@quantracode/vibecheck 0.0.1

package/dist/utils/progress.js

@@ -0,0 +1,165 @@
+/**
+ * Terminal progress display - clean, minimal design
+ */
+import path from "node:path";
+const ANSI = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    red: "\x1b[31m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    cyan: "\x1b[36m",
+    clearLine: "\x1b[2K",
+};
+// Progress bar characters
+const BAR_FILLED = "█";
+const BAR_EMPTY = "░";
+function createProgressBar(current, total, width = 20) {
+    const percent = total > 0 ? Math.min(current / total, 1) : 0;
+    const filled = Math.min(Math.round(percent * width), width);
+    const empty = Math.max(width - filled, 0);
+    return (`${ANSI.cyan}${BAR_FILLED.repeat(filled)}${ANSI.reset}` +
+        `${ANSI.dim}${BAR_EMPTY.repeat(empty)}${ANSI.reset}`);
+}
+function truncateEnd(str, maxLen) {
+    if (str.length <= maxLen)
+        return str.padEnd(maxLen);
+    return str.slice(0, maxLen - 2) + "..";
+}
+export class ScanProgress {
+    packs;
+    results = new Map();
+    startTime = 0;
+    currentPack = -1;
+    totalFiles = 0;
+    currentFile = "";
+    filesProcessed = 0;
+    constructor(packs, totalFiles = 0) {
+        this.packs = packs;
+        this.totalFiles = totalFiles;
+    }
+    start() {
+        this.startTime = Date.now();
+        const width = 88;
+        const filesStr = `${this.totalFiles} files`;
+        const packsStr = `${this.packs.length} packs`;
+        const padding = width - 14 - filesStr.length - packsStr.length;
+        console.log("");
+        console.log(`${ANSI.cyan}  ${"─".repeat(width)}${ANSI.reset}`);
+        console.log(`${ANSI.cyan}  ${ANSI.reset}  ${ANSI.bold}SCANNING${ANSI.reset}  ${ANSI.dim}${filesStr}${ANSI.reset}${" ".repeat(Math.max(padding, 2))}${ANSI.dim}${packsStr}${ANSI.reset}`);
+        console.log(`${ANSI.cyan}  ${"─".repeat(width)}${ANSI.reset}`);
+        console.log("");
+    }
+    startPack(packIndex) {
+        this.currentPack = packIndex;
+        this.results.set(packIndex, { findingsCount: 0, scannersRun: 0 });
+        this.renderPackProgress();
+    }
+    startScanner(packIndex, _scannerIndex) {
+        this.renderPackProgress();
+    }
+    /** Called when a file is processed */
+    onFileProgress(file, processed, _total) {
+        this.currentFile = file;
+        this.filesProcessed = processed;
+        this.renderPackProgress();
+    }
+    completeScanner(packIndex, findingsFound) {
+        const result = this.results.get(packIndex);
+        if (result) {
+            result.findingsCount += findingsFound;
+            result.scannersRun++;
+        }
+        this.renderPackProgress();
+    }
+    renderPackProgress() {
+        const pack = this.packs[this.currentPack];
+        const result = this.results.get(this.currentPack);
+        // Pack number on the left
+        const packNum = `[${String(this.currentPack + 1).padStart(2)}/${this.packs.length}]`;
+        // Calculate progress based on files processed
+        const filePercent = this.totalFiles > 0
+            ? Math.min(Math.round((this.filesProcessed / this.totalFiles) * 100), 100)
+            : 0;
+        // Progress bar
+        const progressBar = createProgressBar(this.filesProcessed, this.totalFiles, 20);
+        // Current file or status
+        const fileName = this.currentFile ? path.basename(this.currentFile) : "";
+        const truncatedFile = truncateEnd(fileName, 28);
+        const statusText = `${ANSI.dim}${truncatedFile}${ANSI.reset} ${ANSI.cyan}${String(filePercent).padStart(3)}%${ANSI.reset}`;
+        // Pack name (fixed width)
+        const packName = truncateEnd(pack.name, 32);
+        // Clear line and write progress
+        process.stdout.write(`\r${ANSI.clearLine}`);
+        process.stdout.write(`  ${ANSI.cyan}●${ANSI.reset} ${ANSI.dim}${packNum}${ANSI.reset}  ${packName} ${progressBar}  ${statusText}`);
+    }
+    completePack(packIndex) {
+        const result = this.results.get(packIndex);
+        const findings = result?.findingsCount ?? 0;
+        const pack = this.packs[packIndex];
+        // Pack number on the left
+        const packNum = `[${String(packIndex + 1).padStart(2)}/${this.packs.length}]`;
+        // Show full progress bar on completion
+        const progressBar = createProgressBar(1, 1, 20);
+        // Pack name (fixed width)
+        const packName = truncateEnd(pack.name, 32);
+        // Status text
+        const statusIcon = findings > 0 ? `${ANSI.yellow}●${ANSI.reset}` : `${ANSI.green}●${ANSI.reset}`;
+        const statusText = findings > 0
+            ? `${ANSI.yellow}${String(findings).padStart(3)} found${ANSI.reset}`
+            : `${ANSI.green}    clean${ANSI.reset}`;
+        // Clear line and write final result
+        process.stdout.write(`\r${ANSI.clearLine}`);
+        console.log(`  ${statusIcon} ${ANSI.dim}${packNum}${ANSI.reset}  ${packName} ${progressBar}  ${statusText}`);
+    }
+    stop() {
+        const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
+        const totalFindings = Array.from(this.results.values()).reduce((sum, r) => sum + r.findingsCount, 0);
+        const width = 88;
+        const statusIcon = totalFindings > 0 ? `${ANSI.yellow}!${ANSI.reset}` : `${ANSI.green}✓${ANSI.reset}`;
+        const findingsText = totalFindings > 0
+            ? `${ANSI.yellow}${ANSI.bold}${totalFindings} finding${totalFindings > 1 ? "s" : ""}${ANSI.reset}`
+            : `${ANSI.green}${ANSI.bold}No findings${ANSI.reset}`;
+        const timeStr = `${elapsed}s`;
+        const mainContent = `  ${statusIcon} COMPLETE  ${findingsText}`;
+        // Account for ANSI codes in length calculation
+        const visibleLen = totalFindings > 0
+            ? 14 + totalFindings.toString().length + (totalFindings > 1 ? 8 : 7)
+            : 23;
+        const padding = width - visibleLen - timeStr.length - 2;
+        console.log("");
+        console.log(`${ANSI.cyan}  ${"─".repeat(width)}${ANSI.reset}`);
+        console.log(`${ANSI.cyan}  ${ANSI.reset}${mainContent}${" ".repeat(Math.max(padding, 2))}${ANSI.dim}${timeStr}${ANSI.reset}`);
+        console.log(`${ANSI.cyan}  ${"─".repeat(width)}${ANSI.reset}`);
+    }
+}
+/**
+ * Simple spinner for single operations
+ */
+export class Spinner {
+    message;
+    startTime = 0;
+    constructor(message) {
+        this.message = message;
+    }
+    start() {
+        this.startTime = Date.now();
+        process.stdout.write(`  ${ANSI.cyan}●${ANSI.reset} ${this.message}...`);
+    }
+    update(message) {
+        this.message = message;
+    }
+    succeed(message) {
+        const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
+        process.stdout.write(`\r${ANSI.clearLine}`);
+        console.log(`  ${ANSI.green}●${ANSI.reset} ${message || this.message} ${ANSI.dim}(${elapsed}s)${ANSI.reset}`);
+    }
+    fail(message) {
+        process.stdout.write(`\r${ANSI.clearLine}`);
+        console.log(`  ${ANSI.red}●${ANSI.reset} ${message || this.message}`);
+    }
+    stop() {
+        process.stdout.write(`\r${ANSI.clearLine}`);
+    }
+}

package/dist/utils/sarif-formatter.d.ts

@@ -0,0 +1,92 @@
+/**
+ * SARIF (Static Analysis Results Interchange Format) output formatter
+ *
+ * Converts VibeCheck findings to SARIF 2.1.0 format for integration
+ * with GitHub Code Scanning and other SARIF-compatible tools.
+ */
+import type { ScanArtifact } from "@vibecheck/schema";
+/**
+ * SARIF 2.1.0 schema types
+ */
+interface SarifLog {
+    $schema: string;
+    version: string;
+    runs: SarifRun[];
+}
+interface SarifRun {
+    tool: SarifTool;
+    results: SarifResult[];
+    invocations?: SarifInvocation[];
+}
+interface SarifTool {
+    driver: SarifDriver;
+}
+interface SarifDriver {
+    name: string;
+    version: string;
+    informationUri?: string;
+    rules: SarifRule[];
+}
+interface SarifRule {
+    id: string;
+    name: string;
+    shortDescription: SarifMessage;
+    fullDescription?: SarifMessage;
+    defaultConfiguration: {
+        level: SarifLevel;
+    };
+    help?: SarifMessage;
+    properties?: {
+        tags?: string[];
+        security_severity?: string;
+    };
+}
+interface SarifResult {
+    ruleId: string;
+    ruleIndex: number;
+    level: SarifLevel;
+    message: SarifMessage;
+    locations: SarifLocation[];
+    fingerprints?: Record<string, string>;
+    properties?: {
+        confidence?: number;
+        category?: string;
+    };
+}
+interface SarifLocation {
+    physicalLocation: SarifPhysicalLocation;
+}
+interface SarifPhysicalLocation {
+    artifactLocation: SarifArtifactLocation;
+    region?: SarifRegion;
+}
+interface SarifArtifactLocation {
+    uri: string;
+    uriBaseId?: string;
+}
+interface SarifRegion {
+    startLine: number;
+    endLine?: number;
+    snippet?: {
+        text: string;
+    };
+}
+interface SarifMessage {
+    text: string;
+}
+interface SarifInvocation {
+    executionSuccessful: boolean;
+    startTimeUtc?: string;
+    endTimeUtc?: string;
+}
+type SarifLevel = "none" | "note" | "warning" | "error";
+/**
+ * Convert VibeCheck scan artifact to SARIF format
+ */
+export declare function toSarif(artifact: ScanArtifact): SarifLog;
+/**
+ * Convert SARIF log to JSON string
+ */
+export declare function sarifToJson(sarif: SarifLog, pretty?: boolean): string;
+export {};
+//# sourceMappingURL=sarif-formatter.d.ts.map

package/dist/utils/sarif-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-formatter.d.ts","sourceRoot":"","sources":["../../src/utils/sarif-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAW,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAGzE;;GAEG;AACH,UAAU,QAAQ;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,UAAU,SAAS;IACjB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,YAAY,CAAC;IAC/B,eAAe,CAAC,EAAE,YAAY,CAAC;IAC/B,oBAAoB,EAAE;QACpB,KAAK,EAAE,UAAU,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE;QACX,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,UAAU,aAAa;IACrB,gBAAgB,EAAE,qBAAqB,CAAC;CACzC;AAED,UAAU,qBAAqB;IAC7B,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,UAAU,qBAAqB;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,eAAe;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AA2IxD;;GAEG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,CAmCxD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAO,GAAG,MAAM,CAElE"}

package/dist/utils/sarif-formatter.js

@@ -0,0 +1,172 @@
+/**
+ * SARIF (Static Analysis Results Interchange Format) output formatter
+ *
+ * Converts VibeCheck findings to SARIF 2.1.0 format for integration
+ * with GitHub Code Scanning and other SARIF-compatible tools.
+ */
+/**
+ * Map VibeCheck severity to SARIF level
+ */
+function severityToSarifLevel(severity) {
+    switch (severity) {
+        case "critical":
+        case "high":
+            return "error";
+        case "medium":
+            return "warning";
+        case "low":
+        case "info":
+            return "note";
+        default:
+            return "note";
+    }
+}
+/**
+ * Map VibeCheck severity to GitHub security severity score (0-10)
+ */
+function severityToSecurityScore(severity) {
+    switch (severity) {
+        case "critical":
+            return "9.0";
+        case "high":
+            return "7.5";
+        case "medium":
+            return "5.0";
+        case "low":
+            return "3.0";
+        case "info":
+            return "0.0";
+        default:
+            return "0.0";
+    }
+}
+/**
+ * Generate SARIF rule definitions from findings
+ */
+function generateRules(findings) {
+    const ruleMap = new Map();
+    // Get unique rules from findings
+    for (const finding of findings) {
+        if (!ruleMap.has(finding.ruleId)) {
+            ruleMap.set(finding.ruleId, finding);
+        }
+    }
+    return Array.from(ruleMap.entries()).map(([ruleId, finding]) => ({
+        id: ruleId,
+        name: ruleId.replace(/-/g, " "),
+        shortDescription: {
+            text: finding.title,
+        },
+        fullDescription: {
+            text: finding.description,
+        },
+        defaultConfiguration: {
+            level: severityToSarifLevel(finding.severity),
+        },
+        help: finding.remediation?.recommendedFix
+            ? {
+                text: finding.remediation.recommendedFix,
+            }
+            : undefined,
+        properties: {
+            tags: [finding.category, "security"],
+            security_severity: severityToSecurityScore(finding.severity),
+        },
+    }));
+}
+/**
+ * Normalize file path for SARIF URI (use forward slashes)
+ */
+function normalizeUri(filePath) {
+    return filePath.replace(/\\/g, "/");
+}
+/**
+ * Convert a finding to SARIF result
+ */
+function findingToResult(finding, ruleIndex) {
+    const locations = finding.evidence.map((evidence) => ({
+        physicalLocation: {
+            artifactLocation: {
+                uri: normalizeUri(evidence.file),
+                uriBaseId: "%SRCROOT%",
+            },
+            region: {
+                startLine: evidence.startLine,
+                endLine: evidence.endLine,
+                snippet: evidence.snippet
+                    ? {
+                        text: evidence.snippet,
+                    }
+                    : undefined,
+            },
+        },
+    }));
+    // If no evidence with file locations, use a default location
+    if (locations.length === 0) {
+        locations.push({
+            physicalLocation: {
+                artifactLocation: {
+                    uri: "unknown",
+                    uriBaseId: "%SRCROOT%",
+                },
+            },
+        });
+    }
+    return {
+        ruleId: finding.ruleId,
+        ruleIndex,
+        level: severityToSarifLevel(finding.severity),
+        message: {
+            text: `${finding.title}\n\n${finding.description}`,
+        },
+        locations,
+        fingerprints: {
+            vibecheck_v1: finding.fingerprint,
+        },
+        properties: {
+            confidence: finding.confidence,
+            category: finding.category,
+        },
+    };
+}
+/**
+ * Convert VibeCheck scan artifact to SARIF format
+ */
+export function toSarif(artifact) {
+    const rules = generateRules(artifact.findings);
+    const ruleIndexMap = new Map(rules.map((r, i) => [r.id, i]));
+    const results = artifact.findings.map((finding) => {
+        const ruleIndex = ruleIndexMap.get(finding.ruleId) ?? 0;
+        return findingToResult(finding, ruleIndex);
+    });
+    const sarifLog = {
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: artifact.tool.name,
+                        version: artifact.tool.version,
+                        informationUri: "https://github.com/anthropics/vibecheck",
+                        rules,
+                    },
+                },
+                results,
+                invocations: [
+                    {
+                        executionSuccessful: true,
+                        startTimeUtc: artifact.generatedAt,
+                    },
+                ],
+            },
+        ],
+    };
+    return sarifLog;
+}
+/**
+ * Convert SARIF log to JSON string
+ */
+export function sarifToJson(sarif, pretty = true) {
+    return JSON.stringify(sarif, null, pretty ? 2 : 0);
+}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@quantracode/vibecheck",
+  "version": "0.0.1",
+  "description": "Security scanner for modern web applications",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "vibecheck": "./dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "security",
+    "scanner",
+    "static-analysis",
+    "nextjs",
+    "express",
+    "typescript",
+    "sarif"
+  ],
+  "author": "",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/quantracode/VibeCheck.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/quantracode/VibeCheck#readme",
+  "bugs": {
+    "url": "https://github.com/quantracode/VibeCheck/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "vibecheck": "node ./dist/index.js",
+    "smoke": "node scripts/smoke-test.mjs",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dependencies": {
+    "@vibecheck/policy": "workspace:*",
+    "@vibecheck/schema": "workspace:*",
+    "commander": "^12.1.0",
+    "fast-glob": "^3.3.2",
+    "ts-morph": "^24.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "vitest": "^2.1.8"
+  }
+}