delimit-cli 4.0.4 → 4.0.5

package/bin/delimit-cli.js

@@ -1318,7 +1318,7 @@ program
             }
         }
 
-        // Auto-detect OpenAPI spec files
+        // Auto-detect OpenAPI spec files — flat patterns + recursive scan
         const specPatterns = [
             'openapi.yaml', 'openapi.yml', 'openapi.json',
             'swagger.yaml', 'swagger.yml', 'swagger.json',
@@ -1329,9 +1329,146 @@ program
             'api/openapi.yaml', 'api/openapi.json',
             'contrib/openapi.json',
         ];
-        const foundSpecs = specPatterns.filter(p => fs.existsSync(path.join(projectDir, p)));
+        let foundSpecs = specPatterns.filter(p => fs.existsSync(path.join(projectDir, p)));
+
+        // Recursive scan: search common directories for OpenAPI/Swagger files
+        const specDirs = ['swagger', 'api', 'docs', 'spec', 'specs', 'openapi', 'schema', 'schemas', 'config', 'src'];
+        const specExtensions = ['.yaml', '.yml', '.json'];
+        const specKeywords = ['openapi', 'swagger', 'api-spec', 'api_spec'];
+        function scanDirForSpecs(dir, depth = 0) {
+            if (depth > 2) return [];  // limit recursion depth
+            const results = [];
+            try {
+                const entries = fs.readdirSync(dir, { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'vendor') continue;
+                    const fullPath = path.join(dir, entry.name);
+                    if (entry.isDirectory() && depth < 2) {
+                        results.push(...scanDirForSpecs(fullPath, depth + 1));
+                    } else if (entry.isFile() && specExtensions.includes(path.extname(entry.name).toLowerCase())) {
+                        // Check if file looks like an OpenAPI/Swagger spec
+                        const nameLower = entry.name.toLowerCase();
+                        const isLikelySpec = specKeywords.some(kw => nameLower.includes(kw)) || nameLower === 'api.yaml' || nameLower === 'api.yml' || nameLower === 'api.json';
+                        if (isLikelySpec) {
+                            results.push(path.relative(projectDir, fullPath));
+                        } else {
+                            // Peek inside to check for openapi/swagger key
+                            try {
+                                const head = fs.readFileSync(fullPath, 'utf-8').slice(0, 512);
+                                if (head.includes('"openapi"') || head.includes("openapi:") || head.includes('"swagger"') || head.includes("swagger:")) {
+                                    results.push(path.relative(projectDir, fullPath));
+                                }
+                            } catch {}
+                        }
+                    }
+                }
+            } catch {}
+            return results;
+        }
+        for (const sd of specDirs) {
+            const sdPath = path.join(projectDir, sd);
+            if (fs.existsSync(sdPath)) {
+                const deepSpecs = scanDirForSpecs(sdPath);
+                for (const ds of deepSpecs) {
+                    if (!foundSpecs.includes(ds)) foundSpecs.push(ds);
+                }
+            }
+        }
+        // Also scan root-level yaml/json files for OpenAPI markers
+        try {
+            const rootEntries = fs.readdirSync(projectDir, { withFileTypes: true });
+            for (const entry of rootEntries) {
+                if (!entry.isFile()) continue;
+                const ext = path.extname(entry.name).toLowerCase();
+                if (!specExtensions.includes(ext)) continue;
+                const rel = entry.name;
+                if (foundSpecs.includes(rel)) continue;
+                try {
+                    const head = fs.readFileSync(path.join(projectDir, rel), 'utf-8').slice(0, 512);
+                    if (head.includes('"openapi"') || head.includes("openapi:") || head.includes('"swagger"') || head.includes("swagger:")) {
+                        foundSpecs.push(rel);
+                    }
+                } catch {}
+            }
+        } catch {}
         const specPath = foundSpecs.length > 0 ? foundSpecs[0] : null;
 
+        // Detect test files and count them
+        let testFileCount = 0;
+        let testFramework = null;
+        function countTestFiles(dir, depth = 0) {
+            if (depth > 3) return;
+            try {
+                const entries = fs.readdirSync(dir, { withFileTypes: true });
+                for (const entry of entries) {
+                    if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'vendor' || entry.name === '__pycache__') continue;
+                    const fullPath = path.join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        if (entry.name === '__tests__' || entry.name === 'test' || entry.name === 'tests' || entry.name === 'spec') {
+                            countTestFiles(fullPath, depth + 1);
+                        } else if (depth < 2) {
+                            countTestFiles(fullPath, depth + 1);
+                        }
+                    } else if (entry.isFile()) {
+                        const name = entry.name.toLowerCase();
+                        if (name.endsWith('.test.js') || name.endsWith('.test.ts') || name.endsWith('.test.tsx') || name.endsWith('.spec.js') || name.endsWith('.spec.ts')) {
+                            testFileCount++;
+                        } else if (name.startsWith('test_') && name.endsWith('.py')) {
+                            testFileCount++;
+                        } else if (name.endsWith('_test.go')) {
+                            testFileCount++;
+                        }
+                    }
+                }
+            } catch {}
+        }
+        countTestFiles(projectDir);
+        // Detect test framework
+        if (fs.existsSync(pkgJsonPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+                const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+                if (allDeps['jest'] || (pkg.scripts && pkg.scripts.test && pkg.scripts.test.includes('jest'))) testFramework = 'jest';
+                else if (allDeps['vitest']) testFramework = 'vitest';
+                else if (allDeps['mocha']) testFramework = 'mocha';
+            } catch {}
+        }
+        if (!testFramework && fs.existsSync(requirementsPath)) {
+            try {
+                const content = fs.readFileSync(requirementsPath, 'utf-8').toLowerCase();
+                if (content.includes('pytest')) testFramework = 'pytest';
+            } catch {}
+        }
+
+        // Quick security scan
+        const securityFindings = [];
+        // Check for common secret patterns in spec files
+        for (const sp of foundSpecs.slice(0, 5)) {
+            try {
+                const content = fs.readFileSync(path.join(projectDir, sp), 'utf-8');
+                if (/(?:api[_-]?key|secret|password|token)\s*[:=]\s*["'][^"']{8,}/i.test(content)) {
+                    securityFindings.push({ severity: 'high', file: sp, issue: 'Possible hardcoded secret in spec file' });
+                }
+                if (/http:\/\/(?!localhost|127\.0\.0\.1)/i.test(content)) {
+                    securityFindings.push({ severity: 'medium', file: sp, issue: 'Non-localhost HTTP URL in spec (should use HTTPS)' });
+                }
+            } catch {}
+        }
+        // Check for .env files committed (not in .gitignore)
+        const envFiles = ['.env', '.env.local', '.env.production'];
+        const gitignorePath = path.join(projectDir, '.gitignore');
+        let gitignoreContent = '';
+        try { gitignoreContent = fs.readFileSync(gitignorePath, 'utf-8'); } catch {}
+        for (const envFile of envFiles) {
+            if (fs.existsSync(path.join(projectDir, envFile))) {
+                if (!gitignoreContent.includes(envFile)) {
+                    securityFindings.push({ severity: 'high', file: envFile, issue: `${envFile} exists and is not in .gitignore` });
+                }
+            }
+        }
+        // Check for package-lock.json / yarn.lock (dependency lockfile)
+        const hasLockfile = fs.existsSync(path.join(projectDir, 'package-lock.json')) || fs.existsSync(path.join(projectDir, 'yarn.lock')) || fs.existsSync(path.join(projectDir, 'pnpm-lock.yaml'));
+
         // Check for CI
         const hasGitHub = fs.existsSync(path.join(projectDir, '.github'));
         const hasGitLabCI = fs.existsSync(path.join(projectDir, '.gitlab-ci.yml'));
@@ -1340,11 +1477,33 @@ program
         // Display detection results
         console.log(`  Project:   ${chalk.bold(projectName)}`);
         if (frameworkLabel) console.log(`  Framework: ${chalk.bold(frameworkLabel)}`);
-        if (specPath) console.log(`  Spec:      ${chalk.bold(specPath)}`);
-        else if (['fastapi', 'nestjs', 'express'].includes(framework))
+        if (foundSpecs.length > 1) {
+            console.log(`  Specs:     ${chalk.bold(foundSpecs.length + ' found')}`);
+            for (const sp of foundSpecs.slice(0, 5)) {
+                console.log(`             ${chalk.gray('-')} ${sp}`);
+            }
+            if (foundSpecs.length > 5) console.log(`             ${chalk.gray(`... and ${foundSpecs.length - 5} more`)}`);
+        } else if (specPath) {
+            console.log(`  Spec:      ${chalk.bold(specPath)}`);
+        } else if (['fastapi', 'nestjs', 'express'].includes(framework)) {
             console.log(`  Spec:      ${chalk.gray('none found')} (Zero-Spec Mode available for ${frameworkLabel})`);
-        else console.log(`  Spec:      ${chalk.gray('none found')}`);
+        } else {
+            console.log(`  Spec:      ${chalk.gray('none found')}`);
+        }
+        if (testFileCount > 0) {
+            console.log(`  Tests:     ${chalk.bold(testFileCount + ' file' + (testFileCount !== 1 ? 's' : ''))}${testFramework ? chalk.gray(' (' + testFramework + ')') : ''}`);
+        } else {
+            console.log(`  Tests:     ${chalk.gray('none detected')}`);
+        }
         if (ciProvider !== 'none') console.log(`  CI:        ${chalk.bold(ciProvider === 'github' ? 'GitHub Actions' : 'GitLab CI')}`);
+        if (securityFindings.length > 0) {
+            console.log(`  Security:  ${chalk.yellow(securityFindings.length + ' finding' + (securityFindings.length !== 1 ? 's' : ''))}`);
+        } else {
+            console.log(`  Security:  ${chalk.green('clean (quick scan)')}`);
+        }
+        if (!hasLockfile && fs.existsSync(pkgJsonPath)) {
+            console.log(`  Lockfile:  ${chalk.yellow('missing — consider committing a lockfile')}`);
+        }
         console.log('');
 
         // Step 2: Choose preset
@@ -1596,7 +1755,7 @@ jobs:
             }
         }
 
-        // Step 6: Save first evidence event (LED-258)
+        // Step 6: Save first evidence event + comprehensive report (LED-258)
         const evidenceDir = path.join(configDir, 'evidence');
         fs.mkdirSync(evidenceDir, { recursive: true });
         const evidenceEvent = {
@@ -1605,23 +1764,67 @@ jobs:
             type: 'governance_init',
             tool: 'delimit_init',
             model: 'cli',
-            status: 'pass',
+            status: securityFindings.some(f => f.severity === 'high') ? 'warn' : 'pass',
             summary: `Governance initialized with ${preset} preset`,
             detail: [
                 `Project: ${projectName}`,
                 frameworkLabel ? `Framework: ${frameworkLabel}` : null,
-                specPath ? `Spec: ${specPath}` : 'Mode: Zero-Spec',
+                foundSpecs.length > 0 ? `Specs found: ${foundSpecs.length} (${foundSpecs.join(', ')})` : 'Mode: Zero-Spec',
                 `Preset: ${preset}`,
+                `Test files: ${testFileCount}`,
+                testFramework ? `Test framework: ${testFramework}` : null,
                 ciProvider !== 'none' ? `CI: ${ciProvider}` : null,
+                securityFindings.length > 0 ? `Security findings: ${securityFindings.length}` : 'Security: clean',
             ].filter(Boolean).join('\n'),
             venture: projectName,
         };
         try {
             const evidenceFile = path.join(evidenceDir, 'events.jsonl');
             fs.appendFileSync(evidenceFile, JSON.stringify(evidenceEvent) + '\n');
-            console.log(chalk.green('  Evidence recorded — first governance event saved'));
         } catch {}
 
+        // Generate first evidence report (LED-258: zero-config onboarding)
+        const firstReport = {
+            generated_at: new Date().toISOString(),
+            project: projectName,
+            framework: frameworkLabel || 'unknown',
+            specs: {
+                count: foundSpecs.length,
+                files: foundSpecs,
+                primary: specPath,
+            },
+            tests: {
+                file_count: testFileCount,
+                framework: testFramework,
+            },
+            security: {
+                findings_count: securityFindings.length,
+                findings: securityFindings,
+                lockfile_present: hasLockfile,
+            },
+            governance: {
+                preset: preset,
+                compliance_template: complianceTemplate,
+                ci_provider: ciProvider,
+                gates_active: specPath || ['fastapi', 'nestjs', 'express'].includes(framework) ? ['api_lint'] : [],
+                gates_ready: ['security_audit', 'deploy_plan', 'release_validate'],
+            },
+        };
+        try {
+            const reportFile = path.join(evidenceDir, 'first-report.json');
+            fs.writeFileSync(reportFile, JSON.stringify(firstReport, null, 2));
+            console.log(chalk.green('  Evidence recorded — first governance report saved'));
+        } catch {}
+
+        // Display security findings if any
+        if (securityFindings.length > 0) {
+            console.log(chalk.bold('\n  Security Findings:'));
+            for (const finding of securityFindings) {
+                const icon = finding.severity === 'high' ? chalk.red('!') : chalk.yellow('~');
+                console.log(`    ${icon} ${chalk.bold(finding.severity.toUpperCase())} ${finding.file} — ${finding.issue}`);
+            }
+        }
+
         // Step 7: Show gate status (LED-258)
         console.log(chalk.bold('\n  Governance Gates:'));
         const gates = [
@@ -1639,15 +1842,29 @@ jobs:
         // Summary
         const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
         console.log(chalk.bold(`\n  Setup complete in ${elapsed}s`));
-        console.log(chalk.gray(`  Evidence saved to .delimit/evidence/events.jsonl\n`));
+        console.log(chalk.gray(`  Evidence saved to .delimit/evidence/\n`));
         console.log('  Next steps:');
         if (specPath) {
             console.log(`    ${chalk.bold('delimit lint')} ${specPath} ${specPath}  — lint on every PR`);
+        } else if (['fastapi', 'nestjs', 'express'].includes(framework)) {
+            console.log(`    ${chalk.bold('delimit lint')}                           — zero-spec mode (${frameworkLabel})`);
         } else {
-            console.log(`    ${chalk.bold('delimit lint')}                           — zero-spec mode`);
+            console.log(`    ${chalk.bold('delimit lint')}                           — add an OpenAPI spec first`);
         }
         console.log(`    ${chalk.bold('delimit doctor')}                         — verify setup`);
         console.log(`    ${chalk.bold('delimit explain')}                        — human-readable report`);
+        if (securityFindings.length > 0) {
+            console.log(`    ${chalk.yellow('Fix security findings above')}            — ${securityFindings.length} issue${securityFindings.length !== 1 ? 's' : ''} found`);
+        }
+        if (testFileCount === 0) {
+            console.log(`    ${chalk.gray('Add tests')}                              — no test files detected`);
+        }
+        if (foundSpecs.length > 1) {
+            console.log(`    ${chalk.gray('Review all ' + foundSpecs.length + ' specs')}                       — multiple specs detected`);
+        }
+        if (ciProvider === 'none') {
+            console.log(`    ${chalk.gray('Add CI')}                                 — no CI detected; consider GitHub Actions`);
+        }
 
         // Beta capture after init (LED-263)
         if (!options.yes) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "delimit-cli",
   "mcpName": "io.github.delimit-ai/delimit-mcp-server",
-  "version": "4.0.4",
+  "version": "4.0.5",
   "description": "Unify Claude Code, Codex, Cursor, and Gemini CLI with persistent context, governance, and multi-model debate.",
   "main": "index.js",
   "files": [