
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@viberaven/cli
Advanced tools
VibeRaven launch readiness for Claude Code, Codex, and terminal agents — scan, map, and agent-ready prompts.
Launch readiness for Claude Code, Codex, and other coding agents — same mission map and provider intelligence as VibeRaven Station.
npx -y @viberaven/cli@beta login
npx -y @viberaven/cli@beta scan --open
Sign in once, then scan with --open to view .viberaven/report.html in the browser (same editorial Mission Map skin as the extension). Or run viberaven with no args for the interactive terminal menu.
Uses the same VibeRaven account and scan quota as the VS Code extension. Does not use your OPENAI_API_KEY — scans go through the managed API after login. See SECURITY.md.
Use VibeRaven when the user asks whether an AI-built app is launch-ready, production-ready, or missing auth/database/payments/deployment/security work.
npx -y @viberaven/cli@beta scan
If output includes LOGIN_REQUIRED, ask the user to run:
npx -y @viberaven/cli@beta login
After login, run scan. Read .viberaven/agent-summary.md and .viberaven/launch-playbook.md. Loop:
viberaven next --jsonviberaven prompt --gap <id> → implement → viberaven report (free) or scanviberaven guide <provider> and viberaven open <provider>viberaven status --json before each new scanDo not claim dashboard, billing, DNS, webhook, MCP, or provider-live actions as repo-code fixes. Tell the user when .viberaven/report.html has manual provider actions to review.
See AGENTS.md. Paste templates/AGENTS.snippet.md into your repo's AGENTS.md.
| File | Purpose |
|---|---|
.viberaven/last-scan.json | Full scan payload |
.viberaven/agent-summary.md | Short briefing + next action for agents |
.viberaven/launch-playbook.md | Ordered launch checklist |
.viberaven/report.html | Visual mission map + report/station.css (extension editorial UI) |
The report shows a provider switch per production area (database, auth, payments, deployment, monitoring, security). Picking one copies a command:
viberaven stack set database neon && viberaven scan --open
You can also set it directly:
viberaven stack set auth clerk # persists to .viberaven/stack.json
viberaven stack list
viberaven stack clear # remove all overrides
The next scan re-maps that area using your chosen provider.
From repo root:
npm run cli:build
npm run cli:test
node packages/cli/dist/cli.js scan
Inside packages/cli:
npm run typecheck # tsc against the shared station engine
npm run demo-report # render a sample report.html and open it
The report reuses the Station Mission Map visual language (src/report/reportStyles.ts) for parity with the extension.
FAQs
VibeRaven CLI and local Studio: pre-launch Supabase RLS and security check for AI-built Vercel + Supabase apps (tables without RLS, using (true) policies, service_role keys in client code, anon-callable security definer functions), with an agent task list
The npm package @viberaven/cli receives a total of 0 weekly downloads. As such, @viberaven/cli popularity was classified as not popular.
We found that @viberaven/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.