getaura 0.1.3 → 0.1.5

package/README.md

@@ -18,12 +18,14 @@ Your agent runs the setup and sends you a link to connect your pilot key in the
 npx getaura init
 ```
 
-`init` checks git and the GitHub CLI, asks which coding agent you use, opens your browser to connect your pilot key, drafts your product brief, installs the Aura skill and runs your first scan.
+`init` checks git and the GitHub CLI, asks which coding agent you use, opens your browser to connect your pilot key, drafts your product brief, installs the Aura skill, offers to install the `aura` command and runs your first scan. After that, run `aura scan` from any folder.
+
+To install the `aura` command yourself: `npm install -g getaura`. Without it, use `npx getaura <command>` (for example `npx getaura scan`).
 
 ## What you get
 
 - **An Aura score** from deterministic checks across security, agent setup, foundations and structure, explained in plain language.
-- **Next steps** in priority order: `aura next`.
+- **Next steps** in priority order. After a scan (or with `aura next`), tick the ones you want in the terminal and Aura does them.
 - **Fixes as pull requests you approve**: `aura apply foundation` puts your brief, agent rules, skills, CI and env example in place in one PR, and `aura fix <finding>` has Aura's agent make code changes on a branch.
 - **An agent that keeps it that way**: the rules and skills Aura installs teach your coding agent your standards, and GitHub Actions re-scans every push.
 

package/dist/index.js

@@ -20031,16 +20031,20 @@ import { fileURLToPath } from "url";
 
 // src/core/exec.ts
 import { spawn, spawnSync } from "child_process";
+var WINDOWS_PROGRAMS = /* @__PURE__ */ new Set(["git", "gh", "node", "tar", "where"]);
+function quoteForCmd(arg) {
+  return /^[\w@%+=:,./\\-]+$/.test(arg) ? arg : `"${arg.replace(/"/g, '\\"')}"`;
+}
+function spawnPlan(cmd, args, platform = process.platform) {
+  const direct = platform !== "win32" || cmd.includes("/") || cmd.includes("\\") || WINDOWS_PROGRAMS.has(cmd.toLowerCase());
+  return direct ? { args, shell: false } : { args: args.map(quoteForCmd), shell: true };
+}
 function run(cmd, args, opts = {}) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, args, {
-        cwd: opts.cwd,
-        env: opts.env ?? process.env,
-        stdio: ["pipe", "pipe", "pipe"],
-        shell: process.platform === "win32" && !cmd.includes("/") && !cmd.includes("\\")
-      });
+      const plan = spawnPlan(cmd, args);
+      child = spawn(cmd, plan.args, { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"], shell: plan.shell });
     } catch (err) {
       resolve({ code: 127, stdout: "", stderr: String(err) });
       return;
@@ -20076,7 +20080,11 @@ var AURA_DIR = ".aura";
 var ALWAYS_IGNORED = ["node_modules", ".next", ".git", "dist", "build", "out", ".vercel", ".turbo", "coverage", ".aura"];
 async function findRepoRoot(cwd = process.cwd()) {
   const r = await run("git", ["rev-parse", "--show-toplevel"], { cwd });
-  return r.code === 0 ? r.stdout.trim() : cwd;
+  return path.resolve(r.code === 0 ? r.stdout.trim() : cwd);
+}
+function isInside(root, full, p2 = path) {
+  const rel = p2.relative(p2.resolve(root), p2.resolve(full));
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${p2.sep}`) && !p2.isAbsolute(rel);
 }
 async function isGitRepo(cwd) {
   return (await run("git", ["rev-parse", "--is-inside-work-tree"], { cwd })).code === 0;
@@ -20421,7 +20429,7 @@ function pmCommands(pm) {
 // package.json
 var package_default = {
   name: "getaura",
-  version: "0.1.3",
+  version: "0.1.5",
   description: "Aura helps you and your coding agent follow best practices while you vibe code.",
   type: "module",
   bin: {
@@ -21591,6 +21599,10 @@ import path9 from "path";
 async function git(root, ...args) {
   return run("git", args, { cwd: root });
 }
+function ghInstallHint(platform = process.platform) {
+  const how = platform === "win32" ? "Install it with `winget install --id GitHub.cli`" : platform === "darwin" ? "Install it with `brew install gh` (or download it from https://cli.github.com)" : "Install it from https://cli.github.com";
+  return `${how}, open a new terminal, then run \`gh auth login\`.`;
+}
 async function ghStatus(root) {
   const v = await run("gh", ["--version"]);
   if (v.code !== 0) return { installed: false, authed: false, hasRemote: false };
@@ -21618,7 +21630,7 @@ async function freeBranchName(root, base) {
 function writeChanges(root, changes) {
   for (const c of changes) {
     const full = path9.join(root, c.path);
-    if (!full.startsWith(root + path9.sep)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
+    if (!isInside(root, full)) throw new Error(`Refusing to write outside the repo: ${c.path}`);
     if (c.content === null) rmSync(full, { force: true });
     else {
       mkdirSync2(path9.dirname(full), { recursive: true });
@@ -22762,7 +22774,7 @@ function safePath(root, rel) {
   if (normalized.startsWith("../") || normalized === ".." || path13.isAbsolute(normalized)) throw new Error(`Path is outside the repo: ${rel}`);
   if (FORBIDDEN.test(normalized)) throw new Error(`Aura doesn\u2019t let the agent touch ${normalized}.`);
   const full = path13.join(root, normalized);
-  if (!full.startsWith(root + path13.sep)) throw new Error(`Path is outside the repo: ${rel}`);
+  if (!isInside(root, full)) throw new Error(`Path is outside the repo: ${rel}`);
   return normalized;
 }
 function clip(text) {
@@ -23382,6 +23394,53 @@ function explainSignIn(outcome) {
   }
 }
 
+// src/commands/pick-steps.ts
+function stepRun(step, hasKey) {
+  const [, sub, arg = step.actionId] = step.command.split(" ");
+  if (sub === "apply") return { kind: "apply", actionId: arg };
+  if (sub === "fix") return { kind: "fix", actionId: arg, withOwnAgent: !hasKey };
+  if (sub === "guide") return { kind: "guide", topic: arg };
+  return { kind: "inventory" };
+}
+function hint(step, hasKey) {
+  const run2 = stepRun(step, hasKey);
+  const what = run2.kind === "apply" ? "opens a pull request" : run2.kind === "fix" ? run2.withOwnAgent ? "writes a task for your coding agent" : "Aura\u2019s agent fixes it in a pull request" : run2.kind === "guide" ? "shows step-by-step instructions" : "a few questions";
+  return [what, step.impact > 0 ? `+${step.impact} points` : "", effortLabel(step.effort)].filter(Boolean).join(" \xB7 ");
+}
+async function pickAndRunSteps(steps, limit = 10) {
+  if (steps.length === 0) {
+    console.log(pc.green("\n  Nothing to do right now."));
+    return 0;
+  }
+  const hasKey = Boolean(getApiKey());
+  console.log("");
+  const chosen = unwrap(
+    await p.multiselect({
+      message: "Next steps: pick what Aura should do now (space to select, enter to confirm, enter with none to skip)",
+      options: steps.slice(0, limit).map((s) => ({ value: s.actionId, label: s.title, hint: hint(s, hasKey) })),
+      required: false
+    })
+  );
+  if (chosen.length === 0) {
+    say.dim("Nothing selected. Run `aura next` any time to pick again.");
+    return 0;
+  }
+  const results = [];
+  for (const step of steps.filter((s) => chosen.includes(s.actionId))) {
+    console.log(`
+${pc.magenta("\u2726")} ${pc.bold(step.title)}`);
+    const run2 = stepRun(step, hasKey);
+    const code = run2.kind === "apply" ? await applyCommand(run2.actionId, { yes: true }) : run2.kind === "fix" ? await fixCommand(run2.actionId, run2.withOwnAgent ? { agent: true } : { yes: true }) : run2.kind === "guide" ? await guideCommand(run2.topic, {}) : await inventoryCommand({});
+    results.push({ title: step.title, ok: code === 0 });
+  }
+  if (results.length > 1) {
+    console.log(`
+${pc.bold("  Done")}`);
+    for (const r of results) console.log(`  ${r.ok ? pc.green("\u2714") : pc.red("\u2716")} ${r.title}`);
+  }
+  return results.every((r) => r.ok) ? 0 : 1;
+}
+
 // src/commands/simple.ts
 async function latestScan(root) {
   const file2 = auraPath(root, "scan.json");
@@ -23400,8 +23459,10 @@ async function nextCommand(flags) {
   const root = await findRepoRoot();
   const scan = await latestScan(root);
   const steps = nextSteps(scan, { includeFoundationBundle: true, accounts: accountState(root, scan.stack.services) });
+  const limit = flags.limit ? Number(flags.limit) : 10;
   if (flags.json) printJson({ score: scan.score, nextSteps: steps });
-  else console.log(renderNextSteps(steps, flags.limit ? Number(flags.limit) : 10));
+  else if (interactive()) return pickAndRunSteps(steps, limit);
+  else console.log(renderNextSteps(steps, limit));
   return 0;
 }
 async function historyCommand(flags) {
@@ -23845,7 +23906,7 @@ ${pc.bold(action2.title)}`);
     const gh = await ghStatus(root);
     if (!gh.installed || !gh.authed || !gh.hasRemote) {
       say.error(
-        !gh.installed ? "The GitHub CLI isn\u2019t installed. Run `aura guide install-github-cli`." : !gh.authed ? "Run `gh auth login` first." : "This repo has no GitHub remote. Push it to GitHub first."
+        !gh.installed ? `The GitHub CLI isn\u2019t installed. ${ghInstallHint()}` : !gh.authed ? "Run `gh auth login` first." : "This repo has no GitHub remote. Push it to GitHub first."
       );
       say.dim("Or run with --no-pr to commit the change on a local branch.");
       return 1;
@@ -24048,6 +24109,21 @@ async function draftBrief(client, answers, summary) {
   return res.brief.trim() + "\n";
 }
 
+// src/core/aura-command.ts
+function hasAuraCommand() {
+  return commandExists("aura");
+}
+var INSTALL_AURA = `npm install -g getaura@${AURA_VERSION}`;
+async function installAuraCommand() {
+  const r = await run("npm", ["install", "-g", `getaura@${AURA_VERSION}`], { timeoutMs: 18e4 });
+  if (r.code !== 0) return { ok: false, needsAdmin: /EACCES|EPERM|permission denied/i.test(r.stderr + r.stdout) };
+  return { ok: true, onPath: await hasAuraCommand() };
+}
+function installFallback(result, platform = process.platform) {
+  const admin = result.needsAdmin && platform !== "win32" ? `Run \`sudo ${INSTALL_AURA}\` and enter your computer password, or use` : "Use";
+  return `${admin} \`npx getaura <command>\` in place of \`aura <command>\` (for example \`npx getaura scan\`).`;
+}
+
 // src/commands/scan.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
 import os5 from "os";
@@ -24113,13 +24189,15 @@ async function scanCommand(flags) {
     return exitCode;
   }
   console.log(renderTerminal(scan, { previous: flags.ci ? base?.score ?? null : previous }));
-  if (!flags.ci) console.log(renderNextSteps(steps, 3));
+  const pick2 = !flags.ci && interactive();
+  if (!flags.ci && !pick2) console.log(renderNextSteps(steps, 3));
   say.dim(
     `
   Full report: .aura/report.md${client.hasKey || flags.explain === false ? "" : "  \xB7  Add a pilot key (aura login) for plain-language explanations."}`
   );
   if (base) say.info(`
   Compared with ${flags.base}: ${base.score} \u2192 ${scan.score}${exitCode ? ` (dropped more than ${maxDrop})` : ""}`);
+  if (pick2) await pickAndRunSteps(steps);
   return exitCode;
 }
 
@@ -24174,8 +24252,7 @@ async function initCommand(flags) {
   }
   const root = await findRepoRoot(cwd);
   const gh = await ghStatus(root);
-  if (!gh.installed)
-    say.warn("The GitHub CLI (gh) isn\u2019t installed. Aura needs it to open pull requests. Run `aura guide install-github-cli`. You can keep going and scan now.");
+  if (!gh.installed) say.warn(`The GitHub CLI (gh) isn\u2019t installed. Aura needs it to open pull requests. ${ghInstallHint()} You can keep going and scan now.`);
   else if (!gh.authed) say.warn("The GitHub CLI isn\u2019t signed in. Run `gh auth login` before applying fixes.");
   else if (!gh.hasRemote) say.warn("This repo has no GitHub remote yet. Push it to GitHub before applying fixes (`gh repo create`).");
   else say.ok("git and the GitHub CLI are ready.");
@@ -24318,6 +24395,26 @@ async function initCommand(flags) {
   }
   saveConfig(root, config2);
   ensureGitignore(root);
+  if (!process.env.CI && !await hasAuraCommand()) {
+    if (tty) {
+      if (unwrap(await p.confirm({ message: "Install the `aura` command so you can run `aura scan` any time?", initialValue: true }))) {
+        const s = spin(true);
+        s.start("Installing the aura command");
+        const installed = await installAuraCommand();
+        if (installed.ok)
+          s.stop(installed.onPath ? "Installed. Run `aura scan` from any folder." : "Installed. Open a new terminal window, then run `aura scan`.");
+        else {
+          s.stop("Couldn\u2019t install the aura command");
+          say.warn(installFallback(installed));
+        }
+      } else say.dim(`Use \`npx getaura <command>\` instead, or install it later with \`${INSTALL_AURA}\`.`);
+    } else {
+      console.log(`
+${pc.magenta("\u2726")} ${pc.bold("Give the user the aura command")}`);
+      console.log(`  Run \`${INSTALL_AURA}\` so they can type \`aura scan\` from now on. Until then, use \`npx getaura <command>\`.
+`);
+    }
+  }
   if (flags.scan === false) {
     if (tty) p.outro("Done. Run `aura scan` when you\u2019re ready.");
     return 0;