@vibecheck-ai/mcp 24.6.8 → 24.6.11

package/dist/chunk-MUP4JXOF.js

@@ -0,0 +1,219 @@
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import * as path from 'path';
+import { dirname } from 'path';
+import { BaseEngine } from './chunk-RR5ETBSV.js';
+import { computeWorkspaceFingerprint } from './chunk-FGMVY5QW.js';
+
+createRequire(import.meta.url);
+const __filename$1 = fileURLToPath(import.meta.url);
+dirname(__filename$1);
+var APP_DIR_RE = /(?:^|\/)app\/|^app\//;
+var PAGES_DIR_RE = /(?:^|\/)pages\/|^pages\//;
+var SRC_APP_RE = /(?:^|\/)src\/app\/|^src\/app\//;
+var SRC_PAGES_RE = /(?:^|\/)src\/pages\/|^src\/pages\//;
+function isNextAppPath(rel) {
+  const n = rel.replace(/\\/g, "/");
+  return APP_DIR_RE.test(n) || PAGES_DIR_RE.test(n) || SRC_APP_RE.test(n) || SRC_PAGES_RE.test(n);
+}
+function isTestOrStoryPath(rel) {
+  const lower = rel.toLowerCase();
+  return /\.(test|spec)\.[cm]?[jt]sx?$/i.test(lower) || /__tests__\//i.test(lower) || /\.stories\.[cm]?[jt]sx?$/i.test(lower);
+}
+function hasUseClientDirective(source) {
+  const lines = source.split("\n");
+  for (let i = 0; i < Math.min(40, lines.length); i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith("//")) continue;
+    if (/^['"]use client['"]\s*;?\s*$/.test(t)) return true;
+  }
+  return false;
+}
+var BROWSER_GLOBAL_RE = /\bwindow\.|\bdocument\.|\blocalStorage\b|\bsessionStorage\b|\bnavigator\.(?:clipboard|geolocation)/;
+var nextjsPackRules = [
+  {
+    ruleId: "NEXT001",
+    pack: "nextjs",
+    fileFilter(ctx) {
+      if (!ctx.fingerprint.packs.has("nextjs")) return false;
+      const ext = ctx.filePath.toLowerCase();
+      if (!/\.(tsx|jsx|ts|js)$/.test(ext)) return false;
+      if (!isNextAppPath(ctx.relativePath)) return false;
+      if (isTestOrStoryPath(ctx.relativePath)) return false;
+      if (/middleware\.[jt]s$/i.test(ctx.filePath)) return false;
+      return true;
+    },
+    run(ctx, emit) {
+      if (hasUseClientDirective(ctx.source)) return;
+      for (let i = 0; i < ctx.lines.length; i++) {
+        const line = ctx.lines[i];
+        const trimmed = line.trim();
+        if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+        if (!BROWSER_GLOBAL_RE.test(line)) continue;
+        emit({
+          id: "",
+          severity: "medium",
+          category: "nextjs",
+          file: ctx.filePath,
+          line: i + 1,
+          column: 0,
+          message: 'Browser-only API in a Next.js app/pages file without a "use client" directive \u2014 this may break RSC / server components.',
+          evidence: trimmed.slice(0, 120),
+          suggestion: 'Add "use client" at the top if this must run on the client, or move the logic to a Client Component and import it from the server file.',
+          confidence: 0.82,
+          autoFixable: false,
+          ruleId: "NEXT001"
+        });
+        return;
+      }
+    }
+  }
+];
+function hasUseClientDirective2(source) {
+  const lines = source.split("\n");
+  for (let i = 0; i < Math.min(40, lines.length); i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith("//")) continue;
+    if (/^['"]use client['"]\s*;?\s*$/.test(t)) return true;
+  }
+  return false;
+}
+var STRIPE_SDK_IMPORT_RE = /from\s+['"]stripe['"]|require\s*\(\s*['"]stripe['"]\s*\)/;
+var stripePackRules = [
+  {
+    ruleId: "STRIPE001",
+    pack: "stripe",
+    fileFilter(ctx) {
+      if (!ctx.fingerprint.packs.has("stripe")) return false;
+      if (!/\.(tsx|jsx|ts|js)$/.test(ctx.filePath.toLowerCase())) return false;
+      if (!hasUseClientDirective2(ctx.source)) return false;
+      return STRIPE_SDK_IMPORT_RE.test(ctx.source);
+    },
+    run(ctx, emit) {
+      let line = 1;
+      for (let i = 0; i < ctx.lines.length; i++) {
+        if (STRIPE_SDK_IMPORT_RE.test(ctx.lines[i])) {
+          line = i + 1;
+          break;
+        }
+      }
+      emit({
+        id: "",
+        severity: "high",
+        category: "stripe",
+        file: ctx.filePath,
+        line,
+        column: 0,
+        message: 'The `stripe` Node SDK is referenced in a file marked "use client" \u2014 secret keys and server-only APIs must not ship to the browser bundle.',
+        evidence: ctx.lines[line - 1]?.trim().slice(0, 100) ?? "stripe",
+        suggestion: "Move Stripe calls to a Route Handler, Server Action, or other server-only module; use @stripe/stripe-js only for publishable-key flows on the client.",
+        confidence: 0.9,
+        autoFixable: false,
+        ruleId: "STRIPE001"
+      });
+    }
+  },
+  {
+    ruleId: "STRIPE002",
+    pack: "stripe",
+    fileFilter(ctx) {
+      if (!ctx.fingerprint.packs.has("stripe")) return false;
+      if (!/\.(tsx?|jsx?)$/.test(ctx.filePath.toLowerCase())) return false;
+      const s = ctx.source;
+      if (!/constructEvent\s*\(/.test(s)) return false;
+      if (!/express\.json\s*\(/.test(s) && !/bodyParser\.json\s*\(/.test(s)) return false;
+      return true;
+    },
+    run(ctx, emit) {
+      let line = 1;
+      for (let i = 0; i < ctx.lines.length; i++) {
+        if (/constructEvent\s*\(/.test(ctx.lines[i])) {
+          line = i + 1;
+          break;
+        }
+      }
+      emit({
+        id: "",
+        severity: "medium",
+        category: "stripe",
+        file: ctx.filePath,
+        line,
+        column: 0,
+        message: "Stripe `constructEvent` needs the raw request body; `express.json()` (or `bodyParser.json()`) consumes the body and can invalidate signature verification.",
+        evidence: ctx.lines[line - 1]?.trim().slice(0, 100) ?? "constructEvent",
+        suggestion: "Use `express.raw({ type: 'application/json' })` on the webhook route, or a dedicated raw body parser, and skip global JSON middleware for that path.",
+        confidence: 0.68,
+        autoFixable: false,
+        ruleId: "STRIPE002"
+      });
+    }
+  }
+];
+var ALL_PACK_RULES = [...nextjsPackRules, ...stripePackRules];
+var FrameworkPackEngine = class extends BaseEngine {
+  constructor(_workspaceRoot, _minConfidence = 0.72) {
+    super();
+    this._workspaceRoot = _workspaceRoot;
+    this._minConfidence = _minConfidence;
+  }
+  id = "framework_packs";
+  name = "Framework Pack Engine";
+  version = "1.0.0";
+  supportedExtensions = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+  _fingerprint = null;
+  async activate() {
+    this._fingerprint = computeWorkspaceFingerprint(this._workspaceRoot);
+  }
+  _getFingerprint() {
+    if (!this._fingerprint) {
+      this._fingerprint = computeWorkspaceFingerprint(this._workspaceRoot);
+    }
+    return this._fingerprint;
+  }
+  async scan(delta, signal) {
+    const fingerprint = this._getFingerprint();
+    if (fingerprint.packs.size === 0) return [];
+    const filePath = delta.documentUri.replace(/^file:\/\//, "");
+    const source = delta.fullText;
+    const lines = delta.lines ?? source.split("\n");
+    const rel = path.relative(this._workspaceRoot, filePath).replace(/\\/g, "/");
+    const ctx = {
+      delta,
+      filePath,
+      relativePath: rel,
+      lines,
+      source,
+      fingerprint,
+      signal
+    };
+    const findings = [];
+    const emit = (partial) => {
+      const ruleId = partial.ruleId ?? "PACK";
+      const id = this.deterministicId(
+        filePath,
+        partial.line,
+        partial.column ?? 0,
+        ruleId,
+        partial.evidence ?? partial.message
+      );
+      return this.createFinding({
+        ...partial,
+        id,
+        engine: "framework_packs"
+      });
+    };
+    for (const rule of ALL_PACK_RULES) {
+      this.checkAbort(signal);
+      if (!fingerprint.packs.has(rule.pack)) continue;
+      if (!rule.fileFilter(ctx)) continue;
+      rule.run(ctx, (partial) => {
+        const f = emit(partial);
+        findings.push(f);
+        return f;
+      });
+    }
+    return findings.filter((f) => (f.confidence ?? 0) >= this._minConfidence);
+  }
+};
+
+export { FrameworkPackEngine };

package/dist/chunk-NR36RTVO.js

@@ -0,0 +1,152 @@
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+
+createRequire(import.meta.url);
+const __filename$1 = fileURLToPath(import.meta.url);
+dirname(__filename$1);
+
+// ../engines/dist/chunk-VCMLDVRT.js
+var NODE_BUILTINS = /* @__PURE__ */ new Set([
+  "assert",
+  "assert/strict",
+  "async_hooks",
+  "buffer",
+  "child_process",
+  "cluster",
+  "console",
+  "constants",
+  "crypto",
+  "dgram",
+  "diagnostics_channel",
+  "dns",
+  "dns/promises",
+  "domain",
+  "events",
+  "fs",
+  "fs/promises",
+  "http",
+  "http2",
+  "https",
+  "inspector",
+  "inspector/promises",
+  "module",
+  "net",
+  "os",
+  "path",
+  "path/posix",
+  "path/win32",
+  "perf_hooks",
+  "process",
+  "punycode",
+  "querystring",
+  "readline",
+  "readline/promises",
+  "repl",
+  "stream",
+  "stream/consumers",
+  "stream/promises",
+  "stream/web",
+  "string_decoder",
+  "sys",
+  "test",
+  "timers",
+  "timers/promises",
+  "tls",
+  "trace_events",
+  "tty",
+  "url",
+  "util",
+  "util/types",
+  "v8",
+  "vm",
+  "wasi",
+  "worker_threads",
+  "zlib"
+]);
+var IMPORT_PATTERNS = [
+  /import\s+(?:\{[^}]*\}|\*\s+as\s+\w+|\w+(?:\s*,\s*(?:\{[^}]*\}|\*\s+as\s+\w+))?)[\s]*from\s+['"]([^'"]+)['"]/g,
+  /import\s+type\s+(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s+from\s+['"]([^'"]+)['"]/g,
+  /^[\s]*import\s+['"]([^'"]+)['"]/gm,
+  /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /export\s+(?:\{[^}]*\}|\*(?:\s+as\s+\w+)?)\s+from\s+['"]([^'"]+)['"]/g
+];
+function extractPackageName(specifier) {
+  let rest = specifier;
+  let pkg;
+  if (rest.startsWith("@")) {
+    const parts = rest.split("/");
+    pkg = parts.length >= 2 ? `${parts[0]}/${parts[1]}` : rest;
+    rest = parts.slice(2).join("/");
+  } else {
+    const slash = rest.indexOf("/");
+    pkg = slash === -1 ? rest : rest.slice(0, slash);
+    rest = slash === -1 ? "" : rest.slice(slash + 1);
+  }
+  return { pkg, subpath: rest || void 0 };
+}
+function isRelativeOrAlias(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/")) return true;
+  if (spec.startsWith("#")) return true;
+  if (spec === "~" || spec.startsWith("~/")) return true;
+  if (spec.startsWith("$")) return true;
+  if (spec.startsWith("@/")) return true;
+  if (spec.length <= 1) return true;
+  if (/^(?:https?|jsr|npm|data|node|bun|file|blob|wasm):/.test(spec)) return true;
+  return false;
+}
+function isNodeBuiltin(spec) {
+  const name = spec.replace(/^node:/, "");
+  return NODE_BUILTINS.has(name);
+}
+function extractJavaScriptNpmImports(source, preLines) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lines = preLines ?? source.split("\n");
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const trimmed = line.trimStart();
+    if (!trimmed) continue;
+    if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*")) continue;
+    for (const pattern of IMPORT_PATTERNS) {
+      pattern.lastIndex = 0;
+      let match;
+      while ((match = pattern.exec(line)) !== null) {
+        const specifier = match[1];
+        if (isRelativeOrAlias(specifier) || isNodeBuiltin(specifier)) continue;
+        const { pkg, subpath } = extractPackageName(specifier);
+        if (seen.has(pkg)) continue;
+        seen.add(pkg);
+        const patternSource = pattern.source;
+        let importKind = "value";
+        if (patternSource.includes("type\\s+")) importKind = "type";
+        else if (patternSource.startsWith(`^[\\s]*import\\s+['"]`)) importKind = "side-effect";
+        else if (patternSource.includes("import\\s*\\(")) importKind = "dynamic";
+        results.push({
+          specifier,
+          packageName: pkg,
+          subpath,
+          line: lineIdx + 1,
+          column: match.index ?? 0,
+          code: trimmed,
+          importKind
+        });
+      }
+    }
+  }
+  return results;
+}
+function extractJavaScriptImportSpecifiersFlat(source, preLines) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const e of extractJavaScriptNpmImports(source, preLines)) {
+    if (!seen.has(e.specifier)) {
+      seen.add(e.specifier);
+      out.push(e.specifier);
+    }
+  }
+  return out;
+}
+
+export { extractJavaScriptImportSpecifiersFlat, extractJavaScriptNpmImports, extractPackageName, isNodeBuiltin, isRelativeOrAlias };