@vibecheckai/cli 3.0.3 → 3.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (119) hide show
  1. package/bin/cli-hygiene.js +241 -0
  2. package/bin/dev/run-v2-torture.js +30 -0
  3. package/bin/guardrail.js +843 -0
  4. package/bin/runners/cli-utils.js +1070 -0
  5. package/bin/runners/context/ai-task-decomposer.js +337 -0
  6. package/bin/runners/context/analyzer.js +462 -0
  7. package/bin/runners/context/api-contracts.js +427 -0
  8. package/bin/runners/context/context-diff.js +342 -0
  9. package/bin/runners/context/context-pruner.js +291 -0
  10. package/bin/runners/context/dependency-graph.js +414 -0
  11. package/bin/runners/context/generators/claude.js +107 -0
  12. package/bin/runners/context/generators/codex.js +108 -0
  13. package/bin/runners/context/generators/copilot.js +119 -0
  14. package/bin/runners/context/generators/cursor.js +514 -0
  15. package/bin/runners/context/generators/mcp.js +151 -0
  16. package/bin/runners/context/generators/windsurf.js +180 -0
  17. package/bin/runners/context/git-context.js +302 -0
  18. package/bin/runners/context/index.js +1042 -0
  19. package/bin/runners/context/insights.js +173 -0
  20. package/bin/runners/context/mcp-server/generate-rules.js +337 -0
  21. package/bin/runners/context/mcp-server/index.js +1176 -0
  22. package/bin/runners/context/mcp-server/package.json +24 -0
  23. package/bin/runners/context/memory.js +200 -0
  24. package/bin/runners/context/monorepo.js +215 -0
  25. package/bin/runners/context/multi-repo-federation.js +404 -0
  26. package/bin/runners/context/patterns.js +253 -0
  27. package/bin/runners/context/proof-context.js +972 -0
  28. package/bin/runners/context/security-scanner.js +303 -0
  29. package/bin/runners/context/semantic-search.js +350 -0
  30. package/bin/runners/context/shared.js +264 -0
  31. package/bin/runners/context/team-conventions.js +310 -0
  32. package/bin/runners/lib/ai-bridge.js +416 -0
  33. package/bin/runners/lib/analysis-core.js +271 -0
  34. package/bin/runners/lib/analyzers.js +579 -0
  35. package/bin/runners/lib/assets/vibecheck-logo.png +0 -0
  36. package/bin/runners/lib/audit-bridge.js +391 -0
  37. package/bin/runners/lib/auth-truth.js +193 -0
  38. package/bin/runners/lib/auth.js +215 -0
  39. package/bin/runners/lib/backup.js +62 -0
  40. package/bin/runners/lib/billing.js +107 -0
  41. package/bin/runners/lib/claims.js +118 -0
  42. package/bin/runners/lib/cli-ui.js +540 -0
  43. package/bin/runners/lib/compliance-bridge-new.js +0 -0
  44. package/bin/runners/lib/compliance-bridge.js +165 -0
  45. package/bin/runners/lib/contracts/auth-contract.js +202 -0
  46. package/bin/runners/lib/contracts/env-contract.js +181 -0
  47. package/bin/runners/lib/contracts/external-contract.js +206 -0
  48. package/bin/runners/lib/contracts/guard.js +168 -0
  49. package/bin/runners/lib/contracts/index.js +89 -0
  50. package/bin/runners/lib/contracts/plan-validator.js +311 -0
  51. package/bin/runners/lib/contracts/route-contract.js +199 -0
  52. package/bin/runners/lib/contracts.js +804 -0
  53. package/bin/runners/lib/detect.js +89 -0
  54. package/bin/runners/lib/detectors-v2.js +703 -0
  55. package/bin/runners/lib/doctor/autofix.js +254 -0
  56. package/bin/runners/lib/doctor/index.js +37 -0
  57. package/bin/runners/lib/doctor/modules/dependencies.js +325 -0
  58. package/bin/runners/lib/doctor/modules/index.js +46 -0
  59. package/bin/runners/lib/doctor/modules/network.js +250 -0
  60. package/bin/runners/lib/doctor/modules/project.js +312 -0
  61. package/bin/runners/lib/doctor/modules/runtime.js +224 -0
  62. package/bin/runners/lib/doctor/modules/security.js +348 -0
  63. package/bin/runners/lib/doctor/modules/system.js +213 -0
  64. package/bin/runners/lib/doctor/modules/vibecheck.js +394 -0
  65. package/bin/runners/lib/doctor/reporter.js +262 -0
  66. package/bin/runners/lib/doctor/service.js +262 -0
  67. package/bin/runners/lib/doctor/types.js +113 -0
  68. package/bin/runners/lib/doctor/ui.js +263 -0
  69. package/bin/runners/lib/doctor-enhanced.js +233 -0
  70. package/bin/runners/lib/doctor-v2.js +608 -0
  71. package/bin/runners/lib/drift.js +425 -0
  72. package/bin/runners/lib/enforcement.js +72 -0
  73. package/bin/runners/lib/entitlements.js +8 -3
  74. package/bin/runners/lib/env-resolver.js +417 -0
  75. package/bin/runners/lib/extractors/client-calls.js +990 -0
  76. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -0
  77. package/bin/runners/lib/extractors/fastify-routes.js +426 -0
  78. package/bin/runners/lib/extractors/index.js +363 -0
  79. package/bin/runners/lib/extractors/next-routes.js +524 -0
  80. package/bin/runners/lib/extractors/proof-graph.js +431 -0
  81. package/bin/runners/lib/extractors/route-matcher.js +451 -0
  82. package/bin/runners/lib/extractors/truthpack-v2.js +377 -0
  83. package/bin/runners/lib/extractors/ui-bindings.js +547 -0
  84. package/bin/runners/lib/findings-schema.js +281 -0
  85. package/bin/runners/lib/html-report.js +650 -0
  86. package/bin/runners/lib/missions/templates.js +45 -0
  87. package/bin/runners/lib/policy.js +295 -0
  88. package/bin/runners/lib/reality/correlation-detectors.js +359 -0
  89. package/bin/runners/lib/reality/index.js +318 -0
  90. package/bin/runners/lib/reality/request-hashing.js +416 -0
  91. package/bin/runners/lib/reality/request-mapper.js +453 -0
  92. package/bin/runners/lib/reality/safety-rails.js +463 -0
  93. package/bin/runners/lib/reality/semantic-snapshot.js +408 -0
  94. package/bin/runners/lib/reality/toast-detector.js +393 -0
  95. package/bin/runners/lib/route-truth.js +10 -10
  96. package/bin/runners/lib/schema-validator.js +350 -0
  97. package/bin/runners/lib/schemas/contracts.schema.json +160 -0
  98. package/bin/runners/lib/schemas/finding.schema.json +100 -0
  99. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -0
  100. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -0
  101. package/bin/runners/lib/schemas/reality-report.schema.json +162 -0
  102. package/bin/runners/lib/schemas/share-pack.schema.json +180 -0
  103. package/bin/runners/lib/schemas/ship-report.schema.json +117 -0
  104. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -0
  105. package/bin/runners/lib/schemas/validator.js +438 -0
  106. package/bin/runners/lib/verdict-engine.js +628 -0
  107. package/bin/runners/runAIAgent.js +228 -1
  108. package/bin/runners/runBadge.js +181 -1
  109. package/bin/runners/runCtxDiff.js +301 -0
  110. package/bin/runners/runInitGha.js +78 -15
  111. package/bin/runners/runLaunch.js +180 -1
  112. package/bin/runners/runProve.js +23 -0
  113. package/bin/runners/runReplay.js +114 -84
  114. package/bin/runners/runScan.js +111 -32
  115. package/bin/runners/runShip.js +23 -2
  116. package/bin/runners/runTruthpack.js +9 -7
  117. package/bin/runners/runValidate.js +161 -1
  118. package/bin/vibecheck.js +6 -1
  119. package/package.json +1 -1
@@ -0,0 +1,318 @@
1
+ /**
2
+ * Reality Detection Module v2
3
+ *
4
+ * Exports semantic snapshots, toast detection, and correlation detectors
5
+ * for meaningful UI change detection.
6
+ */
7
+
8
+ "use strict";
9
+
10
+ const {
11
+ CAPTURE_SCRIPT,
12
+ computeSemanticHash,
13
+ diffSnapshots,
14
+ calculateChangeScore,
15
+ createUIChangeReport,
16
+ IGNORE_TAGS,
17
+ IGNORE_SELECTORS,
18
+ MEANINGFUL_ROLES,
19
+ } = require("./semantic-snapshot");
20
+
21
+ const {
22
+ TOAST_DETECTOR_SCRIPT,
23
+ TOAST_LIBRARIES,
24
+ UNIVERSAL_SELECTORS,
25
+ TOAST_CLASS_TOKENS,
26
+ SUCCESS_TOKENS,
27
+ ERROR_TOKENS,
28
+ INFO_TOKENS,
29
+ classifyToastSignal,
30
+ createToastSignal,
31
+ isToastFalsePositive,
32
+ getLibrarySelectors,
33
+ buildToastSelector,
34
+ } = require("./toast-detector");
35
+
36
+ const {
37
+ DETECTORS,
38
+ analyzeActionCorrelation,
39
+ analyzeAllActions,
40
+ createFinding,
41
+ summarizeActionOutcome,
42
+ generateFingerprint,
43
+ } = require("./correlation-detectors");
44
+
45
+ const {
46
+ IGNORE_PATTERNS,
47
+ shouldIgnoreRequest,
48
+ normalizeRequestUrl,
49
+ extractTrpcOperation,
50
+ extractGraphqlOperation,
51
+ matchRequestToClientCalls,
52
+ mapAllRequests,
53
+ groupRequestsByClientCall,
54
+ } = require("./request-mapper");
55
+
56
+ const {
57
+ DEFAULT_CONFIG: SAFETY_CONFIG,
58
+ createHydrationTracker,
59
+ createActionStabilizer,
60
+ createDuplicateFilter,
61
+ filterToastFalsePositives,
62
+ isTextNoise,
63
+ filterSemanticDiffNoise,
64
+ shouldIgnoreElement,
65
+ buildIgnoreSelector,
66
+ validateMeaningfulChange,
67
+ } = require("./safety-rails");
68
+
69
+ const {
70
+ hashBody,
71
+ detectContentType,
72
+ redactSensitiveData,
73
+ enhanceRequestWithHashes,
74
+ findDuplicateMutations,
75
+ findNoOpMutations,
76
+ detectOptimisticMismatch,
77
+ analyzeUIMismatches,
78
+ PLAYWRIGHT_BODY_CAPTURE_SCRIPT,
79
+ } = require("./request-hashing");
80
+
81
+ // =============================================================================
82
+ // ACTION WINDOW HELPERS
83
+ // =============================================================================
84
+
85
+ /**
86
+ * Default config for UI change detection
87
+ */
88
+ const DEFAULT_CONFIG = {
89
+ quietMs: 300,
90
+ settleMs: 250,
91
+ actionWindowMs: 8000,
92
+ meaningfulScoreThreshold: 0.6,
93
+ ignoreSelectors: [],
94
+ textNoiseRegex: [],
95
+ toast: {
96
+ enabled: true,
97
+ selectorsExtra: [],
98
+ maxLifetimeMs: 15000,
99
+ captureScreenshots: true,
100
+ },
101
+ };
102
+
103
+ /**
104
+ * Merge user config with defaults
105
+ */
106
+ function mergeConfig(userConfig = {}) {
107
+ return {
108
+ ...DEFAULT_CONFIG,
109
+ ...userConfig,
110
+ toast: {
111
+ ...DEFAULT_CONFIG.toast,
112
+ ...(userConfig.toast || {}),
113
+ },
114
+ };
115
+ }
116
+
117
+ /**
118
+ * Create an action window tracker
119
+ */
120
+ function createActionWindow(config = {}) {
121
+ const cfg = mergeConfig(config);
122
+
123
+ return {
124
+ config: cfg,
125
+ beforeSnapshot: null,
126
+ afterSnapshot: null,
127
+ signals: [],
128
+ requests: [],
129
+ startTime: null,
130
+ endTime: null,
131
+
132
+ recordBefore(snapshot) {
133
+ this.beforeSnapshot = snapshot;
134
+ this.startTime = Date.now();
135
+ },
136
+
137
+ recordAfter(snapshot) {
138
+ this.afterSnapshot = snapshot;
139
+ this.endTime = Date.now();
140
+ },
141
+
142
+ addSignal(signal) {
143
+ this.signals.push(signal);
144
+ },
145
+
146
+ addRequest(request) {
147
+ this.requests.push(request);
148
+ },
149
+
150
+ analyze() {
151
+ if (!this.beforeSnapshot || !this.afterSnapshot) {
152
+ return { error: "Missing snapshots" };
153
+ }
154
+
155
+ const uiChange = createUIChangeReport(
156
+ this.beforeSnapshot,
157
+ this.afterSnapshot,
158
+ this.signals
159
+ );
160
+
161
+ return {
162
+ uiChange,
163
+ signals: this.signals,
164
+ requests: this.requests,
165
+ duration: this.endTime - this.startTime,
166
+ };
167
+ },
168
+ };
169
+ }
170
+
171
+ /**
172
+ * Build Playwright script for capturing action with snapshots
173
+ */
174
+ function buildActionCaptureScript(actionSelector, actionType = "click") {
175
+ return `
176
+ async function captureAction(page, selector, actionType) {
177
+ const config = ${JSON.stringify(DEFAULT_CONFIG)};
178
+
179
+ // Setup toast detector
180
+ await page.evaluate(${TOAST_DETECTOR_SCRIPT});
181
+ const toastDetector = await page.evaluate('window.__toastDetector = setupToastDetector()');
182
+
183
+ // Capture before snapshot
184
+ const beforeSnapshot = await page.evaluate(${CAPTURE_SCRIPT});
185
+
186
+ // Track network requests
187
+ const requests = [];
188
+ const requestHandler = (request) => {
189
+ requests.push({
190
+ url: request.url(),
191
+ method: request.method(),
192
+ startTime: Date.now(),
193
+ });
194
+ };
195
+ const responseHandler = (response) => {
196
+ const req = requests.find(r => r.url === response.url() && !r.status);
197
+ if (req) {
198
+ req.status = response.status();
199
+ req.duration = Date.now() - req.startTime;
200
+ }
201
+ };
202
+
203
+ page.on('request', requestHandler);
204
+ page.on('response', responseHandler);
205
+
206
+ // Perform action
207
+ const startTime = Date.now();
208
+ if (actionType === 'click') {
209
+ await page.click(selector);
210
+ } else if (actionType === 'submit') {
211
+ await page.locator(selector).press('Enter');
212
+ }
213
+
214
+ // Wait for settle
215
+ await page.waitForTimeout(config.settleMs);
216
+
217
+ // Wait for network idle or timeout
218
+ try {
219
+ await page.waitForLoadState('networkidle', { timeout: config.actionWindowMs });
220
+ } catch {}
221
+
222
+ // Capture after snapshot
223
+ const afterSnapshot = await page.evaluate(${CAPTURE_SCRIPT});
224
+
225
+ // Get toast signals
226
+ const signals = await page.evaluate('window.__toastDetector?.getSignals() || []');
227
+
228
+ // Cleanup
229
+ page.off('request', requestHandler);
230
+ page.off('response', responseHandler);
231
+
232
+ return {
233
+ beforeSnapshot,
234
+ afterSnapshot,
235
+ signals,
236
+ requests,
237
+ duration: Date.now() - startTime,
238
+ };
239
+ }
240
+ `;
241
+ }
242
+
243
+ // =============================================================================
244
+ // EXPORTS
245
+ // =============================================================================
246
+
247
+ module.exports = {
248
+ // Semantic Snapshot
249
+ CAPTURE_SCRIPT,
250
+ computeSemanticHash,
251
+ diffSnapshots,
252
+ calculateChangeScore,
253
+ createUIChangeReport,
254
+ IGNORE_TAGS,
255
+ IGNORE_SELECTORS,
256
+ MEANINGFUL_ROLES,
257
+
258
+ // Toast Detection
259
+ TOAST_DETECTOR_SCRIPT,
260
+ TOAST_LIBRARIES,
261
+ UNIVERSAL_SELECTORS,
262
+ TOAST_CLASS_TOKENS,
263
+ SUCCESS_TOKENS,
264
+ ERROR_TOKENS,
265
+ INFO_TOKENS,
266
+ classifyToastSignal,
267
+ createToastSignal,
268
+ isToastFalsePositive,
269
+ getLibrarySelectors,
270
+ buildToastSelector,
271
+
272
+ // Correlation Detectors
273
+ DETECTORS,
274
+ analyzeActionCorrelation,
275
+ analyzeAllActions,
276
+ createFinding,
277
+ summarizeActionOutcome,
278
+ generateFingerprint,
279
+
280
+ // Request Mapping
281
+ IGNORE_PATTERNS,
282
+ shouldIgnoreRequest,
283
+ normalizeRequestUrl,
284
+ extractTrpcOperation,
285
+ extractGraphqlOperation,
286
+ matchRequestToClientCalls,
287
+ mapAllRequests,
288
+ groupRequestsByClientCall,
289
+
290
+ // Safety Rails
291
+ SAFETY_CONFIG,
292
+ createHydrationTracker,
293
+ createActionStabilizer,
294
+ createDuplicateFilter,
295
+ filterToastFalsePositives,
296
+ isTextNoise,
297
+ filterSemanticDiffNoise,
298
+ shouldIgnoreElement,
299
+ buildIgnoreSelector,
300
+ validateMeaningfulChange,
301
+
302
+ // Action Window
303
+ DEFAULT_CONFIG,
304
+ mergeConfig,
305
+ createActionWindow,
306
+ buildActionCaptureScript,
307
+
308
+ // Request Body Hashing
309
+ hashBody,
310
+ detectContentType,
311
+ redactSensitiveData,
312
+ enhanceRequestWithHashes,
313
+ findDuplicateMutations,
314
+ findNoOpMutations,
315
+ detectOptimisticMismatch,
316
+ analyzeUIMismatches,
317
+ PLAYWRIGHT_BODY_CAPTURE_SCRIPT,
318
+ };