@viberaven/cli 1.6.5 → 1.6.6

package/README.md

@@ -10,10 +10,10 @@ Requires Node.js 20 or newer. Run from the app's project root:
 
 ```bash
 # Open the local Studio
-npx -y viberaven@1.6.5
+npx -y viberaven@1.6.6
 
 # Fresh terminal check
-npx -y viberaven@1.6.5 check
+npx -y viberaven@1.6.6 check
 ```
 
 The `viberaven` package launches this CLI. Studio combines findings, provider context and git comparisons. For chat, select an installed/authenticated Codex CLI, Claude Code or Gemini CLI and use **Test connection**. Access modes: `ask`, `approve`, `full`. Stop Studio with Ctrl+C.
@@ -27,10 +27,10 @@ Checks include migration tables without RLS, unrestricted policy conditions such
 `check --json` prints a findings summary and artifact paths. `--json` without `check` runs a fresh scan and prints the full gate object.
 
 ```bash
-npx -y viberaven@1.6.5 check --json
-npx -y viberaven@1.6.5 audit --vercel-supabase --json
-npx -y viberaven@1.6.5 fix --gap <gapId> --dry-run
-npx -y viberaven@1.6.5 init --agents all --dry-run
+npx -y viberaven@1.6.6 check --json
+npx -y viberaven@1.6.6 audit --vercel-supabase --json
+npx -y viberaven@1.6.6 fix --gap <gapId> --dry-run
+npx -y viberaven@1.6.6 init --agents all --dry-run
 ```
 
 Read tasks and source before targeted edits. Preview fixes first. The `rls_disabled` recipe adds an RLS migration without policies: agree before applying, because browser roles lose row access until policies exist. Apply/test through your database workflow; recheck after a batch. Provider actions require provider evidence.
@@ -41,9 +41,9 @@ Read tasks and source before targeted edits. Preview fixes first. The `rls_disab
 
 ```bash
 # Fail on blockers
-npx -y viberaven@1.6.5 --strict --json
+npx -y viberaven@1.6.6 --strict --json
 # Also fail on warnings
-npx -y viberaven@1.6.5 --strict=warning --json
+npx -y viberaven@1.6.6 --strict=warning --json
 ```
 
 Default `--strict` returns 0 for `clear`/`warning`, 1 for `not_clear`, 2 for `error`, 3 for `unknown` or unavailable results. `--strict=warning` also returns 1 for warnings.

package/dist/cli.js

@@ -10797,13 +10797,17 @@ function buildGapSeeds(scan, audit, databaseEvidence, extra = {}) {
   );
   const apiRoutes = hasApiRoutes(scan);
   if (scan.secretsFound.length > 0) {
+    const privateLikePaths = scan.secretsFound.filter(
+      (path) => !AMBIGUOUS_CONFIGURATION_BASENAMES.has(import_node_path7.posix.basename(path.replace(/\\/g, "/")).toLowerCase())
+    );
+    const ambiguousOnly = privateLikePaths.length === 0;
     seeds.push({
       id: "secrets_in_repo",
       category: "SECURITY & AUTH",
-      severity: "critical",
-      title: "Secret files are not gitignored",
-      detail: `Files that normally hold live credentials are not covered by .gitignore (${scan.secretsFound.slice(0, 5).join(", ")}). One \`git add .\` away from leaking keys into history.`,
-      copyPrompt: "Add the listed secret files (.env and friends) to .gitignore, verify none of them are already tracked with `git ls-files`, and if any were ever committed, rotate those credentials with the provider and scrub git history.",
+      severity: ambiguousOnly ? "warning" : "critical",
+      title: ambiguousOnly ? "Configuration filenames need review" : "Private-credential-like filenames need review",
+      detail: `This filename-only check found files not covered by .gitignore (${scan.secretsFound.slice(0, 5).join(", ")}). Contents and Git tracking were not checked by this finding. ${ambiguousOnly ? "Base configuration may be intentionally tracked; credential content remains unverified." : `Private-credential-like filenames requiring review: ${privateLikePaths.slice(0, 5).join(", ")}. Credential content remains unverified.`}`,
+      copyPrompt: "Review the listed files locally without pasting their values. Keep intentionally tracked public/base configuration when appropriate, and ignore private overrides after review. Check for actual private credentials and their Git tracking/history locally (`git ls-files` checks tracking). Only if actual private credentials were committed or otherwise exposed, rotate them with the provider and review Git history cleanup.",
       primaryMapCategory: "security"
     });
   }
@@ -11185,7 +11189,7 @@ async function buildLocalStationOutput(input) {
     productionChecklist: checklistFrom(seeds)
   };
 }
-var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
+var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, STRIPE_CODE_USE, STRIPE_EDGE_WEBHOOK_PROMPT, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, AMBIGUOUS_CONFIGURATION_BASENAMES, FULL_READ_LIMITS, PAYMENT_PATH;
 var init_localStation = __esm({
   "src/localStation.ts"() {
     "use strict";
@@ -11332,6 +11336,14 @@ var init_localStation = __esm({
     FINDING_SEVERITY_RANK = { critical: 0, high: 1, warning: 2, info: 3 };
     DETAIL_MAX_FINDINGS = 10;
     SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+    AMBIGUOUS_CONFIGURATION_BASENAMES = /* @__PURE__ */ new Set([
+      ".env",
+      ".env.development",
+      ".env.production",
+      ".env.test",
+      ".npmrc",
+      "npmrc"
+    ]);
     FULL_READ_LIMITS = { files: 40, bytes: 512e3 };
     PAYMENT_PATH = /webhook|stripe|payment|billing|checkout/i;
   }
@@ -15023,7 +15035,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.6.5";
+    VERSION = "1.6.6";
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viberaven/cli",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "description": "VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.",
   "license": "MIT",
   "author": "VibeRaven",