@viberaven/cli 1.2.4 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY.md +53 -53
- package/dist/cli.js +6447 -4332
- package/dist/cli.js.map +4 -4
- package/package.json +75 -75
package/SECURITY.md
CHANGED
|
@@ -1,53 +1,53 @@
|
|
|
1
|
-
# Security - `@viberaven/cli`
|
|
2
|
-
|
|
3
|
-
## Managed Scan Boundary
|
|
4
|
-
|
|
5
|
-
The npm CLI does not read `OPENAI_API_KEY` and does not accept a bring-your-own-key scan path. Scans use the VibeRaven managed API after device login, same as the signed-in VS Code extension.
|
|
6
|
-
|
|
7
|
-
- API keys for model calls live on the server, not in the published npm package.
|
|
8
|
-
- Local credentials store only a VibeRaven access token in `%APPDATA%\viberaven\credentials.json` or `~/.config/viberaven/`.
|
|
9
|
-
- Never commit `credentials.json` or paste tokens into chat.
|
|
10
|
-
|
|
11
|
-
## Safe Commands
|
|
12
|
-
|
|
13
|
-
Human terminal:
|
|
14
|
-
|
|
15
|
-
```bash
|
|
16
|
-
npx -y viberaven
|
|
17
|
-
```
|
|
18
|
-
|
|
19
|
-
Agent or CI gate:
|
|
20
|
-
|
|
21
|
-
```bash
|
|
22
|
-
npx -y viberaven --agent-mode
|
|
23
|
-
npx -y viberaven --verify
|
|
24
|
-
npx -y viberaven --strict
|
|
25
|
-
```
|
|
26
|
-
|
|
27
|
-
VibeRaven is the Agent Context + Production Gate. Agents should read `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json` before claiming an app is safe to deploy.
|
|
28
|
-
|
|
29
|
-
## Written Artifacts
|
|
30
|
-
|
|
31
|
-
After a scan, the CLI may create:
|
|
32
|
-
|
|
33
|
-
| Path | Contents |
|
|
34
|
-
|------|----------|
|
|
35
|
-
| `.viberaven/last-scan.json` | Full scan payload |
|
|
36
|
-
| `.viberaven/agent-tasklist.md` | Agent tasklist |
|
|
37
|
-
| `.viberaven/gate-result.json` | Machine gate verdict |
|
|
38
|
-
| `.viberaven/context-map.json` | Compact agent context |
|
|
39
|
-
| `.viberaven/gaps/<gapId>.json` | Per-gap evidence |
|
|
40
|
-
| `.viberaven/agent-summary.md` | Human/agent summary |
|
|
41
|
-
| `.viberaven/launch-playbook.md` | Launch checklist |
|
|
42
|
-
| `.viberaven/report.html` | Local HTML report |
|
|
43
|
-
|
|
44
|
-
Repo scanners redact common key patterns in evidence strings; the CLI runs an extra redaction pass before writing files.
|
|
45
|
-
|
|
46
|
-
## Provider Boundaries
|
|
47
|
-
|
|
48
|
-
Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
|
|
49
|
-
|
|
50
|
-
## Reporting Issues
|
|
51
|
-
|
|
52
|
-
If you believe a scan artifact leaked a secret, rotate the key immediately and open an issue at https://github.com/ohad6k/VibeRaven/issues with the redacted file path only.
|
|
53
|
-
|
|
1
|
+
# Security - `@viberaven/cli`
|
|
2
|
+
|
|
3
|
+
## Managed Scan Boundary
|
|
4
|
+
|
|
5
|
+
The npm CLI does not read `OPENAI_API_KEY` and does not accept a bring-your-own-key scan path. Scans use the VibeRaven managed API after device login, same as the signed-in VS Code extension.
|
|
6
|
+
|
|
7
|
+
- API keys for model calls live on the server, not in the published npm package.
|
|
8
|
+
- Local credentials store only a VibeRaven access token in `%APPDATA%\viberaven\credentials.json` or `~/.config/viberaven/`.
|
|
9
|
+
- Never commit `credentials.json` or paste tokens into chat.
|
|
10
|
+
|
|
11
|
+
## Safe Commands
|
|
12
|
+
|
|
13
|
+
Human terminal:
|
|
14
|
+
|
|
15
|
+
```bash
|
|
16
|
+
npx -y viberaven
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
Agent or CI gate:
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
npx -y viberaven --agent-mode
|
|
23
|
+
npx -y viberaven --verify
|
|
24
|
+
npx -y viberaven --strict
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
VibeRaven is the Agent Context + Production Gate. Agents should read `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json` before claiming an app is safe to deploy.
|
|
28
|
+
|
|
29
|
+
## Written Artifacts
|
|
30
|
+
|
|
31
|
+
After a scan, the CLI may create:
|
|
32
|
+
|
|
33
|
+
| Path | Contents |
|
|
34
|
+
|------|----------|
|
|
35
|
+
| `.viberaven/last-scan.json` | Full scan payload |
|
|
36
|
+
| `.viberaven/agent-tasklist.md` | Agent tasklist |
|
|
37
|
+
| `.viberaven/gate-result.json` | Machine gate verdict |
|
|
38
|
+
| `.viberaven/context-map.json` | Compact agent context |
|
|
39
|
+
| `.viberaven/gaps/<gapId>.json` | Per-gap evidence |
|
|
40
|
+
| `.viberaven/agent-summary.md` | Human/agent summary |
|
|
41
|
+
| `.viberaven/launch-playbook.md` | Launch checklist |
|
|
42
|
+
| `.viberaven/report.html` | Local HTML report |
|
|
43
|
+
|
|
44
|
+
Repo scanners redact common key patterns in evidence strings; the CLI runs an extra redaction pass before writing files.
|
|
45
|
+
|
|
46
|
+
## Provider Boundaries
|
|
47
|
+
|
|
48
|
+
Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
|
|
49
|
+
|
|
50
|
+
## Reporting Issues
|
|
51
|
+
|
|
52
|
+
If you believe a scan artifact leaked a secret, rotate the key immediately and open an issue at https://github.com/ohad6k/VibeRaven/issues with the redacted file path only.
|
|
53
|
+
|