@vibecheckai/cli 3.0.4 → 3.0.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/bin/dev/run-v2-torture.js +30 -0
  2. package/bin/runners/context/index.js +1 -1
  3. package/bin/runners/lib/analyzers.js +38 -0
  4. package/bin/runners/lib/assets/vibecheck-logo.png +0 -0
  5. package/bin/runners/lib/contracts/auth-contract.js +8 -0
  6. package/bin/runners/lib/contracts/env-contract.js +3 -0
  7. package/bin/runners/lib/contracts/external-contract.js +10 -2
  8. package/bin/runners/lib/contracts/route-contract.js +7 -0
  9. package/bin/runners/lib/contracts.js +804 -0
  10. package/bin/runners/lib/detectors-v2.js +703 -0
  11. package/bin/runners/lib/drift.js +425 -0
  12. package/bin/runners/lib/entitlements-v2.js +3 -1
  13. package/bin/runners/lib/entitlements.js +11 -3
  14. package/bin/runners/lib/env-resolver.js +417 -0
  15. package/bin/runners/lib/extractors/client-calls.js +990 -0
  16. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -0
  17. package/bin/runners/lib/extractors/fastify-routes.js +426 -0
  18. package/bin/runners/lib/extractors/index.js +363 -0
  19. package/bin/runners/lib/extractors/next-routes.js +524 -0
  20. package/bin/runners/lib/extractors/proof-graph.js +431 -0
  21. package/bin/runners/lib/extractors/route-matcher.js +451 -0
  22. package/bin/runners/lib/extractors/truthpack-v2.js +377 -0
  23. package/bin/runners/lib/extractors/ui-bindings.js +547 -0
  24. package/bin/runners/lib/findings-schema.js +281 -0
  25. package/bin/runners/lib/html-report.js +650 -0
  26. package/bin/runners/lib/missions/templates.js +45 -0
  27. package/bin/runners/lib/policy.js +295 -0
  28. package/bin/runners/lib/reality/correlation-detectors.js +359 -0
  29. package/bin/runners/lib/reality/index.js +318 -0
  30. package/bin/runners/lib/reality/request-hashing.js +416 -0
  31. package/bin/runners/lib/reality/request-mapper.js +453 -0
  32. package/bin/runners/lib/reality/safety-rails.js +463 -0
  33. package/bin/runners/lib/reality/semantic-snapshot.js +408 -0
  34. package/bin/runners/lib/reality/toast-detector.js +393 -0
  35. package/bin/runners/lib/report-html.js +5 -0
  36. package/bin/runners/lib/report-templates.js +5 -0
  37. package/bin/runners/lib/report.js +135 -0
  38. package/bin/runners/lib/route-truth.js +10 -10
  39. package/bin/runners/lib/schema-validator.js +350 -0
  40. package/bin/runners/lib/schemas/contracts.schema.json +160 -0
  41. package/bin/runners/lib/schemas/finding.schema.json +100 -0
  42. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -0
  43. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -0
  44. package/bin/runners/lib/schemas/reality-report.schema.json +162 -0
  45. package/bin/runners/lib/schemas/share-pack.schema.json +180 -0
  46. package/bin/runners/lib/schemas/ship-report.schema.json +117 -0
  47. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -0
  48. package/bin/runners/lib/schemas/validator.js +438 -0
  49. package/bin/runners/lib/ui.js +562 -0
  50. package/bin/runners/lib/verdict-engine.js +628 -0
  51. package/bin/runners/runAIAgent.js +228 -1
  52. package/bin/runners/runBadge.js +181 -1
  53. package/bin/runners/runCtx.js +7 -2
  54. package/bin/runners/runCtxDiff.js +301 -0
  55. package/bin/runners/runGuard.js +168 -0
  56. package/bin/runners/runInitGha.js +78 -15
  57. package/bin/runners/runLabs.js +341 -0
  58. package/bin/runners/runLaunch.js +180 -1
  59. package/bin/runners/runMdc.js +203 -1
  60. package/bin/runners/runProof.zip +0 -0
  61. package/bin/runners/runProve.js +23 -0
  62. package/bin/runners/runReplay.js +114 -84
  63. package/bin/runners/runScan.js +111 -32
  64. package/bin/runners/runShip.js +23 -2
  65. package/bin/runners/runTruthpack.js +9 -7
  66. package/bin/runners/runValidate.js +161 -1
  67. package/bin/vibecheck.js +416 -770
  68. package/mcp-server/.guardrail/audit/audit.log.jsonl +2 -0
  69. package/mcp-server/.specs/architecture.mdc +90 -0
  70. package/mcp-server/.specs/security.mdc +30 -0
  71. package/mcp-server/README.md +252 -0
  72. package/mcp-server/agent-checkpoint.js +364 -0
  73. package/mcp-server/architect-tools.js +707 -0
  74. package/mcp-server/audit-mcp.js +206 -0
  75. package/mcp-server/codebase-architect-tools.js +838 -0
  76. package/mcp-server/consolidated-tools.js +804 -0
  77. package/mcp-server/hygiene-tools.js +428 -0
  78. package/mcp-server/index-v1.js +698 -0
  79. package/mcp-server/index.js +2092 -0
  80. package/mcp-server/index.old.js +4137 -0
  81. package/mcp-server/intelligence-tools.js +664 -0
  82. package/mcp-server/intent-drift-tools.js +873 -0
  83. package/mcp-server/mdc-generator.js +298 -0
  84. package/mcp-server/package-lock.json +165 -0
  85. package/mcp-server/package.json +47 -0
  86. package/mcp-server/premium-tools.js +1275 -0
  87. package/mcp-server/test-mcp.js +108 -0
  88. package/mcp-server/test-tools.js +36 -0
  89. package/mcp-server/tier-auth.js +147 -0
  90. package/mcp-server/tools/index.js +72 -0
  91. package/mcp-server/tools-reorganized.ts +244 -0
  92. package/mcp-server/truth-context.js +581 -0
  93. package/mcp-server/truth-firewall-tools.js +1500 -0
  94. package/mcp-server/vibecheck-2.0-tools.js +748 -0
  95. package/mcp-server/vibecheck-tools.js +1075 -0
  96. package/package.json +10 -8
  97. package/bin/guardrail.js +0 -834
  98. package/bin/runners/runAudit.js +0 -2
  99. package/bin/runners/runAutopilot.js +0 -2
  100. package/bin/runners/runCertify.js +0 -2
  101. package/bin/runners/runDashboard.js +0 -10
  102. package/bin/runners/runEnhancedShip.js +0 -2
  103. package/bin/runners/runFixPacks.js +0 -2
  104. package/bin/runners/runNaturalLanguage.js +0 -3
  105. package/bin/runners/runProof.js +0 -2
  106. package/bin/runners/runRealitySniff.js +0 -2
  107. package/bin/runners/runUpgrade.js +0 -2
  108. package/bin/runners/runVerifyAgentOutput.js +0 -2
@@ -0,0 +1,318 @@
1
+ /**
2
+ * Reality Detection Module v2
3
+ *
4
+ * Exports semantic snapshots, toast detection, and correlation detectors
5
+ * for meaningful UI change detection.
6
+ */
7
+
8
+ "use strict";
9
+
10
+ const {
11
+ CAPTURE_SCRIPT,
12
+ computeSemanticHash,
13
+ diffSnapshots,
14
+ calculateChangeScore,
15
+ createUIChangeReport,
16
+ IGNORE_TAGS,
17
+ IGNORE_SELECTORS,
18
+ MEANINGFUL_ROLES,
19
+ } = require("./semantic-snapshot");
20
+
21
+ const {
22
+ TOAST_DETECTOR_SCRIPT,
23
+ TOAST_LIBRARIES,
24
+ UNIVERSAL_SELECTORS,
25
+ TOAST_CLASS_TOKENS,
26
+ SUCCESS_TOKENS,
27
+ ERROR_TOKENS,
28
+ INFO_TOKENS,
29
+ classifyToastSignal,
30
+ createToastSignal,
31
+ isToastFalsePositive,
32
+ getLibrarySelectors,
33
+ buildToastSelector,
34
+ } = require("./toast-detector");
35
+
36
+ const {
37
+ DETECTORS,
38
+ analyzeActionCorrelation,
39
+ analyzeAllActions,
40
+ createFinding,
41
+ summarizeActionOutcome,
42
+ generateFingerprint,
43
+ } = require("./correlation-detectors");
44
+
45
+ const {
46
+ IGNORE_PATTERNS,
47
+ shouldIgnoreRequest,
48
+ normalizeRequestUrl,
49
+ extractTrpcOperation,
50
+ extractGraphqlOperation,
51
+ matchRequestToClientCalls,
52
+ mapAllRequests,
53
+ groupRequestsByClientCall,
54
+ } = require("./request-mapper");
55
+
56
+ const {
57
+ DEFAULT_CONFIG: SAFETY_CONFIG,
58
+ createHydrationTracker,
59
+ createActionStabilizer,
60
+ createDuplicateFilter,
61
+ filterToastFalsePositives,
62
+ isTextNoise,
63
+ filterSemanticDiffNoise,
64
+ shouldIgnoreElement,
65
+ buildIgnoreSelector,
66
+ validateMeaningfulChange,
67
+ } = require("./safety-rails");
68
+
69
+ const {
70
+ hashBody,
71
+ detectContentType,
72
+ redactSensitiveData,
73
+ enhanceRequestWithHashes,
74
+ findDuplicateMutations,
75
+ findNoOpMutations,
76
+ detectOptimisticMismatch,
77
+ analyzeUIMismatches,
78
+ PLAYWRIGHT_BODY_CAPTURE_SCRIPT,
79
+ } = require("./request-hashing");
80
+
81
+ // =============================================================================
82
+ // ACTION WINDOW HELPERS
83
+ // =============================================================================
84
+
85
+ /**
86
+ * Default config for UI change detection
87
+ */
88
+ const DEFAULT_CONFIG = {
89
+ quietMs: 300,
90
+ settleMs: 250,
91
+ actionWindowMs: 8000,
92
+ meaningfulScoreThreshold: 0.6,
93
+ ignoreSelectors: [],
94
+ textNoiseRegex: [],
95
+ toast: {
96
+ enabled: true,
97
+ selectorsExtra: [],
98
+ maxLifetimeMs: 15000,
99
+ captureScreenshots: true,
100
+ },
101
+ };
102
+
103
+ /**
104
+ * Merge user config with defaults
105
+ */
106
+ function mergeConfig(userConfig = {}) {
107
+ return {
108
+ ...DEFAULT_CONFIG,
109
+ ...userConfig,
110
+ toast: {
111
+ ...DEFAULT_CONFIG.toast,
112
+ ...(userConfig.toast || {}),
113
+ },
114
+ };
115
+ }
116
+
117
+ /**
118
+ * Create an action window tracker
119
+ */
120
+ function createActionWindow(config = {}) {
121
+ const cfg = mergeConfig(config);
122
+
123
+ return {
124
+ config: cfg,
125
+ beforeSnapshot: null,
126
+ afterSnapshot: null,
127
+ signals: [],
128
+ requests: [],
129
+ startTime: null,
130
+ endTime: null,
131
+
132
+ recordBefore(snapshot) {
133
+ this.beforeSnapshot = snapshot;
134
+ this.startTime = Date.now();
135
+ },
136
+
137
+ recordAfter(snapshot) {
138
+ this.afterSnapshot = snapshot;
139
+ this.endTime = Date.now();
140
+ },
141
+
142
+ addSignal(signal) {
143
+ this.signals.push(signal);
144
+ },
145
+
146
+ addRequest(request) {
147
+ this.requests.push(request);
148
+ },
149
+
150
+ analyze() {
151
+ if (!this.beforeSnapshot || !this.afterSnapshot) {
152
+ return { error: "Missing snapshots" };
153
+ }
154
+
155
+ const uiChange = createUIChangeReport(
156
+ this.beforeSnapshot,
157
+ this.afterSnapshot,
158
+ this.signals
159
+ );
160
+
161
+ return {
162
+ uiChange,
163
+ signals: this.signals,
164
+ requests: this.requests,
165
+ duration: this.endTime - this.startTime,
166
+ };
167
+ },
168
+ };
169
+ }
170
+
171
+ /**
172
+ * Build Playwright script for capturing action with snapshots
173
+ */
174
+ function buildActionCaptureScript(actionSelector, actionType = "click") {
175
+ return `
176
+ async function captureAction(page, selector, actionType) {
177
+ const config = ${JSON.stringify(DEFAULT_CONFIG)};
178
+
179
+ // Setup toast detector
180
+ await page.evaluate(${TOAST_DETECTOR_SCRIPT});
181
+ const toastDetector = await page.evaluate('window.__toastDetector = setupToastDetector()');
182
+
183
+ // Capture before snapshot
184
+ const beforeSnapshot = await page.evaluate(${CAPTURE_SCRIPT});
185
+
186
+ // Track network requests
187
+ const requests = [];
188
+ const requestHandler = (request) => {
189
+ requests.push({
190
+ url: request.url(),
191
+ method: request.method(),
192
+ startTime: Date.now(),
193
+ });
194
+ };
195
+ const responseHandler = (response) => {
196
+ const req = requests.find(r => r.url === response.url() && !r.status);
197
+ if (req) {
198
+ req.status = response.status();
199
+ req.duration = Date.now() - req.startTime;
200
+ }
201
+ };
202
+
203
+ page.on('request', requestHandler);
204
+ page.on('response', responseHandler);
205
+
206
+ // Perform action
207
+ const startTime = Date.now();
208
+ if (actionType === 'click') {
209
+ await page.click(selector);
210
+ } else if (actionType === 'submit') {
211
+ await page.locator(selector).press('Enter');
212
+ }
213
+
214
+ // Wait for settle
215
+ await page.waitForTimeout(config.settleMs);
216
+
217
+ // Wait for network idle or timeout
218
+ try {
219
+ await page.waitForLoadState('networkidle', { timeout: config.actionWindowMs });
220
+ } catch {}
221
+
222
+ // Capture after snapshot
223
+ const afterSnapshot = await page.evaluate(${CAPTURE_SCRIPT});
224
+
225
+ // Get toast signals
226
+ const signals = await page.evaluate('window.__toastDetector?.getSignals() || []');
227
+
228
+ // Cleanup
229
+ page.off('request', requestHandler);
230
+ page.off('response', responseHandler);
231
+
232
+ return {
233
+ beforeSnapshot,
234
+ afterSnapshot,
235
+ signals,
236
+ requests,
237
+ duration: Date.now() - startTime,
238
+ };
239
+ }
240
+ `;
241
+ }
242
+
243
+ // =============================================================================
244
+ // EXPORTS
245
+ // =============================================================================
246
+
247
+ module.exports = {
248
+ // Semantic Snapshot
249
+ CAPTURE_SCRIPT,
250
+ computeSemanticHash,
251
+ diffSnapshots,
252
+ calculateChangeScore,
253
+ createUIChangeReport,
254
+ IGNORE_TAGS,
255
+ IGNORE_SELECTORS,
256
+ MEANINGFUL_ROLES,
257
+
258
+ // Toast Detection
259
+ TOAST_DETECTOR_SCRIPT,
260
+ TOAST_LIBRARIES,
261
+ UNIVERSAL_SELECTORS,
262
+ TOAST_CLASS_TOKENS,
263
+ SUCCESS_TOKENS,
264
+ ERROR_TOKENS,
265
+ INFO_TOKENS,
266
+ classifyToastSignal,
267
+ createToastSignal,
268
+ isToastFalsePositive,
269
+ getLibrarySelectors,
270
+ buildToastSelector,
271
+
272
+ // Correlation Detectors
273
+ DETECTORS,
274
+ analyzeActionCorrelation,
275
+ analyzeAllActions,
276
+ createFinding,
277
+ summarizeActionOutcome,
278
+ generateFingerprint,
279
+
280
+ // Request Mapping
281
+ IGNORE_PATTERNS,
282
+ shouldIgnoreRequest,
283
+ normalizeRequestUrl,
284
+ extractTrpcOperation,
285
+ extractGraphqlOperation,
286
+ matchRequestToClientCalls,
287
+ mapAllRequests,
288
+ groupRequestsByClientCall,
289
+
290
+ // Safety Rails
291
+ SAFETY_CONFIG,
292
+ createHydrationTracker,
293
+ createActionStabilizer,
294
+ createDuplicateFilter,
295
+ filterToastFalsePositives,
296
+ isTextNoise,
297
+ filterSemanticDiffNoise,
298
+ shouldIgnoreElement,
299
+ buildIgnoreSelector,
300
+ validateMeaningfulChange,
301
+
302
+ // Action Window
303
+ DEFAULT_CONFIG,
304
+ mergeConfig,
305
+ createActionWindow,
306
+ buildActionCaptureScript,
307
+
308
+ // Request Body Hashing
309
+ hashBody,
310
+ detectContentType,
311
+ redactSensitiveData,
312
+ enhanceRequestWithHashes,
313
+ findDuplicateMutations,
314
+ findNoOpMutations,
315
+ detectOptimisticMismatch,
316
+ analyzeUIMismatches,
317
+ PLAYWRIGHT_BODY_CAPTURE_SCRIPT,
318
+ };