@kinkai.cloud/vibecheck 0.2.0 → 0.3.0

package/engines/engines.json

@@ -0,0 +1,7 @@
+{
+  "semgrep": "1.176.0",
+  "osv": "2.5.1",
+  "gitleaks": "8.30.1",
+  "osvLinuxAmd64Sha256": "f9f25499a2c8cc367b3af45df2ea7eeca7fbccceab9c35079968f4b3652194be",
+  "gitleaksLinuxAmd64Sha256": "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+}

package/engines/install.py

@@ -0,0 +1,20 @@
+"""Install pinned Linux x64 engines after verifying release checksums."""
+import hashlib, io, json, pathlib, sys, tarfile, urllib.request
+root = pathlib.Path(sys.argv[1]).resolve()
+root.mkdir(parents=True, exist_ok=True)
+lock = json.loads(pathlib.Path(__file__).with_name('engines.json').read_text())
+artifacts = [
+ ('osv-scanner', f"https://github.com/google/osv-scanner/releases/download/v{lock['osv']}/osv-scanner_linux_amd64", lock['osvLinuxAmd64Sha256']),
+ ('gitleaks', f"https://github.com/gitleaks/gitleaks/releases/download/v{lock['gitleaks']}/gitleaks_{lock['gitleaks']}_linux_x64.tar.gz", lock['gitleaksLinuxAmd64Sha256']),
+]
+for name, url, checksum in artifacts:
+ data = urllib.request.urlopen(url, timeout=60).read()
+ if hashlib.sha256(data).hexdigest() != checksum:
+  raise RuntimeError('Checksum mismatch: ' + name)
+ if name == 'gitleaks':
+  with tarfile.open(fileobj=io.BytesIO(data)) as archive:
+   data = archive.extractfile('gitleaks').read()
+ target = root / name
+ target.write_bytes(data)
+ target.chmod(0o755)
+ print(name + ' installed and verified')

package/engines/requirements.txt

@@ -0,0 +1,66 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+boltons==21.0.0
+bracex==3.0.1
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.1
+click==8.4.2
+click-option-group==0.5.9
+colorama==0.4.6
+cryptography==50.0.1
+exceptiongroup==1.2.2
+face==26.0.1
+glom==25.12.0
+googleapis-common-protos==1.75.3
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+idna==3.19
+importlib_metadata==8.7.1
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+markdown-it-py==4.2.0
+mcp==1.29.0
+mdurl==0.1.2
+opentelemetry-api==1.37.0
+opentelemetry-exporter-otlp-proto-common==1.37.0
+opentelemetry-exporter-otlp-proto-http==1.37.0
+opentelemetry-instrumentation==0.58b0
+opentelemetry-instrumentation-requests==0.58b0
+opentelemetry-instrumentation-threading==0.58b0
+opentelemetry-proto==1.37.0
+opentelemetry-sdk==1.37.0
+opentelemetry-semantic-conventions==0.58b0
+opentelemetry-util-http==0.58b0
+packaging==26.3
+peewee==3.19.0
+protobuf==6.33.6
+pycparser==3.0
+pydantic==2.13.5
+pydantic-settings==2.15.0
+pydantic_core==2.46.5
+Pygments==2.21.0
+PyJWT==2.13.0
+python-dotenv==1.2.3
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rich==15.0.0
+rpds-py==2026.6.3
+ruamel.yaml==0.19.1
+ruamel.yaml.clib==0.2.15
+semantic-version==2.10.0
+semgrep==1.176.0
+sse-starlette==3.4.11
+starlette==1.6.0
+tomli==2.4.1
+typing-inspection==0.4.4
+typing_extensions==4.16.0
+urllib3==2.7.0
+uvicorn==0.52.4
+wcmatch==8.5.2
+wrapt==1.17.3
+zipp==4.1.0

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@kinkai.cloud/vibecheck",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": false,
   "type": "module",
   "bin": {
     "vibecheck": "./dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "engines"
   ],
   "publishConfig": {
     "access": "public"
@@ -21,9 +22,11 @@
     "tsx": "^4",
     "typescript": "^5",
     "vitest": "^3",
+    "zod": "^4",
     "@vibecheck/checks": "0.0.0",
     "@vibecheck/graph": "0.0.0",
-    "@vibecheck/schema": "0.0.0"
+    "@vibecheck/schema": "0.0.0",
+    "@vibecheck/analysis": "0.0.0"
   },
   "exports": {
     "./login": "./src/login.ts",