getaura 0.1.1 → 0.1.2

package/dist/index.js

@@ -9,8 +9,8 @@ var __export = (target, all) => {
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
-import { existsSync as existsSync14, rmSync as rmSync5 } from "fs";
-import path16 from "path";
+import { existsSync as existsSync15, rmSync as rmSync6 } from "fs";
+import path17 from "path";
 
 // src/core/agents.ts
 var AGENT_LAYOUT = {
@@ -990,10 +990,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path20) {
-  if (!path20)
+function getElementAtPath(obj, path21) {
+  if (!path21)
     return obj;
-  return path20.reduce((acc, key) => acc?.[key], obj);
+  return path21.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1333,11 +1333,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path20, issues) {
+function prefixIssues(path21, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path20);
+    iss.path.unshift(path21);
     return iss;
   });
 }
@@ -1787,16 +1787,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path20 = []) => {
+  const processError = (error63, path21 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path20, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1835,17 +1835,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path20 = []) => {
+  const processError = (error63, path21 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path21, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path21, ...issue2.path]);
       } else {
-        const fullpath = [...path20, ...issue2.path];
+        const fullpath = [...path21, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1884,8 +1884,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path20 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path20) {
+  const path21 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path21) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -18987,13 +18987,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path20 = ref.slice(1).split("/").filter(Boolean);
-  if (path20.length === 0) {
+  const path21 = ref.slice(1).split("/").filter(Boolean);
+  if (path21.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path20[0] === defsKey) {
-    const key = path20[1] === void 0 ? void 0 : decodeJSONPointerSegment(path20[1]);
+  if (path21[0] === defsKey) {
+    const key = path21[1] === void 0 ? void 0 : decodeJSONPointerSegment(path21[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -19954,6 +19954,26 @@ var MeResponse = external_exports.object({
   capCents: external_exports.number(),
   periodStart: external_exports.string()
 });
+var ConnectStartRequest = external_exports.object({
+  /** SPKI PEM of a 2048-bit (or larger) RSA key the CLI generated for this session. */
+  publicKey: external_exports.string().min(200).max(2e3)
+});
+var ConnectStartResponse = external_exports.object({
+  code: external_exports.string(),
+  url: external_exports.string(),
+  /** Proves the poller is the CLI that started the session. Never shown to the user. */
+  deviceSecret: external_exports.string(),
+  expiresAt: external_exports.string(),
+  intervalSeconds: external_exports.number()
+});
+var ConnectPollRequest = external_exports.object({ deviceSecret: external_exports.string().min(20).max(200) });
+var ConnectPollResponse = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("pending") }),
+  external_exports.object({ status: external_exports.literal("skipped") }),
+  external_exports.object({ status: external_exports.literal("expired") }),
+  /** `encryptedKey` is base64 RSA-OAEP (SHA-256) ciphertext of the pilot key. */
+  external_exports.object({ status: external_exports.literal("complete"), encryptedKey: external_exports.string(), name: external_exports.string() })
+]);
 var ApiError = external_exports.object({ error: external_exports.object({ code: external_exports.string(), message: external_exports.string() }) });
 
 // src/scoring.ts
@@ -19988,10 +20008,11 @@ function impactOf(checks, fixedCheckIds) {
   return Math.max(0, after.score - before.score);
 }
 function grade(score) {
-  if (score >= 85) return { label: "Strong aura", color: "green" };
-  if (score >= 65) return { label: "Decent aura", color: "yellow" };
-  if (score >= 40) return { label: "Aura at risk", color: "red" };
-  return { label: "Aura loss", color: "red" };
+  if (score >= 95) return { label: "Generational aura", sentence: "You have generational aura", color: "green" };
+  if (score >= 85) return { label: "Strong aura", sentence: "You have strong aura", color: "green" };
+  if (score >= 65) return { label: "Decent aura", sentence: "You have decent aura", color: "yellow" };
+  if (score >= 40) return { label: "Aura at risk", sentence: "Your aura is at risk", color: "red" };
+  return { label: "Generational aura debt", sentence: "You have generational aura debt", color: "red" };
 }
 
 // src/templates.ts
@@ -20400,7 +20421,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.1",
+  version: "0.1.2",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -21516,7 +21537,7 @@ var AuraClient = class _AuraClient {
   get hasKey() {
     return Boolean(this.key);
   }
-  async request(method, path20, body, timeoutMs = 6e4) {
+  async request(method, path21, body, timeoutMs = 6e4) {
     if (!this.key) throw new AuraApiError("no_key", "No pilot key");
     let payload;
     if (body !== void 0) {
@@ -21526,7 +21547,7 @@ var AuraClient = class _AuraClient {
     }
     let res;
     try {
-      res = await fetch(`${this.baseUrl}/v1/${path20}`, {
+      res = await fetch(`${this.baseUrl}/v1/${path21}`, {
         method,
         headers: { authorization: `Bearer ${this.key}`, "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
         body: payload,
@@ -21823,10 +21844,10 @@ var typecheck = {
   applies: (ctx) => ctx.stack.typescript,
   async run(ctx) {
     if (ctx.options.fast) return { status: "unknown", summary: "Skipped in fast mode." };
-    const { existsSync: existsSync16 } = await import("fs");
-    const path20 = await import("path");
-    const tsc = path20.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-    if (!existsSync16(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
+    const { existsSync: existsSync17 } = await import("fs");
+    const path21 = await import("path");
+    const tsc = path21.join(ctx.root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+    if (!existsSync17(tsc)) return { status: "unknown", summary: "Dependencies not installed, so the type check was skipped." };
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: ctx.root, timeoutMs: 18e4 });
     if (r.timedOut) return { status: "unknown", summary: "Type check timed out." };
     if (r.code === 0) return { status: "pass", summary: "No type errors.", engine: "tsc" };
@@ -22726,8 +22747,8 @@ var say = {
 };
 
 // src/commands/fix.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "fs";
-import path15 from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import path16 from "path";
 
 // src/agent/tools.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
@@ -22850,6 +22871,15 @@ function loc(f) {
   if (!l) return "";
   return l.line ? `${l.file}:${l.line}` : l.file;
 }
+function auraBadge(g, colors = pc2.isColorSupported) {
+  const text = `\u2726 ${g.sentence.toUpperCase()} \u2726`;
+  if (!colors) return [`  ${text}`];
+  const c = pc2.createColors(true);
+  const bg = g.color === "green" ? c.bgGreen : g.color === "yellow" ? c.bgYellow : c.bgRed;
+  const fg = g.color === "red" ? c.white : c.black;
+  const pad = " ".repeat(text.length + 6);
+  return [`  ${bg(pad)}`, `  ${bg(fg(c.bold(`   ${text}   `)))}`, `  ${bg(pad)}`];
+}
 function renderTerminal(scan, opts = {}) {
   const g = grade(scan.score);
   const color = g.color === "green" ? pc2.green : g.color === "yellow" ? pc2.yellow : pc2.red;
@@ -22857,13 +22887,14 @@ function renderTerminal(scan, opts = {}) {
   const delta = opts.previous != null ? scan.score - opts.previous : null;
   const deltaText = delta === null || delta === 0 ? "" : delta > 0 ? pc2.green(` \u25B2 ${delta}`) : pc2.red(` \u25BC ${-delta}`);
   lines.push("");
-  lines.push(`  ${pc2.bold("Aura score")}  ${color(pc2.bold(String(scan.score)))}${pc2.dim("/100")}${deltaText}  ${color(g.label)}`);
+  lines.push(`  ${pc2.bold("Aura score")}  ${color(pc2.bold(String(scan.score)))}${pc2.dim("/100")}${deltaText}`);
   if (scan.cappedBy) lines.push(pc2.red(`  Capped at ${scan.score} until this is fixed: ${scan.cappedBy}`));
   lines.push("");
   for (const c of scan.categories) {
     const label = CATEGORY_LABELS[c.category].padEnd(12);
     lines.push(c.score === null ? `  ${label} ${pc2.dim("not applicable")}` : `  ${label} ${bar(c.score)} ${String(c.score).padStart(3)}`);
   }
+  lines.push("", ...auraBadge(g));
   const findings = allFindings(scan).filter((f) => f.severity !== "info");
   const top = findings.slice(0, opts.top ?? 5);
   if (top.length) {
@@ -22908,7 +22939,7 @@ function renderMarkdown(scan, steps) {
   const g = grade(scan.score);
   const md = [];
   md.push(`# Aura report`, "");
-  md.push(`**Aura score: ${scan.score}/100** (${g.label})  `);
+  md.push(`**Aura score: ${scan.score}/100**  `);
   md.push(
     `Scanned ${new Date(scan.scannedAt).toUTCString()}${scan.commit ? ` at commit \`${scan.commit.slice(0, 7)}\`` : ""} with Aura ${scan.auraVersion}.`,
     ""
@@ -22916,7 +22947,7 @@ function renderMarkdown(scan, steps) {
   if (scan.cappedBy) md.push(`> The score is capped at ${scan.score} until this critical issue is fixed: ${scan.cappedBy}`, "");
   md.push("| Category | Score |", "| --- | --- |");
   for (const c of scan.categories) md.push(`| ${CATEGORY_LABELS[c.category]} | ${c.score ?? "n/a"} |`);
-  md.push("");
+  md.push("", `## \u2726 ${g.sentence} \u2726`, "");
   if (steps.length) {
     md.push("## Next steps", "");
     for (const [i, s] of steps.entries())
@@ -23074,8 +23105,8 @@ async function addExplanations(root, scan, client) {
 
 // src/commands/simple.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync13 } from "fs";
+import path15 from "path";
 import YAML2 from "yaml";
 
 // src/commands/inventory.ts
@@ -23198,12 +23229,165 @@ function appendHistory(root, scan) {
   return trimmed;
 }
 
+// src/banner.ts
+import pc3 from "picocolors";
+var SPARKLE = ["     \u2597\u2596     ", "     \u2588\u2588     ", " \u2581\u2582\u2584\u2588\u2588\u2588\u2588\u2584\u2582\u2581 ", " \u2594\u2580\u2580\u2588\u2588\u2588\u2588\u2580\u2580\u2594 ", "     \u2588\u2588     ", "     \u259D\u2598     "];
+var WORDMARK = [
+  " \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 ",
+  "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557",
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551",
+  "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551",
+  "\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551",
+  "\u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D"
+];
+var LOGO = SPARKLE.map((s, i) => `${s}  ${WORDMARK[i]}`);
+var GLOW = [99, 135, 171, 207, 206, 205];
+function glow(line) {
+  const width = LOGO[0].length;
+  return [...line].map((ch, i) => ch === " " ? ch : `\x1B[38;5;${GLOW[Math.floor(i / width * GLOW.length)]}m${ch}`).join("") + "\x1B[39m";
+}
+function banner(colors = pc3.isColorSupported) {
+  const lines = LOGO.map((l) => `  ${colors ? glow(l) : l}`);
+  lines[lines.length - 1] += `  ${colors ? pc3.dim(`v${AURA_VERSION}`) : `v${AURA_VERSION}`}`;
+  return ["", ...lines, ""].join("\n");
+}
+
+// src/api/connect.ts
+import { spawn as spawn2 } from "child_process";
+import { constants, generateKeyPairSync, privateDecrypt } from "crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync12, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import os4 from "os";
+import path14 from "path";
+var pendingFile = () => path14.join(os4.homedir(), ".aura", "pending-connect.json");
+async function postJson(apiUrl, route, body) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl}/v1/${route}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "user-agent": `getaura/${AURA_VERSION}` },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(2e4)
+    });
+  } catch (err) {
+    throw new AuraApiError("network", err.message);
+  }
+  const json2 = await res.json().catch(() => null);
+  if (!res.ok) throw new AuraApiError(json2?.error?.code ?? "model_error", json2?.error?.message ?? `HTTP ${res.status}`);
+  return json2;
+}
+function loadPending(apiUrl, now) {
+  try {
+    const p2 = JSON.parse(readFileSync12(pendingFile(), "utf8"));
+    if (p2.apiUrl === apiUrl && Date.parse(p2.expiresAt) - now > 6e4) return p2;
+  } catch {
+  }
+  return null;
+}
+function clearPendingConnect() {
+  if (existsSync12(pendingFile())) rmSync5(pendingFile(), { force: true });
+}
+async function startOrResumeConnect(apiUrl, now = Date.now()) {
+  const existing = loadPending(apiUrl, now);
+  if (existing) return { ...existing, resumed: true };
+  const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  const res = ConnectStartResponse.parse(await postJson(apiUrl, "connect", { publicKey }));
+  const pending = { apiUrl, privateKey, ...res };
+  mkdirSync5(path14.dirname(pendingFile()), { recursive: true });
+  writeFileSync5(pendingFile(), JSON.stringify(pending, null, 2) + "\n", { mode: 384 });
+  return { ...pending, resumed: false };
+}
+async function waitForConnect(pending, waitSeconds, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+  const deadline = Date.now() + waitSeconds * 1e3;
+  for (; ; ) {
+    const res = ConnectPollResponse.parse(await postJson(pending.apiUrl, "connect/poll", { deviceSecret: pending.deviceSecret }));
+    if (res.status === "complete") {
+      clearPendingConnect();
+      const key = privateDecrypt(
+        { key: pending.privateKey, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+        Buffer.from(res.encryptedKey, "base64")
+      ).toString("utf8");
+      return { status: "complete", key, name: res.name };
+    }
+    if (res.status !== "pending") {
+      clearPendingConnect();
+      return { status: res.status };
+    }
+    if (Date.now() + pending.intervalSeconds * 1e3 > deadline) return { status: "pending" };
+    await sleep(pending.intervalSeconds * 1e3);
+  }
+}
+function openInBrowser(url2) {
+  if (process.env.AURA_NO_BROWSER || process.env.CI) return;
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
+  try {
+    const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/commands/connect.ts
+var AGENT_WAIT_SECONDS = 90;
+function parseWait(value) {
+  const n = Number(value);
+  return value !== void 0 && Number.isFinite(n) && n >= 0 ? n : void 0;
+}
+async function signInWithBrowser(apiUrl, opts) {
+  try {
+    const pending = await startOrResumeConnect(apiUrl);
+    if (!pending.resumed) openInBrowser(pending.url);
+    const wait = opts.waitSeconds ?? (opts.person ? Math.max(0, (Date.parse(pending.expiresAt) - Date.now()) / 1e3) : AGENT_WAIT_SECONDS);
+    console.log(`
+${pc.magenta("\u2726")} ${pc.bold("Connect your Aura pilot key")}`);
+    if (opts.person) {
+      console.log(`  ${pending.resumed ? "Open" : "Your browser should open. If it doesn\u2019t, go to"}: ${pc.cyan(pending.url)}`);
+      console.log(pc.dim(`  Check the page shows the code ${pending.code}. Press Ctrl+C to stop.
+`));
+    } else {
+      console.log(`  Ask the user to open this link and paste their pilot key there (or choose to continue without one):`);
+      console.log(`  ${pending.url}`);
+      console.log(`  Don\u2019t ask for the key in chat. The page sends it to this computer encrypted. Code: ${pending.code}`);
+      console.log(`  Waiting up to ${Math.round(wait)} seconds\u2026
+`);
+    }
+    const s = spin(opts.person);
+    s.start("Waiting for you to finish in the browser");
+    const outcome = await waitForConnect(pending, wait);
+    s.stop(outcome.status === "complete" ? "Key received" : outcome.status === "skipped" ? "Continuing without a key" : "Stopped waiting");
+    return outcome;
+  } catch (err) {
+    return { status: "error", message: friendlyApiError(err) };
+  }
+}
+function explainSignIn(outcome) {
+  switch (outcome.status) {
+    case "skipped":
+      say.dim("No pilot key: Aura will still score your repo, with standard explanations. Add one later with `aura login`.");
+      return true;
+    case "pending":
+      say.warn("Still waiting for the user to finish in the browser. When they have, run the same command again: it carries on with the same link.");
+      return false;
+    case "expired":
+      say.warn("The sign-in link expired. Run the same command again for a new one.");
+      return false;
+    case "error":
+      say.warn(`Couldn\u2019t start sign-in: ${outcome.message}`);
+      return false;
+  }
+}
+
 // src/commands/simple.ts
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
-  if (existsSync12(file2)) {
+  if (existsSync13(file2)) {
     try {
-      const scan = JSON.parse(readFileSync12(file2, "utf8"));
+      const scan = JSON.parse(readFileSync13(file2, "utf8"));
       const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       const dirty = execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
       if (scan.commit === head && !dirty && Date.now() - Date.parse(scan.scannedAt) < 24 * 36e5) return scan;
@@ -23228,19 +23412,31 @@ async function historyCommand(flags) {
   return 0;
 }
 async function loginCommand(flags) {
+  const person = interactive();
+  if (person) process.stdout.write(`${banner()}
+`);
+  const root = await findRepoRoot();
+  const apiUrl = getApiUrl(loadConfig(root));
   let key = flags.key ?? process.env.AURA_KEY;
-  if (!key && interactive()) key = unwrap(await p.password({ message: "Paste your Aura pilot key", mask: "\u2022" }));
+  if (!key && flags.paste && person) key = unwrap(await p.password({ message: "Paste your Aura pilot key", mask: "\u2022" }));
   if (!key) {
-    say.error("Pass your key with --key or set AURA_KEY.");
-    return 1;
+    if (process.env.CI) {
+      say.error("Pass your key with --key or set AURA_KEY.");
+      return 1;
+    }
+    const outcome = await signInWithBrowser(apiUrl, { person, waitSeconds: parseWait(flags.wait) });
+    if (outcome.status !== "complete") {
+      explainSignIn(outcome);
+      return outcome.status === "skipped" ? 0 : 1;
+    }
+    key = outcome.key;
   }
   key = key.trim();
   if (!/^aura_(?:live|dev)_[A-Za-z0-9]{16,}$/.test(key)) {
     say.error("That doesn\u2019t look like an Aura pilot key (they start with aura_live_).");
     return 1;
   }
-  const root = await findRepoRoot();
-  const client = new AuraClient(getApiUrl(loadConfig(root)), key);
+  const client = new AuraClient(apiUrl, key);
   try {
     const me = await client.request("GET", "me");
     saveApiKey(key);
@@ -23304,9 +23500,9 @@ async function configCommand(key, value) {
   return 0;
 }
 function loadGuides() {
-  const dir = path14.join(templatesDir(), "guides");
+  const dir = path15.join(templatesDir(), "guides");
   return readdirSync4(dir).filter((f) => f.endsWith(".md")).map((f) => {
-    const text = readFileSync12(path14.join(dir, f), "utf8");
+    const text = readFileSync13(path15.join(dir, f), "utf8");
     const fm = text.match(/^---\n([\s\S]*?)\n---\n?/);
     const meta3 = fm ? YAML2.parse(fm[1]) : {};
     return { id: f.replace(/\.md$/, ""), title: meta3.title ?? f, summary: meta3.summary ?? "", body: fm ? text.slice(fm[0].length) : text };
@@ -23374,7 +23570,7 @@ function allowedCommands(root, pm, typescript) {
   const pkg = readJson(root, "package.json");
   const run2 = pmCommands(pm).run;
   const cmds = ["test", "lint", "typecheck", "build"].filter((s) => pkg?.scripts?.[s]).map((s) => `${run2} ${s}`);
-  if (typescript && !pkg?.scripts?.typecheck && existsSync13(path15.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
+  if (typescript && !pkg?.scripts?.typecheck && existsSync14(path16.join(root, "node_modules/.bin/tsc"))) cmds.push(`${pmCommands(pm).exec} tsc --noEmit`);
   return cmds;
 }
 function taskFor(root, scan, action2, findings) {
@@ -23425,9 +23621,9 @@ async function untrackEnvFiles(root, findings) {
   const files = findings.filter((f) => f.checkId === "security.env-files").map((f) => f.locations[0].file);
   for (const f of files) await git(root, "rm", "-q", "--cached", "--", f);
   if (files.length) {
-    const gi = path15.join(root, ".gitignore");
-    const current2 = existsSync13(gi) ? readFileSync13(gi, "utf8") : "";
-    if (!/^\.env\*?$/m.test(current2)) writeFileSync5(gi, `${current2.trimEnd()}
+    const gi = path16.join(root, ".gitignore");
+    const current2 = existsSync14(gi) ? readFileSync14(gi, "utf8") : "";
+    if (!/^\.env\*?$/m.test(current2)) writeFileSync6(gi, `${current2.trimEnd()}
 
 # Environment files hold secrets
 .env*
@@ -23629,7 +23825,7 @@ async function applyCommand(actionId, flags) {
   console.log(`
 ${pc.bold(action2.title)}`);
   for (const c of plan.changes)
-    console.log(`  ${c.content === null ? pc.red("delete") : existsSync14(path16.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
+    console.log(`  ${c.content === null ? pc.red("delete") : existsSync15(path17.join(root, c.path)) ? pc.yellow("update") : pc.green("add   ")} ${c.path}`);
   const pm = pmCommands(scan.stack.packageManager);
   if (plan.devDeps?.length) console.log(`  ${pc.cyan("install")} ${plan.devDeps.join(", ")} ${pc.dim(`(${pm.addDev})`)}`);
   for (const cmd of plan.commands ?? []) console.log(`  ${pc.cyan("run   ")} ${cmd.join(" ")}`);
@@ -23657,8 +23853,8 @@ ${pc.bold(action2.title)}`);
   }
   if (interactive() && !flags.yes && !unwrap(await p.confirm({ message: openPr ? "Create a branch and open a pull request?" : "Create a branch and commit?" })))
     return 0;
-  const tsc = path16.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
-  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync14(tsc);
+  const tsc = path17.join(root, "node_modules", ".bin", process.platform === "win32" ? "tsc.cmd" : "tsc");
+  const checkTypes = plan.verifyTypes && scan.stack.typescript && existsSync15(tsc);
   const typeErrors = async () => {
     const r = await run(tsc, ["--noEmit", "--pretty", "false"], { cwd: root, timeoutMs: 3e5 });
     return (r.stdout.match(/error TS\d+/g) ?? []).length;
@@ -23756,16 +23952,16 @@ async function undoPlan(root, plan) {
   for (const file2 of touched) {
     const inHead = (await git(root, "cat-file", "-e", `HEAD:${file2}`)).code === 0;
     if (inHead) await git(root, "checkout", "HEAD", "--", file2);
-    else if (plan.changes.some((c) => c.path === file2)) rmSync5(path16.join(root, file2), { force: true });
+    else if (plan.changes.some((c) => c.path === file2)) rmSync6(path17.join(root, file2), { force: true });
   }
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 
 // src/brief.ts
-import path17 from "path";
+import path18 from "path";
 function repoSummary(ctx) {
   const routes = ctx.files.filter((f) => /^(?:src\/)?app\/(?:.+\/)?(?:page|route)\.[cm]?[jt]sx?$/.test(f) || /^(?:src\/)?pages\/.+\.[cm]?[jt]sx?$/.test(f)).map(
     (f) => "/" + f.replace(/^(?:src\/)?(?:app|pages)\//, "").replace(/(?:^|\/)(?:page|route|index)\.[cm]?[jt]sx?$|\.[cm]?[jt]sx?$/, "").replace(/\([^)]+\)\//g, "")
@@ -23781,7 +23977,7 @@ function repoSummary(ctx) {
   const readme2 = ctx.files.find((f) => /^readme\.mdx?$/i.test(f));
   const readmeText = readme2 ? ctx.read(readme2) ?? "" : "";
   return {
-    name: ctx.pkg?.name ?? path17.basename(ctx.root),
+    name: ctx.pkg?.name ?? path18.basename(ctx.root),
     packageJson: ctx.pkg ? {
       name: ctx.pkg.name,
       description: ctx.pkg.description,
@@ -23853,22 +24049,22 @@ async function draftBrief(client, answers, summary) {
 }
 
 // src/commands/scan.ts
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
-import os4 from "os";
-import path18 from "path";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
+import os5 from "os";
+import path19 from "path";
 async function scanRef(root, ref, opts) {
-  const dir = mkdtempSync3(path18.join(os4.tmpdir(), "aura-base-"));
-  const wt = path18.join(dir, "tree");
+  const dir = mkdtempSync3(path19.join(os5.tmpdir(), "aura-base-"));
+  const wt = path19.join(dir, "tree");
   const add = await run("git", ["worktree", "add", "--detach", wt, ref], { cwd: root });
   if (add.code !== 0) {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync7(dir, { recursive: true, force: true });
     return null;
   }
   try {
     return await runScan(wt, { ...opts, fast: true });
   } finally {
     await run("git", ["worktree", "remove", "--force", wt], { cwd: root });
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync7(dir, { recursive: true, force: true });
   }
 }
 async function scanCommand(flags) {
@@ -23911,7 +24107,7 @@ async function scanCommand(flags) {
   const baseIds = new Set(base ? base.checks.flatMap((c) => c.findings.map((f) => f.id)) : []);
   const newCritical = base ? scan.checks.flatMap((c) => c.findings).filter((f) => f.severity === "critical" && !baseIds.has(f.id)) : [];
   if (base && (base.score - scan.score > maxDrop || newCritical.length > 0)) exitCode = 1;
-  if (flags.commentFile) writeFileSync6(flags.commentFile, renderPrComment(scan, base, maxDrop));
+  if (flags.commentFile) writeFileSync7(flags.commentFile, renderPrComment(scan, base, maxDrop));
   if (quiet) {
     printJson({ ...scan, nextSteps: steps, base: base ? { score: base.score, categories: base.categories } : void 0 });
     return exitCode;
@@ -23931,10 +24127,10 @@ async function scanCommand(flags) {
 var AGENT_IDS = ["claude", "codex", "cursor", "pi"];
 function detectAgents(root) {
   const found = [];
-  if (existsSync15(`${root}/CLAUDE.md`) || existsSync15(`${root}/.claude`)) found.push("claude");
-  if (existsSync15(`${root}/AGENTS.md`)) found.push("codex");
-  if (existsSync15(`${root}/.cursor`) || existsSync15(`${root}/.cursorrules`)) found.push("cursor");
-  if (existsSync15(`${root}/.pi`)) found.push("pi");
+  if (existsSync16(`${root}/CLAUDE.md`) || existsSync16(`${root}/.claude`)) found.push("claude");
+  if (existsSync16(`${root}/AGENTS.md`)) found.push("codex");
+  if (existsSync16(`${root}/.cursor`) || existsSync16(`${root}/.cursorrules`)) found.push("cursor");
+  if (existsSync16(`${root}/.pi`)) found.push("pi");
   return found;
 }
 function openEditor(file2) {
@@ -23942,10 +24138,31 @@ function openEditor(file2) {
   const r = spawnSync2(editor, [file2], { stdio: "inherit", shell: process.platform === "win32" });
   return r.status === 0;
 }
+var EXAMPLE_ANSWERS = '{"whatItDoes": "\u2026", "audience": "\u2026", "chargesMoney": false, "dataHandled": ["personal"], "userRegions": ["Canada"]}';
+function briefHandoff() {
+  return [
+    "",
+    `${pc.magenta("\u2726")} ${pc.bold("Next: write the product brief")}`,
+    "  Ask the user these questions. If you are a coding agent, suggest answers from the code and let the user confirm or correct them:",
+    "  1. What does the app do?",
+    "  2. Who is it for?",
+    "  3. Does it charge money?",
+    "  4. What data does it handle? Any of: personal, payments, health, legal, children, none",
+    "  5. Where are its users? (countries or regions)",
+    "  Save the answers to .aura/answers.json in this shape:",
+    `  ${EXAMPLE_ANSWERS}`,
+    "  Then run: npx getaura@latest init --yes --answers .aura/answers.json",
+    ""
+  ].join("\n");
+}
 async function initCommand(flags) {
   const tty = interactive() && !flags.yes;
   const cwd = process.cwd();
-  if (tty) p.intro(pc.bold(" Aura ") + pc.dim(" set up your repo and your coding agent"));
+  if (tty) {
+    process.stdout.write(`${banner()}
+`);
+    p.intro(pc.dim("Set up your repo and your coding agent"));
+  }
   if (!await isGitRepo(cwd)) {
     say.error("This folder isn\u2019t a git repository. Aura works on a git repo so every change can be a pull request.");
     if (tty && unwrap(await p.confirm({ message: "Run `git init` here now?" }))) {
@@ -23982,9 +24199,20 @@ async function initCommand(flags) {
   }
   config2.agents = agents;
   let key = flags.key ?? getApiKey();
-  if (!key && tty) {
-    const entered = unwrap(await p.password({ message: "Paste your Aura pilot key (leave empty to skip for now)", mask: "\u2022" }));
-    key = entered?.trim() || null;
+  let explained = false;
+  if (!key && !process.env.CI && !config2.noKey) {
+    const outcome = await signInWithBrowser(getApiUrl(config2), { person: interactive(), waitSeconds: parseWait(flags.wait) });
+    if (outcome.status === "complete") {
+      key = outcome.key;
+      delete config2.noKey;
+    } else {
+      if (outcome.status === "skipped") config2.noKey = true;
+      if (!explainSignIn(outcome)) {
+        if (outcome.status === "pending") return 1;
+        say.dim("Continuing without a pilot key for now. Connect one later with `aura login`.");
+      }
+      explained = true;
+    }
   }
   let client = AuraClient.from(config2);
   if (key) {
@@ -23997,20 +24225,20 @@ async function initCommand(flags) {
       say.warn(`${friendlyApiError(err)} Continuing without Aura\u2019s agent.`);
       client = new AuraClient(getApiUrl(config2), null);
     }
-  } else {
+  } else if (!explained) {
     say.dim("No pilot key: Aura will still score your repo, with standard explanations.");
   }
   const ctx = await buildContext(root, { fast: true, noDownload: true }, config2);
   const briefPath = auraPath(root, "brief.md");
   let brief2 = null;
   if (flags.briefFile) {
-    brief2 = readFileSync14(flags.briefFile, "utf8");
-  } else if (existsSync15(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
-    brief2 = readFileSync14(briefPath, "utf8");
+    brief2 = readFileSync15(flags.briefFile, "utf8");
+  } else if (existsSync16(briefPath) && !(tty && unwrap(await p.confirm({ message: "A product brief already exists. Draft a new one?", initialValue: false })))) {
+    brief2 = readFileSync15(briefPath, "utf8");
   } else {
     let answers = null;
     if (flags.answers) {
-      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync14(flags.answers, "utf8")));
+      answers = OnboardingAnswersSchema.parse(JSON.parse(readFileSync15(flags.answers, "utf8")));
     } else if (tty) {
       p.note("A few questions so Aura understands your app. Your answers go into the product brief.", "About your app");
       const whatItDoes = unwrap(await p.text({ message: "What does your app do?", placeholder: "e.g. Lets dog owners book and pay for walks" }));
@@ -24055,7 +24283,7 @@ async function initCommand(flags) {
       }
       brief2 ??= offlineBrief(answers, summary, ctx);
     } else {
-      say.warn("No answers given (non-interactive). Pass --answers <file.json> or --brief-file <path>, or run `aura init` in a terminal to write the brief.");
+      console.log(briefHandoff());
     }
   }
   if (brief2) {
@@ -24094,7 +24322,7 @@ async function initCommand(flags) {
 }
 
 // src/commands/summary.ts
-import path19 from "path";
+import path20 from "path";
 async function activity(root, since) {
   const log = await git(root, "log", `--since=${since.toISOString()}`, "--no-merges", "--format=%H%x09%an%x09%s");
   const commits = log.stdout.split("\n").filter(Boolean).slice(0, 300).map((l) => {
@@ -24151,7 +24379,7 @@ async function summaryCommand(flags) {
   const beforeIds = new Set(before ? allFindings(before).map((f) => f.id) : []);
   const nowIds = new Set(allFindings(now).map((f) => f.id));
   const req = {
-    repo: path19.basename(root),
+    repo: path20.basename(root),
     since: since.toISOString(),
     until: until.toISOString(),
     product: productContext(root),
@@ -24198,6 +24426,7 @@ ${body}`);
 // src/index.ts
 var program = new Command();
 program.name("aura").description("Aura helps you and your coding agent follow best practices while you vibe code.").version(AURA_VERSION).showHelpAfterError();
+program.addHelpText("before", () => interactive() ? banner() : "");
 function action(fn) {
   return async (...args) => {
     try {
@@ -24213,7 +24442,7 @@ function action(fn) {
     }
   };
 }
-program.command("init").description("Set up Aura: pick your agent, write the product brief, install the Aura skill and run the first scan").option("--agent <id...>", "coding agent(s): claude, codex, cursor, pi").option("-y, --yes", "no prompts; use detected defaults").option("--key <key>", "Aura pilot key").option("--brief-file <path>", "use this file as the product brief").option("--answers <path>", "JSON file with the setup answers").option("--no-scan", "skip the first scan").addOption(new Option("--telemetry", "share scores and action names with the Aura team")).addOption(new Option("--no-telemetry", "don\u2019t share anything")).action(action((flags) => initCommand(flags)));
+program.command("init").description("Set up Aura: pick your agent, write the product brief, install the Aura skill and run the first scan").option("--agent <id...>", "coding agent(s): claude, codex, cursor, pi").option("-y, --yes", "no prompts; use detected defaults").option("--key <key>", "Aura pilot key, for CI and scripts (otherwise a browser page asks for it)").option("--wait <seconds>", "how long to wait for the browser sign-in (default: until the link expires; 90 for agents)").option("--brief-file <path>", "use this file as the product brief").option("--answers <path>", "JSON file with the setup answers").option("--no-scan", "skip the first scan").addOption(new Option("--telemetry", "share scores and action names with the Aura team")).addOption(new Option("--no-telemetry", "don\u2019t share anything")).action(action((flags) => initCommand(flags)));
 program.command("scan").description("Run every check, show the Aura score and write .aura/report.md").option("--json", "print the full result as JSON").option("--no-explain", "skip plain-language explanations from Aura\u2019s agent").option("--fast", "skip type checking and git-history secret scanning").option("--ci", "CI mode: no spinners, PR comment output, exit 1 on a score drop").option("--base <ref>", "also scan this git ref and compare").option("--max-drop <n>", "allowed score drop before failing (default from .aura/config.json)").option("--comment-file <path>", "write a PR comment in markdown to this file").option("--no-download", "offline: don\u2019t download scanners or vulnerability data").action(action((flags) => scanCommand(flags)));
 program.command("next").description("Recommended next steps in priority order").option("--json", "print as JSON").option("--limit <n>", "how many to show").action(action((flags) => nextCommand(flags)));
 program.command("apply").argument("<action>", "action id, e.g. foundation, add-ci, install-skills").description("Make a template change on a new branch and open a pull request").option("--dry-run", "show what would change without changing anything").option("--no-pr", "commit on a local branch without pushing or opening a PR").option("-y, --yes", "don\u2019t ask for confirmation").option("--skills <names>", "for install-skills: comma-separated skill names").action(action((id, flags) => applyCommand(id, flags)));
@@ -24222,7 +24451,7 @@ program.command("inventory").description("Services and environment variables the
 program.command("guide").argument("[topic]", "guide to show, e.g. rotate-stripe-key").description("Step-by-step guides for things outside the code").option("--list", "list all guides").action(action((topic, flags) => guideCommand(topic, flags)));
 program.command("history").description("Aura score trend from past scans").option("--json", "print as JSON").action(action((flags) => historyCommand(flags)));
 program.command("summary").description("Plain-language summary of recent changes and the score trend").option("--days <n>", "how many days to cover", "7").option("--post", "post it as a GitHub issue").option("--json", "print as JSON").action(action((flags) => summaryCommand(flags)));
-program.command("login").description("Save your Aura pilot key").option("--key <key>", "pilot key").action(action((flags) => loginCommand(flags)));
+program.command("login").description("Connect your Aura pilot key (opens a browser page to paste it)").option("--key <key>", "pilot key, for CI and scripts (AURA_KEY also works)").option("--paste", "paste the key in this terminal instead of the browser").option("--wait <seconds>", "how long to wait for the browser (default: until the link expires; 90 for agents)").action(action((flags) => loginCommand(flags)));
 program.command("whoami").description("Show your pilot key and agent budget").action(action(() => whoamiCommand()));
 program.command("config").argument("[key]", "telemetry, ciMaxDrop, ignore, unignore, apiUrl").argument("[value]").description("Read or change settings in .aura/config.json").action(action((key, value) => configCommand(key, value)));
 program.command("check-staged").description("Block a commit that adds secrets (used by the pre-commit hook)").action(action(() => checkStagedCommand()));