@darrenjcoxon/vibeguard 1.0.0

package/dist/types.js

@@ -0,0 +1,194 @@
+/**
+ * CodeGuard - Core Types and Interfaces
+ *
+ * Defines the common data structures used across all scanners and reporters
+ */
+import { z } from 'zod';
+// ============================================================================
+// Finding Severity and Categories
+// ============================================================================
+export const SeverityLevel = z.enum(['critical', 'high', 'medium', 'low', 'info']);
+export const FindingCategory = z.enum([
+    'security', // Security vulnerabilities (SAST)
+    'secret', // Exposed secrets/credentials
+    'dependency', // Vulnerable dependencies (SCA)
+    'quality', // Code quality issues
+    'complexity', // Cyclomatic/cognitive complexity
+    'duplication', // Duplicate code
+    'dead-code', // Unused code
+    'style', // Linting/formatting issues
+    'documentation', // Missing documentation
+    'test-coverage', // Test coverage gaps
+    'performance', // Performance issues
+    'accessibility', // A11y issues (for web)
+    'misconfiguration' // IaC/config issues
+]);
+// ============================================================================
+// Core Finding Schema
+// ============================================================================
+export const Finding = z.object({
+    // Identification
+    id: z.string(),
+    source: z.string(), // Which scanner found this
+    // Classification
+    severity: SeverityLevel,
+    category: FindingCategory,
+    // Location
+    file: z.string(),
+    line: z.number().optional(),
+    endLine: z.number().optional(),
+    column: z.number().optional(),
+    endColumn: z.number().optional(),
+    // Details
+    title: z.string(),
+    description: z.string(),
+    snippet: z.string().optional(), // Code snippet
+    // Standards mapping
+    cwe: z.string().optional(), // CWE-XXX
+    owasp: z.string().optional(), // OWASP Top 10 category
+    cvss: z.number().optional(), // CVSS score if applicable
+    cve: z.string().optional(), // CVE identifier
+    // Remediation
+    suggestion: z.string().optional(),
+    fixAvailable: z.boolean().default(false),
+    autoFixable: z.boolean().default(false),
+    // Metadata
+    ruleId: z.string().optional(),
+    ruleUrl: z.string().optional(),
+    confidence: z.enum(['high', 'medium', 'low']).optional(),
+    effort: z.enum(['trivial', 'easy', 'medium', 'hard']).optional(),
+    // Deduplication
+    fingerprint: z.string().optional()
+});
+// ============================================================================
+// Scanner Configuration
+// ============================================================================
+export const ScannerConfig = z.object({
+    enabled: z.boolean().default(true),
+    name: z.string(),
+    timeout: z.number().default(300000), // 5 minutes default
+    // What categories this scanner covers
+    categories: z.array(FindingCategory),
+    // Scanner-specific options
+    options: z.record(z.any()).optional()
+});
+// ============================================================================
+// Scan Target
+// ============================================================================
+export const ScanTargetSchema = z.object({
+    // What to scan
+    path: z.string(), // Local path to code
+    // Git context (optional)
+    git: z.object({
+        remote: z.string().optional(),
+        branch: z.string().optional(),
+        commit: z.string().optional(),
+        baseBranch: z.string().optional(), // For PR diff scanning
+        baseCommit: z.string().optional()
+    }).optional(),
+    // PR context (optional)
+    pullRequest: z.object({
+        provider: z.enum(['github', 'gitlab', 'azure-devops', 'bitbucket']),
+        number: z.number(),
+        url: z.string(),
+        title: z.string().optional(),
+        author: z.string().optional()
+    }).optional(),
+    // Filtering
+    include: z.array(z.string()).optional(), // Glob patterns
+    exclude: z.array(z.string()).optional(),
+    changedFilesOnly: z.boolean().optional()
+});
+// ============================================================================
+// Scan Results
+// ============================================================================
+export const ScannerResult = z.object({
+    scanner: z.string(),
+    success: z.boolean(),
+    error: z.string().optional(),
+    findings: z.array(Finding),
+    metrics: z.object({
+        filesScanned: z.number().optional(),
+        linesScanned: z.number().optional(),
+        duration: z.number(), // milliseconds
+    }),
+    metadata: z.record(z.any()).optional()
+});
+export const ScanReportSchema = z.object({
+    id: z.string(),
+    timestamp: z.string(),
+    target: z.any(), // Using any since we have interface
+    results: z.array(z.any()),
+    findings: z.array(z.any()),
+    summary: z.object({
+        totalFindings: z.number(),
+        bySeverity: z.record(z.number()),
+        byCategory: z.record(z.number()),
+        byScanner: z.record(z.number()),
+        passesQualityGate: z.boolean(),
+        qualityGateDetails: z.string().optional()
+    }),
+    aiSummary: z.string().optional(),
+    aiRecommendations: z.array(z.string()).optional()
+});
+// ============================================================================
+// Quality Gate Configuration
+// ============================================================================
+export const QualityGate = z.object({
+    name: z.string(),
+    rules: z.array(z.object({
+        metric: z.enum([
+            'critical_findings',
+            'high_findings',
+            'security_findings',
+            'secret_findings',
+            'total_findings',
+            'new_findings', // For PR analysis
+            'code_coverage',
+            'duplication_ratio'
+        ]),
+        operator: z.enum(['lt', 'lte', 'gt', 'gte', 'eq']),
+        threshold: z.number(),
+        failOnBreach: z.boolean().default(true)
+    }))
+});
+// ============================================================================
+// Default Quality Gate
+// ============================================================================
+export const DEFAULT_QUALITY_GATE = {
+    name: 'Default',
+    rules: [
+        { metric: 'critical_findings', operator: 'eq', threshold: 0, failOnBreach: true },
+        { metric: 'high_findings', operator: 'lte', threshold: 5, failOnBreach: true },
+        { metric: 'secret_findings', operator: 'eq', threshold: 0, failOnBreach: true }
+    ]
+};
+// ============================================================================
+// Utility functions
+// ============================================================================
+/**
+ * Generate a fingerprint for deduplication
+ */
+export function generateFingerprint(finding) {
+    const parts = [
+        finding.file,
+        finding.line,
+        finding.ruleId || finding.title,
+        finding.category
+    ].filter(Boolean);
+    return Buffer.from(parts.join('|')).toString('base64').slice(0, 32);
+}
+/**
+ * Severity weight for sorting
+ */
+export function severityWeight(severity) {
+    const weights = {
+        critical: 5,
+        high: 4,
+        medium: 3,
+        low: 2,
+        info: 1
+    };
+    return weights[severity];
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,UAAU,EAAY,kCAAkC;IACxD,QAAQ,EAAc,8BAA8B;IACpD,YAAY,EAAU,gCAAgC;IACtD,SAAS,EAAa,sBAAsB;IAC5C,YAAY,EAAU,kCAAkC;IACxD,aAAa,EAAS,iBAAiB;IACvC,WAAW,EAAW,cAAc;IACpC,OAAO,EAAe,4BAA4B;IAClD,eAAe,EAAO,wBAAwB;IAC9C,eAAe,EAAO,qBAAqB;IAC3C,aAAa,EAAS,qBAAqB;IAC3C,eAAe,EAAO,wBAAwB;IAC9C,kBAAkB,CAAI,oBAAoB;CAC3C,CAAC,CAAC;AAGH,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,iBAAiB;IACjB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAe,2BAA2B;IAE5D,iBAAiB;IACjB,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,eAAe;IAEzB,WAAW;IACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,UAAU;IACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAG,eAAe;IAEhD,oBAAoB;IACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAO,UAAU;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAK,wBAAwB;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAM,2BAA2B;IAC5D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAO,iBAAiB;IAElD,cAAc;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEvC,WAAW;IACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEhE,gBAAgB;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,oBAAoB;IAEzD,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAEpC,2BAA2B;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,eAAe;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAkB,qBAAqB;IAEvD,yBAAyB;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAG,uBAAuB;QAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC,CAAC,QAAQ,EAAE;IAEb,wBAAwB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC,QAAQ,EAAE;IAEb,YAAY;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAG,gBAAgB;IAC1D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAwBH,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAG,eAAe;KACvC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,oCAAoC;IACrD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAChC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC9B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAqBH,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,mBAAmB;YACnB,eAAe;YACf,mBAAmB;YACnB,iBAAiB;YACjB,gBAAgB;YAChB,cAAc,EAAO,kBAAkB;YACvC,eAAe;YACf,mBAAmB;SACpB,CAAC;QACF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACxC,CAAC,CAAC;CACJ,CAAC,CAAC;AAmCH,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAC/C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE;QACL,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE;QACjF,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE;QAC9E,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE;KAChF;CACF,CAAC;AAEF,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QAC/B,OAAO,CAAC,QAAQ;KACjB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,MAAM,OAAO,GAAkC;QAC7C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@darrenjcoxon/vibeguard",
+  "version": "1.0.0",
+  "description": "Security scanner for vibe coders. Scan your code, get FIXES.md, let AI fix everything.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "bin": {
+    "vibeguard": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "ai",
+    "vibe-coding",
+    "claude",
+    "cursor",
+    "copilot",
+    "semgrep",
+    "gitleaks",
+    "fixes",
+    "code-review"
+  ],
+  "author": "Darren Coxon",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/darrenjcoxon/vibeguard.git"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.30.0",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "ora": "^8.0.1",
+    "zod": "^3.22.4"
+  },
+  "devDependencies": {
+    "@types/node": "^20.11.0",
+    "typescript": "^5.3.3"
+  }
+}