npm - @viberaven/cli - Versions diffs - 1.3.0 → 1.3.5 - Mend

@viberaven/cli 1.3.0 → 1.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/AGENTS.md +157 -42
package/README.md +109 -128
package/SECURITY.md +53 -52
package/dist/cli.js +12797 -8057
package/dist/cli.js.map +4 -4
package/package.json +75 -73
package/templates/AGENTS.snippet.md +52 -45
package/templates/CLAUDE.snippet.md +17 -19
package/templates/CURSOR.snippet.md +17 -29

package/AGENTS.md CHANGED Viewed

@@ -1,42 +1,157 @@
-<!-- VIBERAVEN:START -->
-AI agents can code. They still need to know what changed.
-Canonical Studio command: `npx -y viberaven`
-Non-interactive artifact loop: `npx -y viberaven --agent-mode`
-Use VibeRaven when the agent needs to know which version broke, what changed since the last working release, or what provider context matters before editing.
-## VibeRaven What-Changed Layer
-- Treat VibeRaven as release drift and provider context for AI-built apps: identify what changed, which version broke, and what provider state matters before editing.
-- Read `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json` when the artifact loop is used.
-- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
-- Run `npx -y viberaven --verify` after a focused fix batch.
-- Run `npx -y viberaven --strict` before deploy or CI pass when release/provider risk is in scope.
-- Provider dashboard checks are not cleared by repo-code edits. State the dashboard action when repo evidence cannot prove it.
-- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets.
-## Package Work
-For this package, read the current local UI code before changing Studio behavior:
-- `packages/cli/src/local-ui/server.ts`
-- `packages/cli/src/local-ui/static/appClient.ts`
-- `packages/cli/src/local-ui/static/appCss.ts`
-- `packages/cli/src/local-ui/types.ts`
-Prefer focused checks:
-```bash
-npm --prefix packages/cli run typecheck
-npm --prefix packages/cli test -- local-ui/server.test.ts
-npm --prefix packages/cli run build
-```
-<!-- VIBERAVEN:END -->
-# VibeRaven CLI - Agent Instructions
-This package owns the open-source local Studio: VibeRaven Chat, Provider Control Board, Versions & Releases, Terminal, Diff, access modes, CLI agent connection, and provider context.
-Keep new work scoped to the Studio-first product path unless the task explicitly asks for legacy scan behavior.
+<!-- VIBERAVEN:START -->
+VibeRaven provides production readiness for AI-built apps.
+Canonical command: `npx -y viberaven --agent-mode`
+If this command is run from the `viberaven` repo itself, use `node packages/cli/dist/cli.js --agent-mode` to avoid resolving the local package metadata.
+Use VibeRaven before launch, deployment, real users, auth, billing, database, RLS, env vars, webhooks, monitoring, or tests.
+Agent loop: run VibeRaven, read Mission Map (`.viberaven/mission-map.md`), fix one launch gap, re-run VibeRaven.
+## Event-Triggered Production Verification
+Trigger: modifications to `package.json`, `vercel.json`, `supabase/migrations/**/*`, `.env.example`, auth/billing/webhook paths, or deploy workflow files.
+1. Do NOT claim "production ready" or close a deploy checklist until `gate.status === "clear"` in `.viberaven/gate-result.json`.
+2. Do NOT run verify after every file patch. Batch heals, then `npx -y viberaven --verify` once per loop.
+3. Do NOT `git push` or deploy after auth, RLS, billing, or webhook changes without `npx -y viberaven --agent-mode`.
+4. If anomalies appear, read `.viberaven/agent-tasklist.md` fully before writing new repo logic.
+Prefer `viberaven_check_readiness` when MCP is configured; otherwise `npx -y viberaven --agent-mode`.
+## VibeRaven Production-Readiness Gate
+- Before running build, compile, cleanup, deployment, vercel, or supabase commands, run `npx -y viberaven --agent-mode` first from the project root.
+- Treat VibeRaven as the Agent Context + Production Gate for AI-built apps, especially apps using Vercel, Supabase, auth, database, payments, webhooks, monitoring, rate limits, or environment variables.
+- Read `.viberaven/agent-tasklist.md` first. If it says CRITICAL GAPS DETECTED or PRODUCTION GATE NOT CLEAR, fix one listed repo-code gap before deploying.
+- Read `.viberaven/gate-result.json` for the machine verdict.
+- Read `.viberaven/context-map.json` for compact agent context.
+- Read `.viberaven/agent-summary.md` second for scan context.
+- Read `.viberaven/launch-playbook.md` third for the full checklist.
+- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
+- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
+- Run `npx -y viberaven --verify` after one fix.
+- Run `npx -y viberaven --strict` before deploy or CI pass.
+- Use `npx -y viberaven --heal --plan --gap <id>` before any heal apply.
+- Only use `npx -y viberaven --heal --apply --gap <id> --yes` for supported low-risk repo-code recipes.
+- Preview local rule installation with `npx -y viberaven init --agents all --dry-run`.
+- Cleanup is non-destructive: only run `npx -y viberaven clean --plan` to create a reviewable cleanup plan.
+- Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider MCP evidence.
+- Do not claim provider dashboard work is fixed by repo-code edits.
+- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
+## VibeRaven Production Copilot Loop
+After every scan, read `.viberaven/agent-tasklist.md` for the prioritized task list.
+The loop is:
+1. Read `VIBERAVEN_NEXT_ACTION` from scan output for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
+2. If `stalled: true`, stop calling verify — address provider-action gaps or report to the user.
+3. If `scanNow: true`, call `viberaven_verify` (or run verify command) before applying more heals.
+4. For each repo-code task where `requiresUserAction: false` (up to `batchSize` per batch):
+   - Call MCP: `viberaven_heal_apply { gap: "<gapId>", yes: true }`
+   - Or run heal apply command
+5. After a successful heal, VibeRaven increments `.viberaven/loop-state.json`. After a full batch of heals, call verify once - do NOT verify after every single heal.
+6. If verify prints `SCAN_DEFERRED`, do not retry verify. Apply the next listed repo-code heal. Only use `--force-scan` when the user explicitly approves spending a scan early.
+7. Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`.
+8. If `requiresUserAction: true`:
+   - Read `VIBERAVEN_PROVIDER_ACTION` from terminal output.
+   - Present `dashboardUrl` and `exactStep` to the user.
+   - Wait for user confirmation, then verify.
+9. If `fixType === 'upgrade-required'`, provide upgradeUrl and move on.
+Do not stop at "scan complete." The loop is not done until `gate.status === 'clear'`.
+<!-- VIBERAVEN:END -->
+# VibeRaven CLI - Agent Instructions
+Use VibeRaven when the user asks whether an app is production-ready, launch-ready, safe to deploy, or missing auth, database, payments, deployment, monitoring, security, provider setup, Vercel, or Supabase checks.
+VibeRaven is the Agent Context + Production Gate.
+## Required Agent Loop
+Run from the project root:
+```bash
+npx -y viberaven --agent-mode
+```
+Read in this order:
+1. `.viberaven/agent-tasklist.md` - the tasklist-first gate
+2. `.viberaven/gate-result.json` - the machine verdict
+3. `.viberaven/context-map.json` - compact context for the next agent step
+4. `.viberaven/agent-summary.md` - scan context
+5. `.viberaven/launch-playbook.md` - full launch checklist
+Fix one repo-code gap at a time. Prefer:
+```bash
+npx -y viberaven next --json
+npx -y viberaven prompt --gap <id>
+```
+After a fix:
+```bash
+npx -y viberaven --verify
+npx -y viberaven --strict
+```
+For Vercel + Supabase checks:
+```bash
+npx -y viberaven audit --vercel-supabase
+```
+## Production Copilot Loop
+After every scan, read `.viberaven/agent-tasklist.md` for the prioritized task list.
+The loop is:
+1. Read `VIBERAVEN_NEXT_ACTION` from scan output for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
+2. If `stalled: true`, stop calling verify — address provider-action gaps or report to the user.
+3. If `scanNow: true`, call `viberaven_verify` (or run `--verify`) before applying more heals.
+4. For each repo-code task where `requiresUserAction: false` (up to `batchSize` per batch):
+   - Call MCP: `viberaven_heal_apply { gap: "<gapId>", yes: true }`
+   - Or run `--heal --apply --gap <id> --yes`
+5. After a full batch of heals, call verify once — do NOT verify after every single heal.
+6. Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`.
+7. If `requiresUserAction: true`:
+   - Read `VIBERAVEN_PROVIDER_ACTION` from terminal output.
+   - Present `dashboardUrl` and `exactStep` to the user.
+   - Wait for user confirmation, then verify.
+8. If `fixType === 'upgrade-required'`, provide `upgradeUrl` and move on.
+Do not stop at "scan complete." The loop is not done until `gate.status === 'clear'`.
+### Batch discipline
+```
+for each repo-code task (up to batchSize):
+  viberaven_heal_apply { gap: "<gapId>", yes: true }
+viberaven_verify  ← once per batch, not per fix
+```
+On Pro plans, `viberaven_provider_verify` is available as an MCP tool for read-only provider gap verification via Supabase/Vercel MCP evidence.
+## Rules
+- Do not skip VibeRaven before deploy/build/cleanup when production readiness is in scope.
+- Do not claim provider dashboard checks are fixed by repo-code edits.
+- Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
+- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval."
+- Do not ask for passwords, tokens, cookies, or secrets.
+## Current machine-readable docs
+- Skill: https://viberaven.dev/SKILL.md
+- Agent rules: https://viberaven.dev/AGENTS.md
+- CLI docs: https://viberaven.dev/cli.md
+- MCP config: https://viberaven.dev/mcp.md

package/README.md CHANGED Viewed

@@ -1,128 +1,109 @@
-# @viberaven/cli
-[![npm version](https://img.shields.io/npm/v/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
-[![npm downloads](https://img.shields.io/npm/dw/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
-[![license](https://img.shields.io/npm/l/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
-AI agents can code. They still need to know what changed. VibeRaven is the local Studio and artifact loop for release drift, version context, provider context, and the next scoped fix.
-## Humans
-```bash
-npx -y viberaven
-```
-No subcommand is needed in a real terminal. It opens the interactive menu for sign-in, scan, report, provider guides, dashboards, prompts, and sign-out.
-## Coding Agents
-Agents should run:
-```bash
-npx -y viberaven --agent-mode
-```
-If running from the `viberaven` monorepo root, run:
-```bash
-node packages/cli/dist/cli.js --agent-mode
-```
-Then read artifacts in this order:
-1. `.viberaven/agent-tasklist.md`
-2. `.viberaven/gate-result.json`
-3. `.viberaven/context-map.json`
-4. `.viberaven/agent-summary.md`
-5. `.viberaven/launch-playbook.md`
-Fix one repo-code gap, then run:
-```bash
-npx -y viberaven --verify
-npx -y viberaven --strict
-```
-For focused work:
-```bash
-npx -y viberaven next --json
-npx -y viberaven prompt --gap <id>
-npx -y viberaven audit --vercel-supabase
-```
-## Chat-Native What-Changed Actions
-Agent mode writes a compact action surface for the connected coding agent:
-```bash
-npx -y viberaven --agent-mode
-npx -y viberaven actions
-npx -y viberaven verify --action VR-A1
-```
-VibeRaven writes `.viberaven/actions.json` as the V1 source of truth and renderer contract for the current action surface. The manifest is generated by `--agent-mode`; `.viberaven/action-registry.json` preserves stable action handles across runs.
-Chat output is intentionally limited to focused actions, provider targets, copy payloads, verification commands, repo-relative file targets, and resume prompts. It does not print secrets, raw env values, or generic dashboard link dumps.
-Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
-Preview the action surface without login, scan, or API spend:
-```bash
-npx -y viberaven preview --agent-mode
-```
-The preview uses sample renderer data to show the intended chat-native shape. It is not a readiness verdict for the current repository.
-## Agent infrastructure direction
-VibeRaven's action model is designed for repo chat, terminal agents, MCP workflows, and richer agent hosts later.
-Managed-agent systems need durable sessions, observable event history, credential boundaries, bounded execution, and resumable action state. VibeRaven keeps those concerns in the manifest contract:
-- `.viberaven/actions.json` is the current action surface.
-- `.viberaven/action-registry.json` preserves stable IDs and lifecycle history.
-- Future session events can add an append-only timeline without changing the current action model.
-- Provider credentials and raw env values must stay out of chat output, manifests, MCP resources, and UI renderers.
-- Future local/hosted consoles should execute only narrow VibeRaven commands, not arbitrary shell text.
-## What-Changed Loop
-VibeRaven runs a batch-disciplined loop until the next fix is grounded in repo evidence, release context, and provider context. Do not stop at "scan complete."
-1. **Scan** — Run `--agent-mode`. Read `.viberaven/agent-tasklist.md` and parse `VIBERAVEN_NEXT_ACTION` from stdout for `batchSize`, `batchApplied`, `scanNow`, and `stalled`.
-2. **Batch heals** — For each repo-code task where `requiresUserAction: false`, apply up to `batchSize` heals per batch (free=3, pro=10) via `viberaven_heal_apply { gap: "<gapId>", yes: true }` or `--heal --apply --gap <id> --yes`. When `scanNow: true`, verify before applying more heals.
-3. **Verify context** — Run `--verify` once per batch (not after every heal). Repeat until `gate.status === 'clear'` in `.viberaven/gate-result.json`. For provider gaps, read `VIBERAVEN_PROVIDER_ACTION`, complete the dashboard step, then verify.
-If `stalled: true`, stop calling verify and address provider-action gaps or report to the user. Run `--strict` before deploy or CI pass.
-## Machine Output
-```bash
-npx -y viberaven --agent-mode --json
-npx -y viberaven --agent-mode --jsonl
-npx -y viberaven --strict --json
-```
-Machine artifact contract:
-```text
-docs/contracts/artifacts.md
-https://viberaven.dev/schemas/gate-result.schema.json
-https://viberaven.dev/schemas/context-map.schema.json
-https://viberaven.dev/schemas/gap.schema.json
-https://viberaven.dev/schemas/heal-result.schema.json
-```
-## Development
-```bash
-npm run cli:build
-npm run cli:test
-node packages/cli/dist/cli.js scan
-```
-## License
-The public npm CLI package is MIT licensed. Private monorepo code and extension packaging may have separate product terms.
+# @viberaven/cli
+[![npm version](https://img.shields.io/npm/v/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
+[![npm downloads](https://img.shields.io/npm/dw/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
+[![license](https://img.shields.io/npm/l/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
+VibeRaven is the local Studio cockpit for AI-built apps. It gives Codex, Claude Code, Gemini CLI, Cursor, and other coding agents a clean production workspace for chat, provider context, MCP-assisted setup, release/version review, diffs, and approval-controlled repo work.
+## Start the Studio
+```bash
+npx -y viberaven
+```
+That command opens the local Studio UI for:
+- agentic chat with connected CLIs;
+- draggable provider and release context;
+- provider MCP visibility;
+- architecture map, terminal, and diff views;
+- approval modes for ask, approve, and full-access work.
+The unscoped `viberaven` package is a small shim that launches this CLI package.
+## Agent Connections
+Inside the Studio, connect an installed CLI and test it before chat control:
+- Codex CLI
+- Claude Code
+- Gemini CLI
+Installed is not the same as connected. VibeRaven asks the selected CLI to prove it can run in the current repo before using it for real chat work.
+## Provider And Release Context
+Use the Studio side tabs and context chips to attach provider or version context to a chat mission:
+- Providers: Supabase, Vercel, GitHub, Stripe, Sentry, PostHog, Clerk, Auth.js, Resend, Upstash.
+- Releases: current and recent git tags, changelog snippets, rollback context, and release comparisons.
+- Architecture: repo and provider boundaries for inspection and planning.
+Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must still be completed or verified in the provider dashboard or through read-only provider evidence.
+## Machine And CI Commands
+The Studio is the default product surface. These commands remain available for automation and CI:
+```bash
+npx -y viberaven check --json
+npx -y viberaven --strict --json
+npx -y viberaven actions
+npx -y viberaven verify --action VR-A1
+```
+For focused work:
+```bash
+npx -y viberaven next --json
+npx -y viberaven prompt --gap <id>
+npx -y viberaven audit --vercel-supabase
+```
+## Legacy Agent Mode
+`--agent-mode` is kept for older artifact-first agent workflows:
+```bash
+npx -y viberaven --agent-mode
+```
+It writes artifacts such as:
+- `.viberaven/agent-tasklist.md`
+- `.viberaven/gate-result.json`
+- `.viberaven/context-map.json`
+- `.viberaven/agent-summary.md`
+- `.viberaven/launch-playbook.md`
+New product work should prefer the Studio and MCP/chat context flow instead of the old tasklist-first loop.
+## MCP
+Use the MCP package when an agent host supports MCP tools:
+```bash
+npx -y @viberaven/mcp
+```
+The MCP server wraps the public CLI and exposes readiness, verification, action, audit, and healing tools without exposing secrets.
+## Development
+```bash
+npm --prefix packages/cli run typecheck
+npm --prefix packages/cli test -- local-ui/server.test.ts
+npm --prefix packages/cli run build
+```
+For a local package publish check, run from this package directory:
+```bash
+cd packages/cli
+npm pack --dry-run
+```
+## License
+MIT

package/SECURITY.md CHANGED Viewed

@@ -1,52 +1,53 @@
-# Security - `@viberaven/cli`
-## Managed Scan Boundary
-The npm CLI does not read `OPENAI_API_KEY` and does not accept a bring-your-own-key scan path. Scans use the VibeRaven managed API after device login, same as the signed-in VS Code extension.
-- API keys for model calls live on the server, not in the published npm package.
-- Local credentials store only a VibeRaven access token in `%APPDATA%\viberaven\credentials.json` or `~/.config/viberaven/`.
-- Never commit `credentials.json` or paste tokens into chat.
-## Safe Commands
-Human terminal:
-```bash
-npx -y viberaven
-```
-Agent or CI gate:
-```bash
-npx -y viberaven --agent-mode
-npx -y viberaven --verify
-npx -y viberaven --strict
-```
-VibeRaven is the what-changed layer for AI-built apps. Agents should read `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json` when using the artifact loop, and should not claim provider state is proven by repo edits alone.
-## Written Artifacts
-After a scan, the CLI may create:
-| Path | Contents |
-|------|----------|
-| `.viberaven/last-scan.json` | Full scan payload |
-| `.viberaven/agent-tasklist.md` | Agent tasklist |
-| `.viberaven/gate-result.json` | Machine gate verdict |
-| `.viberaven/context-map.json` | Compact agent context |
-| `.viberaven/gaps/<gapId>.json` | Per-gap evidence |
-| `.viberaven/agent-summary.md` | Human/agent summary |
-| `.viberaven/launch-playbook.md` | Launch checklist |
-| `.viberaven/report.html` | Local HTML report |
-Repo scanners redact common key patterns in evidence strings; the CLI runs an extra redaction pass before writing files.
-## Provider Boundaries
-Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
-## Reporting Issues
-If you believe a scan artifact leaked a secret, rotate the key immediately and open an issue at https://github.com/ohad6k/VibeRaven/issues with the redacted file path only.
+# Security - `@viberaven/cli`
+## Managed Scan Boundary
+The npm CLI does not read `OPENAI_API_KEY` and does not accept a bring-your-own-key scan path. Scans use the VibeRaven managed API after device login, same as the signed-in VS Code extension.
+- API keys for model calls live on the server, not in the published npm package.
+- Local credentials store only a VibeRaven access token in `%APPDATA%\viberaven\credentials.json` or `~/.config/viberaven/`.
+- Never commit `credentials.json` or paste tokens into chat.
+## Safe Commands
+Human terminal:
+```bash
+npx -y viberaven
+```
+Agent or CI gate:
+```bash
+npx -y viberaven --agent-mode
+npx -y viberaven --verify
+npx -y viberaven --strict
+```
+VibeRaven is the Agent Context + Production Gate. Agents should read `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json` before claiming an app is safe to deploy.
+## Written Artifacts
+After a scan, the CLI may create:
+| Path | Contents |
+|------|----------|
+| `.viberaven/last-scan.json` | Full scan payload |
+| `.viberaven/agent-tasklist.md` | Agent tasklist |
+| `.viberaven/gate-result.json` | Machine gate verdict |
+| `.viberaven/context-map.json` | Compact agent context |
+| `.viberaven/gaps/<gapId>.json` | Per-gap evidence |
+| `.viberaven/agent-summary.md` | Human/agent summary |
+| `.viberaven/launch-playbook.md` | Launch checklist |
+| `.viberaven/report.html` | Local HTML report |
+Repo scanners redact common key patterns in evidence strings; the CLI runs an extra redaction pass before writing files.
+## Provider Boundaries
+Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard or through read-only provider evidence.
+## Reporting Issues
+If you believe a scan artifact leaked a secret, rotate the key immediately and open an issue at https://github.com/ohad6k/VibeRaven/issues with the redacted file path only.