create-qa-architect 5.0.6 → 5.3.1

package/docs/REQUIREMENTS.md

@@ -0,0 +1,148 @@
+# qa-architect - Requirements
+
+**Version:** 1.0.0
+**Last Updated:** 2025-12-27
+**Generated by:** VBL Adopt (auto-extracted from codebase)
+
+## Summary
+
+| Category  | Count   | Status      |
+| --------- | ------- | ----------- |
+| Auth      | 9       | Implemented |
+| Data      | 7       | Implemented |
+| Core      | 88      | Implemented |
+| **Total** | **104** | -           |
+
+## Functional Requirements
+
+### Authentication (F.02)
+
+| REQ-ID      | Description                                         | Priority | Status      |
+| ----------- | --------------------------------------------------- | -------- | ----------- |
+| REQ-F.02.01 | Authentication Flow                                 | P0       | Implemented |
+| REQ-F.02.02 | should complete full authentication cycle           | P0       | Implemented |
+| REQ-F.02.03 | should handle invalid credentials properly          | P0       | Implemented |
+| REQ-F.02.04 | should enforce rate limiting on login attempts      | P0       | Implemented |
+| REQ-F.02.05 | User Authentication Flow                            | P0       | Implemented |
+| REQ-F.02.06 | should complete full authentication journey         | P0       | Implemented |
+| REQ-F.02.07 | should handle login validation errors               | P0       | Implemented |
+| REQ-F.02.08 | should persist authentication across page refreshes | P0       | Implemented |
+| REQ-F.02.09 | Telemetry tests                                     | P0       | Implemented |
+
+### Data Layer (F.06)
+
+| REQ-ID      | Description                                         | Priority | Status      |
+| ----------- | --------------------------------------------------- | -------- | ----------- |
+| REQ-F.06.01 | Database Operations                                 | P1       | Implemented |
+| REQ-F.06.02 | should handle database connection errors gracefully | P1       | Implemented |
+| REQ-F.06.03 | Cli Deps Integration tests                          | P1       | Implemented |
+| REQ-F.06.04 | Premium Dependency Monitoring tests                 | P1       | Implemented |
+| REQ-F.06.05 | Python Parser Fixes tests                           | P1       | Implemented |
+| REQ-F.06.06 | Real World Packages tests                           | P1       | Implemented |
+| REQ-F.06.07 | Setup tests                                         | P1       | Implemented |
+
+### Core Features (F.01)
+
+| REQ-ID      | Description                                             | Priority | Status      |
+| ----------- | ------------------------------------------------------- | -------- | ----------- |
+| REQ-F.01.01 | API Service Integration Tests                           | P0       | Implemented |
+| REQ-F.01.02 | Error Handling                                          | P0       | Implemented |
+| REQ-F.01.03 | Performance                                             | P0       | Implemented |
+| REQ-F.01.04 | should handle concurrent user creation                  | P0       | Implemented |
+| REQ-F.01.05 | should maintain data integrity during transactions      | P0       | Implemented |
+| REQ-F.01.06 | should validate request payloads properly               | P0       | Implemented |
+| REQ-F.01.07 | should handle reasonable load                           | P0       | Implemented |
+| REQ-F.01.08 | Frontend Application Integration Tests                  | P0       | Implemented |
+| REQ-F.01.09 | Component Integration                                   | P0       | Implemented |
+| REQ-F.01.10 | Navigation and Routing                                  | P0       | Implemented |
+| REQ-F.01.11 | Accessibility Integration                               | P0       | Implemented |
+| REQ-F.01.12 | Frontend E2E Tests                                      | P0       | Implemented |
+| REQ-F.01.13 | should handle complex form interactions                 | P0       | Implemented |
+| REQ-F.01.14 | should handle API loading states properly               | P0       | Implemented |
+| REQ-F.01.15 | should update UI based on real-time data                | P0       | Implemented |
+| REQ-F.01.16 | should handle complex navigation flows                  | P0       | Implemented |
+| REQ-F.01.17 | should preserve state during navigation                 | P0       | Implemented |
+| REQ-F.01.18 | should support keyboard navigation                      | P0       | Implemented |
+| REQ-F.01.19 | should work with screen readers                         | P0       | Implemented |
+| REQ-F.01.20 | should handle color contrast and visual requirements    | P0       | Implemented |
+| REQ-F.01.21 | should complete user signup and onboarding              | P0       | Implemented |
+| REQ-F.01.22 | should handle responsive design across devices          | P0       | Implemented |
+| REQ-F.01.23 | should handle network failures gracefully               | P0       | Implemented |
+| REQ-F.01.24 | should maintain performance under load                  | P0       | Implemented |
+| REQ-F.01.25 | runs a placeholder e2e flow                             | P0       | Implemented |
+| REQ-F.01.26 | sample unit test                                        | P0       | Implemented |
+| REQ-F.01.27 | runs and asserts truthy values                          | P0       | Implemented |
+| REQ-F.01.28 | Check Docs tests                                        | P0       | Implemented |
+| REQ-F.01.29 | Critical Fixes tests                                    | P0       | Implemented |
+| REQ-F.01.30 | Error Reporter                                          | P0       | Implemented |
+| REQ-F.01.31 | isErrorReportingEnabled                                 | P0       | Implemented |
+| REQ-F.01.32 | categorizeError                                         | P0       | Implemented |
+| REQ-F.01.33 | sanitizePath                                            | P0       | Implemented |
+| REQ-F.01.34 | sanitizeMessage                                         | P0       | Implemented |
+| REQ-F.01.35 | sanitizeStackTrace                                      | P0       | Implemented |
+| REQ-F.01.36 | ErrorReporter class                                     | P0       | Implemented |
+| REQ-F.01.37 | getErrorReportStats                                     | P0       | Implemented |
+| REQ-F.01.38 | clearErrorReports                                       | P0       | Implemented |
+| REQ-F.01.39 | Error report rotation                                   | P0       | Implemented |
+| REQ-F.01.40 | Error reporting file permissions                        | P0       | Implemented |
+| REQ-F.01.41 | Silent failure behavior                                 | P0       | Implemented |
+| REQ-F.01.42 | should be disabled by default                           | P0       | Implemented |
+| REQ-F.01.43 | should be enabled when ENV var is                       | P0       | Implemented |
+| REQ-F.01.44 | should be disabled for other ENV var values             | P0       | Implemented |
+| REQ-F.01.45 | should categorize permission errors                     | P0       | Implemented |
+| REQ-F.01.46 | should categorize dependency errors                     | P0       | Implemented |
+| REQ-F.01.47 | should categorize network errors                        | P0       | Implemented |
+| REQ-F.01.48 | should categorize configuration errors                  | P0       | Implemented |
+| REQ-F.01.49 | should categorize validation errors                     | P0       | Implemented |
+| REQ-F.01.50 | should categorize unknown errors                        | P0       | Implemented |
+| REQ-F.01.51 | should remove username from macOS paths                 | P0       | Implemented |
+| REQ-F.01.52 | should remove username from Linux paths                 | P0       | Implemented |
+| REQ-F.01.53 | should remove username from Windows paths               | P0       | Implemented |
+| REQ-F.01.54 | should handle non-string inputs                         | P0       | Implemented |
+| REQ-F.01.55 | should sanitize file paths in error messages            | P0       | Implemented |
+| REQ-F.01.56 | should sanitize git URLs with tokens                    | P0       | Implemented |
+| REQ-F.01.57 | should sanitize email addresses                         | P0       | Implemented |
+| REQ-F.01.58 | should sanitize file paths in stack traces              | P0       | Implemented |
+| REQ-F.01.59 | should not capture errors when disabled                 | P0       | Implemented |
+| REQ-F.01.60 | should capture errors when enabled                      | P0       | Implemented |
+| REQ-F.01.61 | should force capture with forceCapture context flag     | P0       | Implemented |
+| REQ-F.01.62 | should include operation context in report              | P0       | Implemented |
+| REQ-F.01.63 | should include additional context in report             | P0       | Implemented |
+| REQ-F.01.64 | should include user comment in report                   | P0       | Implemented |
+| REQ-F.01.65 | should sanitize error message and stack trace           | P0       | Implemented |
+| REQ-F.01.66 | should categorize errors correctly                      | P0       | Implemented |
+| REQ-F.01.67 | should return friendly messages for each error category | P0       | Implemented |
+| REQ-F.01.68 | should return empty stats when no reports exist         | P0       | Implemented |
+| REQ-F.01.69 | should calculate statistics correctly                   | P0       | Implemented |
+| REQ-F.01.70 | should delete error reports file                        | P0       | Implemented |
+| REQ-F.01.71 | should return false if no file exists                   | P0       | Implemented |
+| REQ-F.01.72 | should keep only last 50 reports                        | P0       | Implemented |
+| REQ-F.01.73 | should create error reports file with 0600 permissions  | P0       | Implemented |
+| REQ-F.01.74 | should not throw if error reporting save fails          | P0       | Implemented |
+| REQ-F.01.75 | Gitleaks Binary Resolution tests                        | P0       | Implemented |
+| REQ-F.01.76 | Gitleaks Checksum Verification tests                    | P0       | Implemented |
+| REQ-F.01.77 | Gitleaks Production Checksums tests                     | P0       | Implemented |
+| REQ-F.01.78 | .                                                       | P0       | Implemented |
+| REQ-F.01.79 | Interactive Routing Fix tests                           | P0       | Implemented |
+| REQ-F.01.80 | Multi Language Dependency Monitoring tests              | P0       | Implemented |
+| REQ-F.01.81 | Package Manager Detection tests                         | P0       | Implemented |
+| REQ-F.01.82 | ${i}                                                    | P0       | Implemented |
+| REQ-F.01.83 | example                                                 | P0       | Implemented |
+| REQ-F.01.84 | Python Detection Sensitivity tests                      | P0       | Implemented |
+| REQ-F.01.85 | Setup Error Coverage tests                              | P0       | Implemented |
+| REQ-F.01.86 | Validate Command Patterns tests                         | P0       | Implemented |
+| REQ-F.01.87 | Validation Factory tests                                | P0       | Implemented |
+| REQ-F.01.88 | \n                                                      | P0       | Implemented |
+
+## Non-Functional Requirements
+
+| REQ-ID      | Description    | Metric        | Target |
+| ----------- | -------------- | ------------- | ------ |
+| REQ-N.01.01 | Page load time | LCP           | < 2.5s |
+| REQ-N.01.02 | Test coverage  | Line coverage | >= 50% |
+| REQ-N.01.03 | Accessibility  | WCAG level    | AA     |
+
+---
+
+_Auto-generated by VBL Adopt - 2025-12-27_
+_Run `vbl qa` to verify requirements traceability_

package/docs/SECURITY-AUDIT.md

@@ -0,0 +1,68 @@
+# Security Audit Report
+
+**Status:** ❌ FAILED
+**Total Issues:** 18
+**Critical Issues:** 18
+**Session ID:** sess_mjqeacse_34vjaa
+
+## Secrets Scan
+
+**Status:** ❌ Failed
+**Secrets Found:** 18
+**ESLint Security Issues:** 0
+
+### Issues
+
+- 🔴 **CRITICAL**: Potential Long base64 strings found (lib/validation/config-security.js:17)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (lib/validation/config-security.js:19)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (lib/validation/config-security.js:21)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (lib/validation/config-security.js:23)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (lib/validation/config-security.js:25)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/critical-fixes.test.js:95)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-production-checksums.test.js:22)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-production-checksums.test.js:24)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-production-checksums.test.js:26)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-production-checksums.test.js:28)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-production-checksums.test.js:30)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-real-binary-test.js:25)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-real-binary-test.js:27)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-real-binary-test.js:29)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-real-binary-test.js:31)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/gitleaks-real-binary-test.js:33)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tests/setup-error-coverage.test.js:112)
+- 🔴 **CRITICAL**: Potential Long base64 strings found (tsconfig.json:13)
+
+## Dependency Audit
+
+**Status:** ✅ Passed
+**Total Vulnerabilities:** 0
+**Outdated Packages:** 10
+
+| Severity | Count |
+| -------- | ----- |
+| Critical | 0     |
+| High     | 0     |
+| Moderate | 0     |
+| Low      | 0     |
+
+## OWASP Top 10 Scan
+
+**Status:** ❌ Failed
+**Score:** 0/100
+
+| Check                                           | Status |
+| ----------------------------------------------- | ------ |
+| A01: Broken Access Control                      | ✅     |
+| A02: Cryptographic Failures                     | ❌     |
+| A03: Injection                                  | ❌     |
+| A04: Insecure Design                            | ❌     |
+| A05: Security Misconfiguration                  | ❌     |
+| A06: Vulnerable Components                      | ✅     |
+| A07: Identification and Authentication Failures | ✅     |
+| A08: Software and Data Integrity Failures       | ❌     |
+| A09: Security Logging and Monitoring Failures   | ❌     |
+| A10: Server-Side Request Forgery (SSRF)         | ✅     |
+
+---
+
+_Generated by Security_Auditor_Agent v2.0_

package/docs/TESTING.md

@@ -2,14 +2,13 @@
 
 ## Overview
 
-QA Architect uses Jest for testing with a focus on integration tests that validate real CLI workflows.
+QA Architect uses plain Node-based test runners (no Jest) with a heavy focus on integration tests that validate real CLI workflows end to end.
 
 ## Running Tests
 
 ```bash
-npm test                 # Run all tests
-npm run test:coverage    # Run with coverage report
-npm run test:watch       # Watch mode for development
+npm test                 # Run all tests (sequential Node scripts)
+npm run test:coverage    # Run with coverage report via c8
 ```
 
 ## Test Structure

package/docs/test-trace-matrix.md

@@ -0,0 +1,28 @@
+# qa-architect - Test Traceability Matrix
+
+**Generated:** 2025-12-27
+**Coverage Target:** 50%
+
+## Coverage Summary
+
+| Metric       | Value |
+| ------------ | ----- |
+| Requirements | 0     |
+| Covered      | 0     |
+| Coverage     | 0%    |
+
+## Requirement → Test Mapping
+
+| REQ-ID      | Description   | Test File | Status     |
+| ----------- | ------------- | --------- | ---------- |
+| REQ-F.01.01 | [Description] | -         | ⚠️ Missing |
+
+## Test → Requirement Mapping
+
+| Test File | Tests | REQ-IDs | Status |
+| --------- | ----- | ------- | ------ |
+| -         | -     | -       | -      |
+
+---
+
+_Run `vbl qa` to regenerate this matrix_

package/lib/billing-dashboard.html

@@ -311,9 +311,9 @@
             onclick="selectTier('pro')"
           >
             <div class="tier-name">Pro</div>
-            <div class="tier-price">$59<span class="period">/month</span></div>
+            <div class="tier-price">$19<span class="period">/month</span></div>
             <div style="color: #22c55e; font-size: 0.9rem">
-              or $590/year (save $118)
+              or $190/year (save $38)
             </div>
 
             <ul class="tier-features">
@@ -329,12 +329,8 @@
           <!-- Team Tier -->
           <div class="tier-card" data-tier="team" onclick="selectTier('team')">
             <div class="tier-name">Team</div>
-            <div class="tier-price">
-              $15<span class="period">/user/month</span>
-            </div>
-            <div style="color: #666; font-size: 0.9rem">
-              5-seat minimum ($75/mo)
-            </div>
+            <div class="tier-price">Contact us</div>
+            <div style="color: #666; font-size: 0.9rem">Coming soon</div>
 
             <ul class="tier-features">
               <li>All PRO features included</li>
@@ -353,10 +349,8 @@
             onclick="selectTier('enterprise')"
           >
             <div class="tier-name">Enterprise</div>
-            <div class="tier-price">$249<span class="period">/month</span></div>
-            <div style="color: #666; font-size: 0.9rem">
-              annual + $499 onboarding
-            </div>
+            <div class="tier-price">Contact us</div>
+            <div style="color: #666; font-size: 0.9rem">Coming soon</div>
 
             <ul class="tier-features">
               <li>All TEAM features included</li>

package/lib/commands/deps.js

@@ -0,0 +1,245 @@
+/**
+ * Dependency monitoring command handler
+ *
+ * Extracted from setup.js to improve maintainability.
+ * Handles --deps, --dependency-monitoring commands.
+ */
+
+const fs = require('fs')
+const path = require('path')
+
+const {
+  hasNpmProject,
+  generateBasicDependabotConfig,
+  writeBasicDependabotConfig,
+} = require('../dependency-monitoring-basic')
+
+const {
+  generatePremiumDependabotConfig,
+  writePremiumDependabotConfig,
+} = require('../dependency-monitoring-premium')
+
+const {
+  getLicenseInfo,
+  showUpgradeMessage,
+  checkUsageCaps,
+  incrementUsage,
+} = require('../licensing')
+
+/**
+ * Detect Python project
+ * @param {string} projectPath - Path to project
+ * @returns {boolean} True if Python project detected
+ */
+function detectPythonProject(projectPath) {
+  const pythonFiles = [
+    'pyproject.toml',
+    'requirements.txt',
+    'setup.py',
+    'Pipfile',
+  ]
+  return pythonFiles.some(file => fs.existsSync(path.join(projectPath, file)))
+}
+
+/**
+ * Detect Rust project
+ * @param {string} projectPath - Path to project
+ * @returns {boolean} True if Rust project detected
+ */
+function detectRustProject(projectPath) {
+  return fs.existsSync(path.join(projectPath, 'Cargo.toml'))
+}
+
+/**
+ * Detect Ruby project
+ * @param {string} projectPath - Path to project
+ * @returns {boolean} True if Ruby project detected
+ */
+function detectRubyProject(projectPath) {
+  return fs.existsSync(path.join(projectPath, 'Gemfile'))
+}
+
+/**
+ * Handle dependency monitoring command (Free/Pro/Team/Enterprise)
+ */
+async function handleDependencyMonitoring() {
+  const projectPath = process.cwd()
+  const license = getLicenseInfo()
+
+  // Detect all supported ecosystems (npm, Python, Ruby, Rust, etc.)
+  const hasNpm = hasNpmProject(projectPath)
+  const hasPython = detectPythonProject(projectPath)
+  const hasRust = detectRustProject(projectPath)
+  const hasRuby = detectRubyProject(projectPath)
+
+  if (!hasNpm && !hasPython && !hasRust && !hasRuby) {
+    console.error(
+      '❌ No supported dependency file found (package.json, pyproject.toml, requirements.txt, Gemfile, Cargo.toml).'
+    )
+    console.log("💡 Make sure you're in a directory with dependency files.")
+    process.exit(1)
+  }
+
+  if (hasNpm) console.log('📦 Detected: npm project')
+  if (hasPython) console.log('🐍 Detected: Python project')
+  if (hasRust) console.log('🦀 Detected: Rust project')
+  if (hasRuby) console.log('💎 Detected: Ruby project')
+  console.log(`📋 License tier: ${license.tier.toUpperCase()}`)
+
+  // Enforce Free tier caps for dependency monitoring (counted as dependency PRs)
+  if (license.tier === 'FREE') {
+    const capCheck = checkUsageCaps('dependency-pr')
+    if (!capCheck.allowed) {
+      console.error(`❌ ${capCheck.reason}`)
+      console.error(
+        '   Upgrade to Pro, Team, or Enterprise for unlimited runs: https://vibebuildlab.com/qa-architect'
+      )
+      process.exit(1)
+    }
+
+    const increment = incrementUsage('dependency-pr')
+    const usage = increment.usage || capCheck.usage
+    const caps = capCheck.caps
+    if (usage && caps && caps.maxDependencyPRsPerMonth !== undefined) {
+      console.log(
+        `🧮 Usage: ${usage.dependencyPRs}/${caps.maxDependencyPRsPerMonth} dependency monitoring runs used this month`
+      )
+    }
+  }
+
+  const dependabotPath = path.join(projectPath, '.github', 'dependabot.yml')
+
+  // Use premium or basic config based on license tier
+  const shouldUsePremium =
+    license.tier === 'PRO' ||
+    license.tier === 'TEAM' ||
+    license.tier === 'ENTERPRISE'
+
+  // Free tier only supports npm projects. Fail fast with a clear message.
+  if (!shouldUsePremium && !hasNpm && (hasPython || hasRust || hasRuby)) {
+    console.error(
+      '❌ Dependency monitoring for this project requires a Pro, Team, or Enterprise license.'
+    )
+    console.error(
+      '   Free tier supports npm projects only. Detected non-npm ecosystems.'
+    )
+    console.error(
+      '   Options: add npm/package.json, or upgrade and re-run: npx create-qa-architect@latest --deps after activation.'
+    )
+    process.exit(1)
+  }
+
+  if (shouldUsePremium) {
+    console.log(
+      '\n🚀 Setting up framework-aware dependency monitoring (Premium)...\n'
+    )
+
+    const configData = generatePremiumDependabotConfig({
+      projectPath,
+      schedule: 'weekly',
+    })
+
+    if (configData) {
+      const { ecosystems } = configData
+      const ecosystemNames = Object.keys(ecosystems)
+
+      if (ecosystemNames.length > 0) {
+        console.log('🔍 Detected ecosystems:')
+
+        let primaryEcosystem = null
+        ecosystemNames.forEach(ecoName => {
+          const eco = ecosystems[ecoName]
+          const frameworks = Object.keys(eco.detected || {})
+          const totalPackages = frameworks.reduce((sum, fw) => {
+            return sum + (eco.detected[fw]?.count || 0)
+          }, 0)
+
+          console.log(`   • ${ecoName}: ${totalPackages} packages`)
+
+          if (eco.primary) {
+            primaryEcosystem = ecoName
+          }
+        })
+
+        if (primaryEcosystem) {
+          console.log(`\n🎯 Primary ecosystem: ${primaryEcosystem}`)
+        }
+      }
+
+      writePremiumDependabotConfig(configData, dependabotPath)
+      console.log('\n✅ Created .github/dependabot.yml with framework grouping')
+
+      console.log('\n🎉 Premium dependency monitoring setup complete!')
+      console.log('\n📋 What was added (Pro Tier):')
+      console.log('   • Framework-aware dependency grouping')
+      console.log(
+        `   • ${Object.keys(configData.config.updates[0].groups || {}).length} dependency groups created`
+      )
+      console.log('   • Intelligent update batching (reduces PRs by 60%+)')
+      console.log('   • GitHub Actions dependency monitoring')
+    }
+  } else {
+    console.log('\n🔍 Setting up basic dependency monitoring (Free Tier)...\n')
+
+    const dependabotConfig = generateBasicDependabotConfig({
+      projectPath,
+      schedule: 'weekly',
+    })
+
+    if (dependabotConfig) {
+      writeBasicDependabotConfig(dependabotConfig, dependabotPath)
+      console.log('✅ Created .github/dependabot.yml')
+    }
+
+    console.log('\n🎉 Basic dependency monitoring setup complete!')
+    console.log('\n📋 What was added (Free Tier):')
+    console.log('   • Basic Dependabot configuration for npm packages')
+    console.log('   • Weekly dependency updates on Monday 9am')
+    console.log('   • GitHub Actions dependency monitoring')
+
+    // Show upgrade message for premium features
+    console.log('\n🔒 Premium features now available:')
+    console.log('   ✅ Framework-aware package grouping (React, Vue, Angular)')
+    console.log('   • Coming soon: Multi-language support (Python, Rust, Go)')
+    console.log('   • Planned: Advanced security audit workflows')
+    console.log('   • Planned: Custom update schedules and notifications')
+
+    showUpgradeMessage('Framework-Aware Dependency Grouping')
+  }
+
+  // Auto-enable Dependabot on GitHub if token available
+  console.log('\n🔧 Attempting to enable Dependabot on GitHub...')
+  try {
+    const { setupDependabot } = require('../github-api')
+    const result = await setupDependabot(projectPath, { verbose: true })
+
+    if (result.success) {
+      console.log('✅ Dependabot alerts and security updates enabled!')
+    } else if (result.errors.length > 0) {
+      console.log('⚠️  Could not auto-enable Dependabot:')
+      result.errors.forEach(err => console.log(`   • ${err}`))
+      console.log('\n💡 Manual steps needed:')
+      console.log('   • Go to GitHub repo → Settings → Code security')
+      console.log(
+        '   • Enable "Dependabot alerts" and "Dependabot security updates"'
+      )
+    }
+  } catch (error) {
+    console.log('⚠️  Could not auto-enable Dependabot:', error.message)
+    console.log('\n💡 Manual steps:')
+    console.log('   • Enable Dependabot in GitHub repo settings')
+  }
+
+  console.log('\n💡 Next steps:')
+  console.log('   • Review and commit .github/dependabot.yml')
+  console.log(
+    '   • Dependabot will start monitoring weekly for dependency updates'
+  )
+}
+
+module.exports = {
+  handleDependencyMonitoring,
+  detectPythonProject,
+  detectRustProject,
+  detectRubyProject,
+}

package/lib/commands/index.js

@@ -0,0 +1,25 @@
+/**
+ * Command handlers index
+ *
+ * Centralizes CLI command handlers for better maintainability.
+ * Each command has its own module with focused functionality.
+ */
+
+const { handleValidationCommands } = require('./validate')
+const {
+  handleDependencyMonitoring,
+  detectPythonProject,
+  detectRustProject,
+  detectRubyProject,
+} = require('./deps')
+
+module.exports = {
+  // Validation commands
+  handleValidationCommands,
+
+  // Dependency monitoring commands
+  handleDependencyMonitoring,
+  detectPythonProject,
+  detectRustProject,
+  detectRubyProject,
+}

package/lib/commands/validate.js

@@ -0,0 +1,85 @@
+/**
+ * Validation command handlers
+ *
+ * Extracted from setup.js to improve maintainability.
+ * Handles --validate, --comprehensive, --security-config, --validate-docs commands.
+ */
+
+const { ValidationRunner } = require('../validation')
+
+/**
+ * Handle validation-only commands
+ *
+ * @param {Object} options - Validation options
+ * @param {boolean} options.isConfigSecurityMode - Run config security check only
+ * @param {boolean} options.isDocsValidationMode - Run docs validation only
+ * @param {boolean} options.isComprehensiveMode - Run comprehensive validation
+ * @param {boolean} options.isValidationMode - Run validation mode
+ * @param {boolean} options.disableNpmAudit - Skip npm audit
+ * @param {boolean} options.disableGitleaks - Skip gitleaks
+ * @param {boolean} options.disableActionlint - Skip actionlint
+ * @param {boolean} options.disableMarkdownlint - Skip markdownlint
+ * @param {boolean} options.disableEslintSecurity - Skip ESLint security
+ * @param {boolean} options.allowLatestGitleaks - Allow latest gitleaks version
+ */
+async function handleValidationCommands(options) {
+  const {
+    isConfigSecurityMode,
+    isDocsValidationMode,
+    isComprehensiveMode,
+    isValidationMode,
+    disableNpmAudit,
+    disableGitleaks,
+    disableActionlint,
+    disableMarkdownlint,
+    disableEslintSecurity,
+    allowLatestGitleaks,
+  } = options
+
+  const validationOptions = {
+    disableNpmAudit,
+    disableGitleaks,
+    disableActionlint,
+    disableMarkdownlint,
+    disableEslintSecurity,
+    allowLatestGitleaks,
+  }
+  const validator = new ValidationRunner(validationOptions)
+
+  if (isConfigSecurityMode) {
+    try {
+      await validator.runConfigSecurity()
+      process.exit(0)
+    } catch (error) {
+      console.error(
+        `\n❌ Configuration security validation failed:\n${error.message}`
+      )
+      process.exit(1)
+    }
+  }
+
+  if (isDocsValidationMode) {
+    try {
+      await validator.runDocumentationValidation()
+      process.exit(0)
+    } catch (error) {
+      console.error(`\n❌ Documentation validation failed:\n${error.message}`)
+      process.exit(1)
+    }
+  }
+
+  if (isComprehensiveMode || isValidationMode) {
+    try {
+      // Use parallel validation for 3-5x speedup (runs checks concurrently)
+      await validator.runComprehensiveCheckParallel()
+      process.exit(0)
+    } catch (error) {
+      console.error(`\n❌ Comprehensive validation failed:\n${error.message}`)
+      process.exit(1)
+    }
+  }
+}
+
+module.exports = {
+  handleValidationCommands,
+}