@kinkai.cloud/vibecheck 0.3.0 → 0.3.1

package/README.md

@@ -16,7 +16,7 @@ export PATH="$PWD/.tools/vibecheck/bin:$PATH"
 ```
 
 3. Gere seus relatórios com o runner de testes habitual. Configure os caminhos existentes em `coverage`, `junit` e `sarif` no JSON. Não adicione um relatório que seu projeto não gera. Formatos de cobertura: `lcov`, `cobertura`, `jacoco`.
-4. Analise localmente: `npx vibecheck analyze`. Para publicar, configure `VIBECHECK_PROJECT_TOKEN` como variável de ambiente ou segredo do CI e execute `npx vibecheck analyze --publish`.
+4. Analise localmente: `npx vibecheck analyze`. Para publicar, configure `VIBECHECK_PROJECT_TOKEN` como variável de ambiente, em um arquivo `.env` na raiz do repositório, ou como segredo do CI, e execute `npx vibecheck analyze --publish`. O CLI carrega `.env` localmente quando a variável ainda não está definida no ambiente; nunca publica o arquivo.
 
 O CLI não roda testes arbitrários. Código-fonte completo e valores de segredos permanecem locais. Relatórios sanitizados ficam em `.vibecheck/analysis.json` e `.vibecheck/analysis.sarif`. Adicione `.tools/` e `.vibecheck/` ao `.gitignore`.
 
@@ -33,7 +33,7 @@ No painel: **Achados** para correções, **Mapa** para arquivos, **Dependências
 1. Create a project at https://vibecheck.kinkai.cloud/projects. Copy its configuration and generate a project token in Settings.
 2. Install the CLI and engines using the commands above on Linux x64 or WSL, with Python 3 and venv. Versions are pinned; OSV/Gitleaks binaries are checksum verified. npm does not install engines automatically.
 3. Generate reports using your usual test runner. Configure existing coverage (`lcov`, `cobertura`, `jacoco`), JUnit and SARIF paths. The CLI does not run arbitrary tests.
-4. Run `npx vibecheck analyze`. To upload sanitized results, set `VIBECHECK_PROJECT_TOKEN` in your environment or CI secret store, then run `npx vibecheck analyze --publish`.
+4. Run `npx vibecheck analyze`. To upload sanitized results, set `VIBECHECK_PROJECT_TOKEN` in your environment, in a `.env` file at the repository root, or in your CI secret store, then run `npx vibecheck analyze --publish`. The CLI loads `.env` locally only when the variable is not already set; it never uploads that file.
 
 Publish the reference branch first. Without a comparable merge-base analysis, the gate is inconclusive. Exit codes: 0 pass, 1 fail, 2 inconclusive, 3 operational error. Default policy blocks new high/critical risks and secrets, and requires 80% coverage of new executable lines. Missing required evidence never means pass.
 

package/dist/cli.js

@@ -6,7 +6,7 @@ var __export = (target, all2) => {
 };
 
 // src/analyze.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync, lstatSync as lstatSync2 } from "fs";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync, lstatSync as lstatSync2, readFileSync as readFileSync3 } from "fs";
 import { resolve as resolve2, join as join3 } from "path";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -17693,6 +17693,20 @@ var configSchema = external_exports.object({
   junit: external_exports.array(external_exports.string()).default([]),
   sarif: external_exports.array(external_exports.string()).default([])
 }).strict();
+function loadLocalEnv(root) {
+  const file2 = join3(root, ".env");
+  if (!existsSync(file2) || lstatSync2(file2).isSymbolicLink() || !lstatSync2(file2).isFile())
+    return;
+  for (const line of readFileSync3(file2, "utf8").split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=\s*(.*?)\s*$/);
+    const key = match?.[1];
+    if (!match || !key || process.env[key] !== void 0) continue;
+    let value = match[2];
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+      value = value.slice(1, -1);
+    process.env[key] = value;
+  }
+}
 async function analyzeCommand(argv) {
   if (argv.includes("--help")) {
     console.warn(
@@ -17705,14 +17719,37 @@ async function analyzeCommand(argv) {
     return i < 0 ? void 0 : argv[i + 1];
   };
   const root = resolve2(value("--dir") ?? process.cwd()), configPath = value("--config") ?? "vibecheck.config.json";
-  if (!existsSync(join3(root, configPath)))
+  loadLocalEnv(root);
+  const token = process.env["VIBECHECK_PROJECT_TOKEN"], base = process.env["VIBECHECK_URL"] ?? "https://vibecheck.kinkai.cloud";
+  let config2;
+  if (existsSync(join3(root, configPath))) {
+    config2 = configSchema.parse(JSON.parse(localFile(root, configPath)));
+  } else if (argv.includes("--publish") && token) {
+    const response = await fetch(new URL("/api/projects", base), {
+      headers: { authorization: "Bearer " + token },
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (!response.ok) throw new Error("Project token rejected while discovering project");
+    const project = external_exports.object({ id: external_exports.string().uuid(), reference: external_exports.string() }).parse(await response.json());
+    config2 = {
+      version: 2,
+      projectId: project.id,
+      reference: project.reference,
+      baseline: void 0,
+      coverage: [],
+      junit: [],
+      sarif: []
+    };
+    console.warn(
+      "No vibecheck.config.json found; using project settings discovered from the token."
+    );
+  } else {
     throw new Error(
-      "Create vibecheck.config.json with version: 2 and projectId from the web project."
+      "Create vibecheck.config.json, or set VIBECHECK_PROJECT_TOKEN and use --publish to discover the project automatically."
     );
-  const config2 = configSchema.parse(JSON.parse(localFile(root, configPath)));
+  }
   let baseline = config2.baseline ? analysisReportSchema.parse(JSON.parse(localFile(root, config2.baseline))) : null;
   let report = await analyze({ root, ...config2, baseline });
-  const token = process.env["VIBECHECK_PROJECT_TOKEN"], base = process.env["VIBECHECK_URL"] ?? "https://vibecheck.kinkai.cloud";
   const url2 = new URL(base);
   if (url2.protocol !== "https:" && !["localhost", "127.0.0.1"].includes(url2.hostname))
     throw new Error("Use HTTPS for project uploads");
@@ -18644,12 +18681,12 @@ var sequencedScanEventSchema = external_exports.intersection(
 );
 
 // src/consent.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { createInterface } from "readline/promises";
 import { join as join5, resolve as resolve3 } from "path";
 
 // src/token.ts
-import { chmodSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
 import { join as join4 } from "path";
 function dirConfig() {
@@ -18665,7 +18702,7 @@ function lerToken() {
     return { token: env, host: hostEnv ?? "" };
   }
   try {
-    const bruto = readFileSync3(caminhoToken(), "utf8").trim();
+    const bruto = readFileSync4(caminhoToken(), "utf8").trim();
     const [token, host] = bruto.split("\n");
     if (token === void 0 || token.length === 0) return null;
     return { token, host: host ?? "" };
@@ -18694,7 +18731,7 @@ function repoKey(dir) {
 }
 function listarConsentimentos(deps = {}) {
   try {
-    const bruto = JSON.parse(readFileSync4(caminho(deps), "utf8"));
+    const bruto = JSON.parse(readFileSync5(caminho(deps), "utf8"));
     if (!Array.isArray(bruto)) return [];
     return bruto.filter(
       (e) => e !== null && typeof e === "object" && typeof e.repo === "string" && typeof e.acceptedAt === "string"
@@ -19077,7 +19114,7 @@ async function loginDevice(ci, options = {}) {
 
 // src/repo.ts
 import { execFileSync } from "child_process";
-import { lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
 import { join as join8, relative as relative2 } from "path";
 var MAX_FILES = 800;
 var MAX_BYTES2 = 64e3;
@@ -19140,7 +19177,7 @@ function readCodeContext(dir) {
     try {
       const st = lstatSync3(join8(dir, path));
       if (st.size > (path.endsWith(".sql") ? MAX_SQL_BYTES : MAX_BYTES2)) continue;
-      files.push({ path, content: readFileSync5(join8(dir, path), "utf8") });
+      files.push({ path, content: readFileSync6(join8(dir, path), "utf8") });
     } catch {
     }
   }
@@ -19194,7 +19231,7 @@ function toSarif(report, version2) {
 }
 
 // src/walker.ts
-import { lstatSync as lstatSync4, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { lstatSync as lstatSync4, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
 import { join as join9, relative as relative3 } from "path";
 var IGNORAR = /* @__PURE__ */ new Set([
   "node_modules",
@@ -19339,7 +19376,7 @@ function lerArquivo(raiz, cheio) {
   const rel = posixRel(raiz, cheio);
   let conteudo = "";
   try {
-    conteudo = readFileSync6(cheio, "utf8").slice(0, MAX_BYTES_ARQUIVO);
+    conteudo = readFileSync7(cheio, "utf8").slice(0, MAX_BYTES_ARQUIVO);
   } catch {
     return null;
   }
@@ -19461,7 +19498,7 @@ function isAdvancedScan(grafo) {
 }
 
 // src/cli.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.1";
 var AJUDA = `vibecheck \u2014 security check for AI-built apps
 
   npx @kinkai.cloud/vibecheck [options]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinkai.cloud/vibecheck",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": false,
   "type": "module",
   "bin": {
@@ -25,8 +25,8 @@
     "zod": "^4",
     "@vibecheck/checks": "0.0.0",
     "@vibecheck/graph": "0.0.0",
-    "@vibecheck/schema": "0.0.0",
-    "@vibecheck/analysis": "0.0.0"
+    "@vibecheck/analysis": "0.0.0",
+    "@vibecheck/schema": "0.0.0"
   },
   "exports": {
     "./login": "./src/login.ts",