@viberaven/cli 1.6.4 → 1.6.6

package/README.md

@@ -1,113 +1,67 @@
 # @viberaven/cli
 
-[![npm version](https://img.shields.io/npm/v/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
-[![npm downloads](https://img.shields.io/npm/dw/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
-[![license](https://img.shields.io/npm/l/@viberaven/cli)](https://www.npmjs.com/package/@viberaven/cli)
+A successful deploy does not show whether one user can read another user's rows. VibeRaven reads an AI-built Vercel + Supabase app's repository for missing row level security (RLS), permissive policies and other launch gaps, then writes findings and tasks a coding agent can work through.
 
-<p align="center">
-  <img src="https://raw.githubusercontent.com/ohad6k/VibeRaven/main/assets/banner.png" alt="VibeRaven — AI got your app to demo. VibeRaven gets it to production." width="100%" />
-</p>
+Use a pass before launch or client handoff, after a migration or policy change, or when investigating a production RLS, environment, database connection, service-role or Stripe webhook failure.
 
-VibeRaven is **the Card Table** — a local Studio where your AI-built app is laid out in front of you. Every provider (Supabase, Vercel, Stripe, ...) is a graded trading card in your hand: play a card and its production checks run instantly in chat; a **RAVEN GRADE 10** means that territory is production-ready. Versions are a pile you can pull from, your whole architecture is a region map of cards, and Codex, Claude Code, or Gemini CLI does the actual work — with you controlling how much it's allowed to touch.
+## Start From Your App
 
-## Start the Studio
+Requires Node.js 20 or newer. Run from the app's project root:
 
 ```bash
-npx -y viberaven
-```
-
-That command opens the table:
-
-- **Your hand** — providers as foil cards; click or drop one on the table and its launch checks run in chat, graded 1-10 from repo evidence.
-- **The version pile** — pull a release card to see what changed (real git compare + changelog), view the diff, or ask the agent to explain it.
-- **The region map** — your app as territory: pages, modules, and provider cards connected by routes, every card movable.
-- **Agentic chat** — missions run through your connected CLI, with `ask` / `approve` / `full` access modes and inline approve for risky work.
-- Provider MCP visibility, terminal, and diff views included.
-
-The unscoped `viberaven` package is a small shim that launches this CLI package.
-
-## Agent Connections
-
-Inside the Studio, connect an installed CLI and test it before chat control:
+# Open the local Studio
+npx -y viberaven@1.6.6
 
-- Codex CLI
-- Claude Code
-- Gemini CLI
-
-Installed is not the same as connected. VibeRaven asks the selected CLI to prove it can run in the current repo before using it for real chat work.
-
-## Provider And Release Context
+# Fresh terminal check
+npx -y viberaven@1.6.6 check
+```
 
-Use the Studio side tabs and context chips to attach provider or version context to a chat mission:
+The `viberaven` package launches this CLI. Studio combines findings, provider context and git comparisons. For chat, select an installed/authenticated Codex CLI, Claude Code or Gemini CLI and use **Test connection**. Access modes: `ask`, `approve`, `full`. Stop Studio with Ctrl+C.
 
-- Providers: Supabase, Vercel, GitHub, Stripe, Sentry, PostHog, Clerk, Auth.js, Resend, Upstash.
-- Releases: current and recent git tags, changelog snippets, rollback context, and release comparisons.
-- Architecture: repo and provider boundaries for inspection and planning.
+## Repository Evidence And Tasks
 
-Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must still be completed or verified in the provider dashboard or through read-only provider evidence.
+Checks include migration tables without RLS, unrestricted policy conditions such as `USING (true)`, browser-exposed service-role keys, environment names missing from `.env.example` or similar templates, and Stripe handlers without raw-body signature verification.
 
-## Machine And CI Commands
+`check` refreshes `.viberaven/agent-tasklist.md` (tasks and source locations), `gate-result.json` (full verdict), `context-map.json` (agent context) and `gaps/<gapId>.json` without patching app source.
 
-The Studio is the default product surface. These commands remain available for automation and CI:
+`check --json` prints a findings summary and artifact paths. `--json` without `check` runs a fresh scan and prints the full gate object.
 
 ```bash
-npx -y viberaven check --json
-npx -y viberaven --strict --json
-npx -y viberaven actions
-npx -y viberaven --verify --action VR-A1
+npx -y viberaven@1.6.6 check --json
+npx -y viberaven@1.6.6 audit --vercel-supabase --json
+npx -y viberaven@1.6.6 fix --gap <gapId> --dry-run
+npx -y viberaven@1.6.6 init --agents all --dry-run
 ```
 
-For focused work:
-
-```bash
-npx -y viberaven next --json
-npx -y viberaven prompt --gap <id>
-npx -y viberaven audit --vercel-supabase
-```
+Read tasks and source before targeted edits. Preview fixes first. The `rls_disabled` recipe adds an RLS migration without policies: agree before applying, because browser roles lose row access until policies exist. Apply/test through your database workflow; recheck after a batch. Provider actions require provider evidence.
 
-## Legacy Agent Mode
+## Exit Codes And CI
 
-`--agent-mode` is kept for older artifact-first agent workflows:
+`check` returns 0 with no critical blockers, allowing warnings; 1 for critical blockers; 2 for a scan or comparison error. Unrestricted SELECT can be intentional public content and is a default warning. The focused audit returns 1 whenever its status is not `pass`, including warnings.
 
 ```bash
-npx -y viberaven --agent-mode
+# Fail on blockers
+npx -y viberaven@1.6.6 --strict --json
+# Also fail on warnings
+npx -y viberaven@1.6.6 --strict=warning --json
 ```
 
-It writes artifacts such as:
-
-- `.viberaven/agent-tasklist.md`
-- `.viberaven/gate-result.json`
-- `.viberaven/context-map.json`
-- `.viberaven/agent-summary.md`
-- `.viberaven/launch-playbook.md`
+Default `--strict` returns 0 for `clear`/`warning`, 1 for `not_clear`, 2 for `error`, 3 for `unknown` or unavailable results. `--strict=warning` also returns 1 for warnings.
 
-New product work should prefer the Studio and MCP/chat context flow instead of the old tasklist-first loop.
+## Optional Artifact Compatibility Mode
 
-## MCP
-
-Use the MCP package when an agent host supports MCP tools:
+Older integrations can keep the canonical artifact command:
 
 ```bash
-npx -y @viberaven/mcp
+npx -y viberaven --agent-mode
 ```
 
-The MCP server wraps the public CLI and exposes readiness, verification, action, audit, and healing tools without exposing secrets.
+Studio remains the default. MCP hosts use the separate [`@viberaven/mcp`](https://www.npmjs.com/package/@viberaven/mcp) package.
 
-## Development
+## Scope And Evidence
 
-```bash
-npm --prefix packages/cli run typecheck
-npm --prefix packages/cli test -- local-ui/server.test.ts
-npm --prefix packages/cli run build
-```
-
-For a local package publish check, run from this package directory:
-
-```bash
-cd packages/cli
-npm pack --dry-run
-```
+The scan needs no VibeRaven login or API key; npm downloads can need network. It does not query live policies, prove complete permission coverage, run your build or deploy. With RLS off, table grants determine which roles and operations can reach rows. Verify live user access and provider environment, DNS, billing and webhooks separately. A clear result or score is not a security audit.
 
-## License
+The [missing-RLS example](https://ohad6k.github.io/VibeRaven/examples/proof/missing-rls/) and [RLS comparison](https://ohad6k.github.io/VibeRaven/examples/proof/rls-comparison/) retain published **1.6.3** runs. They are maintainer-authored, not new scans or independent endorsement. Comparison databases are local, not hosted Supabase.
 
-MIT
+[Public repository](https://github.com/ohad6k/VibeRaven) | [Agent reference](https://ohad6k.github.io/VibeRaven/llms.txt). License: MIT.

package/dist/cli.js

@@ -10797,13 +10797,17 @@ function buildGapSeeds(scan, audit, databaseEvidence, extra = {}) {
   );
   const apiRoutes = hasApiRoutes(scan);
   if (scan.secretsFound.length > 0) {
+    const privateLikePaths = scan.secretsFound.filter(
+      (path) => !AMBIGUOUS_CONFIGURATION_BASENAMES.has(import_node_path7.posix.basename(path.replace(/\\/g, "/")).toLowerCase())
+    );
+    const ambiguousOnly = privateLikePaths.length === 0;
     seeds.push({
       id: "secrets_in_repo",
       category: "SECURITY & AUTH",
-      severity: "critical",
-      title: "Secret files are not gitignored",
-      detail: `Files that normally hold live credentials are not covered by .gitignore (${scan.secretsFound.slice(0, 5).join(", ")}). One \`git add .\` away from leaking keys into history.`,
-      copyPrompt: "Add the listed secret files (.env and friends) to .gitignore, verify none of them are already tracked with `git ls-files`, and if any were ever committed, rotate those credentials with the provider and scrub git history.",
+      severity: ambiguousOnly ? "warning" : "critical",
+      title: ambiguousOnly ? "Configuration filenames need review" : "Private-credential-like filenames need review",
+      detail: `This filename-only check found files not covered by .gitignore (${scan.secretsFound.slice(0, 5).join(", ")}). Contents and Git tracking were not checked by this finding. ${ambiguousOnly ? "Base configuration may be intentionally tracked; credential content remains unverified." : `Private-credential-like filenames requiring review: ${privateLikePaths.slice(0, 5).join(", ")}. Credential content remains unverified.`}`,
+      copyPrompt: "Review the listed files locally without pasting their values. Keep intentionally tracked public/base configuration when appropriate, and ignore private overrides after review. Check for actual private credentials and their Git tracking/history locally (`git ls-files` checks tracking). Only if actual private credentials were committed or otherwise exposed, rotate them with the provider and review Git history cleanup.",
       primaryMapCategory: "security"
     });
   }
@@ -11185,7 +11189,7 @@ async function buildLocalStationOutput(input) {
     productionChecklist: checklistFrom(seeds)
   };
 }
-var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
+var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, AMBIGUOUS_CONFIGURATION_BASENAMES, FULL_READ_LIMITS, PAYMENT_PATH;
 var init_localStation = __esm({
   "src/localStation.ts"() {
     "use strict";
@@ -11332,6 +11336,14 @@ var init_localStation = __esm({
     FINDING_SEVERITY_RANK = { critical: 0, high: 1, warning: 2, info: 3 };
     DETAIL_MAX_FINDINGS = 10;
     SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+    AMBIGUOUS_CONFIGURATION_BASENAMES = /* @__PURE__ */ new Set([
+      ".env",
+      ".env.development",
+      ".env.production",
+      ".env.test",
+      ".npmrc",
+      "npmrc"
+    ]);
     FULL_READ_LIMITS = { files: 40, bytes: 512e3 };
     PAYMENT_PATH = /webhook|stripe|payment|billing|checkout/i;
   }
@@ -15023,7 +15035,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.6.4";
+    VERSION = "1.6.6";
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viberaven/cli",
-  "version": "1.6.4",
+  "version": "1.6.6",
   "description": "VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.",
   "license": "MIT",
   "author": "VibeRaven",