komplian 0.3.5 → 0.3.7

package/README.md

@@ -6,7 +6,8 @@
 2. Browser login: `gh auth login -h github.com -s repo -s read:org -w`
 3. `npx komplian onboard --yes`
 
-No OAuth App registration — `gh` uses GitHub’s built-in flow. Default workspace: `~/komplian`.
+No OAuth App registration — `gh` uses GitHub’s built-in flow. **Default workspace:** current working directory (`process.cwd()`), not `~/komplian`. Pass a path as last argument to clone elsewhere.  
+**npm install** runs with `--no-audit --no-fund` unless `KOMPLIAN_NPM_AUDIT=1`. Run `npm audit` in each repo when you work on it.
 
 **Maintainers:** publish from **`scripts/`** (folder with `package.json`), not the monorepo root:
 

package/komplian-onboard.mjs

@@ -96,7 +96,8 @@ function ghApiJson(path) {
 function verifyOrgMembership(org) {
   const enc = encodeURIComponent(org);
   const mem = ghApiJson(`user/memberships/orgs/${enc}`);
-  if (mem.status === 200) {
+  /** spawnSync().status = código de salida de `gh` (0 = éxito), no código HTTP. */
+  if (mem.status === 0) {
     try {
       const j = JSON.parse(mem.stdout);
       if (j.state === "active") return;
@@ -109,7 +110,8 @@ function verifyOrgMembership(org) {
       process.exit(1);
     }
   }
-  if (mem.status === 404) {
+  const hint = (mem.stderr + mem.stdout).toLowerCase();
+  if (hint.includes("404") || hint.includes("not found")) {
     log(
       `${c.red}✗${c.reset} Esta cuenta ${c.bold}no es miembro${c.reset} de la org ${c.bold}${org}${c.reset}.`
     );
@@ -118,21 +120,20 @@ function verifyOrgMembership(org) {
     );
     process.exit(1);
   }
-  const hint = (mem.stderr + mem.stdout).toLowerCase();
-  if (mem.status === 403 || hint.includes("read:org") || hint.includes("scope")) {
+  if (hint.includes("403") || hint.includes("read:org") || hint.includes("scope")) {
     log(`${c.red}✗${c.reset} Falta scope ${c.bold}read:org${c.reset} en gh.`);
     log(`${c.dim}  gh auth refresh -h github.com -s repo -s read:org${c.reset}`);
     process.exit(1);
   }
   log(
-    `${c.red}✗${c.reset} No se pudo verificar la org (${mem.status}):\n${c.dim}${(mem.stderr || mem.stdout).trim()}${c.reset}`
+    `${c.red}✗${c.reset} No se pudo verificar la org (código ${mem.status}):\n${c.dim}${(mem.stderr || mem.stdout).trim()}${c.reset}`
   );
   process.exit(1);
 }
 
 function logGhIdentity() {
   const u = ghApiJson("user");
-  if (u.status !== 200) return;
+  if (u.status !== 0) return;
   try {
     const j = JSON.parse(u.stdout);
     if (j.login) {
@@ -310,13 +311,18 @@ function npmInstallEach(workspace) {
     log(`${c.yellow}○${c.reset} npm no está en PATH — omito installs`);
     return;
   }
+  const audit =
+    process.env.KOMPLIAN_NPM_AUDIT === "1" || process.env.KOMPLIAN_NPM_AUDIT === "true";
+  const installArgs = audit
+    ? ["install"]
+    : ["install", "--no-audit", "--no-fund"];
   for (const ent of readdirSync(workspace)) {
     const d = join(workspace, ent);
     if (!statSync(d).isDirectory()) continue;
     const pkg = join(d, "package.json");
     if (!existsSync(pkg)) continue;
     log(`${c.dim}→${c.reset} ${ent}`);
-    const ir = spawnSync("npm", ["install"], spawnWin({ cwd: d, stdio: "inherit" }));
+    const ir = spawnSync("npm", installArgs, spawnWin({ cwd: d, stdio: "inherit" }));
     if (ir.status !== 0) {
       log(`${c.yellow}○${c.reset} npm install con avisos en ${ent}`);
     } else {
@@ -333,6 +339,7 @@ function usage() {
   log(`  Requisitos: Node 18+, git, GitHub CLI (gh)`);
   log(``);
   log(`  onboard implica --install salvo --no-install`);
+  log(`  [carpeta]          Destino (por defecto: directorio actual, no ~/komplian)`);
   log(`  -y, --yes          Sin menú interactivo (equipo por defecto del JSON)`);
   log(`  -t, --team <slug>  Equipo en komplian-team-repos.json`);
   log(`  -i, --install      npm install en cada repo con package.json`);
@@ -479,7 +486,7 @@ async function main() {
 
   let workspace = args.workspace.trim();
   if (!workspace) {
-    workspace = join(homedir(), "komplian");
+    workspace = process.cwd();
   }
   const abs = resolve(workspace.replace(/^~(?=$|[/\\])/, homedir()));
   if (!isSafeTargetDir(abs)) {
@@ -513,6 +520,9 @@ async function main() {
     log(`${c.yellow}○${c.reset} ${failed} repo(s) fallaron — revisa acceso y reintenta.`);
   }
   log(`${c.green}✓${c.reset} Cursor: ${c.bold}File → Open Folder → ${abs}${c.reset}`);
+  log(
+    `${c.dim}  npm install usa --no-audit --no-fund (menos ruido). Auditoría: cd cada repo y npm audit. KOMPLIAN_NPM_AUDIT=1 para resumen completo.${c.reset}`
+  );
   log(`${c.dim}  .env.example → .env por proyecto; secretos en 1Password — nunca commit.${c.reset}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "komplian",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Komplian developer workspace setup: GitHub CLI (browser login) + git clone by team. Node 18+, git, gh — no OAuth App to register.",
   "type": "module",
   "engines": {