devaudit-cli 0.1.0

package/README.md

@@ -0,0 +1,48 @@
+# devaudit-cli
+
+## Try it locally (no publish needed)
+
+```
+npm install
+node bin/devaudit.js --help
+```
+
+Or link it so `devaudit` works like a real global install:
+
+```
+npm install
+npm link
+devaudit --help
+```
+
+By default the CLI talks to `http://localhost:3000`. Point it at your dev server or prod:
+
+```
+export DEVAUDIT_API_URL=http://localhost:3000
+# or, once logged in, this persists to ~/.devaudit/credentials.json:
+devaudit config set-url https://your-real-domain.com
+```
+
+## What works right now
+
+- `devaudit init` — fully local, no backend needed. Detects your framework, repo, and the env
+  vars your code references, writes `devaudit.config.json`.
+- `devaudit login` / `logout` / `whoami` — work once the routes in `../backend-additions` are
+  deployed and `NEXT_PUBLIC_SITE_URL` + `SUPABASE_SERVICE_ROLE_KEY` are set.
+- `devaudit watch` / `list` / `status` — work once those routes are deployed and the
+  `watched_repos` table exists (see the migration).
+- `devaudit fix <error-id>` — works, but returns a heuristic placeholder until the real AI fix
+  engine is wired into `app/api/cli/errors/[id]/fix/route.ts` (see the TODO in that file).
+
+## Publishing for real
+
+Once you're happy with it:
+
+```
+npm login
+npm publish
+```
+
+The 404 you hit is just npm saying nothing's been published under this name yet — nothing else
+needs to change for `npm install -g devaudit-cli` to start working, once this is `npm publish`ed
+from an account you control.

package/bin/devaudit.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import "../src/index.js";

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "devaudit-cli",
+  "version": "0.1.0",
+  "description": "CLI for DevAudit \u2014 authenticate, watch repos, and pull AI fixes for errors from the terminal.",
+  "type": "module",
+  "bin": {
+    "devaudit": "./bin/devaudit.js"
+  },
+  "files": ["bin", "src", "README.md"],
+  "engines": { "node": ">=18" },
+  "license": "MIT",
+  "keywords": ["devaudit", "cli", "devops", "error-monitoring"],
+  "dependencies": {
+    "commander": "^12.1.0"
+  }
+}

package/src/commands/config-cmd.js

@@ -0,0 +1,14 @@
+import { readCredentials, writeCredentials } from "../lib/config.js";
+import { success, info } from "../lib/print.js";
+
+export function setUrl(url) {
+  const creds = readCredentials() || {};
+  creds.apiUrl = url;
+  writeCredentials(creds);
+  success(`API URL set to ${url}`);
+}
+
+export function showConfig() {
+  const creds = readCredentials();
+  info(JSON.stringify(creds || {}, null, 2));
+}

package/src/commands/errors.js

@@ -0,0 +1,34 @@
+import { apiFetch } from "../lib/api.js";
+import { requireToken } from "../lib/config.js";
+import { info, fail, dim, bold } from "../lib/print.js";
+
+// Rendered defensively (checks each field before printing it) since I haven't seen
+// app/api/v1/errors/route.ts yet and don't want to assume exact field names beyond what
+// errors/[id]/fix/route.ts already confirmed (id, file — repo via a `repositories` relation).
+export async function listErrors(opts) {
+  try {
+    requireToken();
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+    return;
+  }
+  const query = opts.repo ? `?repo=${encodeURIComponent(opts.repo)}` : "";
+  try {
+    const data = await apiFetch(`/v1/errors${query}`);
+    const errors = data.errors || data.results || (Array.isArray(data) ? data : []);
+    if (!errors.length) {
+      info(dim("No errors found."));
+      return;
+    }
+    for (const e of errors) {
+      const repo = e.repo || e.full_name || e.repository?.full_name || "";
+      const loc = [e.file, e.line].filter(Boolean).join(":");
+      const label = e.message || e.cause || e.summary || "(no message)";
+      info(`${bold(e.id)}  ${dim(repo)}  ${dim(loc)}  ${label}`);
+    }
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+  }
+}

package/src/commands/fix.js

@@ -0,0 +1,30 @@
+import { apiFetch } from "../lib/api.js";
+import { requireToken } from "../lib/config.js";
+import { info, success, fail, dim, bold, cyan } from "../lib/print.js";
+
+// Matches the real /v1/errors/:id/fix contract exactly: no local file reading, no --apply — the
+// fix is committed to a new branch on GitHub server-side, and this just reports where it landed.
+// That route 409s if no suggested_patch exists yet, which the message below explains plainly.
+export async function fixCmd(errorId) {
+  try {
+    requireToken();
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const result = await apiFetch(`/v1/errors/${encodeURIComponent(errorId)}/fix`, { method: "POST" });
+    success(`Committed to ${bold(result.branch)}`);
+    info(`Commit: ${dim(result.commit_sha)}`);
+    if (result.commit_url) info(`View: ${cyan(result.commit_url)}`);
+    info(dim("Open a pull request from that branch when you're ready to merge it."));
+  } catch (e) {
+    if (e.status === 409) {
+      fail("No AI-generated fix is available for this error yet.");
+    } else {
+      fail(e.message);
+    }
+    process.exitCode = 1;
+  }
+}

package/src/commands/init.js

@@ -0,0 +1,39 @@
+import { detectFramework, detectRepoSlug, detectEnvVars } from "../lib/detect.js";
+import { readProjectConfig, writeProjectConfig, projectConfigPath } from "../lib/config.js";
+import { info, success, warn, dim, bold, cyan } from "../lib/print.js";
+
+export async function init() {
+  const cwd = process.cwd();
+
+  if (readProjectConfig()) {
+    warn(`${projectConfigPath()} already exists. Delete it first if you want to regenerate it.`);
+    return;
+  }
+
+  info(dim("Scanning project..."));
+  const { framework } = detectFramework(cwd);
+  const repo = detectRepoSlug(cwd);
+  const envVars = detectEnvVars(cwd);
+
+  const config = {
+    version: 1,
+    repo: repo || null,
+    framework,
+    createdAt: new Date().toISOString(),
+  };
+  writeProjectConfig(config);
+
+  success(`Wrote ${bold(projectConfigPath())}`);
+  info(`  framework: ${cyan(framework)}`);
+  info(`  repo:      ${cyan(repo || "(not detected — add it manually, or pass --repo to \`devaudit watch\`)")}`);
+  if (envVars.length) {
+    info(`  env vars referenced in code (${envVars.length}): ${envVars.join(", ")}`);
+  }
+
+  info("");
+  if (repo) {
+    info(`Next: ${bold(`devaudit watch --repo ${repo}`)}`);
+  } else {
+    info(`Next: ${bold("devaudit watch --repo <owner/repo>")}`);
+  }
+}

package/src/commands/list.js

@@ -0,0 +1,26 @@
+import { apiFetch } from "../lib/api.js";
+import { requireToken } from "../lib/config.js";
+import { info, fail, dim, bold } from "../lib/print.js";
+
+export async function list() {
+  try {
+    requireToken();
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { repos } = await apiFetch("/v1/repos");
+    if (!repos || repos.length === 0) {
+      info(dim("No repos connected yet. Connect one from your DevAudit dashboard."));
+      return;
+    }
+    for (const r of repos) {
+      info(`${bold(r.full_name)}  ${dim(`watched since ${r.watched_since}`)}`);
+    }
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+  }
+}

package/src/commands/login.js

@@ -0,0 +1,37 @@
+import readline from "node:readline/promises";
+import { apiFetch } from "../lib/api.js";
+import { writeCredentials, getApiUrl } from "../lib/config.js";
+import { success, fail, info, dim } from "../lib/print.js";
+
+// Matches the real auth scheme: `Authorization: Bearer $DEVAUDIT_TOKEN`, a token generated in
+// account settings (see apiAuth.ts) — not a Supabase session, so there's nothing to redirect a
+// browser to here. Paste-a-token is the whole flow.
+export async function login(opts) {
+  const apiUrl = opts.apiUrl || getApiUrl();
+  let token = opts.token;
+
+  if (!token) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    info(dim("Generate a token from your DevAudit account settings, then paste it here."));
+    token = (await rl.question("Token: ")).trim();
+    rl.close();
+  }
+
+  if (!token) {
+    fail("No token provided.");
+    process.exitCode = 1;
+    return;
+  }
+
+  writeCredentials({ token, apiUrl });
+
+  // Light verification — there's no dedicated /v1/me yet, so a successful /v1/repos call is the
+  // closest thing to "is this token valid" available right now.
+  try {
+    await apiFetch("/v1/repos", { apiUrl });
+    success("Logged in.");
+  } catch (e) {
+    fail(`Saved the token, but couldn't verify it: ${e.message}`);
+    process.exitCode = 1;
+  }
+}

package/src/commands/logout.js

@@ -0,0 +1,7 @@
+import { clearCredentials } from "../lib/config.js";
+import { success } from "../lib/print.js";
+
+export function logout() {
+  clearCredentials();
+  success("Logged out.");
+}

package/src/commands/status.js

@@ -0,0 +1,35 @@
+import { apiFetch } from "../lib/api.js";
+import { requireToken } from "../lib/config.js";
+import { info, fail, dim } from "../lib/print.js";
+
+// No dedicated /v1/status endpoint exists — this just combines /v1/repos and /v1/errors
+// client-side. Drop this once/if a real status endpoint exists; it's a reasonable stand-in
+// until then and doesn't require guessing at backend internals.
+export async function status(opts) {
+  try {
+    requireToken();
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { repos } = await apiFetch("/v1/repos");
+    const query = opts.repo ? `?repo=${encodeURIComponent(opts.repo)}` : "";
+    let errorCount = null;
+    try {
+      const data = await apiFetch(`/v1/errors${query}`);
+      const errors = data.errors || data.results || (Array.isArray(data) ? data : []);
+      errorCount = errors.length;
+    } catch {
+      // /v1/errors may not exist yet or may reject an unrecognized query param — status still
+      // reports what it can.
+    }
+
+    info(`Repos connected: ${repos?.length ?? 0}`);
+    info(`Open errors:      ${errorCount === null ? dim("unavailable") : errorCount}`);
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+  }
+}

package/src/commands/watch.js

@@ -0,0 +1,9 @@
+import { info, dim } from "../lib/print.js";
+
+// There's no POST /v1/repos (or equivalent) in the confirmed API yet — connecting a repo looks
+// like a dashboard-only action right now (pick from GET /api/github/repos, presumably). This
+// stays honest about that instead of guessing an endpoint that might not exist.
+export async function watch() {
+  info("Connecting a repo isn't available from the CLI yet.");
+  info(dim("Connect it from your DevAudit dashboard for now — `devaudit list` will pick it up once it's there."));
+}

package/src/commands/whoami.js

@@ -0,0 +1,23 @@
+import { apiFetch } from "../lib/api.js";
+import { requireToken } from "../lib/config.js";
+import { info, fail, dim } from "../lib/print.js";
+
+// No /v1/me endpoint exists yet, so this can only confirm the token works, not whose it is.
+// Swap this for a real identity check if/when one exists.
+export async function whoami() {
+  try {
+    requireToken();
+  } catch (e) {
+    fail(e.message);
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { repos } = await apiFetch("/v1/repos");
+    info(`Token is valid. Watching ${repos?.length ?? 0} repo(s).`);
+  } catch (e) {
+    fail(e.message);
+    info(dim("Run `devaudit login --token <your-token>` to log in again."));
+    process.exitCode = 1;
+  }
+}

package/src/index.js

@@ -0,0 +1,57 @@
+import { Command } from "commander";
+import { createRequire } from "node:module";
+import { login } from "./commands/login.js";
+import { logout } from "./commands/logout.js";
+import { whoami } from "./commands/whoami.js";
+import { init } from "./commands/init.js";
+import { watch } from "./commands/watch.js";
+import { list } from "./commands/list.js";
+import { listErrors } from "./commands/errors.js";
+import { status } from "./commands/status.js";
+import { fixCmd } from "./commands/fix.js";
+import { setUrl, showConfig } from "./commands/config-cmd.js";
+
+const require = createRequire(import.meta.url);
+const { version } = require("../package.json");
+
+const program = new Command();
+
+program.name("devaudit").description("DevAudit CLI").version(version);
+
+program
+  .command("login")
+  .description("Save a DevAudit API token (generate one from your account settings).")
+  .option("--token <token>", "your DevAudit API token (skips the interactive prompt)")
+  .option("--api-url <url>", "override the API URL for this login")
+  .action(login);
+
+program.command("logout").description("Forget the stored CLI credentials.").action(logout);
+program.command("whoami").description("Check whether the stored token is valid.").action(whoami);
+program.command("init").description("Detect your stack and generate a devaudit.config.json in the current repo.").action(init);
+
+program.command("watch").description("(Not yet available via API) Connect a repo to watch.").action(watch);
+
+program.command("list").description("List repos connected to your account.").action(list);
+
+program
+  .command("errors")
+  .description("List recent errors across your connected repos.")
+  .option("--repo <owner/repo>", "filter to one repo")
+  .action(listErrors);
+
+program
+  .command("status")
+  .description("Summarize connected repos and open errors.")
+  .option("--repo <owner/repo>", "scope to one repo")
+  .action(status);
+
+program
+  .command("fix <errorId>")
+  .description("Apply the AI-suggested fix for an error as a commit on a new branch.")
+  .action(fixCmd);
+
+const config = program.command("config").description("Read or update local CLI configuration.");
+config.command("set-url <url>").description("Set the DevAudit API URL used by this CLI.").action(setUrl);
+config.command("show").description("Print the current local CLI config.").action(showConfig);
+
+program.parseAsync(process.argv);

package/src/lib/api.js

@@ -0,0 +1,43 @@
+import { getApiUrl, getToken } from "./config.js";
+
+// Every /api/cli/* route below is written to return `{ error: string }` on failure, matching
+// the shape the existing app/api routes already use (see env-vars route.ts, host-evaluator
+// route.ts) — so one error-unwrapping helper here covers all of them.
+export async function apiFetch(pathname, { method = "GET", body, auth = true, apiUrl } = {}) {
+  const base = apiUrl || getApiUrl();
+  const headers = { "Content-Type": "application/json" };
+  if (auth) {
+    const token = getToken();
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+  }
+
+  let res;
+  try {
+    res = await fetch(`${base}${pathname}`, {
+      method,
+      headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+  } catch (e) {
+    throw new Error(
+      `Could not reach ${base}${pathname} (${e instanceof Error ? e.message : "network error"}). ` +
+        `Is DEVAUDIT_API_URL set correctly? Currently: ${base}`,
+    );
+  }
+
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+    // non-JSON body — fall through, data stays null
+  }
+
+  if (!res.ok) {
+    const message = (data && data.error) || `Request failed with status ${res.status}`;
+    const err = new Error(message);
+    err.status = res.status;
+    throw err;
+  }
+
+  return data;
+}

package/src/lib/config.js

@@ -0,0 +1,71 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const CONFIG_DIR = path.join(os.homedir(), ".devaudit");
+const CREDENTIALS_PATH = path.join(CONFIG_DIR, "credentials.json");
+const PROJECT_CONFIG_PATH = path.join(process.cwd(), "devaudit.config.json");
+
+// The public API reference shows `https://api.devaudit.org/v1/...`. Locally, v1 routes live at
+// app/v1/... (not app/api/v1/...), so they're served at http://localhost:3000/v1/... directly —
+// no /api prefix. Override with DEVAUDIT_API_URL or `devaudit config set-url` once you have a
+// real domain (or the api.devaudit.org subdomain) pointed at this same deployment.
+const DEFAULT_API_URL = process.env.DEVAUDIT_API_URL || "http://localhost:3000";
+
+export function readCredentials() {
+  try {
+    return JSON.parse(fs.readFileSync(CREDENTIALS_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function writeCredentials(data) {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try {
+    fs.chmodSync(CREDENTIALS_PATH, 0o600);
+  } catch {
+    // best-effort on platforms where chmod semantics differ (Windows)
+  }
+}
+
+export function clearCredentials() {
+  try {
+    fs.unlinkSync(CREDENTIALS_PATH);
+  } catch {
+    // already gone
+  }
+}
+
+export function getApiUrl() {
+  const creds = readCredentials();
+  return (creds && creds.apiUrl) || DEFAULT_API_URL;
+}
+
+export function getToken() {
+  const creds = readCredentials();
+  return creds && creds.token;
+}
+
+export function requireToken() {
+  const token = getToken();
+  if (!token) throw new Error("Not logged in. Run `devaudit login --token <your-token>` first.");
+  return token;
+}
+
+export function readProjectConfig() {
+  try {
+    return JSON.parse(fs.readFileSync(PROJECT_CONFIG_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function writeProjectConfig(data) {
+  fs.writeFileSync(PROJECT_CONFIG_PATH, JSON.stringify(data, null, 2) + "\n", "utf8");
+}
+
+export function projectConfigPath() {
+  return PROJECT_CONFIG_PATH;
+}

package/src/lib/detect.js

@@ -0,0 +1,106 @@
+import fs from "node:fs";
+import path from "node:path";
+
+// Mirrors the framework-detection logic already shipped in the web app's host-evaluator route
+// (app/api/host-evaluator/route.ts), so `devaudit init` and the "Recommend a host" feature on
+// the site agree with each other on what a project is. Keep these two in sync if either changes.
+export function detectFramework(cwd) {
+  const fileNames = safeReaddir(cwd);
+  const hasDockerfile = fileNames.some((f) => f.toLowerCase() === "dockerfile");
+  const hasPython = fileNames.includes("requirements.txt") || fileNames.includes("pyproject.toml");
+
+  let packageJsonString = "";
+  const pkgPath = path.join(cwd, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    try {
+      packageJsonString = fs.readFileSync(pkgPath, "utf8");
+    } catch {
+      // unreadable package.json — fall through with framework left as the static default
+    }
+  }
+
+  let framework = "Static HTML/JS";
+  if (packageJsonString) {
+    const pkgLower = packageJsonString.toLowerCase();
+    if (pkgLower.includes('"next"')) framework = "Next.js";
+    else if (pkgLower.includes('"@remix-run') || pkgLower.includes('"remix"')) framework = "Remix";
+    else if (pkgLower.includes('"@sveltejs/kit"')) framework = "SvelteKit";
+    else if (pkgLower.includes('"react"')) framework = "React SPA";
+    else if (pkgLower.includes('"express"') || pkgLower.includes('"fastify"')) framework = "Node.js API";
+  } else if (hasDockerfile) {
+    framework = "Docker Container";
+  } else if (hasPython) {
+    framework = "Python Service";
+  }
+
+  return { framework, hasDockerfile, hasPython };
+}
+
+export function detectRepoSlug(cwd) {
+  try {
+    const gitConfigPath = path.join(cwd, ".git", "config");
+    const content = fs.readFileSync(gitConfigPath, "utf8");
+    const match = content.match(/url\s*=\s*(.+)/);
+    if (!match) return null;
+    const url = match[1].trim();
+    const sshMatch = url.match(/git@github\.com:([^/]+)\/(.+?)(\.git)?$/);
+    const httpsMatch = url.match(/github\.com\/([^/]+)\/(.+?)(\.git)?$/);
+    const m = sshMatch || httpsMatch;
+    if (!m) return null;
+    return `${m[1]}/${m[2].replace(/\.git$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+
+const SCAN_EXCLUDE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", ".venv", "venv", "__pycache__"]);
+const SCAN_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]);
+const MAX_DEPTH = 6;
+
+/** Bounded recursive scan for `process.env.X` (JS/TS) and `os.environ`/`os.getenv` (Python)
+ *  usages, same regex the host-evaluator route uses for the JS half. Depth-limited and skips
+ *  the usual heavy directories so it stays fast on a real repo, not just the tiny file map the
+ *  web route was originally given. */
+export function detectEnvVars(cwd) {
+  const found = new Set();
+  const jsPattern = /process\.env\.([A-Z0-9_]+)/g;
+  const pyPattern = /os\.(?:environ(?:\.get)?|getenv)\(\s*["']([A-Z0-9_]+)["']/g;
+
+  function walk(dir, depth) {
+    if (depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".env.example") continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
+        walk(full, depth + 1);
+      } else if (SCAN_EXTENSIONS.has(path.extname(entry.name))) {
+        let content;
+        try {
+          content = fs.readFileSync(full, "utf8");
+        } catch {
+          continue;
+        }
+        for (const m of content.matchAll(jsPattern)) found.add(m[1]);
+        for (const m of content.matchAll(pyPattern)) found.add(m[1]);
+      }
+    }
+  }
+
+  walk(cwd, 0);
+  return Array.from(found).sort();
+}
+
+function safeReaddir(dir) {
+  try {
+    return fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}

package/src/lib/print.js

@@ -0,0 +1,24 @@
+// Tiny ANSI helpers so the CLI has a little color without pulling in chalk/picocolors as a
+// dependency. Falls back gracefully — most terminals honor these, and piping to a file just
+// shows the raw codes stripped by most viewers, which is an acceptable MVP tradeoff.
+const wrap = (open, close) => (s) => `\x1b[${open}m${s}\x1b[${close}m`;
+
+export const bold = wrap(1, 22);
+export const dim = wrap(2, 22);
+export const cyan = wrap(36, 39);
+export const green = wrap(32, 39);
+export const yellow = wrap(33, 39);
+export const red = wrap(31, 39);
+
+export function info(msg) {
+  console.log(msg);
+}
+export function success(msg) {
+  console.log(green("✔"), msg);
+}
+export function warn(msg) {
+  console.log(yellow("!"), msg);
+}
+export function fail(msg) {
+  console.error(red("✖"), msg);
+}