komplian 0.3.6 → 0.3.7

package/README.md

@@ -6,7 +6,8 @@
 2. Browser login: `gh auth login -h github.com -s repo -s read:org -w`
 3. `npx komplian onboard --yes`
 
-No OAuth App registration — `gh` uses GitHub’s built-in flow. Default workspace: `~/komplian`.
+No OAuth App registration — `gh` uses GitHub’s built-in flow. **Default workspace:** current working directory (`process.cwd()`), not `~/komplian`. Pass a path as last argument to clone elsewhere.  
+**npm install** runs with `--no-audit --no-fund` unless `KOMPLIAN_NPM_AUDIT=1`. Run `npm audit` in each repo when you work on it.
 
 **Maintainers:** publish from **`scripts/`** (folder with `package.json`), not the monorepo root:
 

package/komplian-onboard.mjs

@@ -311,13 +311,18 @@ function npmInstallEach(workspace) {
     log(`${c.yellow}○${c.reset} npm no está en PATH — omito installs`);
     return;
   }
+  const audit =
+    process.env.KOMPLIAN_NPM_AUDIT === "1" || process.env.KOMPLIAN_NPM_AUDIT === "true";
+  const installArgs = audit
+    ? ["install"]
+    : ["install", "--no-audit", "--no-fund"];
   for (const ent of readdirSync(workspace)) {
     const d = join(workspace, ent);
     if (!statSync(d).isDirectory()) continue;
     const pkg = join(d, "package.json");
     if (!existsSync(pkg)) continue;
     log(`${c.dim}→${c.reset} ${ent}`);
-    const ir = spawnSync("npm", ["install"], spawnWin({ cwd: d, stdio: "inherit" }));
+    const ir = spawnSync("npm", installArgs, spawnWin({ cwd: d, stdio: "inherit" }));
     if (ir.status !== 0) {
       log(`${c.yellow}○${c.reset} npm install con avisos en ${ent}`);
     } else {
@@ -334,6 +339,7 @@ function usage() {
   log(`  Requisitos: Node 18+, git, GitHub CLI (gh)`);
   log(``);
   log(`  onboard implica --install salvo --no-install`);
+  log(`  [carpeta]          Destino (por defecto: directorio actual, no ~/komplian)`);
   log(`  -y, --yes          Sin menú interactivo (equipo por defecto del JSON)`);
   log(`  -t, --team <slug>  Equipo en komplian-team-repos.json`);
   log(`  -i, --install      npm install en cada repo con package.json`);
@@ -480,7 +486,7 @@ async function main() {
 
   let workspace = args.workspace.trim();
   if (!workspace) {
-    workspace = join(homedir(), "komplian");
+    workspace = process.cwd();
   }
   const abs = resolve(workspace.replace(/^~(?=$|[/\\])/, homedir()));
   if (!isSafeTargetDir(abs)) {
@@ -514,6 +520,9 @@ async function main() {
     log(`${c.yellow}○${c.reset} ${failed} repo(s) fallaron — revisa acceso y reintenta.`);
   }
   log(`${c.green}✓${c.reset} Cursor: ${c.bold}File → Open Folder → ${abs}${c.reset}`);
+  log(
+    `${c.dim}  npm install usa --no-audit --no-fund (menos ruido). Auditoría: cd cada repo y npm audit. KOMPLIAN_NPM_AUDIT=1 para resumen completo.${c.reset}`
+  );
   log(`${c.dim}  .env.example → .env por proyecto; secretos en 1Password — nunca commit.${c.reset}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "komplian",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Komplian developer workspace setup: GitHub CLI (browser login) + git clone by team. Node 18+, git, gh — no OAuth App to register.",
   "type": "module",
   "engines": {