@vibecheckai/cli 2.8.2 → 3.0.0

package/bin/runners/runReality.js

@@ -0,0 +1,489 @@
+/**
+ * Reality Mode v2 - Two-Pass Auth Verification + Dead UI Crawler
+ *
+ * Pass A (anon): crawl + click, record which routes look protected
+ * Pass B (auth): crawl same routes using storageState, verify protected routes accessible
+ *
+ * Findings:
+ * - Dead UI (clicks that do nothing)
+ * - HTTP errors (4xx/5xx)
+ * - Auth coverage (protected route reachable anonymously = BLOCK)
+ * - Route coverage stats
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+let chromium;
+let playwrightError = null;
+try {
+  chromium = require("playwright").chromium;
+} catch (e) {
+  chromium = null;
+  playwrightError = e.message;
+}
+
+function ensureDir(p) {
+  fs.mkdirSync(p, { recursive: true });
+}
+
+function stamp() {
+  const d = new Date();
+  const z = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}${z(d.getMonth() + 1)}${z(d.getDate())}_${z(d.getHours())}${z(d.getMinutes())}${z(d.getSeconds())}`;
+}
+
+function sha1(s) {
+  return crypto.createHash("sha1").update(String(s)).digest("hex");
+}
+
+function normalizeUrl(u) {
+  try {
+    const url = new URL(u);
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return u;
+  }
+}
+
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+
+function pathFromUrl(u) {
+  try {
+    return new URL(u).pathname || "/";
+  } catch {
+    return "/";
+  }
+}
+
+function looksRisky(text) {
+  const t = String(text || "").toLowerCase();
+  return /\b(delete|remove|destroy|wipe|purge|drop|cancel\s+plan|unsubscribe|terminate)\b/.test(t);
+}
+
+function looksAuthAction(text) {
+  const t = String(text || "").toLowerCase();
+  return /\b(logout|sign\s*out)\b/.test(t);
+}
+
+function loadTruthpack(repoRoot, truthpackRel) {
+  const rel = truthpackRel || path.join(".vibecheck", "truth", "truthpack.json");
+  const abs = path.isAbsolute(rel) ? rel : path.join(repoRoot, rel);
+  if (!fs.existsSync(abs)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(abs, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function compileNextMatcher(pattern) {
+  const p = String(pattern || "").trim();
+  if (!p) return null;
+  const norm = p.startsWith("/") ? p : `/${p}`;
+  const esc = norm.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  if (norm.includes(":path*")) {
+    const base = esc.replace(/\\:path\\\*/g, "");
+    return new RegExp(`^${base}(\\/.*)?$`, "i");
+  }
+  return new RegExp(`^${esc}$`, "i");
+}
+
+function getProtectedMatchersFromTruthpack(truthpack) {
+  const patterns = truthpack?.auth?.nextMatcherPatterns || [];
+  const out = [];
+  for (const p of patterns) {
+    const rx = compileNextMatcher(p);
+    if (rx) out.push({ pattern: p, rx });
+  }
+  return out;
+}
+
+async function isLoginPage(page) {
+  try {
+    return await page.evaluate(() => {
+      const hasPass = !!document.querySelector("input[type='password']");
+      const txt = (document.body?.innerText || "").toLowerCase();
+      const signInWords = /(sign in|log in|login|welcome back|forgot password)/.test(txt);
+      const urlLooks = /(login|signin|auth)/.test(location.pathname.toLowerCase());
+      return hasPass || signInWords || urlLooks;
+    });
+  } catch {
+    return false;
+  }
+}
+
+async function pageSignature(page) {
+  return page.evaluate(() => {
+    const c = document.querySelectorAll("a,button,input,select,textarea,[role='button']").length;
+    const t = document.body?.innerText?.length || 0;
+    return `${location.href}|${c}|${t}`;
+  });
+}
+
+async function clickOutcome(page, locator, opts = {}) {
+  const beforeSig = await pageSignature(page);
+  const beforeUrl = page.url();
+  const beforeReq = opts.reqCounter.value;
+
+  const domPromise = page.evaluate(() => {
+    return new Promise((resolve) => {
+      const obs = new MutationObserver(() => { obs.disconnect(); resolve({ changed: true }); });
+      obs.observe(document.documentElement, { childList: true, subtree: true, attributes: true });
+      setTimeout(() => { try { obs.disconnect(); } catch {} resolve({ changed: false }); }, 900);
+    });
+  });
+
+  const navPromise = page.waitForNavigation({ timeout: 1200 }).then(() => true).catch(() => false);
+  const clickRes = await locator.click({ timeout: 1200 }).then(() => ({ ok: true })).catch((e) => ({ ok: false, error: String(e?.message || e) }));
+
+  const navRes = await navPromise;
+  const domRes = await domPromise;
+  await page.waitForTimeout(250);
+
+  const afterSig = await pageSignature(page);
+  const afterUrl = page.url();
+
+  return {
+    clickOk: clickRes.ok,
+    clickError: clickRes.error || null,
+    navHappened: !!navRes,
+    urlChanged: normalizeUrl(afterUrl) !== normalizeUrl(beforeUrl),
+    domChanged: !!domRes?.changed || afterSig !== beforeSig,
+    reqDelta: Math.max(0, opts.reqCounter.value - beforeReq),
+    beforeUrl,
+    afterUrl
+  };
+}
+
+async function collectLinks(page, baseUrl) {
+  const links = await page.evaluate(() => Array.from(document.querySelectorAll("a[href]")).map(a => a.getAttribute("href")).filter(Boolean));
+  return links.map(href => { try { return new URL(href, baseUrl).toString(); } catch { return null; } }).filter(Boolean);
+}
+
+async function collectInteractives(page) {
+  return page.evaluate(() => {
+    const nodes = Array.from(document.querySelectorAll("button, a[href], input[type='submit'], [role='button'], [onclick]"));
+    return nodes.slice(0, 80).map((el, idx) => ({
+      idx,
+      tag: el.tagName.toLowerCase(),
+      role: el.getAttribute("role") || "",
+      href: el.tagName === "A" ? el.getAttribute("href") || "" : "",
+      text: (el.getAttribute("aria-label") || el.innerText || "").trim().slice(0, 80),
+      id: el.id || "",
+      disabled: !!(el.disabled || el.getAttribute("aria-disabled") === "true"),
+      key: `${el.tagName}|${el.id}|${idx}`
+    }));
+  });
+}
+
+async function attemptLogin(page, { auth }) {
+  if (!auth) return { did: false, ok: false };
+  const [email, pass] = String(auth).split(":");
+  if (!email || !pass) return { did: false, ok: false };
+
+  try {
+    const emailLoc = page.locator("input[type='email'], input[name*='email' i], input[placeholder*='email' i]").first();
+    const passLoc = page.locator("input[type='password']").first();
+    if ((await emailLoc.count()) === 0 || (await passLoc.count()) === 0) return { did: false, ok: false };
+
+    await emailLoc.fill(email, { timeout: 1200 });
+    await passLoc.fill(pass, { timeout: 1200 });
+
+    const submit = page.locator("button[type='submit'], input[type='submit']").first();
+    const fallback = page.locator("button:has-text('Log in'), button:has-text('Sign in')").first();
+    const before = page.url();
+
+    if ((await submit.count()) > 0) await submit.click({ timeout: 1200 });
+    else if ((await fallback.count()) > 0) await fallback.click({ timeout: 1200 });
+    else return { did: true, ok: false };
+
+    await page.waitForLoadState("networkidle", { timeout: 6000 }).catch(() => {});
+    const stillLogin = await isLoginPage(page);
+    return { did: true, ok: normalizeUrl(page.url()) !== normalizeUrl(before) || !stillLogin };
+  } catch {
+    return { did: true, ok: false };
+  }
+}
+
+async function runSinglePass({ label, baseUrl, context, shotsDir, danger, maxPages, maxDepth, timeoutMs, root }) {
+  const page = await context.newPage();
+  page.setDefaultTimeout(timeoutMs);
+
+  const reqCounter = { value: 0 };
+  const netErrors = [];
+  const consoleErrors = [];
+  const findings = [];
+  const pagesVisited = [];
+
+  page.on("requestfinished", () => { reqCounter.value += 1; });
+  page.on("requestfailed", (req) => { netErrors.push({ url: req.url(), failure: req.failure()?.errorText || "unknown" }); });
+  page.on("console", (msg) => { if (msg.type() === "error") consoleErrors.push({ text: msg.text().slice(0, 500) }); });
+  page.on("pageerror", (err) => { consoleErrors.push({ text: String(err?.message || err).slice(0, 500) }); });
+
+  const visited = new Set();
+  const queue = [{ url: baseUrl, depth: 0 }];
+
+  while (queue.length && pagesVisited.length < maxPages) {
+    const item = queue.shift();
+    if (!item) break;
+
+    const targetUrl = normalizeUrl(item.url);
+    if (!sameOrigin(baseUrl, targetUrl) || visited.has(targetUrl)) continue;
+    if (!danger && looksAuthAction(targetUrl)) continue;
+
+    visited.add(targetUrl);
+
+    const res = await page.goto(targetUrl, { waitUntil: "domcontentloaded" }).catch(() => null);
+    await page.waitForLoadState("networkidle", { timeout: 6000 }).catch(() => {});
+
+    const status = res ? res.status() : null;
+    const loginLike = await isLoginPage(page);
+    pagesVisited.push({ url: page.url(), depth: item.depth, status, loginLike });
+
+    if (status && status >= 400) {
+      const shot = path.join(shotsDir, `${label}_http_${status}_${sha1(targetUrl)}.png`);
+      await page.screenshot({ path: shot, fullPage: true }).catch(() => {});
+      findings.push({
+        id: `R_${label}_HTTP_${status}_${sha1(targetUrl).slice(0, 8)}`,
+        severity: status >= 500 ? "BLOCK" : "WARN",
+        category: "DeadUI",
+        title: `[${label}] HTTP ${status} at ${targetUrl}`,
+        page: targetUrl,
+        reason: "Navigation reached an error status",
+        screenshot: path.relative(root, shot).replace(/\\/g, "/")
+      });
+    }
+
+    if (item.depth < maxDepth) {
+      for (const l of await collectLinks(page, baseUrl)) {
+        const abs = normalizeUrl(l);
+        if (sameOrigin(baseUrl, abs) && !visited.has(abs) && (danger || !looksAuthAction(abs))) {
+          queue.push({ url: abs, depth: item.depth + 1 });
+        }
+      }
+    }
+
+    for (const el of await collectInteractives(page)) {
+      if (el.disabled || (looksRisky(el.text) && !danger)) continue;
+
+      let locator;
+      try {
+        if (el.tag === "a") locator = page.locator("a[href]").nth(el.idx);
+        else if (el.tag === "button") locator = page.locator("button").nth(el.idx);
+        else if (el.role === "button") locator = page.locator("[role='button']").nth(el.idx);
+        else continue;
+      } catch { continue; }
+
+      const out = await clickOutcome(page, locator, { reqCounter });
+
+      if (!out.clickOk) {
+        const shot = path.join(shotsDir, `${label}_click_fail_${sha1(el.key)}.png`);
+        await page.screenshot({ path: shot }).catch(() => {});
+        findings.push({
+          id: `R_${label}_CLICK_FAIL_${sha1(el.key).slice(0, 8)}`,
+          severity: "WARN",
+          category: "DeadUI",
+          title: `[${label}] Click failed: ${el.text || el.tag}`,
+          page: page.url(),
+          reason: out.clickError || "click failed",
+          screenshot: path.relative(root, shot).replace(/\\/g, "/")
+        });
+        continue;
+      }
+
+      if (!out.navHappened && !out.urlChanged && !out.domChanged && out.reqDelta === 0) {
+        const shot = path.join(shotsDir, `${label}_dead_${sha1(el.key)}.png`);
+        await page.screenshot({ path: shot }).catch(() => {});
+        findings.push({
+          id: `R_${label}_DEAD_${sha1(el.key).slice(0, 8)}`,
+          severity: "BLOCK",
+          category: "DeadUI",
+          title: `[${label}] Dead UI: ${el.text || el.tag}`,
+          page: page.url(),
+          reason: "Click produced no navigation, no network activity, and no DOM change",
+          screenshot: path.relative(root, shot).replace(/\\/g, "/")
+        });
+      }
+    }
+  }
+
+  await page.close();
+  return { label, pagesVisited, findings, consoleErrors: consoleErrors.slice(0, 50), networkErrors: netErrors.slice(0, 50) };
+}
+
+function buildAuthCoverageFindings({ baseUrl, matchers, anonPass, authPass }) {
+  const findings = [];
+  const anonByPath = new Map((anonPass.pagesVisited || []).map(p => [pathFromUrl(p.url), p]));
+  const authByPath = new Map((authPass?.pagesVisited || []).map(p => [pathFromUrl(p.url), p]));
+
+  for (const [pathKey, anon] of anonByPath) {
+    const isProtected = matchers.some(m => m.rx.test(pathKey));
+    if (!isProtected) continue;
+
+    const anonLooksBlocked = anon.loginLike || anon.status === 401 || anon.status === 403;
+    const authed = authByPath.get(pathKey);
+    const authedLooksBlocked = authed?.loginLike || authed?.status === 401 || authed?.status === 403;
+
+    if (!anonLooksBlocked) {
+      findings.push({
+        id: `R_AUTH_ANON_ACCESS_${sha1(pathKey).slice(0, 8)}`,
+        severity: "BLOCK",
+        category: "AuthCoverage",
+        title: `Protected route reachable anonymously: ${pathKey}`,
+        page: new URL(pathKey, baseUrl).toString(),
+        reason: "Matcher marks route protected, but anon session did not redirect or deny."
+      });
+    }
+
+    if (authed && authedLooksBlocked) {
+      findings.push({
+        id: `R_AUTH_BLOCKED_${sha1(pathKey).slice(0, 8)}`,
+        severity: "BLOCK",
+        category: "AuthCoverage",
+        title: `Protected route blocked after login: ${pathKey}`,
+        page: new URL(pathKey, baseUrl).toString(),
+        reason: "Authed session still looks like login/401/403 on a protected route."
+      });
+    }
+  }
+
+  return findings;
+}
+
+function coverageFromTruthpack({ truthpack, visitedUrls }) {
+  if (!truthpack) return null;
+  const refs = truthpack?.routes?.clientRefs || [];
+  const uiPaths = new Set(refs.map(r => r?.path || pathFromUrl(r?.url || r)).filter(Boolean));
+  const visitedPaths = new Set(visitedUrls.map(pathFromUrl));
+  const total = uiPaths.size;
+  const hit = Array.from(uiPaths).filter(p => visitedPaths.has(p)).length;
+  return { total, hit, percent: total ? Math.round((hit / total) * 100) : 0, missed: Array.from(uiPaths).filter(p => !visitedPaths.has(p)).slice(0, 50) };
+}
+
+async function runReality({
+  repoRoot,
+  url,
+  auth,
+  storageState,
+  saveStorageState,
+  truthpack,
+  verifyAuth = false,
+  headed = false,
+  maxPages = 18,
+  maxDepth = 2,
+  danger = false,
+  timeoutMs = 15000
+} = {}) {
+  if (!url) throw new Error("--url is required");
+  if (!chromium) {
+    const hint = playwrightError?.includes("Cannot find module") 
+      ? "Run: npm i -D playwright && npx playwright install chromium"
+      : `Playwright error: ${playwrightError || "unknown"}`;
+    throw new Error(`Playwright not available. ${hint}`);
+  }
+
+  const root = repoRoot || process.cwd();
+  const baseUrl = normalizeUrl(url);
+  const outBase = path.join(root, ".vibecheck", "reality", stamp());
+  const shotsDir = path.join(outBase, "screenshots");
+  ensureDir(shotsDir);
+
+  const tp = loadTruthpack(root, truthpack);
+  const matchers = getProtectedMatchersFromTruthpack(tp);
+
+  const browser = await chromium.launch({ headless: !headed });
+
+  // Pass A: Anon
+  const anonContext = await browser.newContext();
+  const anonPass = await runSinglePass({ label: "ANON", baseUrl, context: anonContext, shotsDir, danger, maxPages, maxDepth, timeoutMs, root });
+  await anonContext.close();
+
+  // Pass B: Auth (optional)
+  let authPass = null;
+  let authFindings = [];
+  let savedStatePath = null;
+
+  if (verifyAuth) {
+    const ctxOpts = storageState ? { storageState } : {};
+    const authContext = await browser.newContext(ctxOpts);
+    const authPage = await authContext.newPage();
+    await authPage.goto(baseUrl, { waitUntil: "domcontentloaded" }).catch(() => {});
+    await authPage.waitForLoadState("networkidle", { timeout: 6000 }).catch(() => {});
+
+    if (!storageState && auth) {
+      const loginRes = await attemptLogin(authPage, { auth });
+      if (loginRes.ok && saveStorageState) {
+        const dest = path.isAbsolute(saveStorageState) ? saveStorageState : path.join(root, saveStorageState);
+        ensureDir(path.dirname(dest));
+        await authContext.storageState({ path: dest }).catch(() => {});
+        savedStatePath = dest;
+      }
+    }
+    await authPage.close();
+
+    authPass = await runSinglePass({ label: "AUTH", baseUrl, context: authContext, shotsDir, danger, maxPages, maxDepth, timeoutMs, root });
+    await authContext.close();
+
+    if (matchers.length) {
+      authFindings = buildAuthCoverageFindings({ baseUrl, matchers, anonPass, authPass });
+    }
+  }
+
+  await browser.close();
+
+  const allVisited = [...anonPass.pagesVisited.map(p => p.url), ...(authPass?.pagesVisited || []).map(p => p.url)];
+  const coverage = coverageFromTruthpack({ truthpack: tp, visitedUrls: allVisited });
+
+  const findings = [...anonPass.findings, ...(authPass?.findings || []), ...authFindings];
+
+  const report = {
+    meta: {
+      startedAt: new Date().toISOString(),
+      baseUrl,
+      verifyAuth,
+      maxPages,
+      maxDepth,
+      truthpackLoaded: !!tp,
+      protectedMatcherCount: matchers.length,
+      savedStorageState: savedStatePath ? path.relative(root, savedStatePath).replace(/\\/g, "/") : null
+    },
+    coverage,
+    passes: { anon: anonPass, auth: authPass },
+    findings,
+    consoleErrors: [...anonPass.consoleErrors, ...(authPass?.consoleErrors || [])].slice(0, 50),
+    networkErrors: [...anonPass.networkErrors, ...(authPass?.networkErrors || [])].slice(0, 50)
+  };
+
+  fs.writeFileSync(path.join(outBase, "reality_report.json"), JSON.stringify(report, null, 2), "utf8");
+
+  const latestDir = path.join(root, ".vibecheck", "reality");
+  ensureDir(latestDir);
+  fs.writeFileSync(path.join(latestDir, "latest.json"), JSON.stringify({ latest: path.relative(root, outBase).replace(/\\/g, "/") }, null, 2));
+  fs.writeFileSync(path.join(latestDir, "last_reality.json"), JSON.stringify(report, null, 2), "utf8");
+
+  const blocks = findings.filter(f => f.severity === "BLOCK").length;
+  const warns = findings.filter(f => f.severity === "WARN").length;
+
+  console.log(`\n🧪 vibecheck reality`);
+  console.log(`Anon visited: ${anonPass.pagesVisited.length}/${maxPages}`);
+  if (verifyAuth) console.log(`Auth visited: ${authPass?.pagesVisited?.length || 0}/${maxPages}`);
+  if (coverage) console.log(`Coverage: ${coverage.percent}% of UI paths (${coverage.hit}/${coverage.total})`);
+  console.log(`Findings: ${findings.length} (${blocks} BLOCK, ${warns} WARN)`);
+  console.log(`Report: .vibecheck/reality/${path.basename(outBase)}/reality_report.json`);
+  console.log(`Verdict: ${blocks ? "🛑 BLOCK" : warns ? "⚠️ WARN" : "✅ CLEAN"}`);
+
+  process.exitCode = blocks ? 2 : warns ? 1 : 0;
+}
+
+module.exports = { runReality };

package/bin/runners/runRealitySniff.js

@@ -0,0 +1,2 @@
+async function runRealitySniff(args) { console.log("RealitySniff not yet implemented"); return 0; }
+module.exports = { runRealitySniff };