getaura 0.1.6 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getaura",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Aura helps you and your coding agent follow best practices while you vibe code.",
   "type": "module",
   "bin": {
@@ -9,7 +9,9 @@
   "files": [
     "dist",
     "templates",
-    "README.md"
+    "README.md",
+    ".claude-plugin",
+    "plugin"
   ],
   "engines": {
     "node": ">=22"

package/plugin/skills/fix/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: fix
+description: Fix the most serious Aura finding, or the one the user names, through a pull request they review.
+argument-hint: "[action or finding id]"
+disable-model-invocation: true
+allowed-tools: Bash
+---
+
+Fix: $ARGUMENTS
+
+If the user named nothing to fix, run `aura next --json` (or `npx getaura next --json` if `aura` isn't found) and take the first step. Otherwise use the action or finding the user named.
+
+Follow the step's `delivery`:
+
+- `pr`: run `aura apply <action> --yes`. Tell the user a pull request was opened and what to check before merging.
+- `agent-fix`: run `aura fix <action> --yes` to have Aura's agent make the change in a pull request. If that fails because there's no pilot key, run `aura fix <action> --agent` and complete the task file it writes yourself: on a new branch `aura/<id>`, keep the change small, run the tests, lint and type check, then open a pull request with `gh pr create` and a plain-language description.
+- `guide`: run `aura guide <topic>` and walk the user through it step by step. These are things they do in a dashboard, not in the code.
+- `checklist`: run `aura inventory --json`, show the user which services and accounts Aura found, and ask them to run `aura inventory` in their own terminal to record who owns each account.
+
+Afterwards, run `aura scan --json` and tell the user the new score. Never disable, weaken or ignore a check to raise the score, and never repeat a secret value.

package/plugin/skills/next/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: next
+description: Show Aura's recommended next steps for this repo and let the user pick which to do.
+disable-model-invocation: true
+allowed-tools: Bash
+---
+
+Run `aura next --json` from the repository root. If `aura` isn't found, run `npx getaura next --json` instead.
+
+Show the steps as a short numbered list, most important first. For each: the title, why it matters in one plain sentence, how many points it's worth, and what doing it involves (a pull request to review, Aura's agent making a fix, a guide to follow, or a few questions).
+
+Ask the user which ones they want done. For each one they choose, follow its `delivery`:
+
+- `pr`: run `aura apply <action id> --yes` and tell the user what to check in the pull request.
+- `agent-fix`: run `aura fix <action id> --yes` (without a pilot key, `aura fix <action id> --agent`, then complete the task file it writes).
+- `guide`: run `aura guide <topic>` and walk the user through it.
+- `checklist`: run `aura inventory --json`, show the user which services and accounts Aura found, and ask them to run `aura inventory` in their own terminal to record who owns each account.
+
+Afterwards, run `aura scan --json` and tell the user the new score.

package/plugin/skills/scan/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: scan
+description: Check this repo's Aura score and explain what Aura found, in plain language.
+disable-model-invocation: true
+allowed-tools: Bash
+---
+
+Run `aura scan --json` from the repository root. If `aura` isn't found, run `npx getaura scan --json` instead.
+
+Then tell the user, in plain language for a non-technical founder:
+
+1. The Aura score (0–100) and its label, and the score for each category.
+2. The most serious findings first: what could happen to the business or its users, not just the technical term. Group the rest instead of listing everything.
+3. One clear recommendation for what to do next, and offer to do it (`/aura:fix`).
+
+Never print, quote or repeat a secret value, even partly; refer to it by file and line. Say "Aura found…" for Aura's results and "I think…" for your own view.

package/plugin/skills/setup/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: setup
+description: Set Aura up in this repo, or refresh its setup.
+disable-model-invocation: true
+allowed-tools: Bash
+---
+
+Run `npx getaura@latest init --yes --agent claude` from the repository root and follow the steps it prints:
+
+- **Sign-in link**: ask the user to open it and paste their pilot key in the browser. Never ask for the key in chat. If the command stops while waiting, run it again once they've finished: it carries on with the same link.
+- **Product brief questions**: suggest answers from the code and let the user confirm or correct them, save them as it describes, and run the command it gives.
+- **The `aura` command**: if it says to install it, run that command so the user can type `aura scan` from now on.
+
+If a command fails because the network or writing outside the project is blocked (sandboxed agents such as Codex), ask the user to approve running it with network access. Aura needs the network for sign-in and npm, and writes its settings to `~/.aura`.
+
+Finish by telling the user their Aura score and the most important next step.

package/templates/skills/aura/SKILL.md

@@ -55,7 +55,7 @@ Always use the non-interactive flags below so nothing waits for input.
    - `pr`: run the step's command (`aura apply <action> --yes`). Tell the user a PR was opened and what to check.
    - `agent-fix`: run `aura fix <id> --agent`, then complete the task file yourself (see below), or run `aura fix <id> --yes` if the user prefers Aura's agent.
    - `guide`: run `aura guide <topic>` and walk the user through it. These steps happen in vendor dashboards, so the user does them.
-   - `checklist`: run `aura inventory` and help the user answer the questions.
+   - `checklist`: run `aura inventory --json`, show the user which services and accounts Aura found, and ask them to run `aura inventory` in their own terminal to record who owns each account.
 3. After any change, run `aura scan --json` again and tell the user the new score.
 
 ## Task files
@@ -66,7 +66,7 @@ When `.aura/tasks/<id>.md` exists, it is your brief. Follow it exactly:
 2. Make the change the task describes. Keep it small and focused on that task.
 3. Run the tests, lint and typecheck. Fix anything you broke.
 4. Commit, push and open a PR with `gh pr create`. Write the PR body in plain language: what changed, why it matters, and what the user should check before merging.
-5. Run `aura scan` to confirm the finding is gone.
+5. Run `aura scan --json` to confirm the finding is gone.
 
 ## Rules