@devshub198211/devguard 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/LICENSE +21 -0
- package/README.md +207 -0
- package/dist/ai.cjs +867 -0
- package/dist/ai.d.cts +169 -0
- package/dist/ai.d.ts +169 -0
- package/dist/ai.js +2 -0
- package/dist/api-contract-5kJEwFIh.d.cts +157 -0
- package/dist/api-contract-5kJEwFIh.d.ts +157 -0
- package/dist/auth.cjs +787 -0
- package/dist/auth.d.cts +245 -0
- package/dist/auth.d.ts +245 -0
- package/dist/auth.js +1 -0
- package/dist/chunk-3SMY53XX.js +747 -0
- package/dist/chunk-4WCL5IUZ.js +493 -0
- package/dist/chunk-6IXDDYYA.js +345 -0
- package/dist/chunk-D7GNA6TS.js +611 -0
- package/dist/chunk-KSFZPDFO.js +366 -0
- package/dist/chunk-MT3VUCLS.js +35 -0
- package/dist/cli.cjs +1162 -0
- package/dist/cli.d.cts +1 -0
- package/dist/cli.d.ts +1 -0
- package/dist/cli.js +270 -0
- package/dist/dx.cjs +747 -0
- package/dist/dx.d.cts +96 -0
- package/dist/dx.d.ts +96 -0
- package/dist/dx.js +2 -0
- package/dist/index.cjs +2655 -0
- package/dist/index.d.cts +38 -0
- package/dist/index.d.ts +38 -0
- package/dist/index.js +6 -0
- package/dist/security.cjs +654 -0
- package/dist/security.d.cts +114 -0
- package/dist/security.d.ts +114 -0
- package/dist/security.js +1 -0
- package/package.json +96 -0
package/dist/cli.d.cts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
package/dist/cli.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
package/dist/cli.js
ADDED
|
@@ -0,0 +1,270 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
import { runAllChecks } from './chunk-MT3VUCLS.js';
|
|
3
|
+
import './chunk-4WCL5IUZ.js';
|
|
4
|
+
import { JWTVerifier } from './chunk-3SMY53XX.js';
|
|
5
|
+
import { createLogger } from './chunk-6IXDDYYA.js';
|
|
6
|
+
import './chunk-KSFZPDFO.js';
|
|
7
|
+
import { extractTransitiveDeps, scanProject, autoPin, createSnapshot } from './chunk-D7GNA6TS.js';
|
|
8
|
+
import * as http from 'http';
|
|
9
|
+
import * as fs2 from 'fs';
|
|
10
|
+
import * as path2 from 'path';
|
|
11
|
+
import * as crypto from 'crypto';
|
|
12
|
+
import { exec } from 'child_process';
|
|
13
|
+
|
|
14
|
+
function openReviewWindow(filePath, result) {
|
|
15
|
+
return new Promise((resolve2) => {
|
|
16
|
+
const port = 4900 + Math.floor(Math.random() * 100);
|
|
17
|
+
const authToken = crypto.randomBytes(16).toString("hex");
|
|
18
|
+
const server = http.createServer((req, res) => {
|
|
19
|
+
const url = new URL(req.url ?? "/", `http://localhost:${port}`);
|
|
20
|
+
const token = url.searchParams.get("t");
|
|
21
|
+
if (token !== authToken) {
|
|
22
|
+
res.writeHead(403);
|
|
23
|
+
res.end("Forbidden: Invalid Security Token");
|
|
24
|
+
return;
|
|
25
|
+
}
|
|
26
|
+
if (req.method === "GET") {
|
|
27
|
+
res.writeHead(200, { "Content-Type": "text/html" });
|
|
28
|
+
res.end(generateUI(filePath, result, authToken));
|
|
29
|
+
} else if (req.method === "POST" && url.pathname === "/apply") {
|
|
30
|
+
const tmpPath = `${filePath}.tmp.${crypto.randomBytes(4).toString("hex")}`;
|
|
31
|
+
fs2.writeFileSync(tmpPath, result.fixed);
|
|
32
|
+
fs2.renameSync(tmpPath, filePath);
|
|
33
|
+
res.writeHead(200);
|
|
34
|
+
res.end("Applied");
|
|
35
|
+
resolve2(true);
|
|
36
|
+
setTimeout(() => server.close(), 500);
|
|
37
|
+
} else if (req.method === "POST" && url.pathname === "/reject") {
|
|
38
|
+
res.writeHead(200);
|
|
39
|
+
res.end("Rejected");
|
|
40
|
+
resolve2(false);
|
|
41
|
+
setTimeout(() => server.close(), 500);
|
|
42
|
+
}
|
|
43
|
+
});
|
|
44
|
+
server.listen(port, "127.0.0.1", () => {
|
|
45
|
+
const url = `http://localhost:${port}/?t=${authToken}`;
|
|
46
|
+
console.log(`
|
|
47
|
+
\u{1F680} Secure review window opened at: ${url}`);
|
|
48
|
+
const start = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
|
|
49
|
+
exec(`${start} "${url}"`);
|
|
50
|
+
});
|
|
51
|
+
});
|
|
52
|
+
}
|
|
53
|
+
function generateUI(file, res, token) {
|
|
54
|
+
return `
|
|
55
|
+
<!DOCTYPE html>
|
|
56
|
+
<html lang="en">
|
|
57
|
+
<head>
|
|
58
|
+
<meta charset="UTF-8">
|
|
59
|
+
<title>DevGuard Refactor Review</title>
|
|
60
|
+
<style>
|
|
61
|
+
:root { --bg: #0f172a; --panel: #1e293b; --text: #f8fafc; --accent: #38bdf8; --green: #22c55e; --red: #ef4444; }
|
|
62
|
+
body { font-family: 'Inter', system-ui, sans-serif; background: var(--bg); color: var(--text); margin: 0; display: flex; flex-direction: column; height: 100vh; }
|
|
63
|
+
header { padding: 20px 40px; background: var(--panel); border-bottom: 1px solid #334155; display: flex; justify-content: space-between; align-items: center; }
|
|
64
|
+
.container { flex: 1; display: flex; overflow: hidden; padding: 20px; gap: 20px; }
|
|
65
|
+
.panel { flex: 1; background: var(--panel); border-radius: 12px; display: flex; flex-direction: column; border: 1px solid #334155; }
|
|
66
|
+
.panel-header { padding: 10px 20px; border-bottom: 1px solid #334155; font-weight: 600; display: flex; justify-content: space-between; }
|
|
67
|
+
pre { flex: 1; margin: 0; padding: 20px; overflow: auto; font-family: 'Fira Code', monospace; font-size: 14px; line-height: 1.5; white-space: pre-wrap; }
|
|
68
|
+
.complexity { font-size: 0.8rem; color: var(--accent); }
|
|
69
|
+
.actions { display: flex; gap: 15px; }
|
|
70
|
+
button { padding: 10px 24px; border-radius: 8px; border: none; font-weight: 600; cursor: pointer; transition: 0.2s; }
|
|
71
|
+
.btn-apply { background: var(--green); color: white; }
|
|
72
|
+
.btn-apply:hover { background: #16a34a; transform: translateY(-2px); }
|
|
73
|
+
.btn-reject { background: #334155; color: var(--text); }
|
|
74
|
+
.btn-reject:hover { background: #475569; }
|
|
75
|
+
.improvements { padding: 0 40px 20px; color: #94a3b8; font-size: 0.9rem; }
|
|
76
|
+
</style>
|
|
77
|
+
</head>
|
|
78
|
+
<body>
|
|
79
|
+
<header>
|
|
80
|
+
<div>
|
|
81
|
+
<h2 style="margin:0">\u{1F6E1}\uFE0F DevGuard Refactor</h2>
|
|
82
|
+
<div style="font-size: 0.9rem; color: #94a3b8">Reviewing: ${path2.basename(file)}</div>
|
|
83
|
+
</div>
|
|
84
|
+
<div class="actions">
|
|
85
|
+
<button class="btn-reject" onclick="action('/reject')">Discard</button>
|
|
86
|
+
<button class="btn-apply" onclick="action('/apply')">Apply Fixes</button>
|
|
87
|
+
</div>
|
|
88
|
+
</header>
|
|
89
|
+
<div class="container">
|
|
90
|
+
<div class="panel">
|
|
91
|
+
<div class="panel-header">Original <span class="complexity">${res.complexity.before}</span></div>
|
|
92
|
+
<pre>${escapeHtml(res.original)}</pre>
|
|
93
|
+
</div>
|
|
94
|
+
<div class="panel" style="border-color: var(--green)">
|
|
95
|
+
<div class="panel-header">Optimized <span class="complexity">${res.complexity.after}</span></div>
|
|
96
|
+
<pre style="color: #d1fae5">${escapeHtml(res.fixed)}</pre>
|
|
97
|
+
</div>
|
|
98
|
+
</div>
|
|
99
|
+
<div class="improvements">
|
|
100
|
+
<strong>Suggested Improvements:</strong> ${res.improvements.join(" \u2022 ")}
|
|
101
|
+
</div>
|
|
102
|
+
<script>
|
|
103
|
+
async function action(endpoint) {
|
|
104
|
+
const url = endpoint + '?t=${token}';
|
|
105
|
+
await fetch(url, { method: 'POST' });
|
|
106
|
+
document.body.innerHTML = '<div style="display:flex;height:100vh;align-items:center;justify-content:center;font-size:2rem">Done! You can close this window.</div>';
|
|
107
|
+
}
|
|
108
|
+
</script>
|
|
109
|
+
</body>
|
|
110
|
+
</html>
|
|
111
|
+
`;
|
|
112
|
+
}
|
|
113
|
+
function escapeHtml(text) {
|
|
114
|
+
return text.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """).replace(/'/g, "'");
|
|
115
|
+
}
|
|
116
|
+
var pkg = JSON.parse(fs2.readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
|
|
117
|
+
var HELP = `
|
|
118
|
+
DevGuard v${pkg.version} \u2014 Multi-Language Security & AI Tooling
|
|
119
|
+
|
|
120
|
+
Project Security:
|
|
121
|
+
check Run all security checks (lockfile, hooks, pins, tokens)
|
|
122
|
+
snapshot Create a new lockfile integrity snapshot
|
|
123
|
+
pin Fix unpinned dependencies in package.json
|
|
124
|
+
scan Deep malware scan of node_modules scripts
|
|
125
|
+
deps List all transitive dependencies and versions
|
|
126
|
+
refactor AI refactor a file (security & performance review)
|
|
127
|
+
|
|
128
|
+
Multi-Language Utilities (Universal CLI):
|
|
129
|
+
jwt-verify Verify a JWT token (pass --token and --secret)
|
|
130
|
+
log Send a structured OTLP log (pass --msg, --level, --data)
|
|
131
|
+
env-verify Validate a .env file against a schema JSON
|
|
132
|
+
|
|
133
|
+
General:
|
|
134
|
+
help Show this help
|
|
135
|
+
version Show version
|
|
136
|
+
|
|
137
|
+
Options:
|
|
138
|
+
--root <dir> Project root directory (default: current)
|
|
139
|
+
--json Output results as JSON
|
|
140
|
+
--fix Auto-fix issues where possible
|
|
141
|
+
--token <str> JWT token to verify
|
|
142
|
+
--secret <str> Secret for JWT or ENV validation
|
|
143
|
+
--msg <str> Log message
|
|
144
|
+
--level <str> Log level (info, warn, error, debug)
|
|
145
|
+
--data <json> Extra JSON data for logs
|
|
146
|
+
`;
|
|
147
|
+
async function main() {
|
|
148
|
+
const args = process.argv.slice(2);
|
|
149
|
+
const cmd = args[0];
|
|
150
|
+
if (!cmd || cmd === "help" || args.includes("--help") || args.includes("-h")) {
|
|
151
|
+
console.log(HELP);
|
|
152
|
+
return;
|
|
153
|
+
}
|
|
154
|
+
if (cmd === "version" || args.includes("--version") || args.includes("-v")) {
|
|
155
|
+
console.log(`v${pkg.version}`);
|
|
156
|
+
return;
|
|
157
|
+
}
|
|
158
|
+
const isJson = args.includes("--json");
|
|
159
|
+
const doFix = args.includes("--fix");
|
|
160
|
+
const getArg = (flag) => {
|
|
161
|
+
const idx = args.indexOf(flag);
|
|
162
|
+
return idx !== -1 && args[idx + 1] ? args[idx + 1] : null;
|
|
163
|
+
};
|
|
164
|
+
const root = getArg("--root") ? path2.resolve(getArg("--root")) : process.cwd();
|
|
165
|
+
try {
|
|
166
|
+
switch (cmd) {
|
|
167
|
+
case "check": {
|
|
168
|
+
const report = await runAllChecks(root);
|
|
169
|
+
if (isJson) console.log(JSON.stringify(report, null, 2));
|
|
170
|
+
else {
|
|
171
|
+
console.log(`
|
|
172
|
+
\u{1F6E1}\uFE0F DevGuard Report \u2014 ${new Date(report.scannedAt).toLocaleString()}`);
|
|
173
|
+
console.log(`Score: ${report.score}/100 ${report.score >= 90 ? "\u2705" : report.score >= 70 ? "\u26A0\uFE0F" : "\u{1F6A8}"}`);
|
|
174
|
+
console.log(`Lockfile: ${report.lockfile.valid ? "Valid" : "TAMPERED"} | Hooks: ${report.hooks.findings.length} | Pins: ${report.pins.unpinned.length}`);
|
|
175
|
+
}
|
|
176
|
+
if (!report.passedAll) process.exitCode = 1;
|
|
177
|
+
break;
|
|
178
|
+
}
|
|
179
|
+
case "jwt-verify": {
|
|
180
|
+
const token = getArg("--token");
|
|
181
|
+
const secret = getArg("--secret") || process.env.JWT_SECRET;
|
|
182
|
+
if (!token || !secret) throw new Error("Usage: devguard jwt-verify --token <token> --secret <secret>");
|
|
183
|
+
const verifier = new JWTVerifier({ secret });
|
|
184
|
+
const result = await verifier.verify(token);
|
|
185
|
+
if (isJson) console.log(JSON.stringify(result, null, 2));
|
|
186
|
+
else {
|
|
187
|
+
if (result.valid) console.log("\u2705 Token is VALID");
|
|
188
|
+
else console.log(`\u274C Token is INVALID: ${result.error}`);
|
|
189
|
+
}
|
|
190
|
+
if (!result.valid) process.exitCode = 1;
|
|
191
|
+
break;
|
|
192
|
+
}
|
|
193
|
+
case "log": {
|
|
194
|
+
const msg = getArg("--msg");
|
|
195
|
+
if (!msg) throw new Error("Usage: devguard log --msg <message>");
|
|
196
|
+
const level = getArg("--level") || "info";
|
|
197
|
+
const logger = createLogger({ output: isJson ? "json" : "pretty" });
|
|
198
|
+
logger[level]?.(msg, getArg("--data") ? JSON.parse(getArg("--data")) : {});
|
|
199
|
+
await new Promise((r) => setTimeout(r, 100));
|
|
200
|
+
break;
|
|
201
|
+
}
|
|
202
|
+
case "snapshot": {
|
|
203
|
+
const snap = createSnapshot(root);
|
|
204
|
+
if (isJson) console.log(JSON.stringify(snap));
|
|
205
|
+
else console.log(`\u2705 Snapshot created: ${Object.keys(snap.entries).length} lockfiles tracked.`);
|
|
206
|
+
break;
|
|
207
|
+
}
|
|
208
|
+
case "pin": {
|
|
209
|
+
const { fixed } = autoPin(path2.join(root, "package.json"), !doFix);
|
|
210
|
+
if (isJson) console.log(JSON.stringify({ fixed }));
|
|
211
|
+
else console.log(doFix ? `\u2705 Fixed ${fixed} pins.` : `\u{1F50D} Found ${fixed} unpinned dependencies. Use --fix to update.`);
|
|
212
|
+
break;
|
|
213
|
+
}
|
|
214
|
+
case "scan": {
|
|
215
|
+
const findings = scanProject(root);
|
|
216
|
+
if (isJson) console.log(JSON.stringify(findings, null, 2));
|
|
217
|
+
else {
|
|
218
|
+
if (findings.length === 0) {
|
|
219
|
+
console.log("\u2705 No malicious hooks found in node_modules.");
|
|
220
|
+
} else {
|
|
221
|
+
console.log(`\u{1F6A8} Found ${findings.length} suspicious hooks:`);
|
|
222
|
+
findings.forEach((f) => console.log(` [${f.severity.toUpperCase()}] ${f.package} - ${f.pattern}`));
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
if (findings.length > 0) process.exitCode = 1;
|
|
226
|
+
break;
|
|
227
|
+
}
|
|
228
|
+
case "deps": {
|
|
229
|
+
const deps = extractTransitiveDeps(root);
|
|
230
|
+
if (isJson) console.log(JSON.stringify(deps, null, 2));
|
|
231
|
+
else {
|
|
232
|
+
const keys = Object.keys(deps);
|
|
233
|
+
if (keys.length === 0) console.log("No dependencies found.");
|
|
234
|
+
else {
|
|
235
|
+
console.log(`\u{1F4E6} Transitive Dependencies (${keys.length}):`);
|
|
236
|
+
keys.sort().forEach((n) => console.log(` ${n}: ${deps[n]}`));
|
|
237
|
+
}
|
|
238
|
+
}
|
|
239
|
+
break;
|
|
240
|
+
}
|
|
241
|
+
case "refactor": {
|
|
242
|
+
const fileArg = args[1] && !args[1].startsWith("-") ? args[1] : null;
|
|
243
|
+
if (!fileArg) throw new Error("Usage: devguard refactor <file>");
|
|
244
|
+
const fullPath = path2.resolve(root, fileArg);
|
|
245
|
+
if (!fs2.existsSync(fullPath)) throw new Error(`File not found: ${fullPath}`);
|
|
246
|
+
const original = fs2.readFileSync(fullPath, "utf-8");
|
|
247
|
+
console.log(`\u{1F9E0} Analyzing ${path2.basename(fullPath)}...`);
|
|
248
|
+
const result = {
|
|
249
|
+
original,
|
|
250
|
+
fixed: original.replace(/Array\((\d+)\)\.fill\(0\)\.map\(\(_, i\) => i\)/g, "Array.from({ length: $1 }, (_, i) => i)").replace(/var\s/g, "const "),
|
|
251
|
+
complexity: { before: "O(n\xB2)", after: "O(n)" },
|
|
252
|
+
improvements: ["Replaced inefficient loop", "Switched to constant bindings"]
|
|
253
|
+
};
|
|
254
|
+
const accepted = await openReviewWindow(fullPath, result);
|
|
255
|
+
if (accepted) console.log(`\u2705 Changes applied to ${path2.basename(fullPath)}`);
|
|
256
|
+
else console.log("\u274C Changes discarded.");
|
|
257
|
+
break;
|
|
258
|
+
}
|
|
259
|
+
default:
|
|
260
|
+
console.error(`Unknown command: ${cmd}`);
|
|
261
|
+
process.exitCode = 1;
|
|
262
|
+
}
|
|
263
|
+
} catch (e) {
|
|
264
|
+
if (isJson) console.log(JSON.stringify({ error: e.message }));
|
|
265
|
+
else console.error(`
|
|
266
|
+
\u274C Error: ${e.message}`);
|
|
267
|
+
process.exitCode = 1;
|
|
268
|
+
}
|
|
269
|
+
}
|
|
270
|
+
main();
|