@vibecheckai/cli 2.8.2 → 3.0.0

package/bin/runners/lib/permissions/index.js

@@ -0,0 +1,45 @@
+/**
+ * Permissions Module Index
+ * Exports all permission verification functionality
+ */
+
+"use strict";
+
+const { 
+  extractAuthModel, 
+  extractRolePatterns, 
+  inferRoles, 
+  buildRouteAuthMap 
+} = require("./auth-model");
+
+const { 
+  buildAuthZMatrix, 
+  detectViolations, 
+  formatMatrix 
+} = require("./matrix-builder");
+
+const { 
+  detectIDORCandidates, 
+  buildIDORTestPlan, 
+  executeIDORTest, 
+  formatIDORPlan 
+} = require("./idor-prover");
+
+module.exports = {
+  // Auth model extraction
+  extractAuthModel,
+  extractRolePatterns,
+  inferRoles,
+  buildRouteAuthMap,
+  
+  // AuthZ matrix
+  buildAuthZMatrix,
+  detectViolations,
+  formatMatrix,
+  
+  // IDOR detection
+  detectIDORCandidates,
+  buildIDORTestPlan,
+  executeIDORTest,
+  formatIDORPlan
+};

package/bin/runners/lib/permissions/matrix-builder.js

@@ -0,0 +1,198 @@
+/**
+ * AuthZ Matrix Builder
+ * Builds authorization matrix from auth model and runtime verification
+ */
+
+"use strict";
+
+const crypto = require("crypto");
+
+function sha256(text) {
+  return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+
+/**
+ * Build AuthZ matrix from auth model
+ */
+function buildAuthZMatrix(authModel, runtimeResults = null) {
+  const matrix = {
+    meta: {
+      version: "1.0.0",
+      generatedAt: new Date().toISOString()
+    },
+    roles: authModel.roles.map(r => r.name),
+    routes: [],
+    violations: []
+  };
+
+  for (const route of authModel.routes) {
+    const routeAuthZ = {
+      path: route.path,
+      method: route.method,
+      declared: route.declared,
+      actual: {
+        anon: null,
+        user: null,
+        admin: null
+      }
+    };
+
+    // Merge runtime results if available
+    if (runtimeResults) {
+      const runtimeForRoute = runtimeResults.filter(r => 
+        matchesRoute(route.path, r.path)
+      );
+
+      for (const result of runtimeForRoute) {
+        if (result.role === "anon") {
+          routeAuthZ.actual.anon = {
+            status: result.status,
+            redirected: result.redirected,
+            accessible: result.status >= 200 && result.status < 400 && !result.redirected
+          };
+        } else if (result.role === "user") {
+          routeAuthZ.actual.user = {
+            status: result.status,
+            redirected: result.redirected,
+            accessible: result.status >= 200 && result.status < 400 && !result.redirected
+          };
+        } else if (result.role === "admin") {
+          routeAuthZ.actual.admin = {
+            status: result.status,
+            redirected: result.redirected,
+            accessible: result.status >= 200 && result.status < 400 && !result.redirected
+          };
+        }
+      }
+    }
+
+    matrix.routes.push(routeAuthZ);
+  }
+
+  // Detect violations
+  matrix.violations = detectViolations(matrix);
+
+  return matrix;
+}
+
+/**
+ * Detect authorization violations
+ */
+function detectViolations(matrix) {
+  const violations = [];
+
+  for (const route of matrix.routes) {
+    // Check: protected route accessible anonymously
+    if (route.declared.protected && route.actual.anon?.accessible) {
+      violations.push({
+        id: `AUTHZ_ANON_${sha256(route.path)}`,
+        severity: "BLOCK",
+        type: "anon_access",
+        route: route.path,
+        method: route.method,
+        expected: "protected (should require auth)",
+        actual: "accessible anonymously",
+        message: `Protected route ${route.path} accessible without authentication`,
+        evidence: []
+      });
+    }
+
+    // Check: role mismatch (admin route accessible by user)
+    if (route.declared.roles?.includes("admin") && 
+        !route.declared.roles?.includes("user") &&
+        route.actual.user?.accessible) {
+      violations.push({
+        id: `AUTHZ_ROLE_${sha256(route.path)}`,
+        severity: "BLOCK",
+        type: "role_mismatch",
+        route: route.path,
+        method: route.method,
+        expected: "admin only",
+        actual: "accessible by user role",
+        message: `Admin route ${route.path} accessible by non-admin users`,
+        evidence: []
+      });
+    }
+
+    // Check: protected route blocked after login (broken auth)
+    if (route.declared.protected && 
+        route.actual.anon?.redirected &&
+        route.actual.user && !route.actual.user.accessible) {
+      violations.push({
+        id: `AUTHZ_BLOCKED_${sha256(route.path)}`,
+        severity: "WARN",
+        type: "blocked_after_auth",
+        route: route.path,
+        method: route.method,
+        expected: "accessible after auth",
+        actual: `blocked (status ${route.actual.user.status})`,
+        message: `Protected route ${route.path} not accessible after authentication`,
+        evidence: []
+      });
+    }
+  }
+
+  return violations;
+}
+
+/**
+ * Format matrix for display
+ */
+function formatMatrix(matrix) {
+  const lines = [];
+  
+  lines.push("# AuthZ Matrix\n");
+  lines.push(`Generated: ${matrix.meta.generatedAt}`);
+  lines.push(`Roles: ${matrix.roles.join(", ")}\n`);
+
+  // Build table header
+  const header = ["Route", "Method", "Declared", "Anon", "User", "Admin"];
+  lines.push(`| ${header.join(" | ")} |`);
+  lines.push(`| ${header.map(() => "---").join(" | ")} |`);
+
+  for (const route of matrix.routes) {
+    const declared = route.declared.protected ? "🔒" : "🌐";
+    const anon = formatAccess(route.actual.anon);
+    const user = formatAccess(route.actual.user);
+    const admin = formatAccess(route.actual.admin);
+
+    lines.push(`| ${route.path} | ${route.method} | ${declared} | ${anon} | ${user} | ${admin} |`);
+  }
+
+  if (matrix.violations.length > 0) {
+    lines.push("\n## Violations\n");
+    for (const v of matrix.violations) {
+      const icon = v.severity === "BLOCK" ? "🛑" : "⚠️";
+      lines.push(`${icon} **${v.type}**: ${v.message}`);
+    }
+  }
+
+  return lines.join("\n");
+}
+
+function formatAccess(result) {
+  if (!result) return "?";
+  if (result.accessible) return "✅";
+  if (result.redirected) return "↩️";
+  return `❌ ${result.status}`;
+}
+
+function matchesRoute(pattern, actual) {
+  const patternParts = pattern.split("/").filter(Boolean);
+  const actualParts = actual.split("/").filter(Boolean);
+
+  if (patternParts.length !== actualParts.length) return false;
+
+  for (let i = 0; i < patternParts.length; i++) {
+    const p = patternParts[i];
+    if (p.startsWith(":") || p.startsWith("*")) continue;
+    if (p !== actualParts[i]) return false;
+  }
+  return true;
+}
+
+module.exports = {
+  buildAuthZMatrix,
+  detectViolations,
+  formatMatrix
+};

package/bin/runners/lib/pkgjson.js

@@ -0,0 +1,28 @@
+// bin/runners/lib/pkgjson.js
+const fs = require("fs");
+const path = require("path");
+
+function readPkg(root) {
+  const p = path.join(root, "package.json");
+  if (!fs.existsSync(p)) throw new Error("package.json not found");
+  return { path: p, json: JSON.parse(fs.readFileSync(p, "utf8")) };
+}
+
+function writePkg(pkgPath, json) {
+  fs.writeFileSync(pkgPath, JSON.stringify(json, null, 2) + "\n", "utf8");
+}
+
+function upsertScripts(pkg, scripts) {
+  pkg.scripts = pkg.scripts || {};
+  const changed = [];
+
+  for (const [k, v] of Object.entries(scripts)) {
+    if (pkg.scripts[k] === v) continue;
+    pkg.scripts[k] = v;
+    changed.push(k);
+  }
+
+  return changed;
+}
+
+module.exports = { readPkg, writePkg, upsertScripts };

package/bin/runners/lib/preflight.js

@@ -0,0 +1,142 @@
+/**
+ * Preflight checks - Run before any vibecheck command
+ *
+ * Validates:
+ * - Node version
+ * - Required dependencies
+ * - Project structure
+ * - Configuration
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const MIN_NODE_VERSION = 18;
+
+function checkNodeVersion() {
+  const version = process.version;
+  const major = parseInt(version.slice(1).split(".")[0], 10);
+  if (major < MIN_NODE_VERSION) {
+    return {
+      ok: false,
+      message: `Node.js ${MIN_NODE_VERSION}+ required (you have ${version})`
+    };
+  }
+  return { ok: true };
+}
+
+function checkPlaywright() {
+  try {
+    require.resolve("playwright");
+    return { ok: true };
+  } catch {
+    return {
+      ok: false,
+      optional: true,
+      message: "Playwright not installed. Reality mode requires: npm i -D playwright"
+    };
+  }
+}
+
+function checkFastGlob() {
+  try {
+    require.resolve("fast-glob");
+    return { ok: true };
+  } catch {
+    return {
+      ok: false,
+      message: "fast-glob not installed. Run: npm install"
+    };
+  }
+}
+
+function checkProjectRoot(root) {
+  const pkgPath = path.join(root, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    return {
+      ok: false,
+      message: "No package.json found. Are you in a project directory?"
+    };
+  }
+  return { ok: true };
+}
+
+function checkGit(root) {
+  const gitPath = path.join(root, ".git");
+  if (!fs.existsSync(gitPath)) {
+    return {
+      ok: false,
+      optional: true,
+      message: "Not a git repository. Some features may not work."
+    };
+  }
+  return { ok: true };
+}
+
+function checkWritable(root) {
+  const vibecheckDir = path.join(root, ".vibecheck");
+  try {
+    fs.mkdirSync(vibecheckDir, { recursive: true });
+    const testFile = path.join(vibecheckDir, ".write_test");
+    fs.writeFileSync(testFile, "test");
+    fs.unlinkSync(testFile);
+    return { ok: true };
+  } catch {
+    return {
+      ok: false,
+      message: "Cannot write to .vibecheck directory. Check permissions."
+    };
+  }
+}
+
+function runPreflight(root, { silent = false, strict = false } = {}) {
+  const checks = [
+    { name: "Node.js", check: checkNodeVersion },
+    { name: "Project", check: () => checkProjectRoot(root) },
+    { name: "Writable", check: () => checkWritable(root) },
+    { name: "Git", check: () => checkGit(root) },
+    { name: "fast-glob", check: checkFastGlob },
+    { name: "Playwright", check: checkPlaywright },
+  ];
+
+  const results = [];
+  let hasError = false;
+
+  for (const { name, check } of checks) {
+    const result = check();
+    results.push({ name, ...result });
+    
+    if (!result.ok && !result.optional) {
+      hasError = true;
+    }
+  }
+
+  if (!silent && hasError) {
+    console.error("\n⚠️ Preflight checks failed:\n");
+    for (const r of results) {
+      if (!r.ok && !r.optional) {
+        console.error(`  ✗ ${r.name}: ${r.message}`);
+      }
+    }
+    console.error("");
+  }
+
+  if (!silent && !hasError) {
+    // Show optional warnings
+    const optionalWarnings = results.filter(r => !r.ok && r.optional);
+    if (optionalWarnings.length && process.env.VIBECHECK_VERBOSE) {
+      for (const r of optionalWarnings) {
+        console.warn(`  ⚠ ${r.name}: ${r.message}`);
+      }
+    }
+  }
+
+  return {
+    ok: !hasError,
+    results
+  };
+}
+
+module.exports = { runPreflight, checkNodeVersion, checkPlaywright };

package/bin/runners/lib/reality-findings.js

@@ -0,0 +1,84 @@
+// bin/runners/lib/reality-findings.js
+const fs = require("fs");
+const path = require("path");
+
+function loadLastReality(repoRoot, maxAgeHours = 12) {
+  const p = path.join(repoRoot, ".vibecheck", "reality", "last_reality.json");
+  if (!fs.existsSync(p)) return null;
+
+  const obj = JSON.parse(fs.readFileSync(p, "utf8"));
+  const finishedAt = obj?.meta?.finishedAt ? new Date(obj.meta.finishedAt).getTime() : 0;
+  if (!finishedAt) return null;
+
+  const ageMs = Date.now() - finishedAt;
+  if (ageMs > maxAgeHours * 3600 * 1000) return null; // stale
+
+  return obj;
+}
+
+function findingsFromReality(repoRoot) {
+  const r = loadLastReality(repoRoot);
+  if (!r) return [];
+
+  const out = [];
+  for (const f of r.findings || []) {
+    // Preserve original category (DeadUI, AuthCoverage, etc.)
+    const category = f.category || "DeadUI";
+    
+    // Generate appropriate fix hints based on category
+    let fixHints;
+    if (category === "AuthCoverage") {
+      fixHints = [
+        "Verify your Next.js matcher config protects this route.",
+        "Ensure middleware redirects unauthenticated users.",
+        "Check that session/auth state is being validated server-side."
+      ];
+    } else {
+      fixHints = [
+        "Ensure the element has a real onClick/handler and it returns a real result.",
+        "If it calls /api/*, ensure the route exists and returns success only on res.ok.",
+        "If it's intentionally disabled, reflect that visually and remove the click affordance."
+      ];
+    }
+
+    out.push({
+      id: `F_REALITY_${f.id}`,
+      severity: f.severity === "BLOCK" ? "BLOCK" : "WARN",
+      category,
+      title: f.title,
+      why: category === "AuthCoverage" 
+        ? "Reality Runner detected an auth boundary violation."
+        : "Reality Runner found a UI interaction that fails in the running app.",
+      confidence: "high",
+      evidence: [
+        {
+          id: `ev_${f.id}`,
+          file: f.page ? String(f.page).replace(/^https?:\/\//, "") : "runtime",
+          lines: "0-0",
+          snippetHash: (f.screenshot || "runtime").slice(0, 80),
+          reason: f.reason
+        }
+      ],
+      fixHints
+    });
+  }
+
+  // escalate raw runtime console errors into WARN
+  const ce = (r.consoleErrors || []).slice(0, 5);
+  if (ce.length) {
+    out.push({
+      id: "F_REALITY_CONSOLE_ERRORS",
+      severity: "WARN",
+      category: "DeadUI",
+      title: `Console errors observed during Reality run (${ce.length})`,
+      why: "Console errors often correlate with broken UI handlers or missing data paths.",
+      confidence: "med",
+      evidence: [],
+      fixHints: ["Open the Reality report and fix the first error in the consoleErrors list."]
+    });
+  }
+
+  return out;
+}
+
+module.exports = { findingsFromReality };

package/bin/runners/lib/redact.js

@@ -0,0 +1,29 @@
+// bin/runners/lib/redact.js
+function redactString(s) {
+  if (typeof s !== "string") return s;
+
+  return s
+    .replace(/(api[_-]?key|secret|token|password)\s*[:=]\s*["']?([^"'\s]{6,})["']?/gi, "$1: [REDACTED]")
+    .replace(/(bearer)\s+([a-z0-9_\-\.=]{12,})/gi, "$1 [REDACTED]")
+    .replace(/sk-[a-z0-9]{16,}/gi, "[REDACTED]")
+    .replace(/[a-z0-9+\/=]{80,}/gi, "[REDACTED_BLOB]");
+}
+
+function redactObject(obj) {
+  if (obj == null) return obj;
+  if (typeof obj === "string") return redactString(obj);
+  if (typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map(redactObject);
+
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (/api[_-]?key|secret|token|password|private/i.test(k)) {
+      out[k] = "[REDACTED]";
+      continue;
+    }
+    out[k] = redactObject(v);
+  }
+  return out;
+}
+
+module.exports = { redactObject };

package/bin/runners/lib/replay/capsule-manager.js

@@ -0,0 +1,154 @@
+/**
+ * Replay Capsule Manager
+ * Handles saving, loading, and managing replay capsules
+ */
+
+const fs = require('fs').promises;
+const path = require('path');
+const { v4: uuidv4 } = require('uuid');
+const crypto = require('crypto');
+
+class CapsuleManager {
+  constructor(basePath) {
+    this.basePath = path.join(basePath, '.vibecheck', 'replays');
+  }
+
+  async init() {
+    await fs.mkdir(this.basePath, { recursive: true });
+  }
+
+  async saveCapsule(capsule) {
+    const id = capsule.id || uuidv4();
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const capsuleDir = path.join(this.basePath, `${timestamp}_${id}`);
+    
+    await fs.mkdir(capsuleDir, { recursive: true });
+    
+    // Save metadata
+    const metadata = {
+      id,
+      createdAt: new Date().toISOString(),
+      name: capsule.name || `Replay ${timestamp}`,
+      description: capsule.description || '',
+      tags: capsule.tags || [],
+      steps: capsule.steps ? capsule.steps.length : 0,
+      duration: capsule.duration || 0,
+      status: 'captured',
+      ...capsule.metadata
+    };
+
+    // Save steps
+    const steps = capsule.steps || [];
+    
+    // Generate deterministic hash for the capsule
+    const hash = crypto
+      .createHash('sha256')
+      .update(JSON.stringify({ metadata, steps }))
+      .digest('hex');
+      
+    metadata.hash = hash;
+
+    await Promise.all([
+      fs.writeFile(
+        path.join(capsuleDir, 'metadata.json'),
+        JSON.stringify(metadata, null, 2),
+        'utf8'
+      ),
+      fs.writeFile(
+        path.join(capsuleDir, 'steps.json'),
+        JSON.stringify(steps, null, 2),
+        'utf8'
+      )
+    ]);
+
+    return { id, path: capsuleDir, metadata };
+  }
+
+  async loadCapsule(capsuleId) {
+    const capsules = await this.listCapsules();
+    const capsule = capsules.find(c => c.id === capsuleId || c.metadata.id === capsuleId);
+    
+    if (!capsule) {
+      throw new Error(`Capsule ${capsuleId} not found`);
+    }
+
+    const [metadata, steps] = await Promise.all([
+      fs.readFile(path.join(capsule.path, 'metadata.json'), 'utf8')
+        .then(JSON.parse),
+      fs.readFile(path.join(capsule.path, 'steps.json'), 'utf8')
+        .then(JSON.parse)
+    ]);
+
+    return { metadata, steps };
+  }
+
+  async listCapsules() {
+    try {
+      const dirs = await fs.readdir(this.basePath, { withFileTypes: true });
+      const capsules = [];
+
+      for (const dir of dirs) {
+        if (!dir.isDirectory()) continue;
+        
+        try {
+          const metadataPath = path.join(this.basePath, dir.name, 'metadata.json');
+          const metadata = JSON.parse(await fs.readFile(metadataPath, 'utf8'));
+          
+          capsules.push({
+            id: metadata.id,
+            name: metadata.name,
+            path: path.join(this.basePath, dir.name),
+            metadata,
+            timestamp: new Date(metadata.createdAt).getTime()
+          });
+        } catch (err) {
+          console.error(`Error loading capsule ${dir.name}:`, err.message);
+        }
+      }
+
+      // Sort by timestamp, newest first
+      return capsules.sort((a, b) => b.timestamp - a.timestamp);
+    } catch (err) {
+      if (err.code === 'ENOENT') {
+        return [];
+      }
+      throw err;
+    }
+  }
+
+  async deleteCapsule(capsuleId) {
+    const capsules = await this.listCapsules();
+    const capsule = capsules.find(c => c.id === capsuleId || c.metadata.id === capsuleId);
+    
+    if (!capsule) {
+      throw new Error(`Capsule ${capsuleId} not found`);
+    }
+
+    await fs.rm(capsule.path, { recursive: true, force: true });
+    return true;
+  }
+
+  async exportCapsule(capsuleId, outputPath) {
+    const { metadata, steps } = await this.loadCapsule(capsuleId);
+    const exportData = { metadata, steps };
+    
+    await fs.writeFile(
+      outputPath,
+      JSON.stringify(exportData, null, 2),
+      'utf8'
+    );
+    
+    return outputPath;
+  }
+
+  async importCapsule(filePath) {
+    const data = JSON.parse(await fs.readFile(filePath, 'utf8'));
+    return this.saveCapsule({
+      ...data.metadata,
+      steps: data.steps,
+      imported: true
+    });
+  }
+}
+
+module.exports = CapsuleManager;