw;
-  if (obj.mcpServers && typeof obj.mcpServers === "object") {
-    return obj.mcpServers;
-  }
-  if (obj.servers && typeof obj.servers === "object") {
-    return obj.servers;
+  lines.push(
+    "",
+    `Auto-close queue: ${plan.safeRepoTasks.length} safe repo task${plan.safeRepoTasks.length === 1 ? "" : "s"}`,
+    `Provider actions: ${plan.providerActions.length}`,
+    "",
+    "Best next move:",
+    plan.nextAction.title,
+    plan.nextAction.detail
+  );
+  if (plan.nextAction.openUrl) {
+    lines.push(`Open: ${plan.nextAction.openUrl}`);
   }
-  return void 0;
-}
-function findServerEntry(servers, provider2) {
-  if (servers[provider2]) {
-    return servers[provider2];
+  if (plan.nextAction.command) {
+    lines.push(`Command: ${plan.nextAction.command}`);
   }
-  const key = Object.keys(servers).find((candidate) => candidate.toLowerCase() === provider2);
-  return key ? servers[key] : void 0;
+  lines.push(`Approval required: ${plan.nextAction.approvalRequired ? "yes" : "no"}`);
+  return lines.join("\n");
 }
-function findProviderMcpConfig(provider2, configPaths) {
-  const paths = configPaths ?? resolveConfigPaths();
-  for (const path of paths) {
-    if (!(0, import_node_fs12.existsSync)(path)) {
-      continue;
-    }
-    try {
-      const raw = JSON.parse((0, import_node_fs12.readFileSync)(path, "utf8"));
-      const servers = parseMcpServers(raw);
-      if (!servers) {
-        continue;
-      }
-      const entry = findServerEntry(servers, provider2);
-      if (!entry || typeof entry !== "object") {
-        continue;
+function printLaunchActionBlock(plan) {
+  console.log(LAUNCH_ACTION_START);
+  console.log(
+    JSON.stringify(
+      {
+        VIBERAVEN_LAUNCH_ACTION: plan.nextAction
       }
-      const server = entry;
-      return {
-        command: typeof server.command === "string" ? server.command : void 0,
-        args: Array.isArray(server.args) ? server.args.filter((arg) => typeof arg === "string") : void 0,
-        url: typeof server.url === "string" ? server.url : void 0,
-        source: path
-      };
-    } catch {
-      continue;
-    }
-  }
-  return void 0;
-}
-async function verifyProviderGap(options) {
-  if (options.plan !== "pro") {
-    return {
-      verified: false,
-      reason: "pro-required",
-      upgradeUrl: UPGRADE_URL4
-    };
-  }
-  const provider2 = options.provider.toLowerCase().trim();
-  if (!SUPPORTED_PROVIDERS.has(provider2)) {
-    return {
-      verified: false,
-      reason: "unsupported-provider"
-    };
-  }
-  const mcpConfig = findProviderMcpConfig(provider2);
-  if (!mcpConfig) {
-    return {
-      verified: false,
-      mcpUnavailable: true,
-      fallbackCommand: FALLBACK_COMMAND
-    };
-  }
-  return {
-    verified: false,
-    mcpUnavailable: true,
-    fallbackCommand: FALLBACK_COMMAND
-  };
+    )
+  );
+  console.log(LAUNCH_ACTION_END);
 }
 
+// src/launch/types.ts
+var LAUNCH_PERMISSION_MODES = ["manual", "ask", "safe", "full"];
+
 // src/cli.ts
 function printHelp() {
   console.log(`viberaven ${VERSION} \u2014 launch readiness for AI-built apps
@@ -14142,6 +14546,7 @@ Usage:
 
   viberaven --agent-mode [--json|--jsonl] [path]
                        Agent-first scan; writes tasklist, gate-result, context-map, and per-gap JSON
+                       Optional: --launch-mode manual|ask|safe|full (default: ask)
 
   viberaven --strict[=warning] [path]
                        Fail when production gate is not clear; warning mode also fails on warnings
@@ -14178,6 +14583,9 @@ Usage:
   viberaven doctor --agents [path]
                        Verify agent instruction files and canonical commands
 
+  viberaven audit --vercel-supabase [--json] [path]
+                       Local Vercel/Supabase repo evidence audit (RLS, pooler, secrets)
+
 
 
 Agent workflow (Claude Code / Codex):
@@ -14275,6 +14683,13 @@ function shouldConsumeLeadingHyphenValue(command, key, value) {
 function hasFlag(flags, key) {
   return flags[key] === true || typeof flags[key] === "string";
 }
+function resolveLaunchPermissionMode(flags) {
+  const value = flags["launch-mode"];
+  if (typeof value !== "string") {
+    return "ask";
+  }
+  return LAUNCH_PERMISSION_MODES.includes(value) ? value : "ask";
+}
 async function guardEarlyVerifyScan(input) {
   if (input.flags["force-scan"] === true) {
     return void 0;
@@ -14559,7 +14974,11 @@ async function runScanCommand(flags, positional, options) {
     return { exitCode: 1 };
   }
   const artifact = await enrichArtifactWithAccount(result.artifact, apiBaseUrl, accessToken);
-  const paths = await writeScanArtifacts({ artifact, cwd: workspacePath });
+  const paths = await writeScanArtifacts({
+    artifact,
+    cwd: workspacePath,
+    launchPermissionMode: resolveLaunchPermissionMode(flags)
+  });
   if (flags.json && !options?.deferMachineOutput) {
     console.log(formatScanJsonStdout(artifact));
     return { exitCode: 0, artifacts: paths };
@@ -14574,11 +14993,14 @@ async function runScanCommand(flags, positional, options) {
     const loopState = await loadLoopState(workspacePath);
     const openGapCount = artifact.gaps.length;
     const updatedState = resetBatch(loopState, openGapCount);
-    const tasks = buildTaskList(artifact);
+    const tasks = paths.tasks;
     const plan = artifact.plan ?? "free";
     const block = buildNextActionBlock(tasks, updatedState, plan);
     printNextActionBlock(block);
     printProviderActionBlock(tasks);
+    const launchPlan = paths.launchPlan;
+    console.log(renderLaunchSummary(launchPlan));
+    printLaunchActionBlock(launchPlan);
     await saveLoopState(workspacePath, updatedState);
   }
   if (flags.open) {
@@ -14834,6 +15256,15 @@ async function main() {
         names: positional,
         json: Boolean(flags.json)
       });
+    case "audit":
+      if (flags["vercel-supabase"] !== true) {
+        console.error("Usage: viberaven audit --vercel-supabase [--json] [path]");
+        return 1;
+      }
+      return runAuditCommand({
+        cwd: positional[0] ? (0, import_node_path25.join)(process.cwd(), positional[0]) : process.cwd(),
+        json: Boolean(flags.json)
+      });
     default:
       console.error(`Unknown command: ${command}`);
       printHelp();
@@ -14857,6 +15288,7 @@ if (require.main === module) {
   parseArgs,
   printHelp,
   resolveDefaultEntrypointMode,
+  resolveLaunchPermissionMode,
   runScanCommand
 });
 //# sourceMappingURL=cli.js.map