@vibecheck-ai/mcp 24.6.9 → 24.6.12

package/dist/chunk-LQSBUKYZ.js

@@ -0,0 +1,551 @@
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import * as path from 'path';
+import { dirname } from 'path';
+import * as fs from 'fs';
+import * as fsp from 'fs/promises';
+
+createRequire(import.meta.url);
+const __filename$1 = fileURLToPath(import.meta.url);
+dirname(__filename$1);
+var CALL_PATTERNS = [
+  // fetch('/api/...') or fetch("/api/...") or fetch(`/api/...`)
+  {
+    regex: /\bfetch\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "fetch",
+    pathGroup: 1
+  },
+  // axios.get|post|put|delete|patch|head|options('/api/...')
+  {
+    regex: /\baxios\.(?:get|post|put|delete|patch|head|options|request)\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "axios",
+    pathGroup: 1
+  },
+  // axios('/api/...') — shorthand
+  {
+    regex: /\baxios\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "axios",
+    pathGroup: 1
+  },
+  // ky.get|post|put|delete|patch('/api/...')
+  {
+    regex: /\bky\s*\.\s*(?:get|post|put|delete|patch)\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "ky",
+    pathGroup: 1
+  },
+  // got.get|post|put|delete|patch('/api/...')
+  {
+    regex: /\bgot\s*\.\s*(?:get|post|put|delete|patch)\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "got",
+    pathGroup: 1
+  },
+  // $fetch('/api/...') — Nuxt/ofetch
+  {
+    regex: /\b\$?fetch\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "$fetch",
+    pathGroup: 1
+  },
+  // ofetch('/api/...')
+  {
+    regex: /\bofetch\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "ofetch",
+    pathGroup: 1
+  },
+  // superagent: request.get('/api/...')
+  {
+    regex: /\brequest\s*\.\s*(?:get|post|put|del|delete|patch)\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "superagent",
+    pathGroup: 1
+  },
+  // new URL('/api/...', base)
+  {
+    regex: /new\s+URL\s*\(\s*[`'"](\/?api\/[^`'"?#\s]+)[`'"]/g,
+    client: "URL",
+    pathGroup: 1
+  }
+];
+var INTERPOLATION_RE = /\$\{[^}]+\}/;
+var SAFE_PREFIXES = /* @__PURE__ */ new Set([
+  "/api/auth",
+  // NextAuth.js / Auth.js
+  "/api/_next",
+  // Next.js internals
+  "/api/trpc",
+  // tRPC router
+  "/api/clerk",
+  // Clerk auth
+  "/api/supabase",
+  // Supabase auth helpers
+  "/api/uploadthing",
+  // UploadThing
+  "/api/inngest",
+  // Inngest event handler
+  "/api/sentry",
+  // Sentry tunnel
+  "/api/stripe/webhook",
+  // Common Stripe webhook path
+  "/api/graphql",
+  // GraphQL endpoint (handled by schema, not file-per-route)
+  "/api/health",
+  // Health check endpoints (often middleware)
+  "/api/ping",
+  // Ping/health
+  "/api/webhooks",
+  // Generic webhook handlers
+  "/api/callback",
+  // OAuth/auth callback endpoints
+  "/api/oauth",
+  // OAuth flow endpoints
+  "/api/cron",
+  // Vercel/Next.js cron handlers
+  "/api/revalidate"
+  // Next.js ISR revalidation
+]);
+function isSafePath(apiPath) {
+  for (const prefix of SAFE_PREFIXES) {
+    if (apiPath === prefix || apiPath.startsWith(prefix + "/")) return true;
+  }
+  return false;
+}
+function buildLineRegions(lines) {
+  const regions = [];
+  let inBlock = false;
+  for (const line of lines) {
+    if (inBlock) {
+      const closeIdx = line.indexOf("*/");
+      if (closeIdx === -1) {
+        regions.push({ inComment: true, stringRanges: [] });
+        continue;
+      }
+      inBlock = false;
+      regions.push({
+        inComment: false,
+        codeStart: closeIdx + 2,
+        stringRanges: extractStringRanges(line, closeIdx + 2)
+      });
+      continue;
+    }
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("//") || trimmed.startsWith("#")) {
+      regions.push({ inComment: true, stringRanges: [] });
+      continue;
+    }
+    const blockStart = line.indexOf("/*");
+    if (blockStart !== -1) {
+      const blockEnd = line.indexOf("*/", blockStart + 2);
+      if (blockEnd === -1) {
+        inBlock = true;
+        const isFullComment = line.slice(0, blockStart).trim() === "";
+        regions.push({ inComment: isFullComment, stringRanges: [] });
+        continue;
+      }
+      regions.push({
+        inComment: false,
+        codeStart: blockEnd + 2,
+        stringRanges: extractStringRanges(line, blockEnd + 2)
+      });
+      continue;
+    }
+    regions.push({ inComment: false, stringRanges: extractStringRanges(line) });
+  }
+  return regions;
+}
+function extractStringRanges(line, from = 0) {
+  const ranges = [];
+  let i = from;
+  while (i < line.length) {
+    line[i];
+    i++;
+  }
+  return ranges;
+}
+function deterministicId(uri, line, col, apiPath) {
+  const input = `${uri}::${line}::${col}::ghost::${apiPath}`;
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = hash * 16777619 >>> 0;
+  }
+  return `ghost-route-${hash.toString(16).padStart(8, "0")}`;
+}
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  if (a.length > b.length) [a, b] = [b, a];
+  const m = a.length;
+  const n = b.length;
+  const row = new Uint16Array(m + 1);
+  for (let i = 0; i <= m; i++) row[i] = i;
+  for (let j = 1; j <= n; j++) {
+    let prev = row[0];
+    row[0] = j;
+    for (let i = 1; i <= m; i++) {
+      const temp = row[i];
+      row[i] = a[i - 1] === b[j - 1] ? prev : 1 + Math.min(prev, row[i], row[i - 1]);
+      prev = temp;
+    }
+  }
+  return row[m];
+}
+function compileRoutePattern(routePath) {
+  let isDynamic = false;
+  let isCatchAll = false;
+  let pattern = routePath.replace(/\[\[\.\.\.(\w+)\]\]/g, () => {
+    isDynamic = true;
+    isCatchAll = true;
+    return "(?:\\/.*)?";
+  }).replace(/\[\.\.\.(\w+)\]/g, () => {
+    isDynamic = true;
+    isCatchAll = true;
+    return "\\/.*";
+  }).replace(/\[(\w+)\]/g, () => {
+    isDynamic = true;
+    return "\\/[^/]+";
+  });
+  pattern = pattern.replace(/\//g, "\\/");
+  pattern = pattern.replace(/\\\\\//g, "\\/");
+  return {
+    regex: new RegExp(`^${pattern}$`),
+    isDynamic,
+    isCatchAll
+  };
+}
+var ROUTE_EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs"]);
+var NEXTJS_ROUTE_FILES = /* @__PURE__ */ new Set(["route", "index"]);
+async function buildRouteIndex(workspaceRoot, framework) {
+  const routes = [];
+  const routeDirs = getRouteDirs(workspaceRoot, framework);
+  for (const { dir, style } of routeDirs) {
+    if (!fs.existsSync(dir)) continue;
+    await walkRouteDir(dir, dir, style, routes);
+  }
+  return { routes, framework, builtAt: Date.now() };
+}
+function getRouteDirs(root, framework) {
+  const dirs = [];
+  if (framework === "nextjs" || framework === "unknown") {
+    dirs.push({ dir: path.join(root, "pages", "api"), style: "pages" });
+    dirs.push({ dir: path.join(root, "src", "pages", "api"), style: "pages" });
+    dirs.push({ dir: path.join(root, "app", "api"), style: "app" });
+    dirs.push({ dir: path.join(root, "src", "app", "api"), style: "app" });
+  }
+  if (framework === "nuxt") {
+    dirs.push({ dir: path.join(root, "server", "api"), style: "nuxt-server" });
+    dirs.push({ dir: path.join(root, "server", "routes"), style: "nuxt-server" });
+  }
+  if (framework === "sveltekit") {
+    dirs.push({ dir: path.join(root, "src", "routes", "api"), style: "sveltekit" });
+  }
+  if (framework === "remix") {
+    dirs.push({ dir: path.join(root, "app", "routes"), style: "remix" });
+  }
+  return dirs;
+}
+async function walkRouteDir(baseDir, currentDir, style, routes) {
+  let entries;
+  try {
+    entries = await fsp.readdir(currentDir, { withFileTypes: true });
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT" && process.env.NODE_ENV !== "test") {
+      console.warn(
+        `[vibecheck:ghost-route] Cannot read route dir ${currentDir}: ${code ?? err.message}`
+      );
+    }
+    return;
+  }
+  for (const entry of entries) {
+    const full = path.join(currentDir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith("(") && entry.name.endsWith(")")) {
+        await walkRouteDir(baseDir, full, style, routes);
+        continue;
+      }
+      if (entry.name.startsWith("_")) continue;
+      await walkRouteDir(baseDir, full, style, routes);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const ext = path.extname(entry.name);
+    if (!ROUTE_EXTS.has(ext)) continue;
+    const baseName = path.basename(entry.name, ext);
+    let routePath;
+    if (style === "app" || style === "sveltekit") {
+      if (!NEXTJS_ROUTE_FILES.has(baseName) && baseName !== "+server") continue;
+      const relDir = path.relative(baseDir, currentDir).replace(/\\/g, "/");
+      routePath = "/api" + (relDir ? `/${relDir}` : "");
+    } else if (style === "pages" || style === "nuxt-server") {
+      const relFile = path.relative(baseDir, full).replace(/\\/g, "/");
+      const withoutExt = relFile.replace(/\.[^.]+$/, "");
+      const cleaned = withoutExt.replace(/\/index$/, "") || "";
+      routePath = "/api" + (cleaned ? `/${cleaned}` : "");
+    } else if (style === "remix") {
+      const relFile = path.relative(baseDir, full).replace(/\\/g, "/");
+      const withoutExt = relFile.replace(/\.[^.]+$/, "");
+      const remixPath = withoutExt.replace(/\./g, "/").replace(/\$/g, "[param]").replace(/\/index$/, "");
+      if (!remixPath.startsWith("api")) continue;
+      routePath = `/${remixPath}`;
+    } else {
+      continue;
+    }
+    routePath = routePath.replace(/\/\([^)]+\)/g, "");
+    const compiled = compileRoutePattern(routePath);
+    routes.push({
+      pattern: routePath,
+      regex: compiled.regex,
+      isDynamic: compiled.isDynamic,
+      isCatchAll: compiled.isCatchAll,
+      filePath: full
+    });
+  }
+}
+function detectFramework(workspaceRoot) {
+  try {
+    const raw = fs.readFileSync(path.join(workspaceRoot, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (allDeps["next"]) return "nextjs";
+    if (allDeps["nuxt"]) return "nuxt";
+    if (allDeps["@sveltejs/kit"]) return "sveltekit";
+    if (allDeps["@remix-run/node"] || allDeps["@remix-run/react"]) return "remix";
+    if (allDeps["express"]) return "express";
+  } catch (err) {
+    if (process.env.VIBECHECK_DEBUG) {
+      console.warn(
+        "[ghost_route] detectFramework failed:",
+        err instanceof Error ? err.message : err
+      );
+    }
+  }
+  return "unknown";
+}
+var GhostRouteEngine = class {
+  id = "ghost_route";
+  _workspaceRoot;
+  _confidenceThreshold;
+  _framework = "unknown";
+  _routeIndex = null;
+  _indexBuilding = null;
+  /** Additional path prefixes to never flag. */
+  _extraSafePrefixes;
+  // Stats
+  _stats = {
+    filesScanned: 0,
+    filesSkipped: 0,
+    routeCallsDetected: 0,
+    ghostRoutesFound: 0,
+    routeIndexSize: 0,
+    avgScanMs: 0
+  };
+  _totalScanMs = 0;
+  constructor(workspaceRoot, confidenceThreshold = 0.75, extraSafePrefixes = [], truthpackRouteIndex) {
+    this._workspaceRoot = workspaceRoot;
+    this._confidenceThreshold = confidenceThreshold;
+    this._extraSafePrefixes = extraSafePrefixes;
+    if (truthpackRouteIndex) {
+      this._routeIndex = {
+        routes: truthpackRouteIndex.routes,
+        framework: "truthpack",
+        builtAt: Date.now()
+      };
+      this._stats.routeIndexSize = truthpackRouteIndex.routes.length;
+    }
+  }
+  get stats() {
+    return { ...this._stats };
+  }
+  get framework() {
+    return this._framework;
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────────
+  async activate() {
+    this._framework = detectFramework(this._workspaceRoot);
+    await this._ensureIndex();
+  }
+  /** Rebuild route index. Call after file creation/deletion. */
+  async refresh() {
+    this._framework = detectFramework(this._workspaceRoot);
+    this._routeIndex = null;
+    this._indexBuilding = null;
+    await this._ensureIndex();
+  }
+  async _ensureIndex() {
+    if (this._routeIndex) return this._routeIndex;
+    if (this._indexBuilding) return this._indexBuilding;
+    this._indexBuilding = buildRouteIndex(this._workspaceRoot, this._framework).then((index) => {
+      this._routeIndex = index;
+      this._stats.routeIndexSize = index.routes.length;
+      this._indexBuilding = null;
+      return index;
+    });
+    return this._indexBuilding;
+  }
+  // ── Main Scan ────────────────────────────────────────────────────────────
+  async scan(delta, signal) {
+    if (signal?.aborted) return [];
+    const t0 = performance.now();
+    if (this._framework === "unknown") {
+      this._framework = detectFramework(this._workspaceRoot);
+      if (this._framework === "unknown") {
+        this._stats.filesSkipped++;
+        return [];
+      }
+    }
+    if (!containsRouteCall(delta.fullText)) {
+      this._stats.filesSkipped++;
+      return [];
+    }
+    this._stats.filesScanned++;
+    const index = await this._ensureIndex();
+    if (signal?.aborted) return [];
+    const lines = delta.lines ?? delta.fullText.split("\n");
+    const regions = buildLineRegions(lines);
+    const calls = this._extractRouteCalls(lines, regions, signal);
+    this._stats.routeCallsDetected += calls.length;
+    const findings = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const call of calls) {
+      if (signal?.aborted) break;
+      if (seen.has(call.apiPath)) continue;
+      seen.add(call.apiPath);
+      if (isSafePath(call.apiPath)) continue;
+      if (this._extraSafePrefixes.some((p) => call.apiPath.startsWith(p))) continue;
+      if (this._matchesRoute(index, call.apiPath)) continue;
+      let confidence = 0.85;
+      if (call.hasInterpolation) confidence = 0.65;
+      if (confidence < this._confidenceThreshold) continue;
+      const suggestion = this._findClosestRoute(index, call.apiPath);
+      const sub = call.apiPath.replace(/^\/api\//, "");
+      this._stats.ghostRoutesFound++;
+      findings.push({
+        id: deterministicId(delta.documentUri, call.line, call.column, call.apiPath),
+        engine: this.id,
+        severity: "high",
+        category: "ghost_route",
+        file: delta.documentUri,
+        line: call.line,
+        column: call.column,
+        endLine: call.line,
+        endColumn: call.endColumn,
+        message: `Route \`${call.apiPath}\` has no handler file in this ${this._frameworkLabel()} project`,
+        evidence: call.evidence,
+        suggestion: suggestion ? `Did you mean \`${suggestion}\`? Or create \`${this._suggestFilePath(sub)}\`` : `Create \`${this._suggestFilePath(sub)}\``,
+        confidence,
+        autoFixable: false,
+        ruleId: "GHO001"
+      });
+    }
+    const elapsed = performance.now() - t0;
+    this._totalScanMs += elapsed;
+    this._stats.avgScanMs = this._stats.filesScanned > 0 ? Math.round(this._totalScanMs / this._stats.filesScanned) : 0;
+    return findings;
+  }
+  // ── Route Call Extraction ────────────────────────────────────────────────
+  _extractRouteCalls(lines, regions, signal) {
+    const results = [];
+    for (let i = 0; i < lines.length; i++) {
+      if (signal?.aborted) break;
+      const region = regions[i];
+      if (region.inComment) continue;
+      const line = lines[i];
+      const codeStart = region.codeStart ?? 0;
+      const scanLine = codeStart > 0 ? line.slice(codeStart) : line;
+      for (const pattern of CALL_PATTERNS) {
+        pattern.regex.lastIndex = 0;
+        let m;
+        while ((m = pattern.regex.exec(scanLine)) !== null) {
+          const rawPath = m[pattern.pathGroup];
+          const apiPath = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+          if (/^https?:\/\//.test(rawPath)) continue;
+          const hasInterpolation = INTERPOLATION_RE.test(m[0]);
+          results.push({
+            apiPath: normalizeApiPath(apiPath),
+            line: i + 1,
+            column: codeStart + m.index,
+            endColumn: codeStart + m.index + m[0].length,
+            evidence: m[0],
+            client: pattern.client,
+            hasInterpolation
+          });
+        }
+      }
+    }
+    return results;
+  }
+  // ── Route Matching ───────────────────────────────────────────────────────
+  _matchesRoute(index, apiPath) {
+    for (const route of index.routes) {
+      if (route.pattern === apiPath) return true;
+      if (route.isDynamic && route.regex.test(apiPath)) return true;
+    }
+    return false;
+  }
+  /** Find the closest existing route by Levenshtein distance. */
+  _findClosestRoute(index, apiPath) {
+    let best = null;
+    let bestDist = 5;
+    for (const route of index.routes) {
+      if (route.isDynamic) continue;
+      const d = levenshtein(apiPath, route.pattern);
+      if (d > 0 && d < bestDist) {
+        bestDist = d;
+        best = route.pattern;
+      }
+    }
+    return best;
+  }
+  // ── Suggestion Helpers ───────────────────────────────────────────────────
+  _suggestFilePath(sub) {
+    switch (this._framework) {
+      case "nextjs":
+        return `app/api/${sub}/route.ts`;
+      case "nuxt":
+        return `server/api/${sub}.ts`;
+      case "sveltekit":
+        return `src/routes/api/${sub}/+server.ts`;
+      case "remix":
+        return `app/routes/api.${sub.replace(/\//g, ".")}.ts`;
+      default:
+        return `app/api/${sub}/route.ts`;
+    }
+  }
+  _frameworkLabel() {
+    switch (this._framework) {
+      case "nextjs":
+        return "Next.js";
+      case "nuxt":
+        return "Nuxt";
+      case "sveltekit":
+        return "SvelteKit";
+      case "remix":
+        return "Remix";
+      case "express":
+        return "Express";
+      case "truthpack":
+        return "truthpack";
+      default:
+        return "";
+    }
+  }
+  // ── Lifecycle ────────────────────────────────────────────────────────────
+  dispose() {
+    this._routeIndex = null;
+    this._indexBuilding = null;
+  }
+};
+function containsRouteCall(text) {
+  return text.includes("/api/") || text.includes("'api/") || text.includes('"api/') || text.includes("`/api") || // template literal routes
+  text.includes("fetch(") || // any fetch call may hit an API
+  text.includes("axios.") || // axios method calls
+  text.includes("$fetch(") || // Nuxt $fetch
+  text.includes(".get(") || // HTTP client .get/.post/.put/.delete
+  text.includes(".post(") || text.includes("/v1/") || // versioned API paths (v1, v2)
+  text.includes("/v2/");
+}
+function normalizeApiPath(p) {
+  return p.replace(/\/+/g, "/").replace(/\/$/, "") || // strip trailing slash
+  "/api";
+}
+
+export { GhostRouteEngine };