securevibe 0.1.10 → 0.1.12

package/README.md

@@ -28,8 +28,9 @@ midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE
 | `securevibe init [path]` | **Wire SecureVibe in: pre-commit guard + GitHub Action + gitignore** (doc 12) |
 | `securevibe fix [path]` | **Autonomously fix findings, then re-scan to verify** (doc 05) |
 | `securevibe explain [path]` | AI-powered plain-language explanations for critical/high findings |
+| `securevibe pr-comment [path]` | Post/update a PR findings summary (used by the GitHub Actions workflow) |
 | `securevibe deps [path]` | Audit dependencies for known CVEs against the local OSV database (SCA) |
-| `securevibe db <update\|status>` | Manage the local OSV database — `update` is the only networked command |
+| `securevibe db <update\|status>` | Manage the local OSV database — `update` is networked |
 | `securevibe ready [path]` | Launch readiness scorecard: pass/fail gates + go/no-go verdict |
 | `securevibe ai-audit [path]` | Focus on the AI-agent attack surface (doc 04) |
 | `securevibe protect [path]` | Remediation-first view: the fix for every finding (doc 05) |
@@ -40,11 +41,19 @@ midnight). The `--staged` commit guard is never limited. See [`LICENSE`](LICENSE
 
 Flags: `--json`, `--sarif` (GitHub code-scanning / CI interop), `--no-color`,
 `--ci` (exit `2` on BLOCK, `1` on WARN, `0` on SHIP — for build gates),
-`--staged` (scan only git-staged files — what the pre-commit guard uses).
+`--staged` (scan only git-staged files — what the pre-commit guard uses),
+`--diff <base>` (scan only files changed since `<base>` — what the PR-comment step
+uses; also exempt from the daily usage limit, same as `--staged`).
 `fix` flags: `--apply` (write to disk; asks before each change), `--yes` (apply every
 verified fix without prompting — for CI/scripts), `--no-llm` (deterministic-only), `--json`.
 `init` flags: `--force` (replace an existing hook/workflow/config).
 
+The REPL renders a bordered input box with a live status line (target + active AI-fixer
+provider). Type `/` to open a command-discovery menu, or type commands directly as
+before (`scan`, `fix --apply`, `help`, etc. — the `/` prefix is optional, not required).
+Up/down arrow cycles through your command history. `scan`/`fix`/`explain` show a single
+live progress spinner instead of scrolling status lines.
+
 ## Always-on (doc 12)
 
 `securevibe init` makes the tool continuous so insecure code can't slip through:
@@ -53,11 +62,16 @@ verified fix without prompting — for CI/scripts), `--no-llm` (deterministic-on
   a blocking issue** — including a committed secret (verified: it aborts the commit, then lets the
   clean version through);
 - a **GitHub Actions workflow** (`.github/workflows/securevibe.yml`) that scans every PR and uploads
-  SARIF to GitHub code scanning, gating the build on deployment-readiness;
+  SARIF to GitHub code scanning, gates the build on deployment-readiness, and posts a PR comment
+  summarizing findings in the *changed* files only (updated in place on new commits, not reposted —
+  and the only other command besides `db update` that talks to the network, and only to post a
+  findings summary already computed locally, never your source code);
 - gitignores `.env` / backups and drops a minimal `securevibe.config.json`.
 
-It is idempotent (existing files are left alone unless `--force`) and runs entirely locally —
-**no account, no upload, and your secrets / API keys are never stored or transmitted.**
+It is idempotent (existing files are left alone unless `--force`). Everything it installs runs
+locally — **no account, and your secrets / API keys are never stored or transmitted.** The one
+exception is the PR-comment step above, which uploads a findings summary (never your source code)
+already computed by the local scan.
 
 ## The fix loop (doc 05)
 
@@ -121,8 +135,9 @@ against a local copy of the [OSV](https://osv.dev) advisory database, and report
   CVE still blocks deployment, and `securevibe fix` bumps the package to the lowest non vulnerable
   version while preserving your range prefix (`^`, `~`, `==`, ...).
 - **Offline first.** A bundled seed (`data/osv-seed.json`) ships with the CLI, so `deps` works with
-  no network. `db update` is the **only networked command**: it streams the public OSV npm and PyPI
-  dumps into `~/.securevibe/db`. Nothing about your code or package list leaves the machine.
+  no network. `db update` is the only command that **downloads** anything (the public OSV npm and
+  PyPI dumps, into `~/.securevibe/db`). `pr-comment` is the only command that **uploads** anything,
+  and only a findings summary already computed locally — never your code or package list.
 - **Honest framing.** A clean result reads "no known advisories as of `<db date>`", not "secure" —
   it means nothing matched the local database on that date, which is not a proof of safety.
 

package/dist/engine/git.js

@@ -34,11 +34,15 @@ export function gitDir(root) {
 /**
  * Staged files (added/copied/modified) as absolute paths, filtered to those
  * that exist on disk. Returns null if not a git repo / git unavailable.
+ * `--relative` matters when `root` is a subdirectory of the repo: git diff
+ * paths are toplevel-relative by default, which would silently mis-resolve
+ * against `root` otherwise (and --relative also scopes the diff to `root`,
+ * matching "scan this path" semantics for a subdirectory target).
  */
 export async function listStagedFiles(root) {
     if (!isGitRepo(root))
         return null;
-    const out = git(root, ["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"]);
+    const out = git(root, ["diff", "--cached", "--relative", "--name-only", "--diff-filter=ACM", "-z"]);
     if (out == null)
         return null;
     const rels = out.split("\0").filter((s) => s.length > 0);
@@ -56,3 +60,32 @@ export async function listStagedFiles(root) {
     }
     return abs;
 }
+/**
+ * Files changed (added/copied/modified) between `baseRef` and the working
+ * tree, as absolute paths, filtered to those that still exist on disk. Used
+ * by `--diff` (PR-scoped scans) — same shape as listStagedFiles, but diffing
+ * against an arbitrary ref instead of the index. Returns null if not a git
+ * repo / git unavailable, or if the diff itself fails (e.g. `baseRef` doesn't
+ * exist in this checkout).
+ */
+export async function listChangedFiles(root, baseRef) {
+    if (!isGitRepo(root))
+        return null;
+    const out = git(root, ["diff", "--relative", "--name-only", "--diff-filter=ACM", "-z", baseRef]);
+    if (out == null)
+        return null;
+    const rels = out.split("\0").filter((s) => s.length > 0);
+    const abs = [];
+    for (const rel of rels) {
+        const p = path.join(root, rel);
+        try {
+            const st = await fs.stat(p);
+            if (st.isFile())
+                abs.push(p);
+        }
+        catch {
+            /* changed-but-removed or unreadable — skip */
+        }
+    }
+    return abs;
+}

package/dist/engine/github.js

@@ -0,0 +1,59 @@
+/**
+ * Minimal GitHub REST client for the pr-comment command (doc 12). Posts or
+ * updates a single PR comment, found via a hidden marker so re-runs replace
+ * it in place instead of piling up new comments. Every failure (auth,
+ * network, rate limit) is caught and returned as a result — this must never
+ * throw, since posting the comment is best-effort visibility, not a gate
+ * (the existing `scan --ci` step is what's allowed to fail the build).
+ */
+export const PR_COMMENT_MARKER = "<!-- securevibe-pr-comment -->";
+const API_BASE = "https://api.github.com";
+function authHeaders(token) {
+    return {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "Content-Type": "application/json",
+        "X-GitHub-Api-Version": "2022-11-28",
+    };
+}
+/** Finds an existing SecureVibe comment on the PR by its hidden marker, or null if none/on any failure. */
+async function findExistingComment(target) {
+    try {
+        const res = await fetch(`${API_BASE}/repos/${target.owner}/${target.repo}/issues/${target.prNumber}/comments?per_page=100`, { headers: authHeaders(target.token) });
+        if (!res.ok)
+            return null;
+        const comments = await res.json();
+        if (!Array.isArray(comments))
+            return null;
+        const existing = comments.find((c) => typeof c?.body === "string" && c.body.includes(PR_COMMENT_MARKER));
+        return existing?.id ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Posts a new PR comment, or updates the existing SecureVibe comment (found
+ * via the marker) in place. Never throws — any failure comes back as
+ * `{ posted: false, error }` so the caller can warn and continue.
+ */
+export async function postOrUpdateComment(target, body) {
+    try {
+        const existingId = await findExistingComment(target);
+        const url = existingId
+            ? `${API_BASE}/repos/${target.owner}/${target.repo}/issues/comments/${existingId}`
+            : `${API_BASE}/repos/${target.owner}/${target.repo}/issues/${target.prNumber}/comments`;
+        const res = await fetch(url, {
+            method: existingId ? "PATCH" : "POST",
+            headers: authHeaders(target.token),
+            body: JSON.stringify({ body }),
+        });
+        if (!res.ok) {
+            return { posted: false, updated: false, error: `GitHub API error: ${res.status}` };
+        }
+        return { posted: true, updated: existingId !== null };
+    }
+    catch (err) {
+        return { posted: false, updated: false, error: err?.message ?? String(err) };
+    }
+}

package/dist/engine/init.js

@@ -2,7 +2,7 @@
  * `securevibe init` (doc 12) — make SecureVibe always-on in a project with one
  * command. Installs a git pre-commit guard (blocks commits that introduce a
  * BLOCK-level issue, including committed secrets), a GitHub Actions workflow
- * (PR scan + SARIF upload to code scanning), gitignores `.env` and backups, and
+ * (PR scan + SARIF upload + PR summary comment), gitignores `.env` and backups, and
  * drops a minimal config. Idempotent: existing files are left alone unless
  * `--force`. Everything runs locally — no account, no upload, no API key.
  */
@@ -72,8 +72,8 @@ if [ "$?" -eq 2 ]; then
 fi
 exit 0
 `;
-const WORKFLOW = `# SecureVibe — scan every PR and upload findings to GitHub code scanning.
-# Managed by \`securevibe init\`.
+const WORKFLOW = `# SecureVibe — scan every PR, upload findings to GitHub code scanning, and
+# post a PR summary comment. Managed by \`securevibe init\`.
 name: SecureVibe
 on:
   pull_request:
@@ -82,11 +82,14 @@ on:
 permissions:
   contents: read
   security-events: write
+  issues: write
 jobs:
   securevibe:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 20
@@ -101,6 +104,12 @@ jobs:
           sarif_file: securevibe.sarif
       - name: Gate the build on deployment readiness
         run: securevibe scan . --ci
+      - name: PR comment
+        if: always() && github.event_name == 'pull_request'
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+        run: securevibe pr-comment . --diff \${{ github.event.pull_request.base.sha }}
 `;
 export async function runInit(root, opts = {}) {
     const absRoot = path.resolve(root);
@@ -122,7 +131,7 @@ export async function runInit(root, opts = {}) {
         });
     }
     // 4) GitHub Actions workflow.
-    actions.push(await writeIfAbsent(absRoot, ".github/workflows/securevibe.yml", WORKFLOW, opts.force, "PR scan + SARIF upload"));
+    actions.push(await writeIfAbsent(absRoot, ".github/workflows/securevibe.yml", WORKFLOW, opts.force, "PR scan + SARIF upload + PR summary comment"));
     return { root: absRoot, isGitRepo: repo, actions };
 }
 async function ensureGitignore(root) {

package/dist/engine/taint.js

@@ -1,6 +1,13 @@
 import { walk } from "./ast.js";
-/** Untrusted-input sources. Matching text is considered tainted at its origin. */
-const SOURCE_RE = /\b(req|request)\.(query|body|params|headers|cookies)\b|\bsearchParams\.get\b|\bnextUrl\.searchParams\b|\bparams\.[a-zA-Z_$]|\breq(uest)?\.json\(\)|\bawait\s+\w+\.json\(\)|\bprocess\.argv\b|\bflask\.request\.|\brequest\.args\b|\brequest\.form\b|\brequest\.json\b/;
+/**
+ * Untrusted-input sources. Matching text is considered tainted at its origin.
+ * `req(uest)?.json()` (with or without a preceding `await`) is intentionally
+ * scoped to those two names, not `\w+.json()` generically -- an unrestricted
+ * `\w+` also matched `await res.json()` on a response *we* fetched (e.g. an
+ * outbound GitHub API call), wrongly treating our own already-fetched data
+ * as untrusted input.
+ */
+const SOURCE_RE = /\b(req|request)\.(query|body|params|headers|cookies)\b|\bsearchParams\.get\b|\bnextUrl\.searchParams\b|\bparams\.[a-zA-Z_$]|\breq(uest)?\.json\(\)|\bprocess\.argv\b|\bflask\.request\.|\brequest\.args\b|\brequest\.form\b|\brequest\.json\b/;
 function collectAssignments(root) {
     const out = [];
     walk(root, (n) => {
@@ -32,7 +39,12 @@ function referencesTainted(text, tainted) {
     if (SOURCE_RE.test(text))
         return true;
     for (const v of tainted) {
-        // word-boundary match so `id` doesn't match `idx`
+        // word-boundary match so `id` doesn't match `idx` -- but this also can't
+        // tell a real reference to `v` from `v`'s name coincidentally appearing
+        // inside a string/template literal (e.g. a URL path segment: a tainted
+        // var named `comments` false-matched a fetch URL literally containing
+        // "/comments"). Known false-positive class, not fixed here -- narrowing
+        // SOURCE_RE only closes the one source that produced this instance.
         const re = new RegExp(`\\b${escapeRe(v)}\\b`);
         if (re.test(text))
             return true;

package/dist/index-support.js

@@ -2,6 +2,19 @@
  * Shared helpers used by both the one-shot CLI commands (index.ts) and the
  * interactive REPL (repl.ts), so the two entry points never duplicate logic.
  */
+/**
+ * Pure (no I/O) check: is there no AI-fixer provider key configured right
+ * now? Returns the static nudge text to print when true, undefined when a
+ * key is already set. Shared by the interactive `askLine`-based offer below
+ * and by the Ink REPL path (ui/repl-tui/App.ts), which can't safely open a
+ * second readline on process.stdin while Ink holds it in raw mode — so it
+ * prints this instead of calling maybeOfferAiFixerSetup().
+ */
+export function noKeyNudgeMessage() {
+    if (process.env.GROQ_API_KEY || process.env.ANTHROPIC_API_KEY)
+        return undefined;
+    return "  no AI-fixer key set — those findings show as manual review. Run `securevibe config set-key groq` (outside the REPL) to enable AI-powered fixes.\n\n";
+}
 /**
  * If `fix` is about to run with no AI-fixer provider key available (and we're
  * in an interactive terminal), offer to set one up on the spot — a free Groq
@@ -9,7 +22,7 @@
  * never touches process.env if the user declines or a key is already set.
  */
 export async function maybeOfferAiFixerSetup() {
-    if (process.env.GROQ_API_KEY || process.env.ANTHROPIC_API_KEY)
+    if (!noKeyNudgeMessage())
         return;
     const { isInteractive, askLine } = await import("./ui/prompt.js");
     if (!isInteractive())
@@ -52,7 +65,8 @@ export async function maybeOfferAiFixerSetupDuringInit(root, deps) {
     const isInteractive = deps?.isInteractive ?? (await import("./ui/prompt.js")).isInteractive;
     if (!isInteractive())
         return;
-    process.stderr.write("\n  This project uses an LLM SDK — SecureVibe can auto-fix AI-specific findings\n  (tool-hijack, prompt-injection sinks) with a free key.\n");
+    const writePreamble = deps?.writePreamble ?? ((text) => process.stderr.write(text));
+    writePreamble("\n  This project uses an LLM SDK — SecureVibe can auto-fix AI-specific findings\n  (tool-hijack, prompt-injection sinks) with a free key.\n");
     const offer = deps?.offer ?? maybeOfferAiFixerSetup;
     await offer();
     if (!(process.env.GROQ_API_KEY || process.env.ANTHROPIC_API_KEY)) {

package/dist/index.js

@@ -22,16 +22,18 @@ function addCommon(cmd) {
         .option("--sarif", "output SARIF 2.1.0 (for CI / GitHub code scanning)")
         .option("--no-color", "disable coloured output")
         .option("--staged", "scan only git-staged files (for pre-commit guards)")
+        .option("--diff <base>", "scan only files changed since <base> (for PR checks)")
         .option("--ci", "CI mode: exit non-zero based on deployment readiness");
 }
 /**
  * Free beta metering: one use per analysis command against the daily quota.
- * The --staged commit guard is exempt — a quota must never block a commit.
- * Returns the usage state so callers can show it, or undefined when this run
- * wasn't metered (--staged).
+ * The --staged commit guard and --diff (PR-scoped CI scans) are both exempt —
+ * an always-on automated guard must never be the thing that breaks. Returns
+ * the usage state so callers can show it, or undefined when this run wasn't
+ * metered.
  */
 async function meter(opts = {}) {
-    if (opts.staged)
+    if (opts.staged || opts.diff)
         return undefined;
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
@@ -62,6 +64,20 @@ async function runScan(pathArg, opts, scanOpts = {}) {
             scanOpts = { ...scanOpts, files: staged };
         }
     }
+    // --diff <base>: analyze only files changed since <base> (PR-scoped CI checks).
+    if (opts.diff) {
+        const path = await import("node:path");
+        const { listChangedFiles } = await import("./engine/git.js");
+        const absRoot = path.resolve(target);
+        const changed = await listChangedFiles(absRoot, opts.diff);
+        if (changed === null) {
+            if (!quiet)
+                process.stderr.write(`  · could not diff against ${opts.diff} — scanning the whole tree\n`);
+        }
+        else {
+            scanOpts = { ...scanOpts, files: changed };
+        }
+    }
     const result = await scan(target, {
         ...scanOpts,
         onProgress: quiet ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
@@ -201,6 +217,36 @@ program
     }
     await maybeNotifyUpdate({ json: opts.json });
 });
+program
+    .command("pr-comment")
+    .description("Post/update a PR summary of changed-file findings (used by the GitHub Actions workflow)")
+    .argument("[path]", "path to the repository", ".")
+    .option("--diff <base>", "base ref to diff against (the workflow passes the PR's base SHA)")
+    .action(async (pathArg, opts) => {
+    if (!opts.diff) {
+        process.stderr.write("  pr-comment: --diff <base> is required (the workflow passes the PR's base SHA).\n");
+        process.exit(64);
+    }
+    const { result } = await runScan(pathArg, { diff: opts.diff });
+    const { renderPrComment } = await import("./ui/prComment.js");
+    const body = renderPrComment(result);
+    const token = process.env.GITHUB_TOKEN;
+    const repoSlug = process.env.GITHUB_REPOSITORY;
+    const prNumber = process.env.PR_NUMBER ? Number(process.env.PR_NUMBER) : undefined;
+    if (!token || !repoSlug || !prNumber) {
+        process.stdout.write(body + "\n");
+        return;
+    }
+    const [owner, repo] = repoSlug.split("/");
+    const { postOrUpdateComment } = await import("./engine/github.js");
+    const posted = await postOrUpdateComment({ owner, repo, prNumber, token }, body);
+    if (!posted.posted) {
+        process.stderr.write(`  pr-comment: could not post to GitHub (${posted.error ?? "unknown error"}) — printing instead.\n`);
+        process.stdout.write(body + "\n");
+        return;
+    }
+    process.stderr.write(`  pr-comment: ${posted.updated ? "updated" : "posted"} the summary on PR #${prNumber}.\n`);
+});
 addCommon(program
     .command("ai-audit")
     .description("Focus on the AI-application / agent attack surface (doc 04)")
@@ -275,7 +321,7 @@ addCommon(program
 });
 program
     .command("db")
-    .description("Manage the local OSV vulnerability database (the only networked command)")
+    .description("Manage the local OSV vulnerability database (update is networked)")
     .argument("<action>", "update | status")
     .option("--no-color", "disable coloured output")
     .action(async (action, opts) => {

package/dist/repl.js

@@ -40,28 +40,62 @@ async function meterOrPrint(io) {
     }
     return r;
 }
-const HELP = [
-    "  Commands:",
-    "    scan [--json]                 full scan",
-    "    fix [--apply] [--yes] [--no-llm] [--json]   fix findings",
-    "    explain [--json]               AI explanations for critical/high findings",
-    "    ai-audit | protect | attack-map | score | deps | ready   [--json]",
-    "    init [--force]                 wire up the pre-commit guard + CI",
-    "    config show | set-key <groq|anthropic> | unset-key <groq|anthropic>",
-    "    db update | status             manage the local OSV database",
-    "    cd <path>                      change the scan target",
-    "    pwd                            show the current scan target",
-    "    help                           this message",
-    "    exit | quit                    leave the session",
-].join("\n");
-/** Public entry point: real stdio, refuses to start without a TTY. */
+/** Public entry point: real stdio, refuses to start without a TTY. Mounts
+ * the Ink interactive app (ui/repl-tui/App.ts) -- runReplSession above stays
+ * the tested, TTY-free core; this is the real-terminal presentation layer. */
 export async function runRepl(initialPath) {
     if (!isInteractive()) {
         process.stderr.write("  repl needs an interactive terminal.\n");
         process.exitCode = 64;
         return;
     }
-    await runReplSession(initialPath, { input: process.stdin, output: process.stdout });
+    const { render } = await import("ink");
+    const React = (await import("react")).default;
+    const { App } = await import("./ui/repl-tui/App.js");
+    const { waitUntilExit } = render(React.createElement(App, { initialPath }));
+    await waitUntilExit();
+}
+/**
+ * Handle one line of input against the given state: built-in commands
+ * (exit/quit/q, help, pwd, cd) plus everything dispatch() handles. Returns
+ * true if the session should end after this line. Shared by the legacy
+ * readline loop (runReplSession, below) and the Ink app (ui/repl-tui/App.ts)
+ * — extracted so both drive the exact same behavior from one place.
+ */
+export async function processLine(line, state, io) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return false;
+    const tokens = tokenize(trimmed);
+    const cmd = tokens[0];
+    const rest = tokens.slice(1);
+    try {
+        if (cmd === "exit" || cmd === "quit" || cmd === "q")
+            return true;
+        if (cmd === "help" || cmd === "?") {
+            const { renderHelp } = await import("./ui/repl-tui/commandRegistry.js");
+            write(io, renderHelp() + "\n\n");
+            return false;
+        }
+        if (cmd === "pwd") {
+            write(io, `  ${state.root}\n\n`);
+            return false;
+        }
+        if (cmd === "cd") {
+            if (!rest[0]) {
+                write(io, "  usage: cd <path>\n\n");
+                return false;
+            }
+            state.root = path.resolve(state.root, rest[0]);
+            write(io, `  target: ${state.root}\n\n`);
+            return false;
+        }
+        await dispatch(cmd, rest, state, io);
+    }
+    catch (err) {
+        write(io, `  error: ${err?.message ?? err}\n\n`);
+    }
+    return false;
 }
 /** The actual session loop, over injectable streams — testable without a TTY. */
 export async function runReplSession(initialPath, io) {
@@ -73,39 +107,17 @@ export async function runReplSession(initialPath, io) {
     write(io, `  target: ${state.root}\n\n`);
     while (true) {
         const raw = await askLine(`securevibe (${path.basename(state.root)})> `, io.input, io.output);
-        const line = raw.trim();
-        if (!line)
-            continue;
-        const tokens = tokenize(line);
-        const cmd = tokens[0];
-        const rest = tokens.slice(1);
-        try {
-            if (cmd === "exit" || cmd === "quit" || cmd === "q")
-                break;
-            if (cmd === "help" || cmd === "?") {
-                write(io, HELP + "\n\n");
-                continue;
-            }
-            if (cmd === "pwd") {
-                write(io, `  ${state.root}\n\n`);
-                continue;
-            }
-            if (cmd === "cd") {
-                if (!rest[0]) {
-                    write(io, "  usage: cd <path>\n\n");
-                    continue;
-                }
-                state.root = path.resolve(state.root, rest[0]);
-                write(io, `  target: ${state.root}\n\n`);
-                continue;
-            }
-            await dispatch(cmd, rest, state, io);
-        }
-        catch (err) {
-            write(io, `  error: ${err?.message ?? err}\n\n`);
-        }
+        if (await processLine(raw, state, io))
+            break;
     }
 }
+/** Progress callback for scan()/runFix()/explainFindings(): prefers io.onProgress
+ * (Ink path) over the default scrolling-line behavior (legacy readline path). */
+function progressCallback(io, asJson) {
+    if (asJson)
+        return undefined;
+    return io.onProgress ?? ((m) => write(io, `  · ${m}\n`));
+}
 async function dispatch(cmd, tokens, state, io) {
     const asJson = hasFlag(tokens, "--json");
     if (["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready"].includes(cmd)) {
@@ -113,7 +125,7 @@ async function dispatch(cmd, tokens, state, io) {
         const usage = await meterOrPrint(io);
         const result = await scan(state.root, {
             aiOnly: cmd === "ai-audit",
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            onProgress: progressCallback(io, asJson),
         });
         state.lastResult = result;
         if (asJson) {
@@ -130,15 +142,28 @@ async function dispatch(cmd, tokens, state, io) {
         const opts = { apply: hasFlag(tokens, "--apply"), yes: hasFlag(tokens, "--yes"), json: asJson };
         const decision = decideApply(opts, true);
         if (decision.apply && !hasFlag(tokens, "--no-llm")) {
-            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
-            await maybeOfferAiFixerSetup();
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
         }
         const usage = await meterOrPrint(io);
+        const confirmFn = decision.prompt
+            ? io.makeConfirm
+                ? io.makeConfirm(renderApprovalRequest)
+                : makeFixConfirm(renderApprovalRequest, io.input, io.output)
+            : undefined;
         const result = await runFix(state.root, {
             apply: decision.apply,
             noLlm: hasFlag(tokens, "--no-llm"),
-            confirm: decision.prompt ? makeFixConfirm(renderApprovalRequest, io.input, io.output) : undefined,
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            confirm: confirmFn,
+            onProgress: progressCallback(io, asJson),
         });
         if (asJson) {
             write(io, fixToJson(result) + "\n\n");
@@ -152,16 +177,24 @@ async function dispatch(cmd, tokens, state, io) {
     }
     if (cmd === "explain") {
         if (!asJson) {
-            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
-            await maybeOfferAiFixerSetup();
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
         }
         const { explainFindings } = await import("./engine/explain.js");
         const usage = await meterOrPrint(io);
         const { scan } = await import("./engine/scan.js");
-        const scanResult = await scan(state.root, { onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`) });
+        const scanResult = await scan(state.root, { onProgress: progressCallback(io, asJson) });
         state.lastResult = scanResult;
         const report = await explainFindings(scanResult, {
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            onProgress: progressCallback(io, asJson),
         });
         if (asJson) {
             const { explainToJson } = await import("./ui/explain.js");
@@ -177,8 +210,17 @@ async function dispatch(cmd, tokens, state, io) {
         const { renderInit } = await import("./ui/init.js");
         const result = await runInit(state.root, { force: hasFlag(tokens, "--force") });
         write(io, renderInit(result) + "\n");
-        const { maybeOfferAiFixerSetupDuringInit } = await import("./index-support.js");
-        await maybeOfferAiFixerSetupDuringInit(state.root);
+        const { maybeOfferAiFixerSetupDuringInit, noKeyNudgeMessage } = await import("./index-support.js");
+        await maybeOfferAiFixerSetupDuringInit(state.root, io.inkMode
+            ? {
+                writePreamble: (text) => write(io, text),
+                offer: async () => {
+                    const msg = noKeyNudgeMessage();
+                    if (msg)
+                        write(io, msg);
+                },
+            }
+            : undefined);
         return;
     }
     if (cmd === "config") {
@@ -232,6 +274,10 @@ async function handleConfig(tokens, io) {
         return;
     }
     if (action === "set-key") {
+        if (io.inkMode) {
+            write(io, `  config set-key needs a real terminal prompt — run \`securevibe config set-key ${provider}\` as a one-shot command outside the REPL (or set the ${provider === "groq" ? "GROQ_API_KEY" : "ANTHROPIC_API_KEY"} env var directly).\n\n`);
+            return;
+        }
         const hint = provider === "groq" ? " (free — console.groq.com/keys)" : " (console.anthropic.com)";
         const key = (await askLine(`  Paste your ${provider} API key${hint}: `, io.input, io.output)).trim();
         if (!key) {

package/dist/ui/prComment.js

@@ -0,0 +1,55 @@
+import { SEVERITY_ORDER } from "../engine/types.js";
+import { PR_COMMENT_MARKER } from "../engine/github.js";
+const MAX_FINDINGS = 15;
+const SEV_LABEL = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+const READINESS_LABEL = {
+    ship: "✓ Ship",
+    warn: "⚠ Ship with warnings",
+    block: "✗ Block deploy",
+};
+function severityCounts(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return ["critical", "high", "medium", "low"]
+        .filter((s) => counts[s] > 0)
+        .map((s) => `**${counts[s]}** ${SEV_LABEL[s]}`)
+        .join(" · ");
+}
+export function renderPrComment(result) {
+    const L = [];
+    L.push(PR_COMMENT_MARKER);
+    L.push("## SecureVibe — changed-files scan");
+    L.push("");
+    L.push(`**Grade ${result.score.grade}** (${result.score.composite}/100) — ${READINESS_LABEL[result.score.readiness]}`);
+    L.push("");
+    if (result.findings.length === 0) {
+        L.push("No findings in the files changed by this PR. ✓");
+        return L.join("\n");
+    }
+    L.push(severityCounts(result.findings));
+    L.push("");
+    const sorted = [...result.findings].sort((a, b) => SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity] || b.confidence - a.confidence);
+    const shown = sorted.slice(0, MAX_FINDINGS);
+    const remaining = sorted.length - shown.length;
+    for (const f of shown) {
+        L.push(`### ${SEV_LABEL[f.severity]} — ${f.title}`);
+        L.push(`\`${f.file}:${f.line}\``);
+        L.push("");
+        L.push(`**why:** ${f.why}`);
+        L.push("");
+        L.push(`**fix:** ${f.fix}`);
+        L.push("");
+    }
+    if (remaining > 0) {
+        L.push(`_+${remaining} more finding${remaining === 1 ? "" : "s"} — run \`securevibe scan\` locally to see all._`);
+        L.push("");
+    }
+    return L.join("\n");
+}

package/dist/ui/repl-tui/App.js

@@ -0,0 +1,130 @@
+import React, { useEffect, useRef, useState } from "react";
+import { Box, Static, Text, useApp, useInput } from "ink";
+import path from "node:path";
+import { mapAnswer } from "../prompt.js";
+import { processLine } from "../../repl.js";
+import { makeCallbackWritable } from "./outputStream.js";
+import { filterCommands } from "./commandRegistry.js";
+import { StatusLine } from "./StatusLine.js";
+import { InputBox } from "./InputBox.js";
+import { SlashMenu } from "./SlashMenu.js";
+import { Spinner } from "./Spinner.js";
+const h = React.createElement;
+// Static<T> is generic; createElement can't infer T from an untyped call the
+// way JSX's <Static<string>> would. Pin T=string via a TS instantiation
+// expression instead of casting the props object.
+const StringStatic = (Static);
+/**
+ * Top-level Ink app: <Static> scrollback (everything dispatch() writes,
+ * unchanged from the plain-text output the legacy readline loop already
+ * produces) above a live bottom region (status line, spinner, slash menu,
+ * input box). Every submitted line goes through the exact same
+ * processLine() the legacy readline loop and repl.test.ts already exercise
+ * (Task 1) -- this component only changes how a line is captured and how
+ * output is framed, never what a command does.
+ */
+export function App({ initialPath }) {
+    const { exit } = useApp();
+    const stateRef = useRef({ root: path.resolve(initialPath) });
+    const [lines, setLines] = useState([]);
+    const [value, setValue] = useState("");
+    const [history, setHistory] = useState([]);
+    const [busy, setBusy] = useState(false);
+    const [progressMessage, setProgressMessage] = useState(null);
+    const [confirmKind, setConfirmKind] = useState(null);
+    const [selectedMenuIndex, setSelectedMenuIndex] = useState(0);
+    const confirmResolverRef = useRef(null);
+    const pushLine = (text) => setLines((prev) => [...prev, text]);
+    useEffect(() => {
+        (async () => {
+            const { applyStoredKeysToEnv } = await import("../../config.js");
+            await applyStoredKeysToEnv();
+            const { renderBanner } = await import("../banner.js");
+            pushLine(renderBanner({ subtitle: "interactive session — type `help` or `/`" }) + "\n");
+            pushLine(`  target: ${stateRef.current.root}\n`);
+        })();
+    }, []);
+    const menuOpen = value.startsWith("/");
+    const filteredCommands = menuOpen ? filterCommands(value.slice(1)) : [];
+    const clampedIndex = Math.min(selectedMenuIndex, Math.max(0, filteredCommands.length - 1));
+    useInput((_input, key) => {
+        if (!menuOpen)
+            return;
+        if (key.upArrow)
+            setSelectedMenuIndex((i) => Math.max(0, i - 1));
+        if (key.downArrow)
+            setSelectedMenuIndex((i) => Math.min(filteredCommands.length - 1, i + 1));
+        if (key.escape)
+            setValue("");
+    });
+    const handleChange = (v) => {
+        setSelectedMenuIndex(0);
+        setValue(v);
+    };
+    const handleSubmit = async (line) => {
+        if (confirmResolverRef.current) {
+            const answer = mapAnswer(line, confirmKind ?? "patch");
+            confirmResolverRef.current(answer);
+            setValue("");
+            return;
+        }
+        // A command is already running (busy stays true for its whole duration,
+        // including while a confirm is pending -- but that case already returned
+        // above). Ignore a second real submission rather than racing two
+        // processLine() calls over the same mutable ReplState. The legacy
+        // readline loop can't hit this: only one askLine() is ever pending, so
+        // there's no way to submit a second line before the first resolves.
+        if (busy)
+            return;
+        if (menuOpen) {
+            const chosen = filteredCommands[clampedIndex];
+            setValue(chosen ? chosen.name + " " : "");
+            return;
+        }
+        if (!line.trim()) {
+            setValue("");
+            return;
+        }
+        setHistory((prev) => [...prev, line]);
+        setValue("");
+        setBusy(true);
+        setProgressMessage(null);
+        const io = {
+            input: process.stdin,
+            output: makeCallbackWritable(pushLine),
+            inkMode: true,
+            onProgress: (m) => setProgressMessage(m),
+            makeConfirm: (render) => {
+                return (req) => new Promise((resolve) => {
+                    pushLine(render(req) + "\n");
+                    setConfirmKind(req.kind);
+                    confirmResolverRef.current = (answer) => {
+                        setConfirmKind(null);
+                        confirmResolverRef.current = null;
+                        resolve(answer);
+                    };
+                });
+            },
+        };
+        const shouldExit = await processLine(line, stateRef.current, io);
+        setBusy(false);
+        setProgressMessage(null);
+        if (shouldExit)
+            exit();
+    };
+    return h(React.Fragment, null, h(StringStatic, {
+        items: lines,
+        children: (line, i) => h(Text, { key: i }, line),
+    }), h(Box, { flexDirection: "column" }, h(StatusLine, { targetRoot: stateRef.current.root }), busy && progressMessage ? h(Spinner, { message: progressMessage }) : null, confirmKind
+        ? h(Text, { dimColor: true }, confirmKind === "patch"
+            ? "  Apply this change? [y]es / [n]o / [a]ll / [q]uit"
+            : "  Apply these supporting changes? [y]es / [n]o")
+        : null, menuOpen ? h(SlashMenu, { items: filteredCommands, selectedIndex: clampedIndex }) : null, h(InputBox, {
+        value,
+        onChange: handleChange,
+        onSubmit: handleSubmit,
+        history,
+        onHistoryNavigate: setValue,
+        menuOpen,
+    })));
+}

package/dist/ui/repl-tui/InputBox.js

@@ -0,0 +1,48 @@
+import React, { useState } from "react";
+import { Box, Text, useInput } from "ink";
+import TextInput from "ink-text-input";
+const h = React.createElement;
+/**
+ * Bordered single-line input (`>` prompt, rounded border). Up/down arrow
+ * cycles `history`, but only when the slash menu isn't open -- App.ts's own
+ * useInput takes over up/down for menu-item selection in that state.
+ * TextInput itself only handles left/right cursor movement and
+ * backspace/delete, never up/down, so there's no conflict between this
+ * hook and TextInput's own internal input handling.
+ */
+export function InputBox({ value, onChange, onSubmit, history, onHistoryNavigate, menuOpen }) {
+    const [historyIndex, setHistoryIndex] = useState(null);
+    useInput((_input, key) => {
+        if (menuOpen)
+            return;
+        if (key.upArrow) {
+            if (history.length === 0)
+                return;
+            const next = historyIndex === null ? history.length - 1 : Math.max(0, historyIndex - 1);
+            setHistoryIndex(next);
+            onHistoryNavigate(history[next]);
+            return;
+        }
+        if (key.downArrow) {
+            if (historyIndex === null)
+                return;
+            const next = historyIndex + 1;
+            if (next >= history.length) {
+                setHistoryIndex(null);
+                onHistoryNavigate("");
+            }
+            else {
+                setHistoryIndex(next);
+                onHistoryNavigate(history[next]);
+            }
+        }
+    });
+    return h(Box, { borderStyle: "round", paddingX: 1 }, h(Text, null, "> "), h(TextInput, {
+        value,
+        onChange: (v) => {
+            setHistoryIndex(null);
+            onChange(v);
+        },
+        onSubmit,
+    }));
+}

package/dist/ui/repl-tui/SlashMenu.js

@@ -0,0 +1,10 @@
+import React from "react";
+import { Box, Text } from "ink";
+const h = React.createElement;
+/** Purely presentational -- App.ts owns navigation (up/down) and selection (Enter). */
+export function SlashMenu({ items, selectedIndex }) {
+    if (items.length === 0) {
+        return h(Box, { paddingX: 1 }, h(Text, { dimColor: true }, "no matching commands"));
+    }
+    return h(Box, { flexDirection: "column", paddingX: 1 }, ...items.map((item, i) => h(Text, { key: item.name, color: i === selectedIndex ? "cyan" : undefined }, `${i === selectedIndex ? "› " : "  "}/${item.name} ${item.args} — ${item.description}`)));
+}

package/dist/ui/repl-tui/Spinner.js

@@ -0,0 +1,18 @@
+import React, { useEffect, useState } from "react";
+import { Box, Text } from "ink";
+const h = React.createElement;
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/**
+ * One live-updating line (braille spinner + current step's message),
+ * replacing the old scrolling "· message" lines during scan/fix/explain.
+ * Hand-rolled rather than a dependency -- ten frames and a setInterval is
+ * simple enough not to justify another package.
+ */
+export function Spinner({ message }) {
+    const [frame, setFrame] = useState(0);
+    useEffect(() => {
+        const id = setInterval(() => setFrame((f) => (f + 1) % FRAMES.length), 80);
+        return () => clearInterval(id);
+    }, []);
+    return h(Box, null, h(Text, { color: "cyan" }, FRAMES[frame]), h(Text, null, ` ${message}`));
+}

package/dist/ui/repl-tui/StatusLine.js

@@ -0,0 +1,15 @@
+import React from "react";
+import { Box, Text } from "ink";
+import path from "node:path";
+import { llmAvailability } from "../../engine/fix/llm.js";
+const h = React.createElement;
+/**
+ * target: <basename> · fixer: <groq|anthropic|none>, right-aligned, dim.
+ * fixer reflects the same provider-selection precedence fix's LLM path
+ * already uses (llmAvailability), not a separately reimplemented rule.
+ */
+export function StatusLine({ targetRoot }) {
+    const avail = llmAvailability(false);
+    const fixer = avail.provider ?? "none";
+    return h(Box, { justifyContent: "flex-end" }, h(Text, { dimColor: true }, `target: ${path.basename(targetRoot)} · fixer: ${fixer}`));
+}

package/dist/ui/repl-tui/commandRegistry.js

@@ -0,0 +1,36 @@
+export const COMMANDS = [
+    { name: "scan", args: "[--json]", description: "full scan" },
+    { name: "fix", args: "[--apply] [--yes] [--no-llm] [--json]", description: "fix findings" },
+    { name: "explain", args: "[--json]", description: "AI explanations for critical/high findings" },
+    { name: "ai-audit", args: "[--json]", description: "focus on the AI-agent attack surface" },
+    { name: "protect", args: "[--json]", description: "AI execution firewall guidance" },
+    { name: "attack-map", args: "[--json]", description: "map findings to attacker paths" },
+    { name: "score", args: "[--json]", description: "score-only view" },
+    { name: "deps", args: "[--json]", description: "dependency / CVE audit" },
+    { name: "ready", args: "[--json]", description: "launch readiness scorecard" },
+    { name: "init", args: "[--force]", description: "wire up the pre-commit guard + CI" },
+    {
+        name: "config",
+        args: "show | set-key <groq|anthropic> | unset-key <groq|anthropic>",
+        description: "manage AI-fixer keys",
+    },
+    { name: "db", args: "update | status", description: "manage the local OSV database" },
+    { name: "cd", args: "<path>", description: "change the scan target" },
+    { name: "pwd", args: "", description: "show the current scan target" },
+    { name: "help", args: "", description: "this message" },
+    { name: "exit", args: "", description: "leave the session (aliases: quit, q)" },
+];
+/** Prefix match on command name, case-insensitive. Empty query returns all. */
+export function filterCommands(query) {
+    const q = query.toLowerCase();
+    return COMMANDS.filter((c) => c.name.toLowerCase().startsWith(q));
+}
+/** Plain-text `help` output, one line per command. */
+export function renderHelp() {
+    const lines = ["  Commands:"];
+    for (const c of COMMANDS) {
+        const left = `    ${c.name}${c.args ? " " + c.args : ""}`;
+        lines.push(left.length < 44 ? left.padEnd(44) + c.description : left + "  " + c.description);
+    }
+    return lines.join("\n");
+}

package/dist/ui/repl-tui/outputStream.js

@@ -0,0 +1,16 @@
+import { Writable } from "node:stream";
+/**
+ * A real Writable whose _write feeds every chunk to a callback instead of a
+ * terminal. Lets dispatch()'s existing `io.output.write(text)` calls feed
+ * Ink's <Static> scrollback region instead of writing directly to stdout,
+ * which would corrupt Ink's own live-region redraws (the input box, status
+ * line, spinner, and slash menu all redraw in place on every keystroke).
+ */
+export function makeCallbackWritable(onWrite) {
+    return new Writable({
+        write(chunk, _encoding, callback) {
+            onWrite(chunk.toString());
+            callback();
+        },
+    });
+}

package/dist/version.js

@@ -2,4 +2,4 @@
 // Single source of truth for the CLI's own version, so it can't drift from
 // what commander reports and what the update-check compares against.
 // Kept in sync with the "version" field in package.json by hand at release time.
-export const VERSION = "0.1.10";
+export const VERSION = "0.1.12";

package/package.json

@@ -1,66 +1,71 @@
-{
-  "name": "securevibe",
-  "version": "0.1.10",
-  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
-  "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
-  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
-  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
-    "directory": "packages/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
-  },
-  "keywords": [
-    "security",
-    "scanner",
-    "sast",
-    "ai security",
-    "prompt injection",
-    "vulnerability",
-    "secrets",
-    "sca",
-    "cve",
-    "launch readiness",
-    "vibe coding",
-    "cli"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "bin": {
-    "securevibe": "./dist/index.js"
-  },
-  "files": [
-    "dist",
-    "data",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsx src/index.ts",
-    "start": "node dist/index.js",
-    "test": "node run-tests.mjs"
-  },
-  "dependencies": {
-    "commander": "^12.1.0",
-    "diff": "^5.2.0",
-    "picocolors": "^1.1.1",
-    "tree-sitter-wasms": "^0.1.12",
-    "web-tree-sitter": "^0.25.10",
-    "yauzl": "^3.2.0"
-  },
-  "optionalDependencies": {
-    "@anthropic-ai/sdk": "^0.39.0"
-  },
-  "devDependencies": {
-    "@types/diff": "^5.2.0",
-    "@types/node": "^20.14.0",
-    "@types/yauzl": "^2.10.3",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "securevibe",
+  "version": "0.1.12",
+  "description": "Autonomous AI security engineer for AI generated apps: scan, fix, verify, and gate every commit before you launch",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Benedict Patrick <benedictroger2006@gmail.com>",
+  "homepage": "https://github.com/Benedictpatrick/secure-vibe#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Benedictpatrick/secure-vibe.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/Benedictpatrick/secure-vibe/issues"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "sast",
+    "ai security",
+    "prompt injection",
+    "vulnerability",
+    "secrets",
+    "sca",
+    "cve",
+    "launch readiness",
+    "vibe coding",
+    "cli"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "securevibe": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "data",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "test": "node run-tests.mjs"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "diff": "^5.2.0",
+    "ink": "^6.8.0",
+    "ink-text-input": "^6.0.0",
+    "picocolors": "^1.1.1",
+    "react": "^19.2.7",
+    "tree-sitter-wasms": "^0.1.12",
+    "web-tree-sitter": "^0.25.10",
+    "yauzl": "^3.2.0"
+  },
+  "optionalDependencies": {
+    "@anthropic-ai/sdk": "^0.39.0"
+  },
+  "devDependencies": {
+    "@types/diff": "^5.2.0",
+    "@types/node": "^20.14.0",
+    "@types/react": "^19.2.17",
+    "@types/yauzl": "^2.10.3",
+    "ink-testing-library": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}