@maverick006/vibeguard 1.0.7 → 1.0.9

package/dist/index.js

@@ -23,20 +23,54 @@ program
     .description('Run a security scan on the current directory or target path')
     .option('-d, --dir <path>', 'Directory to scan', process.cwd())
     .option('--fix', 'Automatically generate AI remediation fixes and interactive diff')
-    .option('--demo', 'Showcase the complete security dashboard with sample findings')
+    .option('--ci', 'Run in non-interactive CI mode and exit with policy status code')
     .action(async (targetPath, options) => {
     const scanDir = targetPath || options.dir || process.cwd();
     const startTime = Date.now();
+    let hasSystemError = false;
+    // Use a minimal spinner if in CI mode, or bypass ora entirely if preferred.
+    // For simplicity, we just won't render the interactive dashboard if --ci is set.
     const spinner = (0, ora_1.default)({
         text: chalk_1.default.hex('#00E5FF')('Scanning repository for vulnerabilities (SAST, SCA, Secrets, IaC)...'),
-        spinner: 'dots'
+        spinner: 'dots',
+        isSilent: options.ci
     }).start();
     let findings = [];
     try {
-        // Initialize the security orchestrator and npm audit scanner
+        // Initialize the security orchestrator and scanners
         const { Orchestrator } = require('@maverick006/security-engine');
-        const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
-        const orchestrator = new Orchestrator([new NpmAuditScanner()]);
+        const scanners = [];
+        try {
+            const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
+            scanners.push(new NpmAuditScanner());
+        }
+        catch (e) { }
+        try {
+            const { TrivyScanner } = require('@maverick006/scanner-trivy');
+            scanners.push(new TrivyScanner());
+        }
+        catch (e) { }
+        try {
+            const { SemgrepScanner } = require('@maverick006/scanner-semgrep');
+            scanners.push(new SemgrepScanner());
+        }
+        catch (e) { }
+        try {
+            const { GitleaksScanner } = require('@maverick006/scanner-gitleaks');
+            scanners.push(new GitleaksScanner());
+        }
+        catch (e) { }
+        try {
+            const { CheckovScanner } = require('@maverick006/scanner-checkov');
+            scanners.push(new CheckovScanner());
+        }
+        catch (e) { }
+        try {
+            const { ZapScanner } = require('@maverick006/scanner-zap');
+            scanners.push(new ZapScanner());
+        }
+        catch (e) { }
+        const orchestrator = new Orchestrator(scanners);
         const scanResult = await orchestrator.runScan({
             scanId: `scan-${Date.now()}`,
             repositoryUrl: 'local',
@@ -46,108 +80,8 @@ program
         findings = scanResult.findings || [];
     }
     catch (err) {
-        // Fallback gracefully if scanner encounters environmental differences
-    }
-    // If demo mode or no findings found in empty directory, provide rich showcase findings matching design
-    if (options.demo || findings.length === 0) {
-        findings = [
-            {
-                id: 'VG-CRIT-001',
-                title: 'Hardcoded AWS Secret Key',
-                severity: types_1.Severity.CRITICAL,
-                scanner: 'Gitleaks',
-                file: 'config/aws.py',
-                line: 12,
-                description: 'AWS Secret Key is hardcoded in the source code.',
-                codeSnippet: 'AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"'
-            },
-            {
-                id: 'VG-CRIT-002',
-                title: 'Exposed JWT Secret',
-                severity: types_1.Severity.CRITICAL,
-                scanner: 'Gitleaks',
-                file: 'config/auth.py',
-                line: 8,
-                description: 'Hardcoded JWT secret token detected.',
-                codeSnippet: 'const JWT_SECRET = "super_secret_123"'
-            },
-            {
-                id: 'VG-HIGH-003',
-                title: 'SQL Injection Risk',
-                severity: types_1.Severity.HIGH,
-                scanner: 'Semgrep',
-                file: 'api/users.py',
-                line: 45,
-                description: 'Direct concatenation of user input into SQL query.',
-                codeSnippet: 'query = "SELECT * FROM users WHERE name = " + req.query.name'
-            },
-            {
-                id: 'VG-HIGH-004',
-                title: 'Outdated Dependency (lodash)',
-                severity: types_1.Severity.HIGH,
-                scanner: 'npm-audit',
-                file: 'package.json',
-                line: 23,
-                description: 'Vulnerable prototype pollution in lodash version.',
-                codeSnippet: '"lodash": "4.17.15"'
-            },
-            {
-                id: 'VG-HIGH-005',
-                title: 'Unsafe Deserialization',
-                severity: types_1.Severity.HIGH,
-                scanner: 'Semgrep',
-                file: 'utils/parser.py',
-                line: 78,
-                description: 'Unsafe pickle.loads execution.',
-                codeSnippet: 'data = pickle.loads(user_input)'
-            },
-            {
-                id: 'VG-MED-006',
-                title: 'S3 Bucket Public Read',
-                severity: types_1.Severity.MEDIUM,
-                scanner: 'Checkov',
-                file: 'iac/s3.tf',
-                line: 14,
-                description: 'Public read access enabled on production storage bucket.',
-                codeSnippet: 'acl = "public-read"'
-            },
-            {
-                id: 'VG-MED-007',
-                title: 'Missing Rate Limiting',
-                severity: types_1.Severity.MEDIUM,
-                scanner: 'Semgrep',
-                file: 'api/auth.py',
-                line: 32,
-                description: 'Authentication endpoint lacks rate limiting protection.'
-            },
-            {
-                id: 'VG-MED-008',
-                title: 'CORS Misconfiguration',
-                severity: types_1.Severity.MEDIUM,
-                scanner: 'Semgrep',
-                file: 'web/middleware.py',
-                line: 19,
-                description: 'Wildcard CORS origin enabled in production middleware.'
-            },
-            {
-                id: 'VG-LOW-009',
-                title: 'Unused Dependency',
-                severity: types_1.Severity.LOW,
-                scanner: 'npm-audit',
-                file: 'package.json',
-                line: 102,
-                description: 'Unused package detected.'
-            },
-            {
-                id: 'VG-LOW-010',
-                title: 'Missing Security Headers',
-                severity: types_1.Severity.LOW,
-                scanner: 'Zap',
-                file: 'web/server.py',
-                line: 56,
-                description: 'Strict-Transport-Security header is not set.'
-            }
-        ];
+        console.error(chalk_1.default.red('Orchestrator failed to run scans.'), err);
+        hasSystemError = true;
     }
     spinner.stop();
     const elapsedMs = Date.now() - startTime;
@@ -157,12 +91,12 @@ program
     const stats = (0, formatter_1.calculateScore)(findings);
     const gitInfo = (0, formatter_1.getGitInfo)(scanDir);
     let remediationData = undefined;
-    // Generate AI Remediation
-    if (options.fix || true) {
+    // Generate AI Remediation only if not in CI mode to save time, or if explicitly asked
+    if (findings.length > 0 && !options.ci && (options.fix || true)) {
         try {
             const explainer = new ai_engine_1.ContextualExplainer();
             const primaryFinding = findings[0];
-            let snippet = primaryFinding.codeSnippet || 'AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"';
+            let snippet = primaryFinding.codeSnippet || '';
             if (primaryFinding.file && (0, fs_1.existsSync)((0, path_1.join)(scanDir, primaryFinding.file))) {
                 const content = (0, fs_1.readFileSync)((0, path_1.join)(scanDir, primaryFinding.file), 'utf-8');
                 const lines = content.split('\n');
@@ -170,44 +104,89 @@ program
                 snippet = lines.slice(Math.max(0, targetLine - 3), targetLine + 3).join('\n');
             }
             const explanation = await explainer.explainFinding(primaryFinding, { codeContext: snippet });
-            const diffSnippet = [
-                '10  # config/aws.py',
-                '- 11  AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"',
-                '+ 12  AWS_SECRET_KEY = os.getenv("AWS_SECRET_KEY")',
-                '13'
-            ].join('\n');
             remediationData = {
-                findingId: primaryFinding.id || 'VG-CRIT-001',
-                issue: explanation.summary || 'AWS Secret Key is hardcoded in the source code.',
-                impact: 'This can lead to unauthorized access to your AWS resources and cloud infrastructure.',
-                recommendation: explanation.remediation || 'Use environment variables or AWS Secrets Manager to store secrets.',
-                diffSnippet: explanation.codeFix ? explanation.codeFix : diffSnippet,
-                confidence: 98
+                findingId: primaryFinding.id,
+                issue: explanation.summary,
+                impact: explanation.details || 'Potential security impact based on context.',
+                recommendation: explanation.remediation,
+                diffSnippet: explanation.codeFix || '',
+                confidence: 90
             };
         }
         catch (e) {
-            remediationData = {
-                findingId: 'VG-CRIT-001',
-                issue: 'AWS Secret Key is hardcoded in the source code.',
-                impact: 'This can lead to unauthorized access to your AWS resources.',
-                recommendation: 'Use environment variables or AWS Secrets Manager to store secrets.',
-                diffSnippet: [
-                    '10  # config/aws.py',
-                    '- 11  AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"',
-                    '+ 12  AWS_SECRET_KEY = os.getenv("AWS_SECRET_KEY")',
-                    '13'
-                ].join('\n'),
-                confidence: 98
-            };
+            if (!options.ci) {
+                console.error(chalk_1.default.yellow('AI Remediation generation failed.'), e);
+            }
         }
     }
-    // Render the beautiful cyber dashboard
-    (0, formatter_1.renderDashboard)({
-        findings,
-        stats,
-        gitInfo,
-        duration,
-        remediation: remediationData
-    });
+    if (!options.ci) {
+        // Render the beautiful cyber dashboard interactively
+        (0, formatter_1.renderDashboard)({
+            findings,
+            stats,
+            gitInfo,
+            duration,
+            remediation: remediationData
+        });
+    }
+    else {
+        // CI Output
+        console.log(`VibeGuard CI Scan Complete. Duration: ${duration}`);
+        console.log(`Findings: ${findings.length}`);
+        console.log(`Risk Score: ${stats.score}/100 (${stats.riskLevel})`);
+        const critical = findings.filter(f => (f.severity || '').toUpperCase() === types_1.Severity.CRITICAL).length;
+        const high = findings.filter(f => (f.severity || '').toUpperCase() === types_1.Severity.HIGH).length;
+        console.log(`Critical: ${critical}, High: ${high}`);
+    }
+    // Sync with Web Dashboard
+    const syncSpinner = (0, ora_1.default)({
+        text: chalk_1.default.dim('Syncing results to VibeGuard Dashboard...'),
+        spinner: 'dots',
+        isSilent: options.ci
+    }).start();
+    try {
+        const API_URL = process.env.VIBEGUARD_API_URL || 'http://localhost:3001';
+        const API_KEY = process.env.VIBEGUARD_API_KEY;
+        const response = await fetch(`${API_URL}/api/scans/upload`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${API_KEY}`
+            },
+            body: JSON.stringify({
+                repositoryName: gitInfo.name || 'Local Project',
+                repositoryUrl: gitInfo.name || 'local',
+                numericScore: stats.score,
+                score: stats.riskLevel,
+                findings: findings
+            })
+        });
+        if (response.ok) {
+            syncSpinner.succeed(chalk_1.default.dim('Results synced to dashboard.'));
+        }
+        else {
+            syncSpinner.fail(chalk_1.default.dim('Failed to sync results to dashboard.'));
+        }
+    }
+    catch (e) {
+        syncSpinner.warn(chalk_1.default.dim('Dashboard API unreachable. Skipping sync.'));
+    }
+    // Exit codes
+    if (hasSystemError) {
+        process.exit(2);
+    }
+    // Policy fail if we have CRITICAL or HIGH findings
+    const criticalOrHighCount = findings.filter(f => {
+        const s = (f.severity || '').toUpperCase();
+        return s === types_1.Severity.CRITICAL || s === types_1.Severity.HIGH;
+    }).length;
+    if (criticalOrHighCount > 0) {
+        if (options.ci)
+            console.error(chalk_1.default.red('Security Policy FAILED.'));
+        process.exit(1);
+    }
+    if (options.ci)
+        console.log(chalk_1.default.green('Security Policy PASSED.'));
+    process.exit(0);
 });
 program.parse(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maverick006/vibeguard",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "VibeGuard CLI",
   "main": "dist/index.js",
   "bin": {

package/src/index.ts

@@ -21,24 +21,58 @@ program
   .description('Run a security scan on the current directory or target path')
   .option('-d, --dir <path>', 'Directory to scan', process.cwd())
   .option('--fix', 'Automatically generate AI remediation fixes and interactive diff')
-  .option('--demo', 'Showcase the complete security dashboard with sample findings')
+  .option('--ci', 'Run in non-interactive CI mode and exit with policy status code')
   .action(async (targetPath, options) => {
     const scanDir = targetPath || options.dir || process.cwd();
     const startTime = Date.now();
+    let hasSystemError = false;
 
+    // Use a minimal spinner if in CI mode, or bypass ora entirely if preferred.
+    // For simplicity, we just won't render the interactive dashboard if --ci is set.
     const spinner = ora({
       text: chalk.hex('#00E5FF')('Scanning repository for vulnerabilities (SAST, SCA, Secrets, IaC)...'),
-      spinner: 'dots'
+      spinner: 'dots',
+      isSilent: options.ci
     }).start();
 
     let findings: NormalizedFinding[] = [];
 
     try {
-      // Initialize the security orchestrator and npm audit scanner
+      // Initialize the security orchestrator and scanners
       const { Orchestrator } = require('@maverick006/security-engine');
-      const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
+      const scanners: any[] = [];
 
-      const orchestrator = new Orchestrator([new NpmAuditScanner()]);
+      try {
+        const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
+        scanners.push(new NpmAuditScanner());
+      } catch (e) {}
+
+      try {
+        const { TrivyScanner } = require('@maverick006/scanner-trivy');
+        scanners.push(new TrivyScanner());
+      } catch (e) {}
+
+      try {
+        const { SemgrepScanner } = require('@maverick006/scanner-semgrep');
+        scanners.push(new SemgrepScanner());
+      } catch (e) {}
+
+      try {
+        const { GitleaksScanner } = require('@maverick006/scanner-gitleaks');
+        scanners.push(new GitleaksScanner());
+      } catch (e) {}
+
+      try {
+        const { CheckovScanner } = require('@maverick006/scanner-checkov');
+        scanners.push(new CheckovScanner());
+      } catch (e) {}
+
+      try {
+        const { ZapScanner } = require('@maverick006/scanner-zap');
+        scanners.push(new ZapScanner());
+      } catch (e) {}
+
+      const orchestrator = new Orchestrator(scanners);
 
       const scanResult = await orchestrator.runScan({
         scanId: `scan-${Date.now()}`,
@@ -49,109 +83,8 @@ program
 
       findings = scanResult.findings || [];
     } catch (err) {
-      // Fallback gracefully if scanner encounters environmental differences
-    }
-
-    // If demo mode or no findings found in empty directory, provide rich showcase findings matching design
-    if (options.demo || findings.length === 0) {
-      findings = [
-        {
-          id: 'VG-CRIT-001',
-          title: 'Hardcoded AWS Secret Key',
-          severity: Severity.CRITICAL,
-          scanner: 'Gitleaks',
-          file: 'config/aws.py',
-          line: 12,
-          description: 'AWS Secret Key is hardcoded in the source code.',
-          codeSnippet: 'AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"'
-        },
-        {
-          id: 'VG-CRIT-002',
-          title: 'Exposed JWT Secret',
-          severity: Severity.CRITICAL,
-          scanner: 'Gitleaks',
-          file: 'config/auth.py',
-          line: 8,
-          description: 'Hardcoded JWT secret token detected.',
-          codeSnippet: 'const JWT_SECRET = "super_secret_123"'
-        },
-        {
-          id: 'VG-HIGH-003',
-          title: 'SQL Injection Risk',
-          severity: Severity.HIGH,
-          scanner: 'Semgrep',
-          file: 'api/users.py',
-          line: 45,
-          description: 'Direct concatenation of user input into SQL query.',
-          codeSnippet: 'query = "SELECT * FROM users WHERE name = " + req.query.name'
-        },
-        {
-          id: 'VG-HIGH-004',
-          title: 'Outdated Dependency (lodash)',
-          severity: Severity.HIGH,
-          scanner: 'npm-audit',
-          file: 'package.json',
-          line: 23,
-          description: 'Vulnerable prototype pollution in lodash version.',
-          codeSnippet: '"lodash": "4.17.15"'
-        },
-        {
-          id: 'VG-HIGH-005',
-          title: 'Unsafe Deserialization',
-          severity: Severity.HIGH,
-          scanner: 'Semgrep',
-          file: 'utils/parser.py',
-          line: 78,
-          description: 'Unsafe pickle.loads execution.',
-          codeSnippet: 'data = pickle.loads(user_input)'
-        },
-        {
-          id: 'VG-MED-006',
-          title: 'S3 Bucket Public Read',
-          severity: Severity.MEDIUM,
-          scanner: 'Checkov',
-          file: 'iac/s3.tf',
-          line: 14,
-          description: 'Public read access enabled on production storage bucket.',
-          codeSnippet: 'acl = "public-read"'
-        },
-        {
-          id: 'VG-MED-007',
-          title: 'Missing Rate Limiting',
-          severity: Severity.MEDIUM,
-          scanner: 'Semgrep',
-          file: 'api/auth.py',
-          line: 32,
-          description: 'Authentication endpoint lacks rate limiting protection.'
-        },
-        {
-          id: 'VG-MED-008',
-          title: 'CORS Misconfiguration',
-          severity: Severity.MEDIUM,
-          scanner: 'Semgrep',
-          file: 'web/middleware.py',
-          line: 19,
-          description: 'Wildcard CORS origin enabled in production middleware.'
-        },
-        {
-          id: 'VG-LOW-009',
-          title: 'Unused Dependency',
-          severity: Severity.LOW,
-          scanner: 'npm-audit',
-          file: 'package.json',
-          line: 102,
-          description: 'Unused package detected.'
-        },
-        {
-          id: 'VG-LOW-010',
-          title: 'Missing Security Headers',
-          severity: Severity.LOW,
-          scanner: 'Zap',
-          file: 'web/server.py',
-          line: 56,
-          description: 'Strict-Transport-Security header is not set.'
-        }
-      ];
+      console.error(chalk.red('Orchestrator failed to run scans.'), err);
+      hasSystemError = true;
     }
 
     spinner.stop();
@@ -166,13 +99,13 @@ program
 
     let remediationData: any = undefined;
 
-    // Generate AI Remediation
-    if (options.fix || true) {
+    // Generate AI Remediation only if not in CI mode to save time, or if explicitly asked
+    if (findings.length > 0 && !options.ci && (options.fix || true)) {
       try {
         const explainer = new ContextualExplainer();
         const primaryFinding = findings[0];
 
-        let snippet = primaryFinding.codeSnippet || 'AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"';
+        let snippet = primaryFinding.codeSnippet || '';
         if (primaryFinding.file && existsSync(join(scanDir, primaryFinding.file))) {
           const content = readFileSync(join(scanDir, primaryFinding.file), 'utf-8');
           const lines = content.split('\n');
@@ -182,46 +115,92 @@ program
 
         const explanation = await explainer.explainFinding(primaryFinding, { codeContext: snippet });
 
-        const diffSnippet = [
-          '10  # config/aws.py',
-          '- 11  AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"',
-          '+ 12  AWS_SECRET_KEY = os.getenv("AWS_SECRET_KEY")',
-          '13'
-        ].join('\n');
-
         remediationData = {
-          findingId: primaryFinding.id || 'VG-CRIT-001',
-          issue: explanation.summary || 'AWS Secret Key is hardcoded in the source code.',
-          impact: 'This can lead to unauthorized access to your AWS resources and cloud infrastructure.',
-          recommendation: explanation.remediation || 'Use environment variables or AWS Secrets Manager to store secrets.',
-          diffSnippet: explanation.codeFix ? explanation.codeFix : diffSnippet,
-          confidence: 98
+          findingId: primaryFinding.id,
+          issue: explanation.summary,
+          impact: explanation.details || 'Potential security impact based on context.',
+          recommendation: explanation.remediation,
+          diffSnippet: explanation.codeFix || '',
+          confidence: 90
         };
       } catch (e: any) {
-        remediationData = {
-          findingId: 'VG-CRIT-001',
-          issue: 'AWS Secret Key is hardcoded in the source code.',
-          impact: 'This can lead to unauthorized access to your AWS resources.',
-          recommendation: 'Use environment variables or AWS Secrets Manager to store secrets.',
-          diffSnippet: [
-            '10  # config/aws.py',
-            '- 11  AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"',
-            '+ 12  AWS_SECRET_KEY = os.getenv("AWS_SECRET_KEY")',
-            '13'
-          ].join('\n'),
-          confidence: 98
-        };
+        if (!options.ci) {
+          console.error(chalk.yellow('AI Remediation generation failed.'), e);
+        }
       }
     }
 
-    // Render the beautiful cyber dashboard
-    renderDashboard({
-      findings,
-      stats,
-      gitInfo,
-      duration,
-      remediation: remediationData
-    });
+    if (!options.ci) {
+      // Render the beautiful cyber dashboard interactively
+      renderDashboard({
+        findings,
+        stats,
+        gitInfo,
+        duration,
+        remediation: remediationData
+      });
+    } else {
+      // CI Output
+      console.log(`VibeGuard CI Scan Complete. Duration: ${duration}`);
+      console.log(`Findings: ${findings.length}`);
+      console.log(`Risk Score: ${stats.score}/100 (${stats.riskLevel})`);
+      const critical = findings.filter(f => (f.severity || '').toUpperCase() === Severity.CRITICAL).length;
+      const high = findings.filter(f => (f.severity || '').toUpperCase() === Severity.HIGH).length;
+      console.log(`Critical: ${critical}, High: ${high}`);
+    }
+
+    // Sync with Web Dashboard
+    const syncSpinner = ora({
+      text: chalk.dim('Syncing results to VibeGuard Dashboard...'),
+      spinner: 'dots',
+      isSilent: options.ci
+    }).start();
+
+    try {
+      const API_URL = process.env.VIBEGUARD_API_URL || 'http://localhost:3001';
+      const API_KEY = process.env.VIBEGUARD_API_KEY;
+      const response = await fetch(`${API_URL}/api/scans/upload`, {
+        method: 'POST',
+        headers: { 
+          'Content-Type': 'application/json',
+          'Authorization': `Bearer ${API_KEY}`
+        },
+        body: JSON.stringify({
+          repositoryName: gitInfo.name || 'Local Project',
+          repositoryUrl: gitInfo.name || 'local',
+          numericScore: stats.score,
+          score: stats.riskLevel,
+          findings: findings
+        })
+      });
+      
+      if (response.ok) {
+        syncSpinner.succeed(chalk.dim('Results synced to dashboard.'));
+      } else {
+        syncSpinner.fail(chalk.dim('Failed to sync results to dashboard.'));
+      }
+    } catch (e) {
+      syncSpinner.warn(chalk.dim('Dashboard API unreachable. Skipping sync.'));
+    }
+
+    // Exit codes
+    if (hasSystemError) {
+      process.exit(2);
+    }
+    
+    // Policy fail if we have CRITICAL or HIGH findings
+    const criticalOrHighCount = findings.filter(f => {
+      const s = (f.severity || '').toUpperCase();
+      return s === Severity.CRITICAL || s === Severity.HIGH;
+    }).length;
+
+    if (criticalOrHighCount > 0) {
+      if (options.ci) console.error(chalk.red('Security Policy FAILED.'));
+      process.exit(1);
+    }
+
+    if (options.ci) console.log(chalk.green('Security Policy PASSED.'));
+    process.exit(0);
   });
 
 program.parse(process.argv);