Rebuild the public face for v1.8.0: new demos, README cut to 139 lines

docs/cli-reference.md

@@ -17,7 +17,7 @@ cloudwright [--json] [--stream] [--verbose] [--dry-run] <subcommand> ...
 | Flag | Description |
 |---|---|
 | `--json` | Output as JSON instead of rich terminal output |
-| `--stream` | NDJSON streaming — one JSON object per line (combine with `--json`) |
+| `--stream` | NDJSON streaming, one JSON object per line (combine with `--json`) |
 | `--dry-run` | Preview LLM calls without making them (shows model, tokens, prompt preview) |
 | `--verbose` / `-v` | Verbose logging |
 | `--version` / `-V` | Print version and exit |
@@ -139,7 +139,7 @@ cloudwright cost <spec.yaml> [options]
 |---|---|---|
 | `--compare` | none | Comma-separated providers for multi-cloud cost comparison |
 | `--pricing-tier` | `on_demand` | `on_demand`, `reserved_1yr`, `reserved_3yr`, `spot` |
-| `--workload-profile` / `-w` | none | `small`, `medium`, `large`, `enterprise` — sets realistic traffic/storage defaults |
+| `--workload-profile` / `-w` | none | `small`, `medium`, `large`, `enterprise`. Sets realistic traffic and storage defaults |
 
 Examples:
 
@@ -645,11 +645,42 @@ cloudwright mcp [options]
 
 | Option | Default | Description |
 |---|---|---|
-| `--tools` / `-t` | all | Comma-separated tool groups: `design`, `cost`, `validate`, `analyze`, `export`, `session` |
+| `--tools` / `-t` | all | Comma-separated tool groups: `design`, `cost`, `validate`, `analyze`, `export`, `session`, `review`, `compliance`, `plan` |
 | `--transport` | `stdio` | `stdio` or `sse` |
 
 See [MCP Reference](mcp-reference.md) for setup instructions.
 
+---
+
+### `integrate`
+
+Print, and optionally write, the wiring that connects an AI coding harness to cloudwright. Each client stores its MCP config in a different file, under a different key. This command emits the right shape for the one you name. Do not hand-write the config.
+
+```bash
+cloudwright integrate --list                            # every supported harness
+cloudwright integrate --harness claude-code             # print the exact wiring
+cloudwright integrate --harness cursor --write          # merge it into .cursor/mcp.json
+cloudwright integrate --rules --agent-file claude       # gate block for CLAUDE.md
+```
+
+Pick exactly one of the three modes: `--list`, `--harness <name>`, or `--rules`.
+
+| Option | Default | Description |
+|---|---|---|
+| `--list` / `-l` | off | List supported harnesses, their config file, key, and rules file |
+| `--harness` / `-H` | none | Print the MCP wiring for one harness, in that client's own format |
+| `--rules` | off | Emit a harness-agnostic block that gates infra changes through cloudwright |
+| `--agent-file` | `agents` | Rules target for `--rules`: `agents`, `claude`, or `gemini` |
+| `--write` | off | Write to the file instead of only printing. Creates parent directories |
+| `--output` / `-o` | per harness | Override the default write path |
+| `--force` | off | Overwrite an existing cloudwright entry without confirmation |
+
+This command supports eleven harnesses. Ten speak MCP: Claude Code, Cursor, Cline, Windsurf, GitHub Copilot, Zed, OpenAI Codex CLI, JetBrains Junie, Kiro, and Antigravity. Aider speaks no MCP, so it gets a CLI-pipe recipe built on `cloudwright <cmd> --json`.
+
+`--write` leaves an existing conflicting entry untouched unless you pass `--force`. Roo Code, Continue.dev, Amazon Q Developer, and Google Gemini CLI are discontinued or superseded, so this command skips them.
+
+Full per-harness matrix in [integrations.md](integrations.md).
+
 ## New flags in v1.6.0
 
 | Command | Flag | Purpose |

examples/tapes/cloudwright-hero.tape

@@ -1,52 +1,86 @@
 # Cloudwright hero demo
-# Compile with: vhs examples/tapes/cloudwright-hero.tape
+# Render from the repo root: vhs examples/tapes/cloudwright-hero.tape
+# vhs resolves Output against your current directory, so the repo root is the only
+# cwd that lands the GIF in examples/. The shell inside the tape finds the checkout
+# with git, so it names no machine path and no worktree, and it works in any clone.
+# The earlier version hardcoded a path into .claude/worktrees/. Pruning that
+# worktree made vhs record a broken shell and still exit 0.
+# Scratch work goes in tmp/hero-demo, which is gitignored.
+#
+# The tape hides the ~15s terraform init+validate wait so the loop stays short.
+# The on-screen comment states that wait, so the GIF does not claim plan is instant.
 
 Output examples/cloudwright-hero.gif
 
 Set Shell "bash"
 Set FontSize 16
-Set Width 1100
-Set Height 620
+Set Width 1180
+Set Height 520
 Set Theme "Catppuccin Mocha"
-Set TypingSpeed 35ms
+Set TypingSpeed 16ms
 Set PlaybackSpeed 1.0
-Set Padding 20
+Set Padding 18
 
-# Activate the worktree venv so VHS picks up the local CLI
 Hide
-Type "cd /Users/xavier/Desktop/cloudwright/.claude/worktrees/v1.3-audit-fixes" Enter
-Type "source .venv/bin/activate" Enter
-Type "rm -rf demo && mkdir demo && cd demo" Enter
+Type 'cd "$(git rev-parse --show-toplevel)" && source .venv/bin/activate' Enter
+Type "export TF_PLUGIN_CACHE_DIR=$PWD/tmp/tf-plugin-cache && mkdir -p $TF_PLUGIN_CACHE_DIR" Enter
+Type "rm -rf tmp/hero-demo && mkdir -p tmp/hero-demo && cd tmp/hero-demo" Enter
 Type "clear" Enter
 Show
 
 Sleep 500ms
-Type "cloudwright init -t three_tier_web --name healthcare-api --compliance hipaa,soc2 -o spec.yaml"
+Type "# A typed architecture spec, from a template or from a prompt"
+Enter
 Sleep 600ms
+Type "cloudwright init -t three_tier_web --name healthcare-api --compliance hipaa,soc2 -o spec.yaml"
+Sleep 300ms
 Enter
-Sleep 2.5s
+Sleep 2.2s
+
+Hide
+Type "clear" Enter
+Sleep 300ms
+Show
 
+Type "# Per-component cost, with a confidence flag on every line"
+Enter
+Sleep 600ms
 Type "cloudwright cost spec.yaml --workload-profile medium"
-Sleep 500ms
+Sleep 300ms
 Enter
-Sleep 3s
+Sleep 3.5s
 
-Type "cloudwright validate spec.yaml --compliance hipaa,soc2"
-Sleep 500ms
+Hide
+Type "clear" Enter
+Sleep 300ms
+Show
+
+Type "# Every finding carries the framework control it violates, before anything exists"
 Enter
-Sleep 3s
+Sleep 600ms
+Type "cloudwright compliance spec.yaml --frameworks hipaa,soc2 --no-checkov"
+Sleep 300ms
+Enter
+Sleep 4.5s
+
+Hide
+Type "clear" Enter
+Sleep 300ms
+Show
 
+Type "# Terraform out, then terraform validate proves it deploys. Read-only, never applies."
+Enter
+Sleep 600ms
 Type "cloudwright export spec.yaml --format terraform -o ./infra"
-Sleep 500ms
+Sleep 300ms
 Enter
-Sleep 2.5s
-
-Type "cloudwright export spec.yaml --format pulumi-ts -o ./pulumi-infra"
-Sleep 500ms
+Sleep 1.5s
+Type "cloudwright plan spec.yaml --target terraform --no-plan   # terraform init + validate, ~15s"
+Sleep 300ms
 Enter
-Sleep 2.5s
 
-Type "ls infra/ pulumi-infra/"
-Sleep 500ms
-Enter
-Sleep 2.5s
+# The wait itself is not worth 15s of GIF. Skip the frames, keep the result.
+Hide
+Sleep 20s
+Show
+Sleep 3.5s

examples/tapes/cloudwright-review.tape

@@ -0,0 +1,45 @@
+# Cloudwright offline-review demo: `cloudwright review` + control traceability
+# Render from the repo root: vhs examples/tapes/cloudwright-review.tape
+# vhs resolves Output against your current directory, so the repo root is the only
+# cwd that lands the GIF in examples/. The shell inside the tape finds the checkout
+# with git, so it names no machine path and no worktree, and it works in any clone.
+# It runs the checkout's own .venv against examples/patient-portal.yaml.
+# Both commands unset the API keys first, because neither needs one.
+
+Output examples/cloudwright-review-demo.gif
+
+Set Shell "bash"
+Set FontSize 13
+Set Width 1000
+Set Height 720
+Set Padding 18
+Set Theme "Catppuccin Mocha"
+Set TypingSpeed 16ms
+
+Hide
+Type 'cd "$(git rev-parse --show-toplevel)" && source .venv/bin/activate' Enter
+Type "unset ANTHROPIC_API_KEY OPENAI_API_KEY" Enter
+Type "clear" Enter
+Show
+
+Sleep 500ms
+Type "# Scorer, linter and validator in one report. No API key, no network."
+Enter
+Sleep 600ms
+Type "cloudwright review examples/patient-portal.yaml --compliance hipaa"
+Sleep 300ms
+Enter
+Sleep 6.5s
+
+Hide
+Type "clear" Enter
+Sleep 300ms
+Show
+
+Type "# The chain an auditor asks for: component, resource, control, status"
+Enter
+Sleep 600ms
+Type "cloudwright compliance examples/patient-portal.yaml -f hipaa --no-checkov --traceability"
+Sleep 300ms
+Enter
+Sleep 6.5s