sekura 0.1.0 → 0.1.1

package/README.md

@@ -36,13 +36,13 @@ npx sekura@latest uninstall             # remove the entries, the skill and the
 | GitHub Copilot (VS Code) | the VS Code user `mcp.json` → `servers.sekura` | `.mcp.json` |
 | OpenAI Codex | `codex mcp add sekura --url …`, or `~/.codex/config.toml` → `[mcp_servers.sekura]` | — |
 | Kiro | `~/.kiro/settings/mcp.json` | `.kiro/settings/mcp.json` |
-| Cline | `cline_mcp_settings.json` in VS Code's global storage | — |
+| Cline | `~/.cline/data/settings/cline_mcp_settings.json` (shared by the extension, v4 and later, and the Cline CLI) | — |
 | Zed | `~/.config/zed/settings.json` → `context_servers.sekura` (shown by hand when the file has comments) | — |
 | Antigravity | `~/.gemini/config/mcp_config.json` → `serverUrl` | `.agents/mcp_config.json` |
 | OpenCode | `~/.config/opencode/opencode.json` → `mcp.sekura` | `opencode.json` |
 | JetBrains Junie | — | `.junie/mcp/mcp.json` |
 | Factory Droid, Tabnine, Devin | the tool's own `mcp add` command | — |
-| Goose | a link to the page | — |
+| Goose | `~/.config/goose/config.yaml` → `extensions.sekura` (`streamable_http`) | — |
 
 The skill goes to `~/.agents/skills/sekura/SKILL.md` and, when Claude Code is present, `~/.claude/skills/sekura/SKILL.md`; in project scope to the same paths under the project, plus a section between `<!-- sekura:start -->` and `<!-- sekura:end -->` in `AGENTS.md` (and `CLAUDE.md` if one exists). Reruns replace only what sits between the markers.
 

package/dist/catalogue.js

@@ -9,7 +9,7 @@
 // A tool is "present" when its config directory exists or its binary is on
 // PATH. Presence decides what the wizard offers, never what it writes: the
 // person chooses, and a tool they did not choose is not touched.
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join, delimiter } from 'node:path';
 export const ENDPOINT = 'https://sekura.ai/mcp';
@@ -17,7 +17,7 @@ export const SERVER_NAME = 'sekura';
 export const DOCS = 'https://sekura.ai/connect/';
 /** The home directory, overridable for tests. */
 export const home = () => process.env.SEKURA_HOME || homedir();
-/** VS Code's user directory, where Copilot's `mcp.json` and Cline's settings live. */
+/** VS Code's user directory, where Copilot's `mcp.json` lives. */
 export function codeUserDir(h = home()) {
     switch (platform()) {
         case 'darwin': return join(h, 'Library', 'Application Support', 'Code', 'User');
@@ -26,6 +26,34 @@ export function codeUserDir(h = home()) {
     }
 }
 const xdg = (h) => process.env.XDG_CONFIG_HOME || join(h, '.config');
+/** Cline's MCP settings. Since v4 the extension and the Cline CLI share one
+ *  file under ~/.cline/data (cline/cline, sdk/packages/shared/src/storage/
+ *  paths.ts, resolveMcpSettingsPath), with the same three overrides. The
+ *  file in VS Code's global storage is only migrated from, once per source,
+ *  so an entry written there after that is never read. */
+export function clineSettingsPath(h = home()) {
+    const explicit = process.env.CLINE_MCP_SETTINGS_PATH?.trim();
+    if (explicit)
+        return explicit;
+    const data = process.env.CLINE_DATA_DIR?.trim() || join(process.env.CLINE_DIR?.trim() || join(h, '.cline'), 'data');
+    return join(data, 'settings', 'cline_mcp_settings.json');
+}
+/** True when a VS Code extension is installed: its folder is `<publisher.name>-<version>`. */
+function hasExtension(h, id) {
+    try {
+        return readdirSync(join(h, '.vscode', 'extensions')).some((d) => d.toLowerCase().startsWith(`${id}-`));
+    }
+    catch {
+        return false;
+    }
+}
+/** Goose's config directory: ~/.config/goose on macOS and Linux (Goose uses
+ *  the XDG layout on both), %APPDATA%\Block\goose\config on Windows. */
+export function gooseDir(h = home()) {
+    if (platform() === 'win32')
+        return join(process.env.APPDATA || join(h, 'AppData', 'Roaming'), 'Block', 'goose', 'config');
+    return join(xdg(h), 'goose');
+}
 /** True when `bin` is an executable on PATH. */
 export function onPath(bin) {
     const exts = platform() === 'win32' ? ['.exe', '.cmd', '.bat', ''] : [''];
@@ -46,7 +74,7 @@ export const TOOLS = [
         id: 'tools-claude', name: 'Claude Code',
         detect: (h) => existsSync(join(h, '.claude')) || existsSync(join(h, '.claude.json')) || onPath('claude'),
         user: (h) => [
-            { kind: 'command', bin: 'claude', add: ['mcp', 'add', '--transport', 'http', '-s', 'user', SERVER_NAME, ENDPOINT], remove: ['mcp', 'remove', '-s', 'user', SERVER_NAME] },
+            { kind: 'command', bin: 'claude', add: ['mcp', 'add', '--transport', 'http', '-s', 'user', SERVER_NAME, ENDPOINT], remove: ['mcp', 'remove', '-s', 'user', SERVER_NAME], get: ['mcp', 'get', SERVER_NAME] },
             { kind: 'json', path: join(h, '.claude.json'), key: 'mcpServers', entry: http },
         ],
         project: (cwd) => [{ kind: 'json', path: join(cwd, '.mcp.json'), key: 'mcpServers', entry: http }],
@@ -84,8 +112,10 @@ export const TOOLS = [
     },
     {
         id: 'tools-cline', name: 'Cline',
-        detect: (h) => existsSync(join(codeUserDir(h), 'globalStorage', 'saoudrizwan.claude-dev')),
-        user: (h) => [{ kind: 'json', path: join(codeUserDir(h), 'globalStorage', 'saoudrizwan.claude-dev', 'settings', 'cline_mcp_settings.json'), key: 'mcpServers', entry: { type: 'streamableHttp', url: ENDPOINT } }],
+        // A fresh v4 install has no global-storage folder until the extension
+        // writes one, so the installed extension and ~/.cline count too.
+        detect: (h) => existsSync(join(h, '.cline')) || hasExtension(h, 'saoudrizwan.claude-dev') || existsSync(join(codeUserDir(h), 'globalStorage', 'saoudrizwan.claude-dev')),
+        user: (h) => [{ kind: 'json', path: clineSettingsPath(h), key: 'mcpServers', entry: { type: 'streamableHttp', url: ENDPOINT } }],
         signIn: SIGN_IN,
     },
     {
@@ -138,8 +168,13 @@ export const TOOLS = [
     },
     {
         id: 'tools-goose', name: 'Goose',
-        detect: (h) => existsSync(join(xdg(h), 'goose')) || onPath('goose'),
-        user: () => [{ kind: 'link', href: `${DOCS}#tools-goose`, note: 'Goose takes a goose://extension link or goose configure; the page has both.' }],
+        detect: (h) => existsSync(gooseDir(h)) || onPath('goose'),
+        // The streamable_http shape of Goose's ExtensionConfig (block/goose,
+        // crates/goose/src/agents/extension.rs; documentation/docs/guides/config-files.md).
+        user: (h) => [{ kind: 'yaml', path: join(gooseDir(h), 'config.yaml'), key: 'extensions', lines: [
+                    'type: streamable_http', `name: ${SERVER_NAME}`, 'enabled: true', `uri: ${ENDPOINT}`,
+                    'envs: {}', 'env_keys: []', 'headers: {}', 'timeout: 300', 'bundled: null', 'available_tools: []',
+                ] }],
         signIn: SIGN_IN,
     },
 ];

package/dist/commands/init.js

@@ -2,10 +2,25 @@
 // nothing is written before the review is shown and (unless --yes) agreed.
 import { Command } from 'commander';
 import { checkbox, confirm, select } from '@inquirer/prompts';
-import { DOCS, ENDPOINT, TOOLS } from '../catalogue.js';
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { DOCS, ENDPOINT, TOOLS, home } from '../catalogue.js';
 import { applyStep, buildPlan, describeStep, detectTools } from '../plan.js';
 import { verifyEndpoint } from '../verify.js';
 import { banner, cross, dot, say, tick } from '../ui.js';
+/** The home folder (or the top of the disk) is no project: project scope
+ *  there would put AGENTS.md and .mcp.json in it for every tool to find. */
+export function isProjectDir(cwd) {
+    const real = (p) => { try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    } };
+    const dir = real(cwd);
+    return dir !== real(home()) && dir !== real(homedir()) && dirname(dir) !== dir;
+}
 export async function runInit(opts) {
     const interactive = !opts.yes && process.stdin.isTTY && process.stderr.isTTY;
     const cwd = opts.cwd ?? process.cwd();
@@ -35,7 +50,13 @@ export async function runInit(opts) {
     }
     // 2. Scope and skill.
     let scope = opts.scope ?? 'user';
-    if (!opts.scope && interactive) {
+    const inProject = isProjectDir(cwd);
+    if (scope === 'project' && !inProject) {
+        say(`  ${cwd} is your home folder or the top of the disk, not a project: run sekura init --scope project inside the project, or use --scope user.`);
+        say('  Nothing was changed.');
+        return { written: 0, byHand: 0, failed: 1 };
+    }
+    if (!opts.scope && interactive && inProject) {
         scope = await select({
             message: 'Where',
             choices: [

package/dist/writers.js

@@ -8,11 +8,13 @@
 // save them a copy-paste. Such a file is reported with the lines to add by
 // hand. A TOML file (Codex) is edited as text: the table is appended when
 // absent, replaced when present, and the rest of the file is left byte for
-// byte.
+// byte. So is a YAML file (Goose): the one entry under its top-level key,
+// at the indent the file already uses; Goose rewrites the file itself, so
+// whether the entry is there is read from its fields, not its text.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { SERVER_NAME } from './catalogue.js';
+import { ENDPOINT, SERVER_NAME } from './catalogue.js';
 const describeJson = (t) => JSON.stringify({ [t.key]: { [SERVER_NAME]: t.entry } }, null, 2);
 /** What applying the target would do, for the review before any write. */
 export function describe(t, dryRun = false) {
@@ -20,6 +22,7 @@ export function describe(t, dryRun = false) {
     switch (t.kind) {
         case 'json': return `${verb}write ${t.path}: ${t.key}.${SERVER_NAME} = ${JSON.stringify(t.entry)}`;
         case 'toml': return `${verb}write ${t.path}: [${t.table}] ${t.lines.join('; ')}`;
+        case 'yaml': return `${verb}write ${t.path}: ${t.key}.${SERVER_NAME} (${t.lines.slice(0, 4).join(', ')})`;
         case 'command': return `${verb}run ${t.bin} ${t.add.join(' ')}`;
         case 'link': return `by hand: ${t.note} ${t.href}`;
     }
@@ -123,9 +126,109 @@ export function hasToml(t) {
     const span = tomlSpan(text, t.table);
     return !!span && text.slice(span[0], span[1]).trim() === tomlBlock(t).trim();
 }
+const yamlBlock = (t, indent) => `${indent}${SERVER_NAME}:\n` + t.lines.map((l) => `${indent}${indent}${l}\n`).join('');
+const leading = (line) => /^[ ]*/.exec(line)[0];
+const blank = (line) => !line.trim() || /^\s*#/.test(line);
+/** Where `key:` and our entry under it sit, line by line. `inline` is a key
+ *  whose value is on its own line (`extensions: {}`), which is not edited. */
+function yamlLayout(lines, key) {
+    const head = lines.findIndex((l) => l.startsWith(`${key}:`));
+    if (head < 0)
+        return { missing: true };
+    if (!/^[^:]+:[ \t]*(#.*)?$/.test(lines[head]))
+        return { head, inline: true };
+    let end = head + 1;
+    while (end < lines.length && (blank(lines[end]) ? !/^#/.test(lines[end]) : /^\s/.test(lines[end])))
+        end++;
+    while (end > head + 1 && !lines[end - 1].trim())
+        end--;
+    const first = lines.slice(head + 1, end).find((l) => !blank(l));
+    const indent = first ? leading(first) : '  ';
+    const start = lines.findIndex((l, i) => i > head && i < end && l.replace(/\s+$/, '') === `${indent}${SERVER_NAME}:`);
+    let stop = start + 1;
+    if (start >= 0)
+        while (stop < end && (blank(lines[stop]) || leading(lines[stop]).length > indent.length))
+            stop++;
+    while (start >= 0 && stop > start + 1 && !lines[stop - 1].trim())
+        stop--;
+    return { head, end, indent, entry: start >= 0 ? [start, stop] : null };
+}
+const unquote = (v) => v.replace(/\s+#.*$/, '').trim().replace(/^(['"])(.*)\1$/, '$2');
+/** Our entry's own fields as they stand, whatever order or quoting Goose gave them. */
+function yamlFields(lines) {
+    const own = lines.find((l) => !blank(l));
+    const depth = own ? leading(own).length : 0;
+    const out = {};
+    for (const l of lines) {
+        const m = /^( *)([A-Za-z_]+):(.*)$/.exec(l);
+        if (m && m[1].length === depth)
+            out[m[2]] = unquote(m[3]);
+    }
+    return out;
+}
+function yamlOk(t, entry) {
+    const f = yamlFields(entry);
+    const want = yamlFields(t.lines);
+    return f.type === want.type && f.uri === ENDPOINT && f.enabled === 'true';
+}
+const splitLines = (text) => text.replace(/\n$/, '').split('\n');
+export function applyYaml(t) {
+    const text = existsSync(t.path) ? readFileSync(t.path, 'utf8') : '';
+    if (/\t/.test(text.split('\n').filter((l) => /^\s/.test(l)).join(''))) {
+        return { status: 'by-hand', where: t.path, why: 'it is indented with tabs, which this installer will not rewrite', snippet: `${t.key}:\n${yamlBlock(t, '  ')}` };
+    }
+    const lines = text ? splitLines(text) : [];
+    const at = yamlLayout(lines, t.key);
+    if ('inline' in at) {
+        return { status: 'by-hand', where: t.path, why: `its ${t.key} is written on one line, which this installer will not rewrite`, snippet: `${t.key}:\n${yamlBlock(t, '  ')}` };
+    }
+    let out;
+    if ('missing' in at) {
+        const sep = !text ? [] : lines[lines.length - 1].trim() ? [''] : [];
+        out = [...lines, ...sep, `${t.key}:`, ...splitLines(yamlBlock(t, '  '))];
+    }
+    else if (at.entry) {
+        const [a, b] = at.entry;
+        if (yamlOk(t, lines.slice(a + 1, b)))
+            return { status: 'unchanged', where: t.path };
+        out = [...lines.slice(0, a), ...splitLines(yamlBlock(t, at.indent)), ...lines.slice(b)];
+    }
+    else {
+        out = [...lines.slice(0, at.end), ...splitLines(yamlBlock(t, at.indent)), ...lines.slice(at.end)];
+    }
+    mkdirSync(dirname(t.path), { recursive: true });
+    writeFileSync(t.path, out.join('\n') + '\n');
+    return { status: 'written', where: t.path };
+}
+export function removeYaml(t) {
+    if (!existsSync(t.path))
+        return { status: 'absent', where: t.path };
+    const lines = splitLines(readFileSync(t.path, 'utf8'));
+    const at = yamlLayout(lines, t.key);
+    if (!('entry' in at) || !at.entry)
+        return { status: 'absent', where: t.path };
+    const [a, b] = at.entry;
+    const out = [...lines.slice(0, a), ...lines.slice(b)];
+    // A mapping left with nothing under it reads as null, which Goose refuses.
+    const rest = [...lines.slice(at.head + 1, a), ...lines.slice(b, at.end)];
+    if (!rest.some((l) => !blank(l)))
+        out[at.head] = `${t.key}: {}`;
+    writeFileSync(t.path, out.join('\n') + '\n');
+    return { status: 'removed', where: t.path };
+}
+export function hasYaml(t) {
+    if (!existsSync(t.path))
+        return false;
+    const lines = splitLines(readFileSync(t.path, 'utf8'));
+    const at = yamlLayout(lines, t.key);
+    return 'entry' in at && !!at.entry && yamlOk(t, lines.slice(at.entry[0] + 1, at.entry[1]));
+}
 // ── commands ────────────────────────────────────────────────────────────────
+function spawn(bin, args) {
+    return spawnSync(bin, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+}
 export function runCommand(bin, args) {
-    const r = spawnSync(bin, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    const r = spawn(bin, args);
     const where = `${bin} ${args.join(' ')}`;
     if (r.error)
         return { status: 'failed', where, why: r.error.message };
@@ -133,12 +236,34 @@ export function runCommand(bin, args) {
         return { status: 'failed', where, why: (r.stderr || r.stdout || `exit ${r.status}`).trim().split('\n').slice(-3).join(' ') };
     return { status: 'ran', where };
 }
-// ── one door for the three kinds ────────────────────────────────────────────
+/** Whether the tool's own command lists our entry at our address. */
+function commandHas(t) {
+    if (!t.get)
+        return 'unknown';
+    const r = spawn(t.bin, t.get);
+    if (r.error)
+        return 'unknown';
+    return r.status === 0 && `${r.stdout}`.includes(ENDPOINT);
+}
+/** Adds the entry. A tool that refuses because the name is taken is asked
+ *  what it holds: our address is "already there"; another one is replaced,
+ *  the way a JSON entry pointing elsewhere is corrected on rerun. */
+export function applyCommand(t) {
+    const r = runCommand(t.bin, t.add);
+    if (r.status !== 'failed' || !t.get || !/already exists/i.test(r.why))
+        return r;
+    if (commandHas(t) === true)
+        return { status: 'unchanged', where: `${t.bin} ${t.get.join(' ')}` };
+    const out = runCommand(t.bin, t.remove);
+    return out.status === 'failed' ? out : runCommand(t.bin, t.add);
+}
+// ── one door for every kind ────────────────────────────────────────────
 export function apply(t) {
     switch (t.kind) {
         case 'json': return applyJson(t);
         case 'toml': return applyToml(t);
-        case 'command': return runCommand(t.bin, t.add);
+        case 'yaml': return applyYaml(t);
+        case 'command': return applyCommand(t);
         case 'link': return { status: 'by-hand', where: t.href, why: t.note, snippet: '' };
     }
 }
@@ -146,6 +271,7 @@ export function remove(t) {
     switch (t.kind) {
         case 'json': return removeJson(t);
         case 'toml': return removeToml(t);
+        case 'yaml': return removeYaml(t);
         case 'command': return runCommand(t.bin, t.remove);
         case 'link': return { status: 'absent', where: t.href };
     }
@@ -158,7 +284,8 @@ export function has(t) {
             return r === 'unreadable' ? 'unknown' : r;
         }
         case 'toml': return hasToml(t);
-        case 'command': return 'unknown';
+        case 'yaml': return hasYaml(t);
+        case 'command': return commandHas(t);
         case 'link': return 'unknown';
     }
 }

package/package.json

@@ -1,17 +1,40 @@
 {
   "name": "sekura",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Connect your coding tool to Sekura in one command: npx sekura@latest init",
   "type": "module",
   "license": "MIT",
   "homepage": "https://sekura.ai/connect/",
-  "repository": { "type": "git", "url": "git+https://github.com/sekuraai/sekura-cli.git" },
-  "bugs": { "url": "https://github.com/sekuraai/sekura-cli/issues" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sekuraai/sekura-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sekuraai/sekura-cli/issues"
+  },
   "author": "Sekura Inc. <hello@sekura.ai>",
-  "keywords": ["sekura", "mcp", "security", "vulnerability-scanning", "claude-code", "cursor", "copilot", "codex"],
-  "bin": { "sekura": "dist/cli.js" },
-  "files": ["dist", "skills", "README.md", "LICENSE"],
-  "engines": { "node": ">=18" },
+  "keywords": [
+    "sekura",
+    "mcp",
+    "security",
+    "vulnerability-scanning",
+    "claude-code",
+    "cursor",
+    "copilot",
+    "codex"
+  ],
+  "bin": {
+    "sekura": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/cli.js', 0o755)\"",
     "test": "npm run build && node --test test/init.test.mjs",