@vibe-validate/config 0.9.0 → 0.9.4

package/dist/loader.d.ts

@@ -3,6 +3,35 @@
  *
  * Loads and resolves vibe-validate configuration from files,
  * including preset resolution and config extension.
+ *
+ * SECURITY MODEL:
+ *
+ * This loader executes user-provided configuration files as code (TypeScript/JavaScript)
+ * or parses them as data (JSON). This is intentional and necessary for flexibility,
+ * but has security implications:
+ *
+ * **Trust Boundary**: Configuration files are treated as TRUSTED CODE.
+ * - Config files can execute arbitrary JavaScript/TypeScript
+ * - Config files define shell commands that will be executed during validation
+ * - Users MUST only use config files from trusted sources
+ *
+ * **No Sandboxing**: Configuration files run with full process permissions.
+ * - They have access to the file system, network, environment variables
+ * - They can import arbitrary npm packages
+ * - They can modify process.env or global state
+ *
+ * **Security Responsibilities**:
+ * - **Users**: Only use configs from trusted sources (own code, official presets)
+ * - **Preset Authors**: Ensure presets don't execute untrusted commands
+ * - **This Package**: Validate config schema, but cannot prevent malicious code execution
+ *
+ * **Mitigations**:
+ * - Configuration schema validation (Zod) ensures structure is correct
+ * - Git command injection prevention (array-based spawn, no shell)
+ * - No automatic config downloads from remote sources
+ * - Presets are vetted and included in this package
+ *
+ * See SECURITY.md for complete security considerations.
  */
 import { type VibeValidateConfig } from './schema.js';
 /**

package/dist/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItE;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAO7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CAiC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAazC;AA0DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAc7B"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAItE;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAO7B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CAiC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAazC;AA0DD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAc7B"}

package/dist/loader.js

@@ -3,6 +3,35 @@
  *
  * Loads and resolves vibe-validate configuration from files,
  * including preset resolution and config extension.
+ *
+ * SECURITY MODEL:
+ *
+ * This loader executes user-provided configuration files as code (TypeScript/JavaScript)
+ * or parses them as data (JSON). This is intentional and necessary for flexibility,
+ * but has security implications:
+ *
+ * **Trust Boundary**: Configuration files are treated as TRUSTED CODE.
+ * - Config files can execute arbitrary JavaScript/TypeScript
+ * - Config files define shell commands that will be executed during validation
+ * - Users MUST only use config files from trusted sources
+ *
+ * **No Sandboxing**: Configuration files run with full process permissions.
+ * - They have access to the file system, network, environment variables
+ * - They can import arbitrary npm packages
+ * - They can modify process.env or global state
+ *
+ * **Security Responsibilities**:
+ * - **Users**: Only use configs from trusted sources (own code, official presets)
+ * - **Preset Authors**: Ensure presets don't execute untrusted commands
+ * - **This Package**: Validate config schema, but cannot prevent malicious code execution
+ *
+ * **Mitigations**:
+ * - Configuration schema validation (Zod) ensures structure is correct
+ * - Git command injection prevention (array-based spawn, no shell)
+ * - No automatic config downloads from remote sources
+ * - Presets are vetted and included in this package
+ *
+ * See SECURITY.md for complete security considerations.
  */
 import { resolve, dirname } from 'path';
 import { readFileSync } from 'fs';
@@ -72,7 +101,7 @@ export async function findAndLoadConfig(cwd = process.cwd()) {
         try {
             return await loadConfigFromFile(configPath);
         }
-        catch (err) {
+        catch (_err) {
             // File doesn't exist or can't be loaded - try next
             continue;
         }

package/dist/schema.d.ts

@@ -195,7 +195,7 @@ export declare const ValidationConfigSchema: z.ZodObject<{
         failFast?: boolean | undefined;
     }>, "many">;
     /** Caching configuration */
-    caching: z.ZodDefault<z.ZodObject<{
+    caching: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Caching strategy (default: git-tree-hash) */
         strategy: z.ZodDefault<z.ZodEnum<["git-tree-hash", "timestamp", "disabled"]>>;
         /** Enable caching (default: true) */
@@ -210,7 +210,7 @@ export declare const ValidationConfigSchema: z.ZodObject<{
         strategy?: "git-tree-hash" | "timestamp" | "disabled" | undefined;
         enabled?: boolean | undefined;
         statePath?: string | undefined;
-    }>>;
+    }>>>;
 }, "strip", z.ZodTypeAny, {
     phases: {
         name: string;
@@ -383,7 +383,7 @@ export declare const VibeValidateConfigSchema: z.ZodObject<{
             failFast?: boolean | undefined;
         }>, "many">;
         /** Caching configuration */
-        caching: z.ZodDefault<z.ZodObject<{
+        caching: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             /** Caching strategy (default: git-tree-hash) */
             strategy: z.ZodDefault<z.ZodEnum<["git-tree-hash", "timestamp", "disabled"]>>;
             /** Enable caching (default: true) */
@@ -398,7 +398,7 @@ export declare const VibeValidateConfigSchema: z.ZodObject<{
             strategy?: "git-tree-hash" | "timestamp" | "disabled" | undefined;
             enabled?: boolean | undefined;
             statePath?: string | undefined;
-        }>>;
+        }>>>;
     }, "strip", z.ZodTypeAny, {
         phases: {
             name: string;
@@ -443,7 +443,7 @@ export declare const VibeValidateConfigSchema: z.ZodObject<{
         } | undefined;
     }>;
     /** Git integration configuration */
-    git: z.ZodDefault<z.ZodObject<{
+    git: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Main branch name (default: main) */
         mainBranch: z.ZodDefault<z.ZodString>;
         /** Auto-sync with remote (default: false) */
@@ -458,9 +458,9 @@ export declare const VibeValidateConfigSchema: z.ZodObject<{
         mainBranch?: string | undefined;
         autoSync?: boolean | undefined;
         warnIfBehind?: boolean | undefined;
-    }>>;
+    }>>>;
     /** Output formatting configuration */
-    output: z.ZodDefault<z.ZodObject<{
+    output: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Output format (default: auto) */
         format: z.ZodDefault<z.ZodEnum<["human", "yaml", "json", "auto"]>>;
         /** Show progress indicators (default: true) */
@@ -479,7 +479,7 @@ export declare const VibeValidateConfigSchema: z.ZodObject<{
         showProgress?: boolean | undefined;
         verbose?: boolean | undefined;
         noColor?: boolean | undefined;
-    }>>;
+    }>>>;
     /** Optional: Preset name (typescript-library, typescript-nodejs, etc.) */
     preset: z.ZodOptional<z.ZodString>;
     /** Optional: Extend another config file */

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;IAC/B,kEAAkE;;IAGlE,qDAAqD;;IAGrD,+EAA+E;;IAG/E,qDAAqD;;IAGrD,oDAAoD;;IAGpD,wEAAwE;;;;;;;;;;;;;;;;EAExE,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;IAChC,wDAAwD;;IAGxD,iDAAiD;;IAGjD,kDAAkD;;IAGlD,qCAAqC;;QArCrC,kEAAkE;;QAGlE,qDAAqD;;QAGrD,+EAA+E;;QAG/E,qDAAqD;;QAGrD,oDAAoD;;QAGpD,wEAAwE;;;;;;;;;;;;;;;;;IAyBxE,qFAAqF;;IAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEhE,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,qBAAqB,uDAIhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC,mCAAmC;;QArCnC,wDAAwD;;QAGxD,iDAAiD;;QAGjD,kDAAkD;;QAGlD,qCAAqC;;YArCrC,kEAAkE;;YAGlE,qDAAqD;;YAGrD,+EAA+E;;YAG/E,qDAAqD;;YAGrD,oDAAoD;;YAGpD,wEAAwE;;;;;;;;;;;;;;;;;QAyBxE,qFAAqF;;QAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyBhE,4BAA4B;;QAE1B,gDAAgD;;QAGhD,qCAAqC;;QAGrC,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG7D,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;GAEG;AACH,eAAO,MAAM,kBAAkB,8CAK7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B,uCAAuC;;IAGvC,6CAA6C;;IAG7C,sDAAsD;;;;;;;;;;EAEtD,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,kBAAkB;IAC7B,oCAAoC;;IAGpC,+CAA+C;;IAG/C,uCAAuC;;IAGvC,4CAA4C;;;;;;;;;;;;EAE5C,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;IACnC,+BAA+B;;QAvE/B,mCAAmC;;YArCnC,wDAAwD;;YAGxD,iDAAiD;;YAGjD,kDAAkD;;YAGlD,qCAAqC;;gBArCrC,kEAAkE;;gBAGlE,qDAAqD;;gBAGrD,+EAA+E;;gBAG/E,qDAAqD;;gBAGrD,oDAAoD;;gBAGpD,wEAAwE;;;;;;;;;;;;;;;;;YAyBxE,qFAAqF;;YAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyBhE,4BAA4B;;YAE1B,gDAAgD;;YAGhD,qCAAqC;;YAGrC,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+D7D,oCAAoC;;QAxCpC,uCAAuC;;QAGvC,6CAA6C;;QAG7C,sDAAsD;;;;;;;;;;;IAqCtD,sCAAsC;;QA3BtC,oCAAoC;;QAGpC,+CAA+C;;QAG/C,uCAAuC;;QAGvC,4CAA4C;;;;;;;;;;;;;IAqB5C,0EAA0E;;IAG1E,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE3C,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;IAC/B,kEAAkE;;IAGlE,qDAAqD;;IAGrD,+EAA+E;;IAG/E,qDAAqD;;IAGrD,oDAAoD;;IAGpD,wEAAwE;;;;;;;;;;;;;;;;EAExE,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;IAChC,wDAAwD;;IAGxD,iDAAiD;;IAGjD,kDAAkD;;IAGlD,qCAAqC;;QArCrC,kEAAkE;;QAGlE,qDAAqD;;QAGrD,+EAA+E;;QAG/E,qDAAqD;;QAGrD,oDAAoD;;QAGpD,wEAAwE;;;;;;;;;;;;;;;;;IAyBxE,qFAAqF;;IAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEhE,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,qBAAqB,uDAIhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC,mCAAmC;;QArCnC,wDAAwD;;QAGxD,iDAAiD;;QAGjD,kDAAkD;;QAGlD,qCAAqC;;YArCrC,kEAAkE;;YAGlE,qDAAqD;;YAGrD,+EAA+E;;YAG/E,qDAAqD;;YAGrD,oDAAoD;;YAGpD,wEAAwE;;;;;;;;;;;;;;;;;QAyBxE,qFAAqF;;QAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyBhE,4BAA4B;;QAE1B,gDAAgD;;QAGhD,qCAAqC;;QAGrC,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7D,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;GAEG;AACH,eAAO,MAAM,kBAAkB,8CAK7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B,uCAAuC;;IAGvC,6CAA6C;;IAG7C,sDAAsD;;;;;;;;;;EAEtD,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,kBAAkB;IAC7B,oCAAoC;;IAGpC,+CAA+C;;IAG/C,uCAAuC;;IAGvC,4CAA4C;;;;;;;;;;;;EAE5C,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;IACnC,+BAA+B;;QA3E/B,mCAAmC;;YArCnC,wDAAwD;;YAGxD,iDAAiD;;YAGjD,kDAAkD;;YAGlD,qCAAqC;;gBArCrC,kEAAkE;;gBAGlE,qDAAqD;;gBAGrD,+EAA+E;;gBAG/E,qDAAqD;;gBAGrD,oDAAoD;;gBAGpD,wEAAwE;;;;;;;;;;;;;;;;;YAyBxE,qFAAqF;;YAGrF,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyBhE,4BAA4B;;YAE1B,gDAAgD;;YAGhD,qCAAqC;;YAGrC,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmE7D,oCAAoC;;QAxCpC,uCAAuC;;QAGvC,6CAA6C;;QAG7C,sDAAsD;;;;;;;;;;;IAyCtD,sCAAsC;;QA/BtC,oCAAoC;;QAGpC,+CAA+C;;QAG/C,uCAAuC;;QAGvC,4CAA4C;;;;;;;;;;;;;IA8B5C,0EAA0E;;IAG1E,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE3C,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAcA"}

package/dist/schema.js

@@ -66,7 +66,11 @@ export const ValidationConfigSchema = z.object({
         enabled: z.boolean().default(true),
         /** State file path (default: .vibe-validate-state.yaml) */
         statePath: z.string().default('.vibe-validate-state.yaml'),
-    }).default({}),
+    }).optional().default({
+        strategy: 'git-tree-hash',
+        enabled: true,
+        statePath: '.vibe-validate-state.yaml',
+    }),
 });
 /**
  * Output Format Schema
@@ -110,9 +114,18 @@ export const VibeValidateConfigSchema = z.object({
     /** Validation configuration */
     validation: ValidationConfigSchema,
     /** Git integration configuration */
-    git: GitConfigSchema.default({}),
+    git: GitConfigSchema.optional().default({
+        mainBranch: 'main',
+        autoSync: false,
+        warnIfBehind: true,
+    }),
     /** Output formatting configuration */
-    output: OutputConfigSchema.default({}),
+    output: OutputConfigSchema.optional().default({
+        format: 'auto',
+        showProgress: true,
+        verbose: false,
+        noColor: false,
+    }),
     /** Optional: Preset name (typescript-library, typescript-nodejs, etc.) */
     preset: z.string().optional(),
     /** Optional: Extend another config file */
@@ -140,8 +153,8 @@ export function safeValidateConfig(config) {
         return { success: true, data: result.data };
     }
     // Format Zod errors into readable messages
-    const errors = result.error.errors.map(err => {
-        const path = err.path.join('.');
+    const errors = result.error.issues.map(err => {
+        const path = err.path.map(String).join('.');
         return `${path}: ${err.message}`;
     });
     return { success: false, errors };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-validate/config",
-  "version": "0.9.0",
+  "version": "0.9.4",
   "description": "Configuration system for vibe-validate with TypeScript-first design and framework presets",
   "type": "module",
   "main": "./dist/index.js",