@korayda4/vibe-security 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Koray Demir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,240 @@
+# Vibe Security
+
+> **The security guard for Vibe Coded projects.** Every line of AI-generated Frontend or Backend code is planned, tested, and scanned across all layers and languages. Auto-fix patches included for the most common mistakes.
+
+[![npm](https://img.shields.io/npm/v/%40korayda4%2Fvibe-security?style=flat-square)](https://www.npmjs.com/package/@korayda4/vibe-security)
+[![MCP](https://img.shields.io/badge/MCP-stdio-blue?style=flat-square)](https://modelcontextprotocol.io)
+[![License](https://img.shields.io/badge/license-MIT-green?style=flat-square)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen?style=flat-square)](https://nodejs.org)
+
+---
+
+## What is Vibe Security?
+
+Vibe Security is the **AI skill** for catching security mistakes in code generated by AI agents (Claude Code, VS Code Anthropic Claude extension, Cursor, Continue.dev).
+
+For every change in a Vibe Coded project, our skill:
+
+1. **Plans** — maps the project's languages and frameworks (React, Next.js, Express, Django, .NET, etc.)
+2. **Tests** — runs the scan against 36 rules across 6 layers
+3. **Finds** — XSS, SQLi, IDOR, weak hashing, hardcoded secrets, misconfigured CORS, missing security headers, and more
+4. **Explains** — every finding has CWE, OWASP, threat model, and step-by-step fix
+5. **Fixes** — auto-patch for the most common mistakes (FE-001 DOMPurify, FE-004 source maps, NET-002 CORS)
+
+---
+
+## Install
+
+### From npm
+
+```bash
+npm install -g @korayda4/vibe-security
+```
+
+### From GitHub (pre-publish or alternative channel)
+
+```bash
+npx -y github:korayda4/Vibe-Security init
+```
+
+### MCP server config
+
+**Claude Code** — `~/.claude/mcp_servers.json`:
+```json
+{
+  "mcpServers": {
+    "vibe-security": { "command": "vibe-security" }
+  }
+}
+```
+
+**VS Code Anthropic Claude extension** — `.vscode/settings.json`:
+```json
+{
+  "mcp.servers": {
+    "vibe-security": { "command": "vibe-security", "type": "stdio" }
+  }
+}
+```
+
+After install, restart your editor. The `/securityCheck` slash command will be available.
+
+---
+
+## Use
+
+```
+/securityCheck                  full project scan, writes Security.md
+/securityCheck --frontend       only frontend layer
+/securityCheck --fix            preview + apply auto-fixes
+/securityCheck --baseline       only NEW findings vs baseline
+/securityCheck --rule BE-004    single rule
+```
+
+Or talk to Claude naturally:
+
+> "Run a security scan on this project."
+> "Any IDOR or SQL injection in the backend?"
+> "Explain FE-001 in detail."
+
+---
+
+## Languages & Frameworks
+
+### Frontend technologies
+
+React · Next.js · Vue.js · AngularJS · Svelte
+
+Vibe Security scans every Frontend angle:
+
+- XSS in `innerHTML` / `dangerouslySetInnerHTML` / `<%= raw %>` / `unsafe { + }`
+- Cookie flags (HttpOnly, Secure, SameSite)
+- Public env leaks (`NEXT_PUBLIC_*`, `REACT_APP_*`)
+- Source maps in production
+- Clickjacking protection
+- `eval` / `Function` / `setTimeout(string)` misuse
+- CSP / HSTS / X-Content-Type-Options / Referrer-Policy / Permissions-Policy
+
+### Backend technologies
+
+Node.js · Express · Fastify · NestJS · Django · Flask · FastAPI · Rails · Sinatra · Laravel · Symfony · WordPress · Spring · ASP.NET Core · Blazor · Actix · Axum · Gin · Fiber · C/C++
+
+Vibe Security scans every Backend angle:
+
+- IDOR / BOLA — ownership not verified
+- SQL / NoSQL injection (string concatenation, f-string, `format!`)
+- JWT `alg: none`, weak secret, missing expiry
+- Mass assignment — input not whitelisted
+- Weak password hashing (MD5 / SHA-1 / SHA-256)
+- Token in URL query/path
+- Long-lived tokens without expiry
+- Missing rate limiting on auth endpoints
+- Unsafe file upload (original filename used)
+- Hardcoded secrets / API keys / AWS keys
+
+### Detection sources
+
+`package.json`, `composer.json`, `Gemfile`, `requirements.txt`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `*.csproj`, `*.sln`, `CMakeLists.txt`. Smart detection via file extension, shebang (`#!/usr/bin/env python3`), and syntax sniffing.
+
+---
+
+## How it works in a Vibe Coded project
+
+```
+User writes code with Claude
+    │
+    ▼
+AI invokes /securityCheck  ──►  Vibe Security MCP server
+    │
+    ▼
+1. PLAN  — detect languages, frameworks, project profile
+    │
+    ▼
+2. TEST  — apply 36 rules across 6 layers (Frontend, Backend,
+          Network, Database, CI/CD, Observability)
+    │
+    ▼
+3. FIND  — 36 known vulnerability patterns
+    │
+    ▼
+4. EXPLAIN — CWE + OWASP + threat model + remediation steps
+    │
+    ▼
+5. FIX  — auto-patch for 3 rules; guidance for the rest
+    │
+    ▼
+Security.md written to your project root (not in this repo)
+```
+
+---
+
+## Output
+
+| Format | Use |
+|---|---|
+| `markdown` | Default `Security.md` in your project root |
+| `sarif` | GitHub Code Scanning integration |
+| `json` | Programmatic / CI |
+| `junit` | Jenkins, GitLab CI |
+| `compact` | PR comment summary |
+
+**Important:** `Security.md` is generated at runtime in YOUR project. It is not part of this repo and is gitignored by default. Sample structure: [`docs/SECURITY_REPORT.example.md`](docs/SECURITY_REPORT.example.md).
+
+---
+
+## Configuration
+
+`.vibe-security.json`:
+
+```json
+{
+  "rules": { "FE-006": { "enabled": false } },
+  "ignore": ["**/vendor/**"],
+  "output": { "format": "sarif" }
+}
+```
+
+---
+
+## CI/CD
+
+```yaml
+- run: npx -y @korayda4/vibe-security scan . --format sarif --output vibe-security.sarif
+- uses: github/codeql-action/upload-sarif@v3
+  with: { sarif_file: vibe-security.sarif }
+```
+
+Baseline for PR-only-new-findings:
+
+```bash
+vibe-security scan . --update-baseline --no-fail    # main branch
+vibe-security scan . --baseline .vibe-security-baseline.json    # PR branch
+```
+
+Full GitHub Actions: [`examples/github-actions.yml`](examples/github-actions.yml).
+
+---
+
+## Performance
+
+| Project size | Time |
+|---|---|
+| 500 files | ~200 ms |
+| 5,000 files | ~1.5 s |
+| 50,000 files | ~15 s |
+
+---
+
+## Compatibility
+
+| Platform | Status |
+|---|---|
+| Claude Code (CLI) | ✅ |
+| VS Code Anthropic Claude extension | ✅ |
+| Cursor | ✅ |
+| Continue.dev | ✅ |
+| Standalone CLI / CI | ✅ |
+
+Node.js 18+.
+
+---
+
+## More
+
+- [`docs/USAGE.md`](docs/USAGE.md) — every flag, every output format
+- [`docs/TOKEN_SAFETY.md`](docs/TOKEN_SAFETY.md) — JWT, refresh tokens, rotation
+- [`docs/VULNERABILITY_PRIORITY.md`](docs/VULNERABILITY_PRIORITY.md) — clusters by priority
+- [`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md) — add a new rule
+- [`ROADMAP.md`](ROADMAP.md) — phases and what is next
+
+---
+
+## Maintainer
+
+Koray Demir · [koraydemirmc@gmail.com](mailto:koraydemirmc@gmail.com) · [github.com/korayda4](https://github.com/korayda4)
+
+---
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,333 @@
+#!/usr/bin/env node
+import { scan } from './engine/scanner.js';
+import { writeSecurityReport } from './engine/reporter.js';
+import { applyFixes, formatFixSummary } from './engine/fixer.js';
+import { formatOutput } from './engine/output.js';
+import { readBaseline, writeBaseline, diffAgainstBaseline, } from './engine/baseline.js';
+import { loadConfig } from './engine/config.js';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+function parseArgs(argv) {
+    const args = argv.slice(2);
+    const out = {
+        cmd: args[0] ?? 'scan',
+        target: args[1] ?? process.cwd(),
+        format: 'markdown',
+        fix: false,
+        dryRun: false,
+        updateBaseline: false,
+        watch: false,
+        noFail: false,
+        help: false,
+    };
+    for (let i = 2; i < args.length; i++) {
+        const a = args[i];
+        const next = args[i + 1];
+        switch (a) {
+            case '--format':
+                out.format = next ?? 'markdown';
+                i++;
+                break;
+            case '--output':
+            case '-o':
+                out.output = next;
+                i++;
+                break;
+            case '--fix':
+                out.fix = true;
+                break;
+            case '--dry-run':
+                out.fix = true;
+                out.dryRun = true;
+                break;
+            case '--baseline':
+                out.baseline = next;
+                i++;
+                break;
+            case '--update-baseline':
+                out.updateBaseline = true;
+                break;
+            case '--layers':
+                out.layers = (next ?? '').split(',').filter(Boolean);
+                i++;
+                break;
+            case '--rules':
+                out.rules = (next ?? '').split(',').filter(Boolean);
+                i++;
+                break;
+            case '--watch':
+            case '-w':
+                out.watch = true;
+                break;
+            case '--no-fail':
+                out.noFail = true;
+                break;
+            case '--help':
+            case '-h':
+                out.help = true;
+                break;
+            default:
+                if (!out.target || out.target === process.cwd()) {
+                    out.target = a;
+                }
+        }
+    }
+    return out;
+}
+function printHelp() {
+    console.log(`Vibe Security CLI
+
+Usage:
+  vibe-security scan [path] [options]
+  vibe-security list
+  vibe-security init
+  vibe-security baseline update [path]
+
+Scan options:
+  --format <markdown|json|sarif|junit|compact>   Output format (default: markdown)
+  --output, -o <path>                            Output file path
+  --fix                                          Apply auto-fixes
+  --dry-run                                      Preview auto-fixes without writing
+  --baseline <path>                              Show only new findings vs baseline
+  --update-baseline                              Write current findings to baseline
+  --layers <f,b,n,d,c,o>                         Scan only these layers
+  --rules <FE-001,BE-004>                        Run only these rules
+  --watch, -w                                    Re-scan on file changes
+  --no-fail                                      Exit 0 even with findings
+
+Examples:
+  vibe-security scan . --format sarif --output vibe-security.sarif
+  vibe-security scan src/ --fix --dry-run
+  vibe-security scan . --baseline .vibe-security-baseline.json
+  vibe-security init    # Create .vibe-security.json + slash command files
+`);
+}
+async function cmdInit(rootDir) {
+    const configPath = path.join(rootDir, '.vibe-security.json');
+    const slashCommandPath = path.join(rootDir, '.claude', 'commands', 'securityCheck.md');
+    const vscodeSettingsPath = path.join(rootDir, '.vscode', 'settings.json');
+    const ghInstructionsPath = path.join(rootDir, '.github', 'instructions', 'security-check.instructions.md');
+    const config = {
+        rules: {
+            'OBS-002': { severity: 'low' },
+        },
+        ignore: ['node_modules', 'dist', '.next', 'coverage'],
+        output: { format: 'markdown', path: 'Security.md' },
+    };
+    await fs.mkdir(path.dirname(configPath), { recursive: true });
+    await fs.writeFile(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+    console.log(`✅ ${configPath}`);
+    for (const [target, content] of [
+        [slashCommandPath, SLASH_COMMAND_CLAUDE],
+        [vscodeSettingsPath, VSCODE_SETTINGS],
+        [ghInstructionsPath, SLASH_COMMAND_GITHUB],
+    ]) {
+        await fs.mkdir(path.dirname(target), { recursive: true });
+        await fs.writeFile(target, content, 'utf8');
+        console.log(`✅ ${target}`);
+    }
+    console.log('\n👉 Next:');
+    console.log('   • Claude Code: type /securityCheck');
+    console.log('   • VS Code: reload window, MCP server will be picked up automatically');
+    console.log('   • CI: add `npx -y vibe-security scan . --format sarif` to your workflow');
+}
+async function cmdList() {
+    const { getAllRules } = await import('./engine/rules/index.js');
+    const rules = getAllRules();
+    console.log('Available rules:\n');
+    for (const r of rules) {
+        console.log(`  ${r.id.padEnd(8)} ${r.severity.toUpperCase().padEnd(10)} ${r.layer.padEnd(14)} ${r.title}`);
+    }
+    console.log(`\nTotal: ${rules.length}`);
+}
+async function cmdScan(args) {
+    const rootDir = path.resolve(args.target);
+    if (args.watch) {
+        return cmdWatch(args);
+    }
+    console.log(` Scanning ${rootDir}...`);
+    const config = await loadConfig(rootDir);
+    const result = await scan({
+        rootDir,
+        layers: args.layers,
+        ruleIds: args.rules,
+        ignore: config.ignore,
+    });
+    const baselinePath = args.baseline ?? config.baseline;
+    let displayFindings = result.findings;
+    if (baselinePath) {
+        const baseline = await readBaseline(baselinePath);
+        const diff = diffAgainstBaseline(result, baseline);
+        displayFindings = diff.newFindings;
+        console.log(`📋 Baseline: ${baseline ? `${baseline.findings.length} known` : 'none'} -> ${diff.newFindings.length} new, ${diff.resolvedFindings.length} resolved`);
+    }
+    if (args.fix) {
+        const fixSummary = await applyFixes(result, {
+            dryRun: args.dryRun,
+            onlyRuleIds: args.rules,
+        });
+        console.log('\n' + formatFixSummary(fixSummary, args.dryRun));
+        if (!args.dryRun && fixSummary.applied.length > 0) {
+            console.log(`\n🔧 ${fixSummary.applied.length} file(s) modified.`);
+        }
+    }
+    if (args.format === 'markdown') {
+        const reportPath = args.output ?? path.join(rootDir, 'Security.md');
+        const filtered = { ...result, findings: displayFindings };
+        await writeSecurityReport(filtered, reportPath);
+        console.log(`📝 Report: ${reportPath}`);
+    }
+    else {
+        const out = formatOutput(args.format, { ...result, findings: displayFindings });
+        const outPath = args.output ?? defaultOutputPath(rootDir, args.format);
+        await fs.writeFile(outPath, out, 'utf8');
+        console.log(`📝 ${args.format.toUpperCase()} -> ${outPath}`);
+    }
+    if (args.updateBaseline) {
+        const basePath = baselinePath ?? path.join(rootDir, '.vibe-security-baseline.json');
+        await writeBaseline(basePath, result);
+        console.log(`📌 Baseline updated: ${basePath}`);
+    }
+    const sevEmoji = {
+        critical: '🟣',
+        high: '🔴',
+        medium: '🟠',
+        low: '🟡',
+        info: '🔵',
+    };
+    console.log(`\n${displayFindings.length} finding(s) -- ` +
+        Object.entries(result.summary.bySeverity)
+            .filter(([, n]) => n > 0)
+            .map(([s, n]) => `${sevEmoji[s]} ${s}:${n}`)
+            .join(' - '));
+    return args.noFail || displayFindings.length === 0 ? 0 : 1;
+}
+function defaultOutputPath(rootDir, format) {
+    const ext = format === 'sarif' ? 'sarif' : format === 'json' ? 'json' : format === 'junit' ? 'xml' : 'md';
+    return path.join(rootDir, `vibe-security.${ext}`);
+}
+async function cmdWatch(args) {
+    const rootDir = path.resolve(args.target);
+    console.log(`👀 Watching ${rootDir} (Ctrl+C to stop)...`);
+    let running = false;
+    async function rescan() {
+        if (running)
+            return;
+        running = true;
+        try {
+            const result = await scan({ rootDir });
+            const reportPath = path.join(rootDir, 'Security.md');
+            await writeSecurityReport(result, reportPath);
+            const ts = new Date().toLocaleTimeString();
+            console.log(`[${ts}] ${result.summary.totalFindings} finding(s) -> ${reportPath}`);
+        }
+        finally {
+            running = false;
+        }
+    }
+    await rescan();
+    console.log('   (3s polling interval)');
+    const interval = setInterval(rescan, 3000);
+    process.on('SIGINT', () => {
+        clearInterval(interval);
+        process.exit(0);
+    });
+    return new Promise(() => { });
+}
+async function cmdBaseline(args) {
+    const sub = args.target; // second positional
+    const rootDir = process.cwd();
+    if (sub === 'update') {
+        const result = await scan({ rootDir });
+        const basePath = path.join(rootDir, '.vibe-security-baseline.json');
+        await writeBaseline(basePath, result);
+        console.log(`📌 Baseline updated: ${basePath} (${result.findings.length} entries)`);
+        return 0;
+    }
+    console.error('Usage: vibe-security baseline update');
+    return 2;
+}
+async function main() {
+    const args = parseArgs(process.argv);
+    if (args.help || args.cmd === '--help' || args.cmd === '-h') {
+        printHelp();
+        return 0;
+    }
+    if (args.cmd === 'list' || args.cmd === 'rules')
+        return cmdList().then(() => 0);
+    if (args.cmd === 'init')
+        return cmdInit(args.target).then(() => 0);
+    if (args.cmd === 'baseline')
+        return cmdBaseline(args);
+    if (args.cmd === 'scan' || args.cmd === undefined)
+        return cmdScan(args);
+    console.error(`Unknown command: ${args.cmd}`);
+    printHelp();
+    return 2;
+}
+main().catch((err) => {
+    console.error('Fatal:', err);
+    process.exit(1);
+});
+const SLASH_COMMAND_CLAUDE = `---
+description: Run Vibe Security scan on the current project and report findings
+---
+
+Scan this project for security issues.
+
+Use the following MCP tools in order:
+
+1. **mcp__vibe-security__scan_project** -- Scan the entire project. Set the \`rootDir\` parameter to the current working directory.
+
+2. If the user provided arguments (\$ARGUMENTS):
+   - \`--frontend\` / \`--backend\` / \`--network\` / \`--database\` / \`--cicd\` / \`--observability\` -> filter via the \`layers\` parameter
+   - \`--fix\` -> call \`mcp__vibe-security__get_rule_detail\` for the top 3 critical rules to extract fix suggestions, then present an apply plan to the user
+   - \`--baseline\` -> compare \`mcp__vibe-security__scan_project\` output against the existing baseline, report only the new findings
+   - \`--rule <id>\` -> run only that rule (\`ruleIds\` parameter)
+   - \`--json\` -> request JSON output instead of the table format
+
+3. Summarize findings in order: **critical -> high -> medium -> low**.
+
+4. For the **first 3 findings**, write concrete fix suggestions (with code examples).
+
+5. \`Security.md\` is already written by the MCP server. Show the user the file path and total finding count.
+
+Do NOT:
+- Hide or downplay findings.
+- Suggest a fix you are not sure about; point the user to the rule documentation instead.
+- Ask clarifying questions before scanning -- scan directly.
+`;
+const VSCODE_SETTINGS = JSON.stringify({
+    'mcp.servers': {
+        'vibe-security': {
+            command: 'vibe-security',
+            type: 'stdio',
+        },
+    },
+}, null, 2) + '\n';
+const SLASH_COMMAND_GITHUB = `---
+description: Auto-invoked when user runs /securityCheck -- runs Vibe Security MCP scan and explains findings
+applyTo: "**"
+---
+
+When the user runs /securityCheck (with or without arguments), you MUST:
+
+1. Call the MCP tool \`scan_project\` provided by the \`vibe-security\` server.
+   - \`rootDir\`: \${workspaceFolder}
+   - If the user passed --frontend, --backend, --network, --database, --cicd, or --observability, pass the matching \`layers\` filter.
+   - If the user passed --fix, also call \`get_rule_detail\` for the top 3 critical findings and present auto-fix suggestions inline.
+   - If the user passed --rule <id>, pass \`ruleIds: [<id>]\`.
+2. Summarize the result as a table: severity, count, top 3 files.
+3. For each Critical and High finding, show: file:line, snippet, one-line fix.
+4. Confirm that Security.md was written at the workspace root.
+5. If no findings: congratulate the user.
+
+Do not ask clarifying questions before scanning -- just scan.
+
+Available MCP tools:
+- \`scan_project\` -- full project scan
+- \`scan_file\` -- single file scan
+- \`list_rules\` -- list all rules
+- \`get_rule_detail\` -- get rule details (use this for auto-fix suggestions)
+`;
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAkBlC,SAAS,SAAS,CAAC,IAAuB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAY;QACnB,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM;QACtB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,KAAK;QACV,MAAM,EAAE,KAAK;QACb,cAAc,EAAE,KAAK;QACrB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;KACZ,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,UAAU;gBACb,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,UAAU,CAAC;gBAChC,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,IAAI;gBACP,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,OAAO;gBACV,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,KAAK,WAAW;gBACd,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,KAAK,YAAY;gBACf,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACpB,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,mBAAmB;gBACtB,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,KAAK,UAAU;gBACb,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,SAAS;gBACZ,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,SAAS,CAAC;YACf,KAAK,IAAI;gBACP,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR;gBACE,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;oBAChD,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;CAyBb,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACvF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAE3G,MAAM,MAAM,GAAG;QACb,KAAK,EAAE;YACL,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC/B;QACD,MAAM,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;KACpD,CAAC;IAEF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACxC,CAAC,kBAAkB,EAAE,eAAe,CAAC;QACrC,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;KAClC,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,OAAO;IACpB,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAa;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;QACxB,OAAO;QACP,MAAM,EAAE,IAAI,CAAC,MAAa;QAC1B,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACL,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACpD,IAAI,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC;QACnC,OAAO,CAAC,GAAG,CACT,gBAAgB,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,WAAW,CACtJ,CAAC;IACJ,CAAC;IACH,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,oBAAoB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAC1D,MAAM,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,cAAc,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;QACpF,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC;IACH,MAAM,QAAQ,GAA2B;QACrC,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,IAAI;KACX,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,eAAe,CAAC,MAAM,iBAAiB;QAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;aACxB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aAC3C,IAAI,CAAC,KAAK,CAAC,CACjB,CAAC;IAEF,OAAO,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAa;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,sBAAsB,CAAC,CAAC;IAE1D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,UAAU,MAAM;QACnB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACrD,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,aAAa,kBAAkB,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAa;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,oBAAoB;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;QACpE,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5D,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE,OAAO,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2B5B,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CACpC;IACE,aAAa,EAAE;QACb,eAAe,EAAE;YACf,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,OAAO;SACd;KACF;CACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CAAC;AAET,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB5B,CAAC"}

package/dist/engine/baseline.d.ts

@@ -0,0 +1,19 @@
+import type { Finding, ScanResult } from '../types.js';
+export interface BaselineFile {
+    readonly version: number;
+    readonly createdAt: string;
+    readonly findings: readonly BaselineEntry[];
+}
+export interface BaselineEntry {
+    readonly ruleId: string;
+    readonly file: string;
+    readonly line: number;
+    readonly hash: string;
+}
+export declare function findingFingerprint(f: Finding): string;
+export declare function readBaseline(filePath: string): Promise<BaselineFile | null>;
+export declare function writeBaseline(filePath: string, result: ScanResult): Promise<void>;
+export declare function diffAgainstBaseline(result: ScanResult, baseline: BaselineFile | null): {
+    newFindings: readonly Finding[];
+    resolvedFindings: readonly BaselineEntry[];
+};

package/dist/engine/baseline.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+const BASELINE_VERSION = 1;
+export function findingFingerprint(f) {
+    return createHash('sha256')
+        .update(`${f.ruleId}|${f.file}|${f.match.line}|${f.match.snippet.trim()}`)
+        .digest('hex')
+        .slice(0, 16);
+}
+export async function readBaseline(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== BASELINE_VERSION)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeBaseline(filePath, result) {
+    const entries = result.findings.map((f) => ({
+        ruleId: f.ruleId,
+        file: f.file,
+        line: f.match.line,
+        hash: findingFingerprint(f),
+    }));
+    const file = {
+        version: BASELINE_VERSION,
+        createdAt: new Date().toISOString(),
+        findings: entries,
+    };
+    await fs.mkdir(path.dirname(path.resolve(filePath)), { recursive: true });
+    await fs.writeFile(filePath, JSON.stringify(file, null, 2), 'utf8');
+}
+export function diffAgainstBaseline(result, baseline) {
+    if (!baseline) {
+        return { newFindings: result.findings, resolvedFindings: [] };
+    }
+    const currentHashes = new Set(result.findings.map(findingFingerprint));
+    const baselineHashes = new Set(baseline.findings.map((e) => e.hash));
+    const newFindings = result.findings.filter((f) => !baselineHashes.has(findingFingerprint(f)));
+    const resolvedFindings = baseline.findings.filter((e) => !currentHashes.has(e.hash));
+    return { newFindings, resolvedFindings };
+}
+//# sourceMappingURL=baseline.js.map