@zivis/cli 0.1.0-alpha.34 → 0.1.0-alpha.35

package/dist/internal/extractor/graph-builder.js

@@ -1,32 +1,8 @@
-/**
- * Build a RepoGraphArtifactV1 from an ExtractionResult.
- *
- * The existing extractor emits an entity-list shape (components,
- * externalServices, dataStores, manifests). This builder is the canonical
- * translator from that internal intermediate into the graph artifact that
- * downstream pattern matching, threat modeling, and evidence storage all
- * consume.
- *
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
- * Schema: schemas/repo-graph-artifact.schema.json
- *
- * v1 scope (locked): three node types (service, endpoint, external_dependency)
- * and two edge types (exposes, depends_on). Datastores and the corresponding
- * reads/writes edges are deferred to Phase 1.5.
- *
- * Lane assignment for v1: every node and edge produced by deterministic
- * adapter output is `trusted`. Inferred-lane nodes are introduced later by
- * the matching engine (Phase 3), not by extraction.
- */
 const TRUSTED_LANE = "trusted";
 const TRUSTED_SOURCE = "inspect.trusted";
 export function buildRepoGraphArtifact(result, opts = {}) {
     const nodes = [];
     const edges = [];
-    // Service nodes — every component that isn't an external service or pure datastore.
-    // The existing extractor models datastores via `dataStores` and external SDKs via
-    // `externalServices`; `components` covers code-defined services and frontends.
-    // Skip components that arrive with empty evidence — schema requires minItems: 1.
     const serviceById = new Map();
     for (const component of result.components) {
         if (component.kind === "external_service" || component.kind === "data_store") {
@@ -38,10 +14,6 @@ export function buildRepoGraphArtifact(result, opts = {}) {
         serviceById.set(node.id, node);
         nodes.push(node);
     }
-    // Endpoint nodes + exposes edges — derived from each service's http_route evidence.
-    // Non-canonical methods (e.g. Express `app.use()` mounts emitted by the TS adapter)
-    // are dropped here — they're middleware mounts, not endpoints. Fixing them belongs
-    // upstream in the adapter; the graph-builder enforces the contract.
     for (const component of result.components) {
         const owningServiceId = serviceIdFor(component);
         if (!serviceById.has(owningServiceId))
@@ -61,9 +33,6 @@ export function buildRepoGraphArtifact(result, opts = {}) {
             edges.push(buildExposesEdge(owningServiceId, endpointNode.id, ev));
         }
     }
-    // External dependency nodes — one per (registry, package) tuple.
-    // Manifest-only deps (no callSites) fall back to manifest evidence so they still
-    // satisfy the schema's evidence: minItems: 1 invariant.
     const manifestEvidenceByPackage = indexManifestsByPackage(result);
     const depById = new Map();
     for (const ext of result.externalServices) {
@@ -71,11 +40,10 @@ export function buildRepoGraphArtifact(result, opts = {}) {
         if (depById.has(node.id))
             continue;
         if (node.evidence.length === 0)
-            continue; // truly orphaned — skip
+            continue;
         depById.set(node.id, node);
         nodes.push(node);
     }
-    // File-to-service index for resolving callSites into depends_on edges.
     const fileToServiceId = buildFileToServiceIndex(result.components, serviceById);
     for (const ext of result.externalServices) {
         const depId = externalDepId(ext);
@@ -119,7 +87,6 @@ export function buildRepoGraphArtifact(result, opts = {}) {
         edges,
     };
 }
-// ── Node builders ──
 function buildServiceNode(component) {
     const id = serviceIdFor(component);
     return {
@@ -208,7 +175,6 @@ function buildDependsOnEdge(serviceId, depId, evidence) {
         evidence,
     };
 }
-// ── Helpers ──
 function serviceIdFor(component) {
     return `service::${component.language}::${component.name}`;
 }
@@ -217,12 +183,9 @@ function externalDepId(ext) {
     return `external_dependency::${registry}::${ext.package}`;
 }
 function registryFor(ext) {
-    // Heuristic — the existing extractor doesn't tag registry, so derive from package shape.
     if (ext.package.startsWith("github.com/"))
         return "go";
     if (ext.package.startsWith("@") || /^[a-z0-9-]+$/.test(ext.package)) {
-        // npm + pypi share many shapes; lean npm by default since most ai_sdks live there.
-        // PyPI-only packages can be retagged once adapters expose registry directly.
         return "npm";
     }
     return "npm";
@@ -280,4 +243,3 @@ function toImportEvidence(loc, pkg) {
 function stripPrefix(value, prefix) {
     return value.startsWith(prefix) ? value.slice(prefix.length) : value;
 }
-//# sourceMappingURL=graph-builder.js.map

package/dist/internal/extractor/graph-types.d.ts

@@ -1,13 +1,3 @@
-/**
- * TypeScript interfaces for RepoGraphArtifactV1.
- *
- * Canonical source: schemas/repo-graph-artifact.schema.json
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
- *
- * The JSON schema is authoritative — these types must stay in sync. A
- * repo-level test (planned) validates extractor output against the schema
- * to catch drift.
- */
 export type Lane = "trusted" | "inferred";
 export type Source = "inspect.trusted" | "inspect.inferred";
 export type GraphLanguage = "typescript" | "javascript" | "python" | "go";

package/dist/internal/extractor/graph-types.js

@@ -1,12 +1 @@
-/**
- * TypeScript interfaces for RepoGraphArtifactV1.
- *
- * Canonical source: schemas/repo-graph-artifact.schema.json
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
- *
- * The JSON schema is authoritative — these types must stay in sync. A
- * repo-level test (planned) validates extractor output against the schema
- * to catch drift.
- */
 export {};
-//# sourceMappingURL=graph-types.js.map

package/dist/internal/extractor/index.d.ts

@@ -1,22 +1,8 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import type { ExtractionResult } from "./types.js";
 export interface RunOptions {
     rootDir: string;
-    /** Subset of language adapters to run; defaults to all registered. */
     languages?: Array<"typescript" | "go" | "python">;
-    /** Extra ignore patterns from --ignore flags. */
     extraIgnores?: string[];
-    /** Version string for the extractor — usually @zivis/cli's package version. */
     extractorVersion: string;
 }
 export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;

package/dist/internal/extractor/index.js

@@ -1,14 +1,3 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -25,7 +14,6 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
-    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -104,4 +92,3 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/types.d.ts

@@ -1,29 +1,3 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -44,21 +18,16 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
-    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
-    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
-    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
-    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
-    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -84,30 +53,16 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
-    /**
-     * Per-language manifests detected in the scope. Surfaces dependency-only
-     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
-     * we can't yet match call sites.
-     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
-    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
-/**
- * Adapter contract — one per language. Each adapter is fed the list of
- * source files matched for it (already filtered by .gitignore + .zivisignore)
- * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
- * structured findings the framework merges into the final ExtractionResult.
- */
 export interface LanguageAdapter {
     language: Language;
-    /** File extensions this adapter handles. */
     extensions: string[];
-    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1,28 +1 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/internal/extractor/walker.d.ts

@@ -1,24 +1,7 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 export interface WalkOptions {
     rootDir: string;
-    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
-    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
-    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -28,5 +11,4 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
-/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;

package/dist/internal/extractor/walker.js

@@ -1,17 +1,3 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -64,7 +50,6 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
-                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -99,12 +84,9 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
-        // No ignore file — fine.
     }
 }
-/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=walker.js.map

package/dist/internal/github-linkage-prompt.d.ts

@@ -1,26 +1,7 @@
-/**
- * Lane-2 conversion prompts — nudges the user to install the ZIVIS
- * GitHub App and / or link a repo to a specific Application.
- *
- * Surfaced from `zivis auth login`, `zivis auth init`, and `zivis check`
- * so the next step is obvious right after a developer signs in.
- *
- * Best-effort by design: any fetch failure returns `null` so we don't
- * fail an otherwise-successful auth or check run on a transient API
- * blip.
- */
 import type { ZivisConfig } from "@zivis/mcp/types";
 export interface BuildLinkagePromptOpts {
     config: ZivisConfig;
-    /** Optional. When provided we also check whether THIS app has linked repos. */
     applicationId?: string;
-    /** Format hint: "short" omits the explanatory why-line. Default "full". */
     style?: "short" | "full";
 }
-/**
- * Fetch GitHub App status + (if applicationId given) per-app repo
- * linkage status, then return a multi-line printable prompt suggesting
- * the next step. Returns null when nothing actionable is missing
- * (fully linked) or when we couldn't determine the state.
- */
 export declare function buildLinkagePrompt(opts: BuildLinkagePromptOpts): Promise<string | null>;

package/dist/internal/github-linkage-prompt.js

@@ -1,21 +1,4 @@
-/**
- * Lane-2 conversion prompts — nudges the user to install the ZIVIS
- * GitHub App and / or link a repo to a specific Application.
- *
- * Surfaced from `zivis auth login`, `zivis auth init`, and `zivis check`
- * so the next step is obvious right after a developer signs in.
- *
- * Best-effort by design: any fetch failure returns `null` so we don't
- * fail an otherwise-successful auth or check run on a transient API
- * blip.
- */
 import { resolveAuth } from "@zivis/mcp/auth";
-/**
- * Fetch GitHub App status + (if applicationId given) per-app repo
- * linkage status, then return a multi-line printable prompt suggesting
- * the next step. Returns null when nothing actionable is missing
- * (fully linked) or when we couldn't determine the state.
- */
 export async function buildLinkagePrompt(opts) {
     const creds = await resolveAuth(opts.config);
     if (creds.method === "none")
@@ -23,24 +6,19 @@ export async function buildLinkagePrompt(opts) {
     const appStatus = await fetchGitHubAppStatus(opts.config, creds);
     if (!appStatus)
         return null;
-    // Case 1: GitHub App not installed at all → install URL.
     if (!appStatus.installed) {
         if (!appStatus.installUrl)
-            return null; // env not configured; don't show a broken link
+            return null;
         return formatInstallPrompt(appStatus.installUrl, opts.style ?? "full");
     }
-    // Case 2: App installed but caller has a specific applicationId and
-    // that app has no linked repo → web link-repo prompt.
     if (opts.applicationId) {
         const repoStatus = await fetchAppRepoStatus(opts.config, creds, opts.applicationId);
         if (repoStatus && !repoStatus.linked) {
             return formatLinkRepoPrompt(opts.config, opts.applicationId, opts.style ?? "full");
         }
     }
-    // Case 3: All good (or no applicationId to check at app-level).
     return null;
 }
-// ── HTTP helpers ──
 async function fetchGitHubAppStatus(config, creds) {
     try {
         const res = await fetch(`${config.apiBaseUrl}/api/github-app/status`, {
@@ -78,7 +56,6 @@ function authHeaders(creds) {
     }
     return base;
 }
-// ── Formatters ──
 function formatInstallPrompt(installUrl, style) {
     if (style === "short") {
         return `Next: install the ZIVIS GitHub App — ${installUrl}`;
@@ -104,18 +81,15 @@ function formatLinkRepoPrompt(config, applicationId, style) {
     ].join("\n");
 }
 function guessAppUrlFromApi(apiBaseUrl) {
-    // Standard mapping: api.* ⇄ app.* on the same root domain.
     try {
         const u = new URL(apiBaseUrl);
         if (u.host.startsWith("api.")) {
             u.host = "app." + u.host.slice(4);
             return `${u.protocol}//${u.host}`;
         }
-        // localhost / non-standard hosts → fall back to the api URL itself.
         return apiBaseUrl;
     }
     catch {
         return "https://app.zivis.ai";
     }
 }
-//# sourceMappingURL=github-linkage-prompt.js.map

package/dist/internal/ide-setup.d.ts

@@ -1,34 +1,11 @@
 export type GuidanceClient = "cursor" | "claude-code-cli" | "vscode-copilot" | "vscode-claude" | "cline" | "windsurf";
 export interface GuidanceOptions {
-    /** Workspace root to write guidance files into */
     cwd: string;
-    /** Which IDE client to write guidance for */
     client: GuidanceClient;
 }
-/**
- * Write IDE guidance files for the given client.
- *
- * The guidance files teach the host AI (Cursor, Claude Code, etc.)
- * when to suggest ZIVIS tools — no security knowledge required from the user.
- *
- * All writes are idempotent: re-running replaces only the ZIVIS-managed
- * block, never user content.
- *
- * Returns the list of file paths written.
- */
 export declare function writeGuidance(opts: GuidanceOptions): string[];
-/**
- * Detect which IDE configs are present in the given workspace.
- * Returns client identifiers whose config files/dirs were found.
- */
 export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
 export declare function setupCursor(): Promise<void>;
-/**
- * Write a workspace-level .cursor/mcp.json with `--workspace <cwd>` so Cursor
- * starts an isolated MCP process bound to this specific repo.
- * One process = one org = zero cross-tenant risk, regardless of what other
- * repos are open in Cursor.
- */
 export declare function setupCursorWorkspace(): Promise<void>;
 export declare function setupVsCodeCopilot(): Promise<void>;
 export declare function setupVsCodeClaude(): Promise<void>;

package/dist/internal/ide-setup.js

@@ -1,12 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 const SERVER_NAME = "zivis";
-// ── Idempotent block append ──
-/**
- * Append (or replace) a ZIVIS-managed block inside a text file.
- * The block is wrapped in <!-- BEGIN ZIVIS:key --> / <!-- END ZIVIS:key -->
- * markers so future calls replace only this section without touching user content.
- */
 function appendBlock(filePath, blockKey, content) {
     const begin = `<!-- BEGIN ZIVIS:${blockKey} -->`;
     const end = `<!-- END ZIVIS:${blockKey} -->`;
@@ -31,8 +25,6 @@ function appendBlock(filePath, blockKey, content) {
 function escapeRegex(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-// ── Content templates ──
-/** Full Cursor .mdc rule — uses globs so it only attaches when relevant files are open */
 function cursorRuleContent() {
     return `---
 description: ZIVIS security guidance — quietly suggest security checks at the right moments
@@ -117,7 +109,6 @@ might break in", "security plan", "categories of attacks".
 
 <!-- END ZIVIS:guidance -->`;
 }
-/** Short block for CLAUDE.md / AGENTS.md — must be concise (read every turn) */
 function claudeBlockContent() {
     return `## ZIVIS Security (MCP)
 
@@ -135,7 +126,6 @@ ZIVIS is connected to this project. Use its tools sparingly — only for securit
 
 **Slash commands:** /zivis-getting-started  /zivis-secure-my-app  /zivis-audit-dependencies  /zivis-prep-for-launch`;
 }
-/** .clinerules / .windsurfrules content */
 function ruleFileContent() {
     return `# ZIVIS Security Guidance
 
@@ -168,7 +158,6 @@ Say "security plan" not "threat model".
 /zivis-prep-for-launch — pre-launch checklist
 /zivis-weekly-check — weekly status update`;
 }
-/** GitHub Copilot instructions block */
 function copilotBlockContent() {
     return `## ZIVIS Security Integration
 
@@ -186,7 +175,6 @@ Use ZIVIS only for security-related user requests. Never proactively run scans o
 
 **Language:** Avoid security jargon (threat model, STRIDE, attack vector) unless user uses it first.`;
 }
-// ── Per-IDE writers ──
 function writeCursorGuidance(cwd) {
     const rulesDir = path.join(cwd, ".cursor", "rules");
     if (!fs.existsSync(rulesDir))
@@ -225,24 +213,12 @@ function writeWindsurfGuidance(cwd) {
     fs.writeFileSync(rulesPath, ruleFileContent());
     return rulesPath;
 }
-/**
- * Write IDE guidance files for the given client.
- *
- * The guidance files teach the host AI (Cursor, Claude Code, etc.)
- * when to suggest ZIVIS tools — no security knowledge required from the user.
- *
- * All writes are idempotent: re-running replaces only the ZIVIS-managed
- * block, never user content.
- *
- * Returns the list of file paths written.
- */
 export function writeGuidance(opts) {
     const { cwd, client } = opts;
     const written = [];
     switch (client) {
         case "cursor": {
             written.push(writeCursorGuidance(cwd));
-            // Also write CLAUDE.md/AGENTS.md block if those files exist
             const extraPaths = writeClaudeBlockGuidance(cwd).filter((p) => fs.existsSync(p));
             written.push(...extraPaths);
             break;
@@ -267,46 +243,25 @@ export function writeGuidance(opts) {
     }
     return written.filter(Boolean);
 }
-/**
- * Detect which IDE configs are present in the given workspace.
- * Returns client identifiers whose config files/dirs were found.
- */
 export function detectIdesInRepo(cwd) {
     const found = [];
-    // Cursor
     if (fs.existsSync(path.join(cwd, ".cursor"))) {
         found.push("cursor");
     }
-    // Claude Code (CLAUDE.md)
     if (fs.existsSync(path.join(cwd, "CLAUDE.md"))) {
         found.push("claude-code-cli");
     }
-    // VS Code (check for .vscode directory)
     if (fs.existsSync(path.join(cwd, ".vscode"))) {
-        // Assume Copilot by default for VS Code
         found.push("vscode-copilot");
     }
-    // Cline (.clinerules)
     if (fs.existsSync(path.join(cwd, ".clinerules"))) {
         found.push("cline");
     }
-    // Windsurf (.windsurfrules)
     if (fs.existsSync(path.join(cwd, ".windsurfrules"))) {
         found.push("windsurf");
     }
     return found;
 }
-/**
- * Build the MCP server config for an IDE config file.
- *
- * When workspacePath is provided, we pass it as `--workspace <path>` so the
- * MCP server process resolves its session from `.zivis/project.json` at that
- * path — not from an env var that can drift or be accidentally reused across
- * tenants. This gives us one-process-per-org isolation at the IDE level.
- *
- * ZIVIS_SESSION is intentionally NOT used here. The workspace path is the
- * canonical, immutable tenant binding for an MCP process.
- */
 function buildServerConfig(workspacePath, extra) {
     const args = ["mcp", "serve"];
     if (workspacePath) {
@@ -342,17 +297,10 @@ async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
 export async function setupCursor() {
     const homeDir = process.env.HOME || "";
     const configPath = path.join(homeDir, ".cursor", "mcp.json");
-    // Global config has no workspace path — serves repos without .zivis/project.json
     await updateMcpConfig(configPath, SERVER_NAME, buildServerConfig(), "mcpServers");
     console.log(`✓ Cursor global MCP config updated: ${configPath}`);
     console.log("  Restart Cursor for changes to take effect");
 }
-/**
- * Write a workspace-level .cursor/mcp.json with `--workspace <cwd>` so Cursor
- * starts an isolated MCP process bound to this specific repo.
- * One process = one org = zero cross-tenant risk, regardless of what other
- * repos are open in Cursor.
- */
 export async function setupCursorWorkspace() {
     const workspacePath = process.cwd();
     const configPath = path.join(workspacePath, ".cursor", "mcp.json");
@@ -446,4 +394,3 @@ export function printClaudeCodeManual() {
     console.log("");
     console.log("Then restart Claude Code for changes to take effect");
 }
-//# sourceMappingURL=ide-setup.js.map

package/dist/internal/orgs.js

@@ -28,4 +28,3 @@ export function extractEmail(idToken) {
         return "unknown";
     }
 }
-//# sourceMappingURL=orgs.js.map

package/dist/internal/project-binding.d.ts

@@ -7,7 +7,6 @@ export interface EnsureBindingOpts {
     cwd: string;
     autoBind: boolean;
     skipBind: boolean;
-    /** Overwrite an existing conflicting binding without erroring (used by `zivis auth init`). */
     force?: boolean;
 }
 export declare function ensureProjectBinding(opts: EnsureBindingOpts): Promise<void>;