@maverick006/ai-engine 1.0.2 → 1.0.4

package/dist/explainer.d.ts

@@ -6,6 +6,7 @@ export interface ExplanationOptions {
 }
 /**
  * Generates contextual explanations for deterministic security findings using NVIDIA NIM.
+ * Operates as an optional advisory module; returns deterministic scanner guidance if API key is missing.
  */
 export declare class ContextualExplainer {
     private ai;
@@ -15,6 +16,10 @@ export declare class ContextualExplainer {
      * Generates a contextual explanation and remediation strategy for a given finding.
      */
     explainFinding(finding: NormalizedFinding, options?: ExplanationOptions): Promise<AIExplanation>;
+    /**
+     * Complete pre-AI secret redaction to ensure credentials never leak into prompt context.
+     */
+    maskSecrets(text: string): string;
     private buildPrompt;
     private parseAIResponse;
     private generateFallbackExplanation;

package/dist/explainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"explainer.d.ts","sourceRoot":"","sources":["../src/explainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,YAAY,CAAwC;gBAEhD,MAAM,CAAC,EAAE,MAAM;IAU3B;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1G,OAAO,CAAC,WAAW;IA+BnB,OAAO,CAAC,eAAe;IA6BvB,OAAO,CAAC,2BAA2B;CAWpC"}
+{"version":3,"file":"explainer.d.ts","sourceRoot":"","sources":["../src/explainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,EAAE,CAAuB;IACjC,OAAO,CAAC,YAAY,CAAwC;gBAEhD,MAAM,CAAC,EAAE,MAAM;IAU3B;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC;IAkC1G;;OAEG;IACI,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAyBxC,OAAO,CAAC,WAAW;IAyBnB,OAAO,CAAC,eAAe;IAqCvB,OAAO,CAAC,2BAA2B;CAgBpC"}

package/dist/explainer.js

@@ -7,6 +7,7 @@ exports.ContextualExplainer = void 0;
 const openai_1 = __importDefault(require("openai"));
 /**
  * Generates contextual explanations for deterministic security findings using NVIDIA NIM.
+ * Operates as an optional advisory module; returns deterministic scanner guidance if API key is missing.
  */
 class ContextualExplainer {
     ai = null;
@@ -24,94 +25,127 @@ class ContextualExplainer {
      * Generates a contextual explanation and remediation strategy for a given finding.
      */
     async explainFinding(finding, options = {}) {
-        if (!this.ai) {
-            // Fallback if no API key is provided
+        const client = options.apiKey
+            ? new openai_1.default({ apiKey: options.apiKey, baseURL: 'https://integrate.api.nvidia.com/v1' })
+            : this.ai;
+        if (!client) {
+            // Deterministic fallback when no AI API key is configured
             return this.generateFallbackExplanation(finding);
         }
         try {
             const modelName = options.model || this.defaultModel;
-            const prompt = this.buildPrompt(finding, options.codeContext);
-            const completion = await this.ai.chat.completions.create({
+            // MASK ALL SECRETS BEFORE SENDING TO MODEL
+            const safeContext = this.maskSecrets(options.codeContext || '').slice(0, 2000); // 2000 chars max context
+            const safeFinding = { ...finding, codeSnippet: this.maskSecrets(finding.codeSnippet || '') };
+            const prompt = this.buildPrompt(safeFinding, safeContext);
+            const completion = await client.chat.completions.create({
                 model: modelName,
                 messages: [{ role: "user", content: prompt }],
-                temperature: 0.2, // Low temp for more deterministic code fixes
+                temperature: 0.2,
                 max_tokens: 1024,
             });
             const text = completion.choices[0]?.message?.content || "";
             return this.parseAIResponse(finding.scanId || 'unknown', text);
         }
         catch (error) {
-            console.error('Failed to generate AI explanation:', error);
-            return this.generateFallbackExplanation(finding);
+            console.warn('AI explanation failed, reverting to deterministic guidance:', error.message);
+            return this.generateFallbackExplanation(finding, 'FAILED');
         }
     }
+    /**
+     * Complete pre-AI secret redaction to ensure credentials never leak into prompt context.
+     */
+    maskSecrets(text) {
+        if (!text)
+            return text;
+        let masked = text;
+        // Mask Private Keys
+        masked = masked.replace(/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g, '[MASKED_PRIVATE_KEY]');
+        // Mask AWS Access Keys
+        masked = masked.replace(/\b(AKIA|ASIA|AROA)[0-9A-Z]{16}\b/g, '$1[MASKED_AWS_KEY]');
+        // Mask Database Connection Strings (Postgres, MySQL, Mongo, Redis)
+        masked = masked.replace(/(?:postgres|postgresql|mysql|mongodb|mongodb\+srv|redis):\/\/[^\s"']+/gi, '[MASKED_DATABASE_URL]');
+        // Mask Bearer Tokens
+        masked = masked.replace(/Bearer\s+[a-zA-Z0-9_\-\.]+/gi, 'Bearer [MASKED_BEARER_TOKEN]');
+        // Mask JWTs
+        masked = masked.replace(/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, '[MASKED_JWT]');
+        // Mask Generic Secrets in code (password = "...", secret: '...', token = "...")
+        masked = masked.replace(/(password|secret|token|api[_-]?key|client_secret)["'\s:=]+(["'])(?:(?!\2).)+(\2)/gi, '$1="[MASKED_SECRET]"');
+        return masked;
+    }
     buildPrompt(finding, codeContext) {
-        return `
-You are VibeGuard, a strict, deterministic DevSecOps assistant. 
-A deterministic security scanner has found the following vulnerability. 
-Do not guess if it's a false positive, assume the scanner is correct.
-Your job is to explain the vulnerability clearly to a developer and provide a safe remediation snippet.
-
-SCANNER FINDING:
-Title: ${finding.title}
-Severity: ${finding.severity}
-Scanner: ${finding.scanner}
-File: ${finding.file}
-Line: ${finding.line}
-Rule: ${finding.ruleId}
-Description: ${finding.description}
-CWE: ${finding.cwe || 'Unknown'}
-OWASP: ${finding.owasp || 'Unknown'}
-
-${codeContext ? `CODE CONTEXT:\n${codeContext}` : ''}
-${finding.codeSnippet ? `SNIPPET:\n${finding.codeSnippet}` : ''}
-
-Format your response exactly as the following JSON. Do not include markdown blocks around the JSON, just output raw JSON:
-{
-  "summary": "A 1-2 sentence summary of what the issue is.",
-  "details": "A detailed explanation of how this vulnerability works and why it's dangerous.",
-  "remediation": "A step-by-step guide to fixing the issue.",
-  "codeFix": "The exact code snippet to replace the vulnerable code. (Optional, if applicable)"
-}
-`;
+        return `You are VibeGuard, a strict DevSecOps assistant. 
+A deterministic security scanner detected this vulnerability:
+Title: ${finding.title}
+Severity: ${finding.severity}
+Scanner: ${finding.scanner}
+File: ${finding.file || 'N/A'}
+Line: ${finding.line || 'N/A'}
+Rule: ${finding.ruleId || 'N/A'}
+Description: ${finding.description || 'N/A'}
+CWE: ${finding.cwe || 'Unknown'}
+OWASP: ${finding.owasp || 'Unknown'}
+
+${codeContext ? `CODE CONTEXT:\n${codeContext}` : ''}
+${finding.codeSnippet ? `SNIPPET:\n${finding.codeSnippet}` : ''}
+
+Provide an actionable remediation in pure JSON with no markdown wrapping:
+{
+  "summary": "1-2 sentence overview of the vulnerability.",
+  "details": "Technical explanation of the security risk.",
+  "remediation": "Step-by-step guidance to fix the vulnerability.",
+  "codeFix": "The patched code snippet to replace the vulnerable lines."
+}`;
     }
     parseAIResponse(findingId, text) {
         try {
-            // Strip potential markdown code blocks if the AI disobeyed instructions
-            const cleanText = text.replace(/^```json\s*/, '').replace(/```\s*$/, '').trim();
+            let cleanText = text.trim();
+            const jsonMatch = cleanText.match(/\{[\s\S]*\}/);
+            if (jsonMatch) {
+                cleanText = jsonMatch[0];
+            }
             const parsed = JSON.parse(cleanText);
             return {
                 id: `explain-${Date.now()}`,
                 findingId,
-                summary: parsed.summary || 'Explanation generation failed.',
+                summary: parsed.summary || 'Security advisory generated.',
                 details: parsed.details || '',
                 remediation: parsed.remediation || '',
-                codeFix: parsed.codeFix,
+                codeFix: parsed.codeFix || undefined,
                 modelUsed: this.defaultModel,
-                createdAt: new Date()
+                createdAt: new Date(),
+                isAiAssisted: true,
+                verificationStatus: 'SUGGESTED'
             };
         }
-        catch (e) {
+        catch {
             return {
                 id: `explain-${Date.now()}`,
                 findingId,
-                summary: 'Failed to parse AI response.',
-                details: 'The AI provided an explanation, but it was not in the expected format.',
-                remediation: text, // dumping raw text into remediation as fallback
+                summary: 'Advisory Guidance',
+                details: text.slice(0, 500),
+                remediation: 'Inspect the flagged file and apply standard security remediations.',
                 modelUsed: this.defaultModel,
-                createdAt: new Date()
+                createdAt: new Date(),
+                isAiAssisted: true,
+                verificationStatus: 'SUGGESTED'
             };
         }
     }
-    generateFallbackExplanation(finding) {
+    generateFallbackExplanation(finding, state = 'NOT_CONFIGURED') {
+        const isFailed = state === 'FAILED';
         return {
             id: `fallback-${Date.now()}`,
             findingId: finding.scanId,
-            summary: `Automated summary for ${finding.title}`,
-            details: finding.description,
-            remediation: 'No NVIDIA_API_KEY detected. To unlock automatic AI code generation and remediation, please set the NVIDIA_API_KEY environment variable!',
-            modelUsed: 'fallback',
-            createdAt: new Date()
+            summary: finding.title || 'Deterministic Security Guidance',
+            details: finding.description || 'Vulnerability detected by deterministic security scanner.',
+            remediation: finding.remediation || (isFailed
+                ? 'AI service was temporarily unreachable. Refer to rule guidance or vendor advisory to resolve.'
+                : 'Configure NVIDIA_API_KEY in environment to enable optional AI remediation assistance.'),
+            modelUsed: 'deterministic-rules',
+            createdAt: new Date(),
+            isAiAssisted: false,
+            verificationStatus: 'NOT_APPLIED'
         };
     }
 }

package/dist/explainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"explainer.js","sourceRoot":"","sources":["../src/explainer.ts"],"names":[],"mappings":";;;;;;AACA,oDAA4B;AAQ5B;;GAEG;AACH,MAAa,mBAAmB;IACtB,EAAE,GAAkB,IAAI,CAAC;IACzB,YAAY,GAAG,oCAAoC,CAAC,CAAC,0BAA0B;IAEvF,YAAY,MAAe;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,EAAE,GAAG,IAAI,gBAAM,CAAC;gBACnB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,OAA0B,EAAE,UAA8B,EAAE;QAC/E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,qCAAqC;YACrC,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAE9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACvD,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG,EAAE,6CAA6C;gBAC/D,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YAE3D,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,OAA0B,EAAE,WAAoB;QAClE,OAAO;;;;;;;SAOF,OAAO,CAAC,KAAK;YACV,OAAO,CAAC,QAAQ;WACjB,OAAO,CAAC,OAAO;QAClB,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,MAAM;eACP,OAAO,CAAC,WAAW;OAC3B,OAAO,CAAC,GAAG,IAAI,SAAS;SACtB,OAAO,CAAC,KAAK,IAAI,SAAS;;EAEjC,WAAW,CAAC,CAAC,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;EAClD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;;;;CAS9D,CAAC;IACA,CAAC;IAEO,eAAe,CAAC,SAAiB,EAAE,IAAY;QACrD,IAAI,CAAC;YACH,wEAAwE;YACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,SAAS;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gCAAgC;gBAC3D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;gBACrC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,SAAS;gBACT,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,wEAAwE;gBACjF,WAAW,EAAE,IAAI,EAAE,gDAAgD;gBACnE,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,2BAA2B,CAAC,OAA0B;QAC5D,OAAO;YACL,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,MAAM;YACzB,OAAO,EAAE,yBAAyB,OAAO,CAAC,KAAK,EAAE;YACjD,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,WAAW,EAAE,yIAAyI;YACtJ,SAAS,EAAE,UAAU;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;IACJ,CAAC;CACF;AAlHD,kDAkHC"}
+{"version":3,"file":"explainer.js","sourceRoot":"","sources":["../src/explainer.ts"],"names":[],"mappings":";;;;;;AACA,oDAA4B;AAQ5B;;;GAGG;AACH,MAAa,mBAAmB;IACtB,EAAE,GAAkB,IAAI,CAAC;IACzB,YAAY,GAAG,oCAAoC,CAAC,CAAC,0BAA0B;IAEvF,YAAY,MAAe;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,EAAE,GAAG,IAAI,gBAAM,CAAC;gBACnB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,OAA0B,EAAE,UAA8B,EAAE;QAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;YAC3B,CAAC,CAAC,IAAI,gBAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;YACxF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0DAA0D;YAC1D,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;YAErD,2CAA2C;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,yBAAyB;YACzG,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAE7F,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACtD,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC7C,WAAW,EAAE,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,MAAM,GAAG,IAAI,CAAC;QAElB,oBAAoB;QACpB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,2GAA2G,EAAE,sBAAsB,CAAC,CAAC;QAE7J,uBAAuB;QACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;QAEnF,mEAAmE;QACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,yEAAyE,EAAE,uBAAuB,CAAC,CAAC;QAE5H,qBAAqB;QACrB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,8BAA8B,CAAC,CAAC;QAExF,YAAY;QACZ,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oDAAoD,EAAE,cAAc,CAAC,CAAC;QAE9F,gFAAgF;QAChF,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,oFAAoF,EAAE,sBAAsB,CAAC,CAAC;QAEtI,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,OAA0B,EAAE,WAAoB;QAClE,OAAO;;SAEF,OAAO,CAAC,KAAK;YACV,OAAO,CAAC,QAAQ;WACjB,OAAO,CAAC,OAAO;QAClB,OAAO,CAAC,IAAI,IAAI,KAAK;QACrB,OAAO,CAAC,IAAI,IAAI,KAAK;QACrB,OAAO,CAAC,MAAM,IAAI,KAAK;eAChB,OAAO,CAAC,WAAW,IAAI,KAAK;OACpC,OAAO,CAAC,GAAG,IAAI,SAAS;SACtB,OAAO,CAAC,KAAK,IAAI,SAAS;;EAEjC,WAAW,CAAC,CAAC,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;EAClD,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;;;;;;;;EAQ7D,CAAC;IACD,CAAC;IAEO,eAAe,CAAC,SAAiB,EAAE,IAAY;QACrD,IAAI,CAAC;YACH,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,SAAS;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,8BAA8B;gBACzD,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;gBACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;gBACpC,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,WAAW;aAChC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,SAAS;gBACT,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3B,WAAW,EAAE,oEAAoE;gBACjF,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,WAAW;aAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,2BAA2B,CAAC,OAA0B,EAAE,QAAqC,gBAAgB;QACnH,MAAM,QAAQ,GAAG,KAAK,KAAK,QAAQ,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,MAAM;YACzB,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,iCAAiC;YAC3D,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,2DAA2D;YAC3F,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,QAAQ;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,uFAAuF,CAAC;YAC5F,SAAS,EAAE,qBAAqB;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,YAAY,EAAE,KAAK;YACnB,kBAAkB,EAAE,aAAa;SAClC,CAAC;IACJ,CAAC;CACF;AA7JD,kDA6JC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from './explainer';
+export * from './verifier';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -15,4 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./explainer"), exports);
+__exportStar(require("./verifier"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,6CAA2B"}

package/dist/verifier.d.ts

@@ -0,0 +1,24 @@
+import { NormalizedFinding, FindingStatus, ScannerResult } from '@maverick006/types';
+import { SecurityScanner } from '@maverick006/security-engine';
+export interface VerificationRequest {
+    finding: NormalizedFinding;
+    codeFix: string;
+    originalFileContent?: string;
+    scanner: SecurityScanner;
+    filePath: string;
+}
+export interface VerificationResult {
+    originalFinding: NormalizedFinding;
+    status: FindingStatus.VERIFIED | FindingStatus.FAILED_VERIFICATION | FindingStatus.NOT_VERIFIED;
+    message: string;
+    reScanResult?: ScannerResult;
+}
+/**
+ * Rescan Verification Engine:
+ * Validates AI-suggested code fixes by applying them in an isolated workspace
+ * and executing the deterministic scanner to verify the vulnerability is actually gone.
+ */
+export declare class RescanVerifier {
+    verifyPatch(request: VerificationRequest): Promise<VerificationResult>;
+}
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAK/D,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,iBAAiB,CAAC;IACnC,MAAM,EAAE,aAAa,CAAC,QAAQ,GAAG,aAAa,CAAC,mBAAmB,GAAG,aAAa,CAAC,YAAY,CAAC;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACnB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA+D7E"}

package/dist/verifier.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RescanVerifier = void 0;
+const types_1 = require("@maverick006/types");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+/**
+ * Rescan Verification Engine:
+ * Validates AI-suggested code fixes by applying them in an isolated workspace
+ * and executing the deterministic scanner to verify the vulnerability is actually gone.
+ */
+class RescanVerifier {
+    async verifyPatch(request) {
+        const { finding, codeFix, scanner, filePath } = request;
+        if (!codeFix || !codeFix.trim()) {
+            return {
+                originalFinding: finding,
+                status: types_1.FindingStatus.NOT_VERIFIED,
+                message: 'No executable code fix provided to verify'
+            };
+        }
+        const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'vibeguard-verify-'));
+        try {
+            const relativeTarget = path.isAbsolute(filePath)
+                ? path.basename(filePath)
+                : filePath;
+            const isolatedFilePath = path.join(tempDir, relativeTarget);
+            await fs.mkdir(path.dirname(isolatedFilePath), { recursive: true });
+            // Write the patched file
+            await fs.writeFile(isolatedFilePath, codeFix, 'utf8');
+            // Re-run scanner against the isolated workspace
+            const rescanResult = await scanner.scan({
+                scanId: `verify-${Date.now()}`,
+                repositoryPath: tempDir
+            });
+            // Check if the original finding still exists
+            const targetRule = (finding.ruleId || finding.title || '').toLowerCase();
+            const stillFails = rescanResult.findings.some(f => {
+                const rescanRule = (f.ruleId || f.title || '').toLowerCase();
+                return rescanRule === targetRule;
+            });
+            if (!stillFails) {
+                return {
+                    originalFinding: finding,
+                    status: types_1.FindingStatus.VERIFIED,
+                    message: `Verification succeeded: ${scanner.name} confirmed the vulnerability is resolved with no new regressions.`,
+                    reScanResult: rescanResult
+                };
+            }
+            else {
+                return {
+                    originalFinding: finding,
+                    status: types_1.FindingStatus.FAILED_VERIFICATION,
+                    message: `Verification failed: ${scanner.name} still flagged the vulnerability after applying the proposed fix.`,
+                    reScanResult: rescanResult
+                };
+            }
+        }
+        catch (err) {
+            return {
+                originalFinding: finding,
+                status: types_1.FindingStatus.NOT_VERIFIED,
+                message: `Verification could not be performed: ${err.message}`
+            };
+        }
+        finally {
+            try {
+                await fs.rm(tempDir, { recursive: true, force: true });
+            }
+            catch { }
+        }
+    }
+}
+exports.RescanVerifier = RescanVerifier;
+//# sourceMappingURL=verifier.js.map

package/dist/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAqF;AAErF,gDAAkC;AAClC,2CAA6B;AAC7B,uCAAyB;AAiBzB;;;;GAIG;AACH,MAAa,cAAc;IACzB,KAAK,CAAC,WAAW,CAAC,OAA4B;QAC5C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAExD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,OAAO;gBACL,eAAe,EAAE,OAAO;gBACxB,MAAM,EAAE,qBAAa,CAAC,YAAY;gBAClC,OAAO,EAAE,2CAA2C;aACrD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEpE,yBAAyB;YACzB,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAEtD,gDAAgD;YAChD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBACtC,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC9B,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;YAEH,6CAA6C;YAC7C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACzE,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAChD,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC7D,OAAO,UAAU,KAAK,UAAU,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,eAAe,EAAE,OAAO;oBACxB,MAAM,EAAE,qBAAa,CAAC,QAAQ;oBAC9B,OAAO,EAAE,2BAA2B,OAAO,CAAC,IAAI,mEAAmE;oBACnH,YAAY,EAAE,YAAY;iBAC3B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO;oBACL,eAAe,EAAE,OAAO;oBACxB,MAAM,EAAE,qBAAa,CAAC,mBAAmB;oBACzC,OAAO,EAAE,wBAAwB,OAAO,CAAC,IAAI,mEAAmE;oBAChH,YAAY,EAAE,YAAY;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,eAAe,EAAE,OAAO;gBACxB,MAAM,EAAE,qBAAa,CAAC,YAAY;gBAClC,OAAO,EAAE,wCAAwC,GAAG,CAAC,OAAO,EAAE;aAC/D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAhED,wCAgEC"}

package/package.json

@@ -1,23 +1,24 @@
-{
-  "name": "@maverick006/ai-engine",
-  "version": "1.0.2",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "scripts": {
-    "build": "tsc",
-    "clean": "rm -rf dist",
-    "test": "jest",
-    "typecheck": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@maverick006/types": "*",
-    "openai": "^7.8.0"
-  },
-  "devDependencies": {
-    "@types/jest": "^29.5.0",
-    "@types/node": "^20.0.0",
-    "jest": "^29.5.0",
-    "ts-jest": "^29.1.0",
-    "typescript": "^5.0.0"
-  }
-}
+{
+  "name": "@maverick006/ai-engine",
+  "version": "1.0.4",
+  "description": "VibeGuard AI Engine for intelligent remediation",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@maverick006/types": "*",
+    "openai": "^7.8.0",
+    "typescript": "^5.0.0",
+    "@types/node": "^20.0.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "jest": "^29.5.0",
+    "ts-jest": "^29.1.0"
+  }
+}